Apache Santuario XML Security For Java vulnerabilities

6 CVEs affecting Apache Santuario XML Security For Java, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-44483, published 2023-10-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-4517, published 2014-01-11. Medium severity, CVSS 4.3. EPSS: 8.9% chance of exploitation in the next 30 days. Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs),…
CVE-2021-40690, published 2021-09-19. High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days. All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from…
CVE-2013-2172, published 2013-08-20. Medium severity, CVSS 4.3. EPSS: 5.9% chance of exploitation in the next 30 days. jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML…
CVE-2014-8152, published 2015-01-21. Medium severity, CVSS 5.0. EPSS: 5.6% chance of exploitation in the next 30 days. Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
CVE-2023-44483, published 2023-10-20. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files…
CVE-2019-12400, published 2019-08-23. Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days. In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted…