Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/xerces/xercesImpl@2.9.1
purl pkg:maven/xerces/xercesImpl@2.9.1
Next non-vulnerable version 2.12.2
Latest non-vulnerable version 2.12.2
Risk score 3.4
Vulnerabilities affecting this package (9)
Advisory Summary Fixed in package version
CVE-2009-2625

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update …
2.10.0
Vulnerable
2.11.0
Vulnerable
2.12.0
Vulnerable
CVE-2012-0881

Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted …
2.12.0
Vulnerable
CVE-2013-4002

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 …
2.12.0
Vulnerable
GHSA-w4jq-qh47-hvjq
Aliases:
CVE-2020-14338
Improper Input Validation in Xerces A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator … There are no reported fixed by versions.
GHSA-7j4h-8wpf-rqfh
Aliases:
CVE-2013-4002
Missing XML Validation in Apache Xerces2 XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime …
2.12.0
Vulnerable
GHSA-h65f-jvqw-m9fj
Aliases:
CVE-2022-23437
Infinite Loop in Apache Xerces Java There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially …
2.12.2
Not vulnerable
GHSA-334p-wv2m-w3vp
Aliases:
CVE-2009-2625
Denial of service in Apache Xerces2 XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in …
2.10.0
Vulnerable
GHSA-vmqm-g3vh-847m
Aliases:
CVE-2012-0881
Denial of service in Apache Xerces2 Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of …
2.12.0
Vulnerable
2.12.0
Vulnerable
CVE-2020-14338
Aliases:
GHSA-w4jq-qh47-hvjq
Improper Input Validation A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in … There are no reported fixed by versions.
This package is not known to fix any advisories.