CWE-776 Archives - CVE Vulnerability

CVE-2008-3281

Sun, 26 Feb 2023 09:09:56 +0000

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

The post CVE-2008-3281 appeared first on CVE Vulnerability.

CVE-2018-10868

Sun, 26 Feb 2023 06:45:01 +0000

redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a “Billion Laugh Attack” by replying to XMLRPC methods when getting the status of an host.

The post CVE-2018-10868 appeared first on CVE Vulnerability.

CVE-2020-6856

Sun, 26 Feb 2023 06:42:53 +0000

An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders.

The post CVE-2020-6856 appeared first on CVE Vulnerability.

CVE-2020-5227

Sun, 26 Feb 2023 06:42:14 +0000

Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.

The post CVE-2020-5227 appeared first on CVE Vulnerability.

CVE-2020-3946

Sun, 26 Feb 2023 06:41:51 +0000

InstallBuilder AutoUpdate tool and regular installers enabling built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service).

The post CVE-2020-3946 appeared first on CVE Vulnerability.

CVE-2020-24665

Sun, 26 Feb 2023 06:39:30 +0000

The Dashboard Editor in Hitachi Vantara Pentaho through 7.x – 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service (DoS) condition. Specifically, the vulnerability lies in the ‘dashboardXml’ parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, >= 8.3.0.0 GA

The post CVE-2020-24665 appeared first on CVE Vulnerability.

CVE-2020-24590

Sun, 26 Feb 2023 06:39:29 +0000

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.

The post CVE-2020-24590 appeared first on CVE Vulnerability.

CVE-2020-2172

Sun, 26 Feb 2023 06:39:02 +0000

Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

The post CVE-2020-2172 appeared first on CVE Vulnerability.

CVE-2020-15303

Sun, 26 Feb 2023 06:37:47 +0000

Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564.

The post CVE-2020-15303 appeared first on CVE Vulnerability.

CVE-2020-11462

Sun, 26 Feb 2023 06:36:14 +0000

An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve a temporary DoS state of the management interface when sending an XML Entity Expansion (XEE) payload to the XMLRPC based RPC2 interface. The duration of the DoS state depends on available memory and CPU speed. The default restricted mode of the RPC2 interface is NOT vulnerable.

The post CVE-2020-11462 appeared first on CVE Vulnerability.