WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product libxml2✕
Overview 115 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 7 public PoC · 0 EPSS ≥ 0.5
115matches 0in Waratek scope0.0% 0protected0.0% 2exploited1.7% 0CISA KEV0.0% 7public PoC6.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 8 7.0% Not applicable 107 93.0% Withdrawn CVE 0 0.0%
Critical 9 7.8% High 51 44.3% Medium 48 41.7% Low 7 6.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 115 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 1.7% Working exploit published 7 6.1% Proof of concept only 8 7.0% Forecast only 0 0.0% No public exploit 98 85.2%
split by peak 21 / year
Not applicable: 107Outside Waratek scope: 8 Low: 7Medium: 48High: 51Critical: 9 not blocked: 115 No public exploit: 98Proof of concept only: 8Working exploit published: 7Exploited: 2
20031 Not applicable1 Medium1 not blocked1 No public exploit1 20041 Not applicable1 High1 not blocked1 Working exploit published1 20051 Not applicable1 High1 not blocked1 Working exploit published1 20060 20070 20083 Not applicable3 High1 Medium2 not blocked3 Working exploit published2 No public exploit1 20092 Not applicable2 Medium2 not blocked2 No public exploit2 20102 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20111 Not applicable1 High1 not blocked1 Working exploit published1 20123 Not applicable3 Medium3 not blocked3 No public exploit3 20133 Not applicable3 High1 Medium2 not blocked3 No public exploit3 20142 Not applicable2 Medium2 not blocked2 No public exploit2 201511 Not applicable11 High1 Medium9 Low1 not blocked11 No public exploit11 201621 Not applicable21 Critical3 High11 Medium7 not blocked21 Working exploit published2 Proof of concept only1 No public exploit18 20179 Not applicable9 Critical2 High6 Medium1 not blocked9 Proof of concept only1 No public exploit8 201811 Not applicable11 Critical2 High3 Medium6 not blocked11 No public exploit11 20191 Outside Waratek scope1 High1 not blocked1 No public exploit1 20203 Outside Waratek scope3 High2 Medium1 not blocked3 Proof of concept only1 No public exploit2 20214 Not applicable4 High2 Medium2 not blocked4 No public exploit4 20225 Not applicable5 High3 Medium2 not blocked5 Exploited2 No public exploit3 20234 Not applicable4 Medium4 not blocked4 Proof of concept only1 No public exploit3 20243 Outside Waratek scope1 Not applicable2 Critical1 High2 not blocked3 Proof of concept only1 No public exploit2 202510 Outside Waratek scope3 Not applicable7 Critical1 High6 Medium1 Low2 not blocked10 Proof of concept only3 No public exploit7 202614 Not applicable14 High8 Medium2 Low4 not blocked14 No public exploit14
200420062008201020122014201620182020202220242026
115 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2013-0338 Medium 2013-04-25 Not applicable No public exploit libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
CVE-2012-0841 Medium 2012-12-21 Not applicable No public exploit libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
CVE-2012-5134 Medium 2012-11-28 Not applicable No public exploit Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.
CVE-2012-2871 Medium 2012-08-31 Not applicable No public exploit libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.
CVE-2011-1944 High 2011-09-02 Not applicable Working exploit published Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.
CVE-2010-4494 High 2010-12-07 Not applicable No public exploit Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.
CVE-2010-4008 Medium 2010-11-17 Not applicable No public exploit libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
CVE-2009-2416 Medium 2009-08-11 Not applicable No public exploit Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.
CVE-2009-2414 Medium 2009-08-11 Not applicable No public exploit Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.
CVE-2008-4409 Medium 2008-10-03 Not applicable Working exploit published libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.
CVE-2008-3529 High 2008-09-12 Not applicable Working exploit published Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.
CVE-2008-3281 Medium 2008-08-27 Not applicable No public exploit libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
CVE-2004-0989 High 2005-03-01 Not applicable Working exploit published Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.
CVE-2004-0110 High 2004-03-15 Not applicable Working exploit published Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.
CVE-2003-1564 Medium 2003-12-31 Not applicable No public exploit libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."
‹ prev page 2 of 2 next ›