Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2017-9233
High · 7.5
CWE-611 Jul 25, 2017
XML External Entity (XXE) in Libexpat Project Libexpat
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
CVE-2016-9563
Medium · 6.5
KEV High · 53 CWE-611 Nov 23, 2016
SAP NetWeaver XML External Entity (XXE) Vulnerability
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
CVE-2016-9318
Medium · 5.5
CWE-611 Nov 15, 2016
XML External Entity (XXE) in Xmlsoft Libxml2
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVE-2013-0340
Medium · 6.8
CWE-611 Jan 21, 2014
expat 2.1.0 and earlier does not properly handle entities expansion unless an application...
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.