XML Entity Expansion

xlsx-streamer is vulnerable to XML entity expansion which is also known as XML Bombs. Lack of necessary settings to prevent XML Entity Expansion issues allows an attacker to pass malicious XML object via XML parser...

com.gizbel.excel:excel-extractor (>=1.0.0, <=1.0.1) potentially affected by CVE-2022-23640 via com.monitorjbl:xlsx-streamer (1.0.1)

com.monitorjbl:xlsx-streamer MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.monitorjbl:xlsx-streamer and may be impacted: - com.gizbel.excel:excel-extractor =1.0.0, =1.0.1 Source cves: CVE-2022-23640 Source advisory:...

com.crealytics:spark-excel_2.11 (>=0.10.0, <=0.11.1), tech.mlsql:streamingpro-mlsql-spark_2.4 (1.2.0) +1 more potentially affected by CVE-2022-23640 via com.monitorjbl:xlsx-streamer (2.0.0)

com.monitorjbl:xlsx-streamer MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.monitorjbl:xlsx-streamer and may be impacted: - com.crealytics:spark-excel2.11 =0.10.0, =1.4.0, =1.5.0 Source cves: CVE-2022-23640 Source advisory:...

org.dynamoframework:dynamo-integration-import (>=1.2, <=1.6.3-cb3) potentially affected by CVE-2022-23640 via com.monitorjbl:xlsx-streamer (0.2.9)

com.monitorjbl:xlsx-streamer MAVEN version 0.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.monitorjbl:xlsx-streamer and may be impacted: - org.dynamoframework:dynamo-integration-import =1.2, =1.6.3-cb3 Source cves: CVE-2022-23640 Source...

com.kenshoo:xlsx2csv (0.1.1), com.kenshoo:xlsx2csv (0.1.2) potentially affected by CVE-2022-23640 via com.monitorjbl:xlsx-streamer (1.0.2)

com.monitorjbl:xlsx-streamer MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.monitorjbl:xlsx-streamer and may be impacted: - com.kenshoo:xlsx2csv 0.1.1 - com.kenshoo:xlsx2csv 0.1.2 Source cves: CVE-2022-23640 Source advisory:...

com.crealytics:spark-excel_2.11 (>=0.9.12, <=0.9.18), com.iceolive:excelutil (1.0.0) +140 more potentially affected by CVE-2022-23640 via com.monitorjbl:xlsx-streamer (1.2.1)

com.monitorjbl:xlsx-streamer MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.monitorjbl:xlsx-streamer and may be impacted: - com.crealytics:spark-excel2.11 =0.9.12, =1.1.1, =1.1.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =0.6.0,...

com.crealytics:spark-excel_2.11 (>=0.10.0, <=0.11.1), tech.mlsql:streamingpro-mlsql-spark_2.4 (1.2.0) +1 more potentially affected by CVE-2022-23640 via com.monitorjbl:xlsx-streamer (2.0.0)

com.monitorjbl:xlsx-streamer MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.monitorjbl:xlsx-streamer and may be impacted: - com.crealytics:spark-excel2.11 =0.10.0, =1.4.0, =1.5.0 Source cves: CVE-2022-23640 Source advisory:...

CVE-2022-23640: Improper Restriction of XML External Entity Reference

Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no...