MediumCVSS 5.3
EPSS 1.5%
** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage.
Vendor
org.apache.any23 vulnerabilities
4 published CVES affecting org.apache.any23, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 4
- Critical
- 3
- High
- 0
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest org.apache.any23 CVEs
Newest publication first
-
-
CriticalCVSS 9.1 EPSS 2.9%
An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with...
-
CVE-2021-40146 A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java
PublishedCriticalCVSS 9.8 EPSS 5.7%A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs...
-
CriticalCVSS 9.1 EPSS 2.8%
An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an appli...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.