Improper Restriction of Recursive Entity References in DTDs

Every one of the 88 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows…CVE-2009-195553% likely
2. The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.CVE-2017-18640Snakeyaml Project · 27% likely

   Snakeyaml Project

3. Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML…CVE-2019-12401Apache · 8.5% likely

   Apache

4. XMLBeans XML Entity ExpansionCVE-2021-23926Apache Software Foundation · 6.3% likely

   Apache

5. It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker in…CVE-2022-0217Prosody · 5.2% likely

   Prosody

6. c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading config…CVE-2019-5427Mchange · 4.9% likely
7. Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion…CVE-2017-5644Apache Software Foundation · 4.6% likely

   Apache

8. jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a cr…CVE-2011-1755Jabberd2 · 3.7% likely
9. The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages.CVE-2014-2228Talend · 3.3% likely

   Talend

10. Denial of Service (DoS)CVE-2022-25857Snakeyaml Project · CVSS 7.5 · 2.9% likely

    Snakeyaml Project

11. libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service…CVE-2008-32812.5% likely
12. Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.CVE-2015-9541Qt · 2.5% likely

    Qt

13. opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection VulnerabilitiesCVE-2013-4335opOpenSocialPlugin · 2.5% likely
14. The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML…CVE-2019-20104Atlassian · 2.4% likely

    Atlassian

15. Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limitsCVE-2013-6461Ruby · 2.2% likely

    Ruby

16. Feedgen Vulnerable to XML Denial of Service AttacksCVE-2020-5227lkiesow · CVSS 4.4 · 2.2% likely
17. Nokogiri before 1.5.4 is vulnerable to XXE attacksCVE-2012-6685Nokogiri · 2.2% likely
18. Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documentsCVE-2013-6460Ruby · 2.1% likely

    Ruby

19. A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.CVE-2021-3541Xmlsoft · 2.1% likely

    Xmlsoft

20. libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).CVE-2024-28757Siemens · CVSS 7.5 · 2.0% likely

    Siemens

21. An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Ap…CVE-2022-26662Tryton · 2.0% likely

    Tryton

22. untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting thi…CVE-2022-33977Christian Stefanescu · 1.8% likely
23. Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consump…CVE-2011-3288Cisco · 1.8% likely

    Cisco

24. The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack wi…CVE-2019-15160Kbrw · 1.7% likely
25. libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU c…CVE-2003-15641.6% likely
26. XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, t…CVE-2019-5442Pippo · 1.4% likely

    Pippo

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.