CVE-2017-1000061

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10000627.5kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code executionCVE-2017-10000636.1kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosureCVE-2017-10000647.5kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoSCVE-2017-10000656.1Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionalitCVE-2017-10000667.5The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in theCVE-2017-10000678.8MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in aCVE-2017-10000687.5TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the abilityCVE-2017-10000698.8CSRF in Bitly oauth2_proxy 2.1 during authentication flowCVE-2017-10000706.1The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-lCVE-2017-10000718.1Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against aCVE-2017-10000729.8Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modification of unexpected memCVE-2017-10000739.8Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.