CVE-2020-24590

CRITICAL Year: 2020
CVSS v3 Score
9.1
Critical
CVSS v2 Score
6.4
Medium
Weakness Type
CWE-776
View all →

Vulnerability Description

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.

Related Vulnerabilities

CVE-2021-23926

CRITICAL
CVSS:9.1(Critical)

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion atta...

CWE-7762021

CVE-2013-4335

CRITICAL
CVSS:9.8(Critical)

opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities

CWE-7762013

CVE-2014-2228

CRITICAL
CVSS:9.8(Critical)

The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages.

CWE-7762014

CVE-2024-28982

HIGH
CVSS:8.2(High)

Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML Extern...

CWE-7762024

CVE-2009-1955

HIGH
CVSS:7.5(High)

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to c...

CWE-7762009

CVE-2011-1755

HIGH
CVSS:7.5(High)

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document co...

CWE-7762011