Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1697 vulnerabilities reference this CWE, most recent first.
GHSA-Q423-XQRX-XQPF
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19
VLAI
Details
Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition by processing a specially crafted XML document.
{
"affected": [],
"aliases": [
"CVE-2021-20838"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-01T02:15:00Z",
"severity": "HIGH"
},
"details": "Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition by processing a specially crafted XML document.",
"id": "GHSA-q423-xqrx-xqpf",
"modified": "2022-05-24T19:19:22Z",
"published": "2022-05-24T19:19:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20838"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN33453839/index.html"
},
{
"type": "WEB",
"url": "https://www.antenna.co.jp/news/2021/osdc72-20211027.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-Q425-6M5X-QP5P
Vulnerability from github – Published: 2022-05-02 03:27 – Updated: 2024-02-10 03:30
VLAI
Details
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2009-1699"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-06-10T18:00:00Z",
"severity": "HIGH"
},
"details": "The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an \"XXE attack.\"",
"id": "GHSA-q425-6m5x-qp5p",
"modified": "2024-02-10T03:30:18Z",
"published": "2022-05-02T03:27:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1699"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/8907"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/54972"
},
{
"type": "WEB",
"url": "http://scary.beasts.org/security/CESA-2009-006.html"
},
{
"type": "WEB",
"url": "http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35379"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43068"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3613"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3639"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/35260"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/35321"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-857-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1522"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1621"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0212"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q42M-MP58-HXV5
Vulnerability from github – Published: 2023-10-09 12:30 – Updated: 2024-04-04 08:26
VLAI
Details
In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
Severity
8.6 (High)
{
"affected": [],
"aliases": [
"CVE-2023-45612"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-09T11:15:11Z",
"severity": "CRITICAL"
},
"details": "In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE",
"id": "GHSA-q42m-mp58-hxv5",
"modified": "2024-04-04T08:26:02Z",
"published": "2023-10-09T12:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45612"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q43H-4XR8-J6FQ
Vulnerability from github – Published: 2022-05-14 02:47 – Updated: 2022-05-14 02:47
VLAI
Details
XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2015-7326"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-07T14:29:00Z",
"severity": "CRITICAL"
},
"details": "XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.",
"id": "GHSA-q43h-4xr8-j6fq",
"modified": "2022-05-14T02:47:37Z",
"published": "2022-05-14T02:47:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7326"
},
{
"type": "WEB",
"url": "https://github.com/miltonio/milton2/commit/5f81b0c48a817d4337d8b0e99ea0b4744ecd720b"
},
{
"type": "WEB",
"url": "https://github.com/miltonio/milton2/commit/b41072b"
},
{
"type": "WEB",
"url": "https://github.com/miltonio/milton2/commit/b5851c1"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134178/Milton-Webdav-2.7.0.1-XXE-Injection.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/536813/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/77392"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q485-J897-QC27
Vulnerability from github – Published: 2019-01-07 19:14 – Updated: 2022-09-14 22:34
VLAI
Summary
XML External Entity Reference in mchange:c3p0
Details
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
Severity
9.8 (Critical)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.9.5.2"
},
"package": {
"ecosystem": "Maven",
"name": "com.mchange:c3p0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-20433"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:50:54Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.",
"id": "GHSA-q485-j897-qc27",
"modified": "2022-09-14T22:34:12Z",
"published": "2019-01-07T19:14:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20433"
},
{
"type": "WEB",
"url": "https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-q485-j897-qc27"
},
{
"type": "PACKAGE",
"url": "https://github.com/zhutougg/c3p0"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00021.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Reference in mchange:c3p0"
}
GHSA-Q48R-XG9H-78M8
Vulnerability from github – Published: 2022-11-15 12:00 – Updated: 2022-11-22 00:12
VLAI
Summary
Concrete CMS vulnerable to XML External Entity
Details
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "concrete5/concrete5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "concrete5/concrete5"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-43689"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-22T00:12:47Z",
