CVE Feed

    Dashboard / CVE / CVE-2013-7332

    CVE-2013-7332

    The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

    Published:Feb 26, 2014
    Last Modified:Apr 12, 2025
    EPS:Feb 26, 2014
    EPSS Score:0.10957
    CVSS Score:5

    Affected Products

    Vendor
    Microsoft
    Product
    Windows 8
    Vendor
    Microsoft
    Product
    Windows 8.1

    Exploits

    https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2019-19161 (CVSS 7.2) — CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications. A vulnerability i…
    CVE-2019-19160 (CVSS 5.7) — Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscri…
    CVE-2020-7808 (CVSS 8.7) — In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update modu…
    CVE-2019-19165 (CVSS 7.2) — AxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote files to be down…
    CVE-2020-7804 (CVSS 6.4) — ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute …
    CVE-2019-14678 (CVSS 10) — SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attacker…
    CVE-2018-16183 (CVSS 7.8) — An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32b…
    CVE-2018-16160 (CVSS 7.8) — SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in t…
    CVE-2017-14010 (CVSS 7.8) — In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled se…
    CVE-2018-6947 (CVSS 7.8) — An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shippe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High