Vendor/product archive

mchange / c3p0 CVEs

Beta · best-effort

2 CVEs tagged to mchange / c3p0 — 1 Critical, 1 High, 0 Medium, 0 Low, 0 Unrated.

See this archive with more filters Back to mchange vendor archive

CVE-2019-5427

Published Apr 22, 2019

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading config…

CVSS 7.5 · High

Vendor/product tagsBeta · best-effort

CVE-2018-20433

Published Dec 24, 2018

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

Showing 1-2 of 2 CVEsPage 1 of 1