CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 13)
Page 13 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-14868 | High | 7.5 | 2017-11-30 | Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request… |
CVE-2017-1000190 | Critical | 9.1 | 2017-11-17 | SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on. |
CVE-2017-10889 | Medium | 4.3 | 2017-11-17 | TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2017-1477 | High | 8.1 | 2017-11-13 | IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp… |
CVE-2017-9096 | High | 8.8 | 2017-11-08 | The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity… |
CVE-2014-3600 | Critical | 9.8 | 2017-10-27 | XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath… |
CVE-2014-3579 | Critical | 9.8 | 2017-10-27 | XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an… |
CVE-2016-5002 | High | 7.8 | 2017-10-27 | XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct serv… |
CVE-2017-15639 | Medium | 6.5 | 2017-10-19 | tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature. |
CVE-2014-9487 | Critical | 9.8 | 2017-10-17 | The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possi… |
CVE-2017-12629 | Critical | 9.8 | 2017-10-14 | Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener com… |
CVE-2017-10617 | Medium | 5.0 | 2017-10-13 | The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files… |
CVE-2017-15280 | Medium | 5.5 | 2017-10-12 | XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending… |
CVE-2017-12623 | Medium | 6.5 | 2017-10-10 | An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to prop… |
CVE-2017-13706 | Critical | 9.9 | 2017-10-10 | XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticate… |
CVE-2014-0030 | Critical | 9.8 | 2017-10-10 | The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2017-14759 | Critical | 9.8 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML… |
CVE-2017-12620 | Critical | 