CVE-2014-3004

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

Date published : 2014-06-11

http://www.securityfocus.com/bid/67676

http://seclists.org/fulldisclosure/2014/May/142