CVE-2021-44550

CVE-2021-44550 corresponds to an Incorrect Access Control vulnerability in Stanford CoreNLP 4.3.2, exposed via the NERServlet classifier. The issue enables HTTP header injection by not properly validating or escaping the classifier header, allowing a remote attacker to craft requests that inject ...

CVE-2022-0239

The CVE-2022-0239 entry pertains to Stanford CoreNLP (corenlp) with an XML External Entity (XXE) processing flaw. Root cause: SchemaFactory is created without secure processing enabled and is used to validate XML against a schema, enabling XXE when processing malicious XML. Impact (per public rec...

CVE-2022-0198

The CVE-2022-0198 entry concerns Stanford CoreNLP (stanfordnlp/corenlp) and an XML External Entity (XXE) vulnerability. Affected component: CoreNLP’s XML processing via TransformXML()/XML parsing paths, leading to improper restriction of external entities. Potential impact (per sources): reading ...

CVE-2021-3878

CVE-2021-3878 affects Stanford CoreNLP: XML External Entity (XXE) processing vulnerability in readDocument() via DomReader.java. An unauthenticated, network-based attacker could exploit this to read arbitrary files, cause DoS, SSRF, port scanning, or other system impacts as indicated by the descr...

CVE-2021-3869

The CVE-2021-3869 entry concerns Stanford CoreNLP (corenlp) and is caused by improper restriction of XML External Entity (XXE) references. Public sources in the connected documents confirm this XXE vulnerability affecting CoreNLP, with references indicating potential exposure/read access issues v...