CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 12)
Page 12 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-2296 | High | 8.8 | 2018-07-20 | XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Acc… |
CVE-2018-14065 | Critical | 9.8 | 2018-07-15 | XMLReader.php in PHPOffice Common before 0.2.9 allows XXE. |
CVE-2016-9491 | Medium | 4.9 | 2018-07-13 | ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to ad… |
CVE-2016-9487 | High | 7.8 | 2018-07-13 | EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially c… |
CVE-2018-12463 | Critical | 9.8 | 2018-07-12 | An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbi… |
CVE-2018-1000616 | Critical | 9.8 | 2018-07-09 | ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\driv… |
CVE-2018-1000614 | Critical | 9.8 | 2018-07-09 | ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/pro… |
CVE-2018-13439 | High | 7.5 | 2018-07-08 | WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL. |
CVE-2018-1542 | High | 7.1 | 2018-07-06 | IBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration Console for Content Platform Engine (ACCE) 5.2.1 and 5.5.0 are vuln… |
CVE-2018-8026 | Medium | 5.5 | 2018-07-05 | This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enums… |
CVE-2018-11640 | Critical | 9.1 | 2018-07-03 | XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitrary files or cause a… |
CVE-2018-7783 | High | 7.5 | 2018-07-03 | Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulti… |
CVE-2017-7465 | Critical | 9.0 | 2018-06-27 | It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause r… |
CVE-2018-1000548 | High | 7.8 | 2018-06-26 | Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data, denial of service… |
CVE-2018-1000546 | High | 7.8 | 2018-06-26 | Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible information disclosure… |
CVE-2018-1000542 | High | 7.8 | 2018-06-26 | netbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible information disclosure… |
CVE-2018-1000540 | High | 7.8 | 2018-06-26 | LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when viewing the XML file in… |
CVE-2018-1000515 | High | 7.5 | 2018-06-26 | ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that ca… |
CVE-2018-8819 | High | 7.5 | 2018-06-14 | An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5. An unauthenticated attacker could enter malicious input to… |
CVE-2018-5434 | Medium | 5.8 | 2018-06-13 | The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious use… |
CVE-2018-5433 | Medium | 6.5 | 2018-06-13 | The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/… |
CVE-2017-3208 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML do… |
CVE-2017-3206 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML docum… |
CVE-2018-6670 | High | 7.6 | 2018-06-07 | External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information vi… |
CVE-2018-1456 | High | 7.1 | 2018-06-06 | IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attack… |
CVE-2018-11586 | Critical | 9.8 | 2018-06-05 | XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-si… |
CVE-2018-1000198 | Medium | 6.5 | 2018-06-05 | A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers wi… |
CVE-2018-10613 | High | 7.5 | 2018-06-04 | Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and MDS PulseNET Enterp… |
CVE-2018-10653 | Critical | 9.8 | 2018-05-23 | There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-1309 | Critical | 9.8 | 2018-05-23 | Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disa… |
CVE-2018-8010 | Medium | 5.5 | 2018-05-21 | This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema… |
CVE-2018-4942 | High | 7.5 | 2018-05-19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerab… |
CVE-2017-2815 | High | 8.1 | 2018-05-15 | An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval o… |
CVE-2018-10832 | Medium | 5.5 | 2018-05-11 | ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML… |
CVE-2018-1259 | High | 7.5 | 2018-05-11 | Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property bi… |
CVE-2018-0765 | High | 7.5 | 2018-05-09 | A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." Th… |
CVE-2018-1247 | High | 7.1 | 2018-05-08 | RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin us… |
CVE-2018-1183 | Critical | 9.8 | 2018-04-30 | In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VA… |
CVE-2017-15691 | Medium | 6.5 | 2018-04-26 | In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC pri… |
CVE-2018-10175 | Medium | 6.5 | 2018-04-20 | Digital Guardian Management Console 7.1.2.0015 has an XXE issue. |
CVE-2018-10077 | Medium | 4.9 | 2018-04-20 | XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data. |
CVE-2014-0950 | High | 7.1 | 2018-04-20 | Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, and (4) ClearQuest Ec… |
CVE-2014-0931 | Critical | 9.1 | 2018-04-20 | Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2) Perl CC/CQ integration trigger scripts, (3) CMAPI Java interface… |
CVE-2017-8315 | High | 7.5 | 2018-04-20 | Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnera… |
CVE-2017-6323 | High | 8.0 | 2018-04-16 | The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an ext… |
CVE-2018-1308 | High | 7.5 | 2018-04-09 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter… |
CVE-2018-1421 | High | 7.1 | 2018-04-04 | IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2018-9116 | Critical | 9.1 | 2018-03-29 | An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause… |
