CVE-2017-1000061

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Jul 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10000627.5kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution CVE-2017-10000636.1kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure CVE-2017-10000647.5kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS CVE-2017-10000656.1Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionalit CVE-2017-10000667.5The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the CVE-2017-10000678.8MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in a CVE-2017-10000687.5TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability CVE-2017-10000698.8CSRF in Bitly oauth2_proxy 2.1 during authentication flow CVE-2017-10000706.1The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-l CVE-2017-10000718.1Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against a CVE-2017-10000729.8Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modification of unexpected mem CVE-2017-10000739.8Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.