WaratekVRT Sign in

Apache POI CVEs

10 CVEs, 5 protected by Waratek

Reset
More filters (2)
Columns
Vendor apache✕Product poi✕
Overview 10 matches · 5 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
10matches 5protected50.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 5 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 50.0%
Critical 0 0.0% High 1 10.0% Medium 9 90.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 50.0% partly blocked 0 0.0% not blocked 5 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 10 100.0%
split by peak 2 / year
No exploit published: 5Protected by Waratek: 5 Medium: 9High: 1 not blocked: 5blocked by ARMR today: 5 No public exploit: 10
20121 No exploit published1 Medium1 not blocked1 No public exploit1 20130 20142 Protected by Waratek1 No exploit published1 Medium2 blocked by ARMR today1 not blocked1 No public exploit2 20151 No exploit published1 Medium1 not blocked1 No public exploit1 20161 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20171 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20181 No exploit published1 High1 not blocked1 No public exploit1 20191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20200 20210 20221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20230 20240 20251 No exploit published1 Medium1 not blocked1 No public exploit1
2013201520172019202120232025
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-31672 Medium 2025-04-09 No exploit published No public exploit Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry. This issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file. Users are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read https://poi.apache.org/security.html for recommendations about how to use the POI libraries securely.
CVE-2022-26336 Medium 2022-03-04 Protected by Waratek No public exploit A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
CVE-2019-12415 Medium 2019-10-23 Protected by Waratek No public exploit In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
CVE-2017-12626 High 2018-01-29 No exploit published No public exploit Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
CVE-2017-5644 Medium 2017-03-24 Protected by Waratek No public exploit Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVE-2016-5000 Medium 2016-08-05 Protected by Waratek No public exploit The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2014-9527 Medium 2015-01-06 No exploit published No public exploit HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
CVE-2014-3574 Medium 2014-09-04 No exploit published No public exploit Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVE-2014-3529 Medium 2014-09-04 Protected by Waratek No public exploit The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2012-0213 Medium 2012-08-07 No exploit published No public exploit The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.