CVE-2020-29128

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

petl before 1.68, in some configurations, allows resolution of entities in an XML document.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-91

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.mdThird Party Advisory
https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8Patch, Third Party Advisory
https://github.com/petl-developers/petl/issues/526Issue Tracking, Third Party Advisory
https://github.com/petl-developers/petl/pull/527Patch, Third Party Advisory
https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8Patch, Third Party Advisory
https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347Third Party Advisory
https://petl.readthedocs.io/en/stable/changes.htmlRelease Notes, Vendor Advisory
https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.mdThird Party Advisory
https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8Patch, Third Party Advisory
https://github.com/petl-developers/petl/issues/526Issue Tracking, Third Party Advisory
https://github.com/petl-developers/petl/pull/527Patch, Third Party Advisory
https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8Patch, Third Party Advisory
https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347Third Party Advisory
https://petl.readthedocs.io/en/stable/changes.htmlRelease Notes, Vendor Advisory

Timeline

Published: Nov 26, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-291294.3ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the to CVE-2020-29137.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-291304.3slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the t CVE-2020-291336.1jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filename in the signImgFile CVE-2020-291348.6The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all versions Fluig Lake 1 CVE-2020-291354.1cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).CVE-2020-291366.5In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).CVE-2020-291376.1cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).CVE-2020-291385.3Incorrect Access Control in the configuration backup path in SAGEMCOM F@ST3486 NET DOCSIS 3.0, software NET_4.109.0, allows remote unauthent CVE-2020-291397.2A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote CVE-2020-29147.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-291407.2A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker