CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 12)
Page 12 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-7461 | Medium | 6.5 | 2018-03-20 | XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denia… |
CVE-2014-3990 | Critical | 9.8 | 2018-03-20 | The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) a… |
CVE-2018-6225 | Medium | 4.3 | 2018-03-15 | An XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protect… |
CVE-2018-2401 | Medium | 5.4 | 2018-03-14 | SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External… |
CVE-2018-1077 | High | 7.5 | 2018-03-14 | Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server. |
CVE-2018-0878 | Low | 3.1 | 2018-03-14 | Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2018-1000124 | Critical | 10.0 | 2018-03-13 | I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) tha… |
CVE-2018-1000090 | High | 7.5 | 2018-03-13 | textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web serve… |
CVE-2018-1000069 | Medium | 5.5 | 2018-03-13 | FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from vi… |
CVE-2018-5758 | Medium | 6.5 | 2018-03-12 | The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing… |
CVE-2016-0250 | Medium | 5.4 | 2018-03-12 | XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authentica… |
CVE-2018-7230 | High | 8.8 | 2018-03-09 | A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all f… |
CVE-2016-0268 | Medium | 4.3 | 2018-03-09 | XML external entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Finan… |
CVE-2018-0218 | Low | 3.3 | 2018-03-08 | A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker… |
CVE-2018-0207 | Low | 3.3 | 2018-03-08 | A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker… |
CVE-2017-7426 | Medium | 5.4 | 2018-03-01 | The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak informat… |
CVE-2017-18197 | Critical | 9.8 | 2018-02-24 | In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attack… |
CVE-2018-6489 | Critical | 9.8 | 2018-02-22 | XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML… |
CVE-2017-1758 | High | 7.1 | 2018-02-21 | IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, a… |
CVE-2016-0369 | Low | 2.7 | 2018-02-21 | XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information v… |
CVE-2017-7375 | Critical | 9.8 | 2018-02-19 | A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, exte… |
CVE-2017-5828 | High | 8.1 | 2018-02-15 | An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found. |
CVE-2018-2393 | High | 7.5 | 2018-02-14 | Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA… |
CVE-2018-2392 | High | 7.5 | 2018-02-14 | Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA… |
CVE-2018-1000056 | High | 8.3 | 2018-02-09 | Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions… |
CVE-2018-1000055 | High | 8.3 | 2018-02-09 | Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permi… |
CVE-2018-1000054 | High | 8.3 | 2018-02-09 | Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in… |
CVE-2018-3600 | Medium | 6.5 | 2018-02-09 | A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive… |
CVE-2018-1307 | High | 8.1 | 2018-02-09 | In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structure… |
CVE-2018-5789 | High | 7.5 | 2018-02-05 | An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is a Remote, Unauthenticated XML Entity Exp… |
CVE-2018-6486 | High | 7.3 | 2018-02-02 | XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16… |
CVE-2014-3244 | Critical | 9.8 | 2018-02-01 | XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially exec… |
CVE-2014-3005 | Critical | 9.8 | 2018-02-01 | XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote a… |
CVE-2018-1364 | High | 8.2 | 2018-01-29 | IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this… |
CVE-2017-14699 | Medium | 6.5 | 2018-01-29 | Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_… |
CVE-2018-1000012 | High | 8.8 | 2018-01-23 | Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissi… |
CVE-2018-1000011 | High | 8.8 | 2018-01-23 | Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissi… |
CVE-2018-1000010 | High | 8.8 | 2018-01-23 | Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions i… |
CVE-2018-1000009 | High | 8.8 | 2018-01-23 | Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permis… |
CVE-2018-1000008 | High | 8.8 | 2018-01-23 | Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions i… |
CVE-2018-0108 | Medium | 5.3 | 2018-01-18 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity… |
CVE-2018-0100 | Medium | 4.4 | 2018-01-18 | A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write acce… |
CVE-2016-0219 | Medium | 6.5 | 2018-01-16 | XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15… |
CVE-2017-1666 | High | 8.1 | 2018-01-09 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker co… |
CVE-2017-1000477 | High | 7.5 | 2018-01-03 | XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks. |
CVE-2017-1000498 | High | 7.8 | 2018-01-03 | AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution |
CVE-2017-1000497 | Critical | 9.8 | 2018-01-03 | Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution |
CVE-2017-1000496 | High | 8.8 | 2018-01-03 | Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of cod… |
CVE-2014-3630 | Critical | 9.8 | 2017-12-29 | XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to re… |