CVE-2015-7461 | Medium | 6.5 | 2018-03-20 | XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denia… |
CVE-2014-3990 | Critical | 9.8 | 2018-03-20 | The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) a… |
CVE-2018-6225 | Medium | 4.3 | 2018-03-15 | An XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protect… |
CVE-2018-2401 | Medium | 5.4 | 2018-03-14 | SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External… |
CVE-2018-1077 | High | 7.5 | 2018-03-14 | Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server. |
CVE-2018-0878 | Low | 3.1 | 2018-03-14 | Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2018-1000124 | Critical | 10.0 | 2018-03-13 | I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) tha… |
CVE-2018-1000090 | High | 7.5 | 2018-03-13 | textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web serve… |
CVE-2018-1000069 | Medium | 5.5 | 2018-03-13 | FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from vi… |
CVE-2018-5758 | Medium | 6.5 | 2018-03-12 | The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing… |
CVE-2016-0250 | Medium | 5.4 | 2018-03-12 | XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authentica… |
CVE-2018-7230 | High | 8.8 | 2018-03-09 | A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all f… |
CVE-2016-0268 | Medium | 4.3 | 2018-03-09 | XML external entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Finan… |
CVE-2018-0218 | Low | 3.3 | 2018-03-08 | A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker… |
CVE-2018-0207 | Low | 3.3 | 2018-03-08 | A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker… |
CVE-2017-7426 | Medium | 5.4 | 2018-03-01 | The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak informat… |
CVE-2017-18197 | Critical | 9.8 | 2018-02-24 | In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attack… |
CVE-2018-6489 | Critical | 9.8 | 2018-02-22 | XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML… |
CVE-2017-1758 | High | 7.1 | 2018-02-21 | IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, a… |
CVE-2016-0369 | Low | 2.7 | 2018-02-21 | XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information v… |
CVE-2017-7375 | Critical | 9.8 | 2018-02-19 | A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, exte… |
CVE-2017-5828 | High | 8.1 | 2018-02-15 | An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found. |
CVE-2018-2393 | High | 7.5 | 2018-02-14 | Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA… |
CVE-2018-2392 | High | 7.5 | 2018-02-14 | Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA… |
CVE-2018-1000056 | High | 8.3 | 2018-02-09 | Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions… |
CVE-2018-1000055 | High | 8.3 | 2018-02-09 | Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permi… |
CVE-2018-1000054 | High | 8.3 | 2018-02-09 | Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in… |
CVE-2018-3600 | Medium | 6.5 | 2018-02-09 | A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive… |
CVE-2018-1307 | High | 8.1 | 2018-02-09 | In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structure… |
CVE-2018-5789 | High | 7.5 | 2018-02-05 | An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is a Remote, Unauthenticated XML Entity Exp… |
CVE-2018-6486 | High | 7.3 | 2018-02-02 | XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16… |
CVE-2014-3244 | Critical | 9.8 | 2018-02-01 | XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially exec… |
CVE-2014-3005 | Critical | 9.8 | 2018-02-01 | XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote a… |
CVE-2018-1364 | High | 8.2 | 2018-01-29 | IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this… |
CVE-2017-14699 | Medium | 6.5 | 2018-01-29 | Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_… |
CVE-2018-1000012 | High | 8.8 | 2018-01-23 | Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissi… |
CVE-2018-1000011 | High | 8.8 | 2018-01-23 | Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissi… |
CVE-2018-1000010 | High | 8.8 | 2018-01-23 | Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions i… |
CVE-2018-1000009 | High | 8.8 | 2018-01-23 | Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permis… |
CVE-2018-1000008 | High | 8.8 | 2018-01-23 | Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions i… |
CVE-2018-0108 | Medium | 5.3 | 2018-01-18 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity… |
CVE-2018-0100 | Medium | 4.4 | 2018-01-18 | A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write acce… |
CVE-2016-0219 | Medium | 6.5 | 2018-01-16 | XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15… |
CVE-2017-1666 | High | 8.1 | 2018-01-09 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker co… |
CVE-2017-1000477 | High | 7.5 | 2018-01-03 | XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks. |
CVE-2017-1000498 | High | 7.8 | 2018-01-03 | AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution |
CVE-2017-1000497 | Critical | 9.8 | 2018-01-03 | Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution |
CVE-2017-1000496 | High | 8.8 | 2018-01-03 | Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of cod… |
CVE-2014-3630 | Critical | 9.8 | 2017-12-29 | XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to re… |
CVE-2017-14101 | Critical | 9.8 | 2017-12-15 | A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical… |
CVE-2017-11286 | High | 7.5 | 2017-12-01 | Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and ea… |
CVE-2017-14949 | High | 7.5 | 2017-11-30 | Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only… |