CWE-776

Medium likelihood

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Parent: CWE-674 - Uncontrolled Recursion

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

86 vulnerabilities with CWE-776
CVE-2021-38490 HIGH
Altova MobileTogether Server <7.3 SP1 - Info Disclosure
CVSS 7.5
CVE-2021-3541 MEDIUM
libxml2 < 2.9.11 - Denial of Service via Exponential Entity Expansion
CVSS 6.5
CVE-2021-32623 HIGH
Opencast < 9.6 - Authenticated Denial of Service via XML Entity Expansion
CVSS 8.1
CVE-2021-23926 CRITICAL
Apache XMLBeans <= 2.6.0 - XML External Entity Injection
CVSS 9.1
CVE-2021-1267 MEDIUM
Cisco Secure Firewall Management Center < 6.6.1 - Authenticated Denial of Service via XML Entity Expansion
CVSS 4.3
CVE-2020-15303 MEDIUM
Infoblox NIOS < 8.5.2 - XML External Entity Injection via XML Upload
CVSS 6.5
CVE-2020-24665 MEDIUM
Hitachi Vantara Pentaho <7.1.0.25-<8.2.0.6-<8.3.0.0 - XML Entity Ex...
CVSS 6.5
CVE-2020-24590 CRITICAL
WSO2 API Manager <3.1.0, API Microgateway 2.2.0 - SSRF
CVSS 9.1
CVE-2020-11462 HIGH
OpenVPN Access Server < 2.7.0 and 2.8.x < 2.8.3 - Denial of Service via XML Entity Expansion
CVSS 7.5
CVE-2020-3946 HIGH
VMware InstallBuilder < 19.11.0 - Denial of Service via XML Entity Expansion
CVSS 7.5
CVE-2020-2172 MEDIUM
Jenkins Code Coverage API Plugin < 1.1.4 - XML External Entity Injection
CVSS 6.5
CVE-2020-6856 MEDIUM
SOS JobScheduler 1.12 and 1.13.2 - XML External Entity Injection in JOC Cockpit
CVSS 6.5
CVE-2020-5227 MEDIUM
feedgen < 0.9.0 - XML Denial of Service via Entity Expansion
CVSS 4.4
CVE-2019-19144 CRITICAL
Quantum DXi6702 2.3.0.3 - XML External Entity Injection via rest/Users Endpoint
CVSS 9.8
CVE-2019-20104 HIGH
Atlassian Crowd < 3.2.11 - Denial of Service via XML Entity Expansion
CVSS 7.5
CVE-2019-11253 HIGH
Kubernetes v1.0-1.12 and < v1.13.12, v1.14.8, v1.15.5, v1.16.2 - Denial of Service via Malicious YAML/JSON Payloads
CVSS 7.5
CVE-2019-12401 HIGH
Apache Solr 1.3.0-1.4.1, 3.1.0-3.6.2, 4.0.0-4.10.4 - XML Entity Expansion via Update Handler
CVSS 7.5
CVE-2019-15903 HIGH
libexpat < 2.2.8 - XML External Entity Injection via DTD Parsing
CVSS 7.5
CVE-2019-15160 HIGH
SweetXml < 0.6.6 - Denial of Service via XML Entity Expansion
CVSS 7.5
CVE-2019-5442 HIGH
Pippo 1.12.0 - Denial of Service via XML Entity Expansion
CVSS 7.5
CVE-2019-5427 HIGH
c3p0 <0.9.5.4 - Info Disclosure
CVSS 7.5
CVE-2018-10868 HIGH
redhat-certification 7 - XML External Entity Injection via XMLRPC Status Reply
CVSS 7.5
CVE-2017-18640 HIGH
SnakeYAML < 1.26 - XML Entity Expansion via Alias Feature
CVSS 7.5
CVE-2017-5644 MEDIUM
Apache POI < 3.15 - Denial of Service via XML Entity Expansion
CVSS 5.5
CVE-2015-9541 HIGH
Qt < 5.12.8 - XML External Entity Injection via QXmlStreamReader
CVSS 7.5
Details
Vulnerabilities 86
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits