CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 10)
Page 10 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0948 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an exte… |
CVE-2019-12154 | Critical | 9.1 | 2019-06-11 | XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources… |
CVE-2019-10337 | High | 7.5 | 2019-06-11 | An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file fo… |
CVE-2019-3722 | High | 7.5 | 2019-06-06 | Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A… |
CVE-2019-10327 | High | 8.1 | 2019-05-31 | An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary direc… |
CVE-2019-9670 | Critical | 9.8 | 2019-05-29 | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Au… |
CVE-2018-20160 | Critical | 9.8 | 2019-05-29 | ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks… |
CVE-2019-0188 | High | 7.5 | 2019-05-28 | Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This… |
CVE-2018-8940 | Critical | 9.8 | 2019-05-14 | ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsing them, allowing an… |
CVE-2019-7442 | Critical | 9.8 | 2019-05-08 | An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read… |
CVE-2019-4208 | High | 7.1 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2018-14485 | Critical | 9.8 | 2019-05-07 | BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd. |
CVE-2019-11677 | Critical | 9.8 | 2019-05-02 | The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. |
CVE-2019-10309 | Critical | 9.3 | 2019-04-30 | Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing… |
CVE-2019-11519 | Medium | 4.9 | 2019-04-25 | Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Impo… |
CVE-2018-17169 | High | 7.7 | 2019-04-23 | An XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-sid… |
CVE-2018-17289 | Medium | 6.5 | 2019-04-18 | An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to rea… |
CVE-2019-8999 | High | 7.5 | 2019-04-18 | An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access… |
CVE-2019-0228 | Critical | 9.8 | 2019-04-17 | Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a c… |
CVE-2019-0284 | Medium | 6.0 | 2019-04-10 | SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can ca… |
CVE-2019-0795 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0793 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0792 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0791 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0790 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-10244 | High | 7.5 | 2019-04-09 | In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part… |
CVE-2019-0756 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2018-20222 | Critical | 9.8 | 2019-04-04 | XXE issue in Airsonic before 10.1.2 during parse. |
CVE-2019-4043 | High | 7.1 | 2019-04-02 | IBM Sterling B2B Integrator Standard Edition 5.2.0 snf 6.0.0.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remot… |
CVE-2017-18111 | High | 8.7 | 2019-03-29 | The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used… |
CVE-2017-18110 | Medium | 6.5 | 2019-03-29 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read… |
CVE-2019-3481 | High | 7.1 | 2019-03-25 | Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7. |
CVE-2017-9362 | High | 8.8 | 2019-03-25 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. |
CVE-2019-8997 | Medium | 5.9 | 2019-03-21 | An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an att… |
CVE-2019-9761 | High | 7.5 | 2019-03-14 | An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs be… |
CVE-2019-5918 | Critical | 9.1 | 2019-03-12 | Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2019-0277 | Medium | 6.5 | 2019-03-12 | SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privil… |
CVE-2019-9658 | Medium | 5.3 | 2019-03-11 | Checkstyle before 8.18 loads external DTDs by default. |
CVE-2019-1698 | Medium | 4.9 | 2019-02-21 | A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote atta… |
CVE-2018-1727 | High | 7.1 | 2019-02-15 | IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote at… |
CVE-2019-0265 | Medium | 4.9 | 2019-02-15 | SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in… |
CVE-2019-7722 | High | 8.1 | 2019-02-11 | PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by di… |
CVE-2019-1003015 | Critical | 9.1 | 2019-02-06 | An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/Re… |
CVE-2018-1970 | High | 7.1 | 2019-02-04 | IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2018-1801 | Medium | 5.3 | 2019-02-04 | IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Me… |
CVE-2018-19858 | High | 8.6 | 2019-01-30 | PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities. If an attacker passes HTML referencing an XML f… |
CVE-2019-3774 | Critical | 9.8 | 2019-01-18 | Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from… |
CVE-2019-3773 | Critical | 9.8 | 2019-01-18 | Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when… |
CVE-2019-3772 | Critical | 9.8 | 2019-01-18 | Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible… |
CVE-2018-20233 | Medium | 6.5 | 2019-01-18 | The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to rea… |
CVE-2018-2019 | High | 7.1 | 2019-01-18 | IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2018-20733 | High | 7.5 | 2019-01-17 | BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE. |
