CVE-2023-6194

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to generate a report then Eclipse Memory Analyzer may access external files or URLs defined via a DTD in the report definition.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Dec 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-61954.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5CVE-2023-61968.8The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is dueCVE-2023-61975.4The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is dueCVE-2023-61989.3Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access CVE-2023-61996.5Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.CVE-2023-62007.5A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send anCVE-2023-62018.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System PanoramaCVE-2023-62024.3Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user aCVE-2023-62037.5The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a craftedCVE-2023-62046.5On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the CVE-2023-62056.5It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.CVE-2023-62065.4The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible