CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 11)
Page 11 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1835 | High | 7.1 | 2018-11-02 | IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2018-17912 | High | 7.5 | 2018-11-02 | An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosure. |
CVE-2018-18737 | High | 7.5 | 2018-10-29 | An XXE issue was discovered in Douchat 4.0.4 because Data\notify.php calls simplexml_load_string. This can also be used for SSRF. |
CVE-2018-18659 | High | 7.5 | 2018-10-26 | An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpSe… |
CVE-2018-1747 | High | 7.1 | 2018-10-15 | IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote atta… |
CVE-2018-1844 | High | 7.1 | 2018-10-12 | IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp… |
CVE-2018-12544 | Critical | 9.8 | 2018-10-10 | In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks… |
CVE-2018-8533 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an… |
CVE-2018-8532 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an… |
CVE-2018-8527 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an… |
CVE-2018-8494 | High | 8.8 | 2018-10-10 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerab… |
CVE-2018-11796 | High | 7.5 | 2018-10-09 | In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, w… |
CVE-2018-10614 | High | 8.8 | 2018-10-09 | An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project XML files. |
CVE-2018-17889 | Medium | 5.3 | 2018-10-08 | In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the XMLParser that shi… |
CVE-2018-0414 | Medium | 5.7 | 2018-10-05 | A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain informat… |
CVE-2018-12471 | Medium | 6.5 | 2018-10-04 | A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking e… |
CVE-2018-1702 | High | 7.1 | 2018-09-28 | IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (XXE) attack when… |
CVE-2018-17411 | Critical | 9.8 | 2018-09-26 | An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20. |
CVE-2018-15531 | Critical | 9.8 | 2018-09-26 | JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java. |
CVE-2018-1669 | High | 7.1 | 2018-09-25 | IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM… |
CVE-2018-1607 | High | 7.1 | 2018-09-25 | IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing… |
CVE-2018-1588 | High | 7.1 | 2018-09-25 | IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6) is vulnerable to a XML External Entity Injection (XXE)… |
CVE-2018-12243 | High | 8.8 | 2018-09-19 | The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input cont… |
CVE-2018-11761 | High | 7.5 | 2018-09-19 | In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability… |
CVE-2018-12585 | High | 8.2 | 2018-09-14 | An XXE vulnerability in the OPC UA Java and .NET Legacy Stack can allow remote attackers to trigger a denial of service. |
CVE-2018-8420 | High | 8.8 | 2018-09-13 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerab… |
CVE-2018-16252 | Low | 3.3 | 2018-09-05 | FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection. |
CVE-2018-16521 | Critical | 9.8 | 2018-09-05 | An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0. |
CVE-2018-16303 | High | 7.5 | 2018-09-01 | PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related i… |
CVE-2018-11719 | Medium | 4.9 | 2018-08-30 | Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE. |
CVE-2018-13826 | Critical | 9.1 | 2018-08-30 | An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote… |
CVE-2018-13823 | High | 7.5 | 2018-08-30 | An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote… |
CVE-2017-17762 | High | 7.5 | 2018-08-29 | XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request… |
CVE-2018-11758 | High | 8.1 | 2018-08-22 | This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apa… |
CVE-2018-1000652 | Critical | 10.0 | 2018-08-20 | JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denia… |
CVE-2018-1000651 | Critical | 10.0 | 2018-08-20 | Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, s… |
CVE-2018-1000644 | Critical | 10.0 | 2018-08-20 | Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the discl… |
CVE-2018-1000639 | Critical | 9.6 | 2018-08-20 | LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side requ… |
CVE-2018-13417 | Critical | 9.8 | 2018-08-13 | In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote… |
CVE-2018-13415 | Critical | 9.8 | 2018-08-13 | In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, u… |
CVE-2018-11048 | High | 8.1 | 2018-08-10 | Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External… |
CVE-2018-12408 | High | 7.5 | 2018-08-08 | The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMat… |
CVE-2016-8526 | High | 8.8 | 2018-08-06 | Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access st… |
CVE-2018-14473 | Critical | 9.1 | 2018-08-04 | OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a craft… |
CVE-2018-13416 | Critical | 9.8 | 2018-08-03 | In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remo… |
CVE-2017-8316 | High | 7.5 | 2018-08-03 | IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both A… |
CVE-2017-16349 | High | 8.1 | 2018-08-02 | An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external en… |
CVE-2018-3881 | Critical | 9.4 | 2018-08-01 | An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially cra… |
CVE-2018-8027 | Critical | 9.8 | 2018-07-31 | Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor. |
CVE-2017-7464 | High | 8.7 | 2018-07-27 | It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to… |
CVE-2017-7545 | Medium | 6.5 | 2018-07-26 | It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker co… |
CVE-2018-10600 | Critical | 9.8 | 2018-07-24 | SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbit… |
CVE-2014-2296 | High | 8.8 | 2018-07-20 | XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Acc… |
CVE-2018-14065 | Critical | 9.8 | 2018-07-15 | XMLReader.php in PHPOffice Common before 0.2.9 allows XXE. |
CVE-2016-9491 | Medium | 4.9 | 2018-07-13 | ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to ad… |
CVE-2016-9487 | High | 7.8 | 2018-07-13 | EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially c… |
CVE-2018-12463 | Critical | 9.8 | 2018-07-12 | An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbi… |
CVE-2018-1000616 | Critical | 9.8 | 2018-07-09 | ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\driv… |
CVE-2018-1000614 | Critical | 9.8 | 2018-07-09 | ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/pro… |
CVE-2018-13439 | High | 7.5 | 2018-07-08 | WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL. |
CVE-2018-1542 | High | 7.1 | 2018-07-06 | IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine (ACCE) 5.2.1 and 5.5.0 are vuln… |
CVE-2018-8026 | Medium | 5.5 | 2018-07-05 | This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enums… |
CVE-2018-11640 | Critical | 9.1 | 2018-07-03 | XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitrary files or cause a… |
CVE-2018-7783 | High | 7.5 | 2018-07-03 | Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulti… |
CVE-2017-7465 | Critical | 9.0 | 2018-06-27 | It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause r… |
CVE-2018-1000548 | High | 7.8 | 2018-06-26 | Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data, denial of service… |
CVE-2018-1000546 | High | 7.8 | 2018-06-26 | Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible information disclosure… |
CVE-2018-1000542 | High | 7.8 | 2018-06-26 | netbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible information disclosure… |
CVE-2018-1000540 | High | 7.8 | 2018-06-26 | LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when viewing the XML file in… |
CVE-2018-1000515 | High | 7.5 | 2018-06-26 | ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that ca… |
CVE-2018-8819 | High | 7.5 | 2018-06-14 | An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5. An unauthenticated attacker could enter malicious input to… |
CVE-2018-5434 | Medium | 5.8 | 2018-06-13 | The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious use… |
CVE-2018-5433 | Medium | 6.5 | 2018-06-13 | The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/… |
CVE-2017-3208 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML do… |
CVE-2017-3206 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML docum… |
CVE-2018-6670 | High | 7.6 | 2018-06-07 | External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information vi… |
CVE-2018-1456 | High | 7.1 | 2018-06-06 | IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attack… |
CVE-2018-11586 | Critical | 9.8 | 2018-06-05 | XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-si… |
CVE-2018-1000198 | Medium | 6.5 | 2018-06-05 | A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers wi… |
CVE-2018-10613 | High | 7.5 | 2018-06-04 | Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and MDS PulseNET Enterp… |
CVE-2018-10653 | Critical | 9.8 | 2018-05-23 | There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-1309 | Critical | 9.8 | 2018-05-23 | Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disa… |
CVE-2018-8010 | Medium | 5.5 | 2018-05-21 | This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema… |
CVE-2018-4942 | High | 7.5 | 2018-05-19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerab… |
CVE-2017-2815 | High | 8.1 | 2018-05-15 | An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval o… |
CVE-2018-10832 | Medium | 5.5 | 2018-05-11 | ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML… |
CVE-2018-1259 | High | 7.5 | 2018-05-11 | Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property bi… |
CVE-2018-0765 | High | 7.5 | 2018-05-09 | A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." Th… |
CVE-2018-1247 | High | 7.1 | 2018-05-08 | RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin us… |
CVE-2018-1183 | Critical | 9.8 | 2018-04-30 | In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VA… |
CVE-2017-15691 | Medium | 6.5 | 2018-04-26 | In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC pri… |
CVE-2018-10175 | Medium | 6.5 | 2018-04-20 | Digital Guardian Management Console 7.1.2.0015 has an XXE issue. |
CVE-2018-10077 | Medium | 4.9 | 2018-04-20 | XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data. |
CVE-2014-0950 | High | 7.1 | 2018-04-20 | Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, and (4) ClearQuest Ec… |
CVE-2014-0931 | Critical | 9.1 | 2018-04-20 | Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2) Perl CC/CQ integration trigger scripts, (3) CMAPI Java interface… |
CVE-2017-8315 | High | 7.5 | 2018-04-20 | Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnera… |
CVE-2017-6323 | High | 8.0 | 2018-04-16 | The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an ext… |
CVE-2018-1308 | High | 7.5 | 2018-04-09 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter… |
CVE-2018-1421 | High | 7.1 | 2018-04-04 | IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2018-9116 | Critical | 9.1 | 2018-03-29 | An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause… |