CVE-2022-33977

HIGH Year: 2022
CVSS v3 Score
7.5
High
Weakness Type
CWE-776
View all →

Vulnerability Description

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.

Related Vulnerabilities

CVE-2009-1955

HIGH
CVSS:7.5(High)

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to c...

CWE-7762009

CVE-2011-1755

HIGH
CVSS:7.5(High)

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document co...

CWE-7762011

CVE-2011-3288

HIGH
CVSS:7.5(High)

Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process cra...

CWE-7762011

CVE-2015-9541

HIGH
CVSS:7.5(High)

Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.

CWE-7762015

CVE-2017-18640

HIGH
CVSS:7.5(High)

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

CWE-7762017