CVE-2017-14101 | Critical | 9.8 | 2017-12-15 | A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical… |
CVE-2017-11286 | High | 7.5 | 2017-12-01 | Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and ea… |
CVE-2017-14949 | High | 7.5 | 2017-11-30 | Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only… |
CVE-2017-14868 | High | 7.5 | 2017-11-30 | Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request… |
CVE-2017-1000190 | Critical | 9.1 | 2017-11-17 | SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on. |
CVE-2017-10889 | Medium | 4.3 | 2017-11-17 | TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2017-1477 | High | 8.1 | 2017-11-13 | IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp… |
CVE-2017-9096 | High | 8.8 | 2017-11-08 | The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity… |
CVE-2014-3600 | Critical | 9.8 | 2017-10-27 | XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath… |
CVE-2014-3579 | Critical | 9.8 | 2017-10-27 | XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an… |
CVE-2016-5002 | High | 7.8 | 2017-10-27 | XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct serv… |
CVE-2017-15639 | Medium | 6.5 | 2017-10-19 | tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature. |
CVE-2014-9487 | Critical | 9.8 | 2017-10-17 | The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possi… |
CVE-2017-12629 | Critical | 9.8 | 2017-10-14 | Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener com… |
CVE-2017-10617 | Medium | 5.0 | 2017-10-13 | The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files… |
CVE-2017-15280 | Medium | 5.5 | 2017-10-12 | XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending… |
CVE-2017-12623 | Medium | 6.5 | 2017-10-10 | An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to prop… |
CVE-2017-13706 | Critical | 9.9 | 2017-10-10 | XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticate… |
CVE-2014-0030 | Critical | 9.8 | 2017-10-10 | The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2017-14759 | Critical | 9.8 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML… |
CVE-2017-12620 | Critical | 9.8 | 2017-10-03 | When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications… |
CVE-2016-4434 | High | 7.8 | 2017-09-30 | Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE)… |
CVE-2017-14527 | High | 8.8 | 2017-09-28 | Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arb… |
CVE-2017-14526 | High | 8.8 | 2017-09-28 | Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents… |
CVE-2017-12621 | Critical | 9.8 | 2017-09-28 | During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the bod… |
CVE-2017-1527 | High | 8.1 | 2017-09-26 | IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could… |
CVE-2017-8710 | Medium | 5.5 | 2017-09-13 | The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an X… |
CVE-2017-8918 | Medium | 5.5 | 2017-09-12 | XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template… |
CVE-2017-8040 | Medium | 6.5 | 2017-09-09 | In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was disc… |
CVE-2017-9095 | Medium | 5.5 | 2017-09-08 | XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import. |
CVE-2017-12216 | High | 8.8 | 2017-09-07 | A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to informati… |
CVE-2017-9458 | Critical | 9.8 | 2017-09-07 | XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7… |
CVE-2015-7241 | Critical | 9.8 | 2017-09-06 | XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. |
CVE-2015-3160 | Medium | 4.3 | 2017-09-06 | XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submi… |
CVE-2017-1458 | High | 8.1 | 2017-09-05 | IBM QRadar Network Security 5.4 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vu… |
CVE-2016-5795 | High | 7.3 | 2017-08-31 | An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-V… |
CVE-2017-12069 | High | 8.2 | 2017-08-30 | An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the af… |
CVE-2017-11272 | High | 7.5 | 2017-08-11 | Adobe Digital Editions 4.5.4 and earlier has a security bypass vulnerability. |
CVE-2016-8739 | High | 7.5 | 2017-08-10 | The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera P… |
CVE-2017-1192 | High | 8.2 | 2017-08-10 | IBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this v… |
CVE-2010-2245 | High | 7.4 | 2017-08-08 | XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a cra… |
CVE-2017-11390 | High | 7.5 | 2017-08-02 | XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-470… |
CVE-2015-0194 | Medium | 6.5 | 2017-08-02 | XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read ar… |
CVE-2017-1383 | Critical | 9.1 | 2017-08-02 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2017-9233 | High | 7.5 | 2017-07-25 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malfo… |
CVE-2017-11457 | Medium | 6.5 | 2017-07-25 | XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct… |
CVE-2017-1219 | Medium | 6.5 | 2017-07-19 | IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulner… |
CVE-2016-6798 | Critical | 9.8 | 2017-07-19 | In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which al… |
CVE-2017-7664 | Critical | 10.0 | 2017-07-17 | Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. |
CVE-2017-1000061 | High | 7.1 | 2017-07-17 | xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or d… |
CVE-2017-1000021 | High | 8.8 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. |