CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 10)
Page 10 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14276 | Medium | 6.5 | 2019-10-23 | WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body. |
CVE-2019-1060 | High | 8.8 | 2019-10-10 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-12711 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-16188 | High | 7.1 | 2019-09-25 | HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can send a specially cr… |
CVE-2019-9488 | Medium | 4.9 | 2019-09-11 | Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be… |
CVE-2019-16174 | High | 8.8 | 2019-09-09 | An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or co… |
CVE-2019-6179 | High | 7.5 | 2019-09-03 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator… |
CVE-2019-13608 | High | 7.5 | 2019-08-29 | Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. |
CVE-2019-15641 | Medium | 6.5 | 2019-08-26 | xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi. |
CVE-2019-15637 | High | 8.1 | 2019-08-26 | Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects T… |
CVE-2019-4513 | High | 8.2 | 2019-08-26 | IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remo… |
CVE-2019-14258 | High | 7.5 | 2019-08-21 | The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988. |
CVE-2019-4424 | High | 8.2 | 2019-08-20 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when proce… |
CVE-2019-4340 | High | 8.2 | 2019-08-20 | IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote atta… |
CVE-2019-4433 | High | 8.2 | 2019-08-20 | IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attac… |
CVE-2019-4419 | High | 8.2 | 2019-08-20 | IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2019-1187 | Medium | 5.5 | 2019-08-14 | A denial of service vulnerability exists when the XmlLite runtime (XmlLite.dll) improperly parses XML input. An attacker who successfully exploited this vulner… |
CVE-2019-1057 | High | 7.5 | 2019-08-14 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the… |
CVE-2019-0340 | Medium | 5.4 | 2019-08-14 | The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. T… |
CVE-2019-14693 | High | 8.5 | 2019-08-08 | Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could… |
CVE-2019-13176 | High | 7.5 | 2019-08-08 | An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XX… |
CVE-2018-14383 | High | 7.5 | 2019-08-07 | The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2… |
CVE-2017-18438 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). |
CVE-2019-4456 | High | 7.1 | 2019-07-30 | IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A r… |
CVE-2019-4062 | High | 7.1 | 2019-07-30 | IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2019-10266 | High | 7.5 | 2019-07-26 | An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file struc… |
CVE-2019-10264 | High | 7.2 | 2019-07-26 | An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Impor… |
CVE-2019-13990 | Critical | 9.8 | 2019-07-26 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. |
CVE-2019-10976 | Medium | 5.5 | 2019-07-26 | Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsi… |
CVE-2019-2861 | Medium | 4.2 | 2019-07-23 | Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Diffic… |
CVE-2019-1010202 | Medium | 6.5 | 2019-07-23 | Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/ma… |
CVE-2019-7847 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successfu… |
CVE-2019-1010268 | Critical | 9.8 | 2019-07-18 | Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading fi… |
CVE-2019-13625 | Critical | 9.1 | 2019-07-17 | NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file. |
CVE-2018-17152 | Medium | 6.4 | 2019-07-11 | Intersystems Cache 2017.2.2.865.0 allows XXE. |
CVE-2019-12924 | Critical | 9.8 | 2019-07-08 | MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was po… |
CVE-2019-13358 | High | 7.5 | 2019-07-05 | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a… |
CVE-2015-3907 | Critical | 9.8 | 2019-07-03 | CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks. |
CVE-2019-13031 | High | 8.1 | 2019-06-28 | LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification serv… |
CVE-2019-9843 | High | 7.5 | 2019-06-28 | In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP… |
CVE-2018-20843 | High | 7.5 | 2019-06-24 | In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM a… |
CVE-2019-11392 | High | 7.5 | 2019-06-21 | BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd. |
CVE-2019-10718 | High | 7.5 | 2019-06-21 | BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs. |
CVE-2019-1903 | Medium | 6.5 | 2019-06-20 | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) co… |
CVE-2018-15506 | Critical | 9.8 | 2019-06-19 | In BubbleUPnP 0.9 update 30, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauth… |
CVE-2018-18471 | Critical | 9.8 | 2019-06-19 | /api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chaine… |
CVE-2018-18406 | Critical | 9.9 | 2019-06-19 | An issue was discovered in Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final). The Audit Report module is affected by a blind XXE vulnerability when a… |
CVE-2018-1845 | High | 7.1 | 2019-06-17 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacke… |
