CWE-776: XEE
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Also known as Improper Restriction of Recursive Entity References in DTDs, Billion Laughs Attack, XML Bomb.
A kind of CWE-674 Uncontrolled Recursion.
From the CWE List. © The MITRE Corporation.
Newest
zendframework/zend-xmlrpcPackagistZendFramework vulnerable to XXE/XEE attacks9.8 Criticalzendframework/zendframeworkPackagistZendframework vulnerable to XXE/XEE attacks9.8 Critical- dnkorpushov ebookmeta, lxml +1 moreebookmeta XML External Entity vulnerability9.1 Critical
- dnkorpushov ebookmetaebookmeta XML External Entity vulnerability7.5 High
symfony/validatorPackagistsymfony/validator XML Entity Expansion vulnerability7.5 Highsymfony/translationPackagistsymfony/translation XML Entity Expansion vulnerability7.5 Highsymfony/symfonyPackagistSymfony XML Entity Expansion security vulnerability7.5 Highsilverstripe/frameworkPackagistSilverStripe framework XML Quadratic Blowup Attack5.3 Medium- langchain, langchain-ai langchain-ai/langchain, langchain-ai\/langchain +2 moreBillion Laughs Attack leading to DoS in langchain-ai/langchain5.9 Medium
- libexpat project libexpat, fedoraproject fedora, netapp active iq unified manager +17 more +19 morelibexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of...7.5 High
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 morelibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile...5.5 Medium
- typechoTypecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the...7.5 High
- apache tilesApache Tiles: Unvalidated input may lead to path traversal and XXE7.5 High
- fnando svg optimizersvg_optimizer rubygem external XML entity (XXE) vulnerability5.9 Medium
- grupposcai realgimmA XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI...6.5 Medium
- phoenix contact cloud client 1101t-tx/tx, tc cloud client 1002-4g, tc cloud client 1002-4g att +11 more +13 morePHOENIX CONTACT: Denial-of-Service due to malicious XML files in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT4.9 Medium
- getkirby kirbyKirby XML External Entity (XXE) vulnerability in the XML data handler6.8 Medium
- charleskorn kamlkaml has potential denial of service while parsing input with anchors and aliases7.5 High
- clamav, cisco secure endpoint, secure endpoint private cloud +1 more +3 moreOn Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A...5.3 Medium
- jenkins testcomplete support, jenkins project testcomplete support plugin +1 moreXML Entity Expansion in Jenkins TestComplete support Plugin9.8 Critical
- jenkins mstest, jenkins project mstest plugin +1 moreXML external entity vulnerability on agents in Jenkins MSTest Plugin9.8 Critical
- linaro lava, debian linux +1 moreIn Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials...6.5 Medium
- auieosoftware candidatsCandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This...7.5 High
- dell hybrid client, hybrid client (dhc) +1 moreDell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege...7.1 High
k8s.io/apimachineryGoKubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing7.5 High- snakeyaml project snakeyaml, debian linux +1 moreDenial of Service (DoS)7.5 High
- christian stefanescu untangleuntangle vulnerable to XML Entity Expansion7.5 High
- mendix excel importer, siemens mendix excel importer module (mendix 8 compatible), mendix excel importer module (mendix 9 compatible) +2 moreA vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All...6.5 Medium
- silverstripeQuadratic blowup in Convert::xml2array()6.5 Medium
- obdasystems mastroOBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack...7.5 High
- apport project apport, canonical ubuntu linux +1 more~/.config/apport/settings parsing is vulnerable to "billion laughs" attack5.5 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be...6.5 Medium
- tryton proteus, trytond, debian linux +2 moreXML Entity Expansion in trytond and proteus7.5 High
- monitorjbl excel-streaming-reader, excel streaming reader project streaming reader +1 moreImproper Restriction of XML External Entity Reference in Excel-Streaming-Reader9.8 Critical
- prosodyprosody - security update7.5 High
- mcafee endpoint security, mcafee,llc mcafee endpoint security (ens) for windows +1 moreXML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior...5.0 Medium
- altova mobiletogether serverAltova MobileTogether Server before 7.3 SP1 allows XML exponential entity expansion, a different...7.5 High
- xml2dict project xml2dictXML2Dict XML Entity Expansion Vulnerability7.5 High
- infoblox niosInfoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related...6.5 Medium
- apereo opencastOpencast vulnerable to billion laughs attack (XML bomb)8.1 High
- [unknown] redhat-certification, redhat certification +1 moreIt has been discovered that redhat-certification does not properly limit the number of recursive...7.5 High
- gnome libxml2, netapp active iq unified manager, cloud backup +19 more +21 moreA flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all...6.5 Medium
- ibm websphere application serverIBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity...8.2 High
- perforce helix almThe XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build...4.9 Medium
- pupnp project pupnpA stack overflow in pupnp 1.16.1 can cause the denial of service through the Parser_parseDocument...7.5 High
- hitachi vantara pentahoThe Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity...6.5 Medium
- apache xmlbeans, debian linux, netapp oncommand unified manager core package +4 more +6 moreXMLBeans XML Entity Expansion9.1 Critical
- cisco firepower management center, secure firewall management center +1 moreCisco Firepower Management Center XML Entity Expansion Vulnerability4.3 Medium
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML...4.9 Medium
- we-con levistudiouAn XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing...7.5 High
- Show moreLoading…