XML Entity Expansion

xlsx-streamer is vulnerable to XML entity expansion which is also known as XML Bombs. Lack of necessary settings to prevent XML Entity Expansion issues allows an attacker to pass malicious XML object via XML parser...

Mageia: Security Advisory (MGASA-2015-0294)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2015-0294 Updated springframework package fixes security vulnerability

In Spring Framework before 3.2.14, if DTD is not entirely disabled, inline DTD declarations can be used to perform denial of service attacks known as XML bombs. Such declarations are both well-formed and valid according to XML schema rules but when parsed can cause out of memory errors. To protec...

DoS Attack with XML Input

XML external entities were previously disabled with the publication of http://pivotal.io/security/cve-2013-6429 . If DTD is not entirely disabled, inline DTD declarations can be used to perform Denial of Service attacks known as XML bombs. Such declarations are both well-formed and valid accordin...