CVE-2015-9280 | Critical | 10.0 | 2019-01-16 | MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter. |
CVE-2018-16166 | High | 8.8 | 2019-01-09 | LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2019-5748 | Critical | 9.8 | 2019-01-09 | In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks. |
CVE-2018-11788 | Critical | 9.8 | 2019-01-07 | Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features X… |
CVE-2019-5312 | Critical | 9.8 | 2019-01-04 | An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue e… |
CVE-2018-20664 | Critical | 9.8 | 2019-01-03 | Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license. |
CVE-2018-19371 | Medium | 6.5 | 2019-01-02 | The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system. |
CVE-2018-14720 | Critical | 9.8 | 2019-01-02 | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK c… |
CVE-2018-1000889 | High | 8.8 | 2018-12-28 | Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/… |
CVE-2018-7837 | High | 7.5 | 2018-12-24 | An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow… |
CVE-2018-20433 | Critical | 9.8 | 2018-12-24 | c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization. |
CVE-2018-20318 | Critical | 9.8 | 2018-12-21 | An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. |
CVE-2018-17247 | Medium | 5.9 | 2018-12-20 | Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access… |
CVE-2018-1000844 | Critical | 9.1 | 2018-12-20 | Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that ca… |
CVE-2018-1000840 | Medium | 6.5 | 2018-12-20 | Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacke… |
CVE-2018-1000838 | Critical | 10.0 | 2018-12-20 | autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, deni… |
CVE-2018-1000837 | Critical | 10.0 | 2018-12-20 | UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data… |
CVE-2018-1000836 | Critical | 9.0 | 2018-12-20 | bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Dis… |
CVE-2018-1000835 | Critical | 10.0 | 2018-12-20 | KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, d… |
CVE-2018-1000834 | Critical | 9.0 | 2018-12-20 | runelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call that can result in Di… |
CVE-2018-1000831 | Critical | 10.0 | 2018-12-20 | K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denia… |
CVE-2018-1000830 | Critical | 10.0 | 2018-12-20 | XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confidential data, denial of… |
CVE-2018-1000829 | Critical | 9.0 | 2018-12-20 | Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can result in Disclosure of… |
CVE-2018-1000828 | Critical | 9.0 | 2018-12-20 | FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Dis… |
CVE-2018-1000825 | Critical | 10.0 | 2018-12-20 | FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidenti… |
CVE-2018-1000823 | Critical | 10.0 | 2018-12-20 | exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data… |
CVE-2018-1000822 | Critical | 10.0 | 2018-12-20 | codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confiden… |
CVE-2018-1000821 | Critical | 10.0 | 2018-12-20 | MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confide… |
CVE-2018-1000820 | Critical | 10.0 | 2018-12-20 | neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosur… |
CVE-2018-20298 | Medium | 6.5 | 2018-12-19 | S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by… |
CVE-2018-20157 | High | 7.5 | 2018-12-15 | The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arb… |
CVE-2018-1821 | High | 7.1 | 2018-12-13 | IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remot… |
CVE-2018-2492 | High | 7.1 | 2018-12-11 | SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2… |
CVE-2018-20059 | Critical | 9.8 | 2018-12-11 | jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE. |
CVE-2018-15805 | Critical | 9.1 | 2018-12-10 | Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE) vulnerability, allowing an attacker to read arbitrary files or cause… |
CVE-2018-20000 | High | 7.5 | 2018-12-10 | Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/commo… |
CVE-2018-7063 | High | 8.1 | 2018-12-07 | In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may… |
CVE-2018-1920 | High | 7.1 | 2018-12-07 | IBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex… |
CVE-2018-1424 | High | 7.1 | 2018-12-07 | IBM Marketing Platform 9.1.0, 9.1.2, and 10.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could e… |
CVE-2018-15362 | Critical | 9.1 | 2018-12-07 | XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0 |
CVE-2018-16792 | Critical | 9.1 | 2018-12-05 | SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate d… |
CVE-2018-1730 | High | 7.1 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulner… |
CVE-2018-1905 | High | 7.1 | 2018-11-26 | IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2018-19244 | High | 8.6 | 2018-11-13 | An XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an atta… |
CVE-2018-15444 | Medium | 6.3 | 2018-11-08 | A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write… |
CVE-2018-17186 | High | 7.2 | 2018-11-06 | An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and cod… |
CVE-2018-18980 | High | 7.5 | 2018-11-06 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML… |
CVE-2018-1846 | High | 7.1 | 2018-11-02 | IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection (XXE) attack when processi… |