CWE-776

Medium likelihood

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Parent: CWE-674 - Uncontrolled Recursion

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

71 vulnerabilities with CWE-776
CVE-2022-25857 HIGH
Snakeyaml < 1.31 - XML Entity Expansion
CVSS 7.5
CVE-2022-0217 HIGH
Prosody - Info Disclosure
CVSS 7.5
CVE-2022-33977 HIGH
untangle <1.2.0 - DoS
CVSS 7.5
CVE-2022-34467 MEDIUM
Mendix Excel Importer < 9.2.2 - XML Entity Expansion
CVSS 6.5
CVE-2022-26662 HIGH
Tryton Application Platform <5.0.45-6.2.5 - DoS
CVSS 7.5
CVE-2022-23640 CRITICAL
Excel Streaming Reader < 2.1.0 - XXE
CVSS 9.8
CVE-2021-41559 MEDIUM
Silverstripe < 4.10.9 - XML Entity Expansion
CVSS 6.5
CVE-2021-40511 HIGH
OBDA systems' Mastro 1.0 - DoS
CVSS 7.5
CVE-2021-20464 MEDIUM
IBM Cognos Analytics <11.2.0 - DoS
CVSS 6.5
CVE-2021-31842 MEDIUM
Mcafee Endpoint Security < 10.7.0 - XML Entity Expansion
CVSS 5.0
CVE-2021-38490 HIGH
Altova MobileTogether Server <7.3 SP1 - Info Disclosure
CVSS 7.5
CVE-2021-3541 MEDIUM
libxml2 - DoS
CVSS 6.5
CVE-2021-32623 HIGH
Apereo Opencast < 9.6 - XML Entity Expansion
CVSS 8.1
CVE-2021-23926 CRITICAL
Apache Xmlbeans < 2.6.0 - XML Entity Expansion
CVSS 9.1
CVE-2021-1267 MEDIUM
Cisco Secure Firewall Management Center < 6.6.1 - XML Entity Expansion
CVSS 4.3
CVE-2020-15303 MEDIUM
Infoblox NIOS <8.5.2 - SSRF
CVSS 6.5
CVE-2020-24665 MEDIUM
Hitachi Vantara Pentaho <7.1.0.25-<8.2.0.6-<8.3.0.0 - XML Entity Ex...
CVSS 6.5
CVE-2020-24590 CRITICAL
WSO2 API Manager <3.1.0, API Microgateway 2.2.0 - SSRF
CVSS 9.1
CVE-2020-11462 HIGH
Openvpn Access Server < 2.7.0 - XML Entity Expansion
CVSS 7.5
CVE-2020-3946 HIGH
InstallBuilder <19.11 - DoS
CVSS 7.5
CVE-2020-2172 MEDIUM
Jenkins Code Coverage API < 1.1.4 - XML Entity Expansion
CVSS 6.5
CVE-2020-6856 MEDIUM
Sos-berlin Jobscheduler - XML Entity Expansion
CVSS 6.5
CVE-2020-5227 MEDIUM
Feedgen < 0.9.0 - XML Entity Expansion
CVSS 4.4
CVE-2019-19144 CRITICAL
Quantum DXi6702 <2.3.0.3 - SSRF
CVSS 9.8
CVE-2019-20104 HIGH
Atlassian Crowd < 3.2.11 - XML Entity Expansion
CVSS 7.5
Details
Vulnerabilities 71
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits