← Back

Dom4j

dom4j

Vendor: Dom4j Project • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-10683
5Canonical
Dom4j ProjectNetapp+2 more
38Agile Plm
Application Testing SuiteBanking Platform+35 more
Jun 17, 2026
May 1, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe,...Show more
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.Show less
CVE-2018-1000632
5Debian
Dom4j ProjectNetapp+2 more
14Debian Linux
Dom4jFlexcube Investor Servicing+11 more
Nov 21, 2024
Aug 20, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection....Show more
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.Show less