CVE-2017-18197

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...

CVE-2017-18197

CVE-2017-18197 affects mxGraph (before 3.7.6). In mxGraphViewImageReader.java, the SAXParserFactory used in convert() lacks XXE-defensive flags, enabling XML External Entity attacks (as demonstrated by /ServerView). Public disclosures and advisories (GHSA-wvpv-8524-wg6x; Fed/Debian/Nessus entries...

CVE-2017-18197

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...

CVE-2017-18197

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...

CVE-2017-18197: Improper Restriction of XML External Entity Reference

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert is missing flags to prevent XML External Entity XXE attacks, as demonstrated by /ServerView...

mxgraph mxGraphViewImageReader.java file XML external entity vulnerability

mxGraph is a JavaScript charting library . A security vulnerability in the mxGraphViewImageReader.java file in versions prior to mxGraph 3.7.6 stems from a SAXParserFactory instance in the 'convert' function that lacks the user blocking XML external entity injection attacks with a status flag...

PT-2018-6728

Name of the Vulnerable Software and Affected Versions: mxGraph versions prior to 3.7.6 Description: The issue concerns a missing configuration in the SAXParserFactory instance within the convert function of mxGraphViewImageReader.java, which makes it susceptible to XML External Entity XXE attacks...