CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 13)
Page 13 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-8557 | Medium | 5.5 | 2017-07-11 | Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows… |
CVE-2017-0170 | Medium | 6.5 | 2017-07-11 | Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold… |
CVE-2017-1254 | High | 7.1 | 2017-07-05 | IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnera… |
CVE-2017-10670 | Critical | 9.8 | 2017-06-30 | An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitab… |
CVE-2017-1322 | High | 8.2 | 2017-06-27 | IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi… |
CVE-2017-6662 | High | 8.0 | 2017-06-26 | A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated… |
CVE-2017-9231 | High | 7.5 | 2017-06-16 | XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecifie… |
CVE-2016-9698 | High | 8.1 | 2017-06-08 | IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remo… |
CVE-2016-0254 | Medium | 6.5 | 2017-06-07 | IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML… |
CVE-2015-7326 | Critical | 9.8 | 2017-06-07 | XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3. |
CVE-2017-2308 | Medium | 6.5 | 2017-05-30 | An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files… |
CVE-2017-9295 | Medium | 6.5 | 2017-05-29 | XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users to read arbitrary… |
CVE-2016-6256 | Critical | 9.6 | 2017-05-26 | SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exe… |
CVE-2014-0225 | High | 8.8 | 2017-05-25 | When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by… |
CVE-2017-8913 | High | 8.8 | 2017-05-23 | The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a cra… |
CVE-2017-1289 | High | 8.2 | 2017-05-22 | IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnera… |
CVE-2017-7907 | Medium | 6.6 | 2017-05-19 | An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML… |
CVE-2017-7503 | Critical | 9.8 | 2017-05-18 | It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to… |
CVE-2017-1103 | High | 8.1 | 2017-05-10 | IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker… |
CVE-2016-9691 | High | 8.6 | 2017-05-05 | IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing… |
CVE-2017-1149 | High | 8.1 | 2017-04-25 | IBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML d… |
CVE-2017-8110 | Critical | 10.0 | 2017-04-25 | www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php. |
CVE-2017-3548 | Medium | 6.5 | 2017-04-24 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are… |
CVE-2017-8056 | Medium | 5.3 | 2017-04-22 | WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent p… |
CVE-2017-5662 | High | 7.3 | 2017-04-18 | In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG fil… |
CVE-2017-5661 | High | 7.3 | 2017-04-18 | In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files… |
CVE-2016-7051 | High | 8.6 | 2017-04-14 | XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-si… |
CVE-2017-7457 | Medium | 5.0 | 2017-04-14 | XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure. |
CVE-2015-7273 | Critical | 9.8 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE. |
CVE-2016-6805 | Medium | 5.9 | 2017-04-07 | Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents. |
CVE-2016-9707 | High | 8.1 | 2017-03-31 | IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker co… |
CVE-2016-6111 | Critical | 9.1 | 2017-03-31 | IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing X… |
CVE-2016-9924 | Critical | 9.8 | 2017-03-29 | Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks. |
CVE-2016-10149 | High | 7.5 | 2017-03-24 | XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response. |
CVE-2017-6895 | Critical | 9.8 | 2017-03-23 | USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml. |
CVE-2016-5749 | Medium | 5.5 | 2017-03-23 | NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to… |
CVE-2016-5748 | Medium | 5.5 | 2017-03-23 | External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be… |
CVE-2016-4931 | Medium | 6.5 | 2017-03-20 | XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. |
CVE-2017-3811 | Medium | 6.5 | 2017-03-17 | An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the informatio… |
CVE-2016-9724 | High | 8.1 | 2017-03-07 | IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could e… |
CVE-2016-10127 | Critical | 9.0 | 2017-03-03 | PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response. |
CVE-2017-6344 | Medium | 5.9 | 2017-02-27 | XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document. |
CVE-2016-8974 | High | 8.1 | 2017-02-23 | IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remot… |
CVE-2017-3839 | Medium | 4.3 | 2017-02-22 | An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote att… |
CVE-2017-6055 | High | 7.8 | 2017-02-17 | XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or… |
CVE-2016-4312 | High | 7.5 | 2017-02-17 | XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated… |