"nvd_published_at": "2022-11-14T23:15:00Z",
"severity": "MODERATE"
},
"details": "Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.",
"id": "GHSA-q48r-xg9h-78m8",
"modified": "2022-11-22T00:12:47Z",
"published": "2022-11-15T12:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43689"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes"
},
{
"type": "PACKAGE",
"url": "https://github.com/concretecms/concretecms"
},
{
"type": "WEB",
"url": "https://github.com/concretecms/concretecms/releases/8.5.10"
},
{
"type": "WEB",
"url": "https://github.com/concretecms/concretecms/releases/9.1.3"
},
{
"type": "WEB",
"url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Concrete CMS vulnerable to XML External Entity"
}
GHSA-Q4M6-R7VG-PR4J
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33
VLAI
Details
IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6) is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 143501.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2018-1588"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-25T15:29:00Z",
"severity": "HIGH"
},
"details": "IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6) is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 143501.",
"id": "GHSA-q4m6-r7vg-pr4j",
"modified": "2022-05-13T01:33:06Z",
"published": "2022-05-13T01:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1588"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/143501"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10731511"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-Q4MM-89Q2-XFFG
Vulnerability from github – Published: 2022-05-17 01:52 – Updated: 2024-02-09 16:27
VLAI
Summary
phpMyAdmin vulnerable to XML external entity (XXE) injection attack
Details
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"events": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.10.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2011-4107"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-09T16:27:56Z",
"nvd_published_at": "2011-11-17T19:55:00Z",
"severity": "MODERATE"
},
"details": "The `simplexml_load_string` function in the XML import plug-in (`libraries/import/xml.php`) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.",
"id": "GHSA-q4mm-89q2-xffg",
"modified": "2024-02-09T16:27:57Z",
"published": "2022-05-17T01:52:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4107"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2fbf631384fd8cded55f4500cb87b129442f9ed2"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/34d99de000de9d15cfdf5e9cc8b7682d51110bbd"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5fa86b8e81565c15ddbc359e8f59ecd829a2b717"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/a5e206fbd2ca814042cfc1bb7dd3b40c28ce3fb5"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=751112"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71108"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpmyadmin/phpmyadmin"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2011/Nov/21"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/8533"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/5"
},
{
"type": "WEB",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "phpMyAdmin vulnerable to XML external entity (XXE) injection attack"
}
GHSA-Q4Q3-6VR4-QQ23
Vulnerability from github – Published: 2024-08-15 18:31 – Updated: 2024-08-15 21:31
VLAI
Details
XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-22218"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T18:15:19Z",
"severity": "HIGH"
},
"details": "XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.",
"id": "GHSA-q4q3-6vr4-qq23",
"modified": "2024-08-15T21:31:19Z",
"published": "2024-08-15T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22218"
},
{
"type": "WEB",
"url": "https://docs.terminalfour.com/articles/release-notes-highlights"
},
{
"type": "WEB",
"url": "https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22218--cve-2024-22219"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q4XF-3PMQ-3HW8
Vulnerability from github – Published: 2022-01-06 20:41 – Updated: 2021-03-29 16:20
VLAI
Summary
Improper Restriction of XML External Entity Reference in Apache NiFi
Details
In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).
Severity
5.5 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.11.4"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.nifi:nifi"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.12.0-RC1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-13940"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-29T16:20:14Z",
"nvd_published_at": "2020-10-01T20:15:00Z",
"severity": "MODERATE"
},
"details": "In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).",
"id": "GHSA-q4xf-3pmq-3hw8",
"modified": "2021-03-29T16:20:14Z",
"published": "2022-01-06T20:41:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13940"
},
{
"type": "WEB",
"url": "https://github.com/apache/nifi/commit/7f0416ee8bdcee95e28409cc6fae9c1394c2a798"
},
{
"type": "WEB",
"url": "https://nifi.apache.org/security#CVE-2020-13940"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of XML External Entity Reference in Apache NiFi"
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.