CVE-2019-0948 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an exte… |
CVE-2019-12154 | Critical | 9.1 | 2019-06-11 | XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources… |
CVE-2019-10337 | High | 7.5 | 2019-06-11 | An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file fo… |
CVE-2019-3722 | High | 7.5 | 2019-06-06 | Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A… |
CVE-2019-10327 | High | 8.1 | 2019-05-31 | An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary direc… |
CVE-2019-9670 | Critical | 9.8 | 2019-05-29 | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Au… |
CVE-2018-20160 | Critical | 9.8 | 2019-05-29 | ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks… |
CVE-2019-0188 | High | 7.5 | 2019-05-28 | Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This… |
CVE-2018-8940 | Critical | 9.8 | 2019-05-14 | ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsing them, allowing an… |
CVE-2019-7442 | Critical | 9.8 | 2019-05-08 | An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read… |
CVE-2019-4208 | High | 7.1 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2018-14485 | Critical | 9.8 | 2019-05-07 | BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd. |
CVE-2019-11677 | Critical | 9.8 | 2019-05-02 | The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. |
CVE-2019-10309 | Critical | 9.3 | 2019-04-30 | Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing… |
CVE-2019-11519 | Medium | 4.9 | 2019-04-25 | Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Impo… |
CVE-2018-17169 | High | 7.7 | 2019-04-23 | An XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-sid… |
CVE-2018-17289 | Medium | 6.5 | 2019-04-18 | An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to rea… |
CVE-2019-8999 | High | 7.5 | 2019-04-18 | An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access… |
CVE-2019-0228 | Critical | 9.8 | 2019-04-17 | Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a c… |
CVE-2019-0284 | Medium | 6.0 | 2019-04-10 | SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can ca… |
CVE-2019-0795 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0793 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0792 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0791 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0790 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-10244 | High | 7.5 | 2019-04-09 | In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part… |
CVE-2019-0756 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2018-20222 | Critical | 9.8 | 2019-04-04 | XXE issue in Airsonic before 10.1.2 during parse. |
CVE-2019-4043 | High | 7.1 | 2019-04-02 | IBM Sterling B2B Integrator Standard Edition 5.2.0 snf 6.0.0.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remot… |
CVE-2017-18111 | High | 8.7 | 2019-03-29 | The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used… |
CVE-2017-18110 | Medium | 6.5 | 2019-03-29 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read… |
CVE-2019-3481 | High | 7.1 | 2019-03-25 | Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7. |
CVE-2017-9362 | High | 8.8 | 2019-03-25 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. |
CVE-2019-8997 | Medium | 5.9 | 2019-03-21 | An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an att… |
CVE-2019-9761 | High | 7.5 | 2019-03-14 | An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs be… |
CVE-2019-5918 | Critical | 9.1 | 2019-03-12 | Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2019-0277 | Medium | 6.5 | 2019-03-12 | SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privil… |
CVE-2019-9658 | Medium | 5.3 | 2019-03-11 | Checkstyle before 8.18 loads external DTDs by default. |
CVE-2019-1698 | Medium | 4.9 | 2019-02-21 | A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote atta… |
CVE-2018-1727 | High | 7.1 | 2019-02-15 | IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote at… |
CVE-2019-0265 | Medium | 4.9 | 2019-02-15 | SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in… |
CVE-2019-7722 | High | 8.1 | 2019-02-11 | PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by di… |
CVE-2019-1003015 | Critical | 9.1 | 2019-02-06 | An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/Re… |
CVE-2018-1970 | High | 7.1 | 2019-02-04 | IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2018-1801 | Medium | 5.3 | 2019-02-04 | IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Me… |
CVE-2018-19858 | High | 8.6 | 2019-01-30 | PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities. If an attacker passes HTML referencing an XML f… |
CVE-2019-3774 | Critical | 9.8 | 2019-01-18 | Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from… |
CVE-2019-3773 | Critical | 9.8 | 2019-01-18 | Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when… |
CVE-2019-3772 | Critical | 9.8 | 2019-01-18 | Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible… |
CVE-2018-20233 | Medium | 6.5 | 2019-01-18 | The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to rea… |
CVE-2018-2019 | High | 7.1 | 2019-01-18 | IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2018-20733 | High | 7.5 | 2019-01-17 | BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE. |