CVE-2017-5992 | High | 8.2 | 2017-02-15 | Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document. |
CVE-2016-9706 | Critical | 9.1 | 2017-02-15 | IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE)… |
CVE-2016-8348 | Critical | 9.8 | 2017-02-13 | An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious input to Liebert Site… |
CVE-2016-8980 | High | 8.1 | 2017-02-01 | IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacke… |
CVE-2016-6059 | High | 8.1 | 2017-02-01 | IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remo… |
CVE-2016-3027 | Medium | 6.5 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A re… |
CVE-2016-2908 | Critical | 9.1 | 2017-02-01 | IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML d… |
CVE-2015-7743 | Medium | 6.5 | 2017-01-23 | XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new… |
CVE-2016-10097 | High | 7.5 | 2017-01-02 | XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary file… |
CVE-2016-7460 | Critical | 9.1 | 2016-12-29 | The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read… |
CVE-2016-7459 | High | 7.7 | 2016-12-29 | VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch… |
CVE-2016-7458 | Medium | 5.8 | 2016-12-29 | VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing… |
CVE-2016-9181 | High | 7.1 | 2016-12-22 | perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an ap… |
CVE-2016-9180 | Critical | 9.1 | 2016-12-22 | perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are alwa… |
CVE-2016-5851 | High | 8.8 | 2016-12-21 | python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document. |
CVE-2016-4047 | Medium | 4.3 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be place… |
CVE-2016-3055 | High | 8.1 | 2016-12-01 | IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) v… |
CVE-2016-3033 | High | 8.1 | 2016-12-01 | IBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML d… |
CVE-2016-0284 | Medium | 5.4 | 2016-11-24 | The XML parser in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2… |
CVE-2016-9563 | Medium | 6.5 | 2016-11-23 | BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~… |
CVE-2016-9318 | Medium | 5.5 | 2016-11-16 | libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be… |
CVE-2015-1832 | Critical | 9.1 | 2016-10-03 | XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-d… |
CVE-2016-5971 | High | 7.1 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a de… |
CVE-2016-6408 | High | 7.5 | 2016-09-24 | Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an ent… |
CVE-2016-4264 | High | 8.6 | 2016-09-01 | The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP… |
CVE-2016-5000 | Medium | 5.5 | 2016-08-05 | The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity dec… |
CVE-2015-8866 | Critical | 9.6 | 2016-05-22 | ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes i… |
CVE-2016-3974 | Critical | 9.1 | 2016-04-07 | XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of servi… |
CVE-2015-2125 | | 2015-06-07 | Unspecified vulnerability in HP WebInspect 7.x through 10.4 before 10.4 update 1 allows remote authenticated users to bypass intended access restrictions via u… | |
CVE-2015-3451 | | 2015-05-12 | The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity… | |
CVE-2014-3004 | | 2014-06-11 | The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via… | |
CVE-2013-6429 | | 2014-01-26 | The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which… | |
CVE-2013-0340 | | 2014-01-21 | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows… | |
CVE-2013-1824 | | 2013-09-16 | The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external en… | |
CVE-2013-1915 | | 2013-04-25 | ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory… | |
CVE-2012-3363 | Critical | 9.1 | 2013-02-13 | Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to r… |
CVE-2012-5656 | Medium | 5.5 | 2013-01-18 | The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity… |
CVE-2012-2239 | Critical | 9.1 | 2012-11-24 | Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) inj… |
CVE-2012-4399 | High | 7.5 | 2012-10-09 | The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity refe… |
CVE-2012-3489 | Medium | 6.5 | 2012-10-03 | The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before… |
CVE-2012-0037 | Medium | 6.5 | 2012-06-17 | Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allow… |
CVE-2011-4107 | Medium | 6.5 | 2011-11-17 | The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows rem… |
CVE-2010-3322 | High | 8.8 | 2010-09-14 | The XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain sensitive information and gain privileges via an XML External Entity (… |
CVE-2009-1699 | High | 7.5 | 2009-06-10 | The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not pr… |
CVE-2005-1306 | High | 7.5 | 2005-06-15 | The Adobe Reader control in Adobe Reader and Acrobat 7.0 and 7.0.1 allows remote attackers to determine the existence of files via Javascript containing XML sc… |