UpHeron
All vulnerabilities

Servers and applications

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue,…

Severity
Medium 4.3
Published
31 May 2014
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 8.0.5
  • Version 8.0.3
  • Version 8.0.1
  • Version 8.0.0-rc10
All 107 release lines
  • Every version up to 6.0.39
  • Version 6.0.0-alpha
  • Version 6
  • Version 6.0.1-alpha
  • Version 6.0.1
  • Version 6.0.2-alpha
  • Version 6.0.2-beta
  • Version 6.0.2
  • Version 6.0.3
  • Version 6.0.4-alpha
  • Version 6.0.4
  • Version 6.0.5
  • Version 6.0.6-alpha
  • Version 6.0.6
  • Version 6.0.7-alpha
  • Version 6.0.7-beta
  • Version 6.0.7
  • Version 6.0.8-alpha
  • Version 6.0.8
  • Version 6.0.9-beta
  • Version 6.0.9
  • Version 6.0.10
  • Version 6.0.11
  • Version 6.0.12
  • Version 6.0.13
  • Version 6.0.14
  • Version 6.0.15
  • Version 6.0.16
  • Version 6.0.17
  • Version 6.0.18
  • Version 6.0.19
  • Version 6.0.20
  • Version 6.0.24
  • Version 6.0.26
  • Version 6.0.27
  • Version 6.0.28
  • Version 6.0.29
  • Version 6.0.30
  • Version 6.0.31
  • Version 6.0.32
  • Version 6.0.33
  • Version 6.0.35
  • Version 6.0.36
  • Version 6.0.37
  • Version 7.0.0-beta
  • Version 7.0.0
  • Version 7.0.1
  • Version 7.0.2-beta
  • Version 7.0.2
  • Version 7.0.3
  • Version 7.0.4-beta
  • Version 7.0.4
  • Version 7.0.5
  • Version 7.0.6
  • Version 7.0.7
  • Version 7.0.8
  • Version 7.0.9
  • Version 7.0.10
  • Version 7.0.11
  • Version 7.0.12
  • Version 7.0.13
  • Version 7.0.14
  • Version 7.0.15
  • Version 7.0.16
  • Version 7.0.17
  • Version 7.0.18
  • Version 7.0.19
  • Version 7.0.20
  • Version 7.0.21
  • Version 7.0.22
  • Version 7.0.23
  • Version 7.0.24
  • Version 7.0.25
  • Version 7.0.26
  • Version 7.0.27
  • Version 7.0.28
  • Version 7.0.29
  • Version 7.0.30
  • Version 7.0.31
  • Version 7.0.32
  • Version 7.0.33
  • Version 7.0.34
  • Version 7.0.35
  • Version 7.0.36
  • Version 7.0.37
  • Version 7.0.38
  • Version 7.0.39
  • Version 7.0.40
  • Version 7.0.41
  • Version 7.0.42
  • Version 7.0.43
  • Version 7.0.44
  • Version 7.0.45
  • Version 7.0.46
  • Version 7.0.47
  • Version 7.0.48
  • Version 7.0.49
  • Version 7.0.50
  • Version 7.0.52
  • Version 7.0.53
  • Version 8.0.0-rc1
  • Version 8.0.0-rc2
  • Version 8.0.0-rc5
  • Version 8.0.0-rc10
  • Version 8.0.1
  • Version 8.0.3
  • Version 8.0.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-0119
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-0119