{"id":"CVE-2021-29997","aliases":["EUVD-2021-16456","GHSA-6xmx-h98x-6vxg"],"status":"published","title":"XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the...","description":"An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01067,"percentile":0.65076,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125","CWE-611"],"published":"2021-04-13T16:34:02Z","modified":"2026-06-17T03:48:34Z","products":[{"vendor":"windriver","product":"vxworks"}],"references":[{"url":"https://support2.windriver.com/index.php?page=security-notices","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2021-29997","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29997"},{"url":"https://github.com/advisories/GHSA-6xmx-h98x-6vxg"}],"sources":{"cve":[{"id":"CVE-2021-29997","description":"An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.","status":"published","published":"2021-04-13T16:34:02Z","modified":"2024-08-03T22:24:59.073Z","updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-16456","description":"An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.","status":"published","published":"2021-04-13T16:34:02Z","modified":"2024-08-03T22:24:59Z","updated_at":"2026-11-03T03:24:43.413555Z"}],"ghsa":[{"id":"GHSA-6xmx-h98x-6vxg","title":"XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the...","description":"XML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.","status":"published","published":"2022-05-24T17:47:29Z","modified":"2023-01-29T05:06:22Z","cwes":["CWE-125","CWE-611"],"updated_at":"2026-11-02T14:46:00.528527Z"}],"nvd":[{"id":"CVE-2021-29997","description":"An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.","status":"published","published":"2021-04-13T17:15:12.263Z","modified":"2026-06-17T03:48:34.77Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:51.610648Z"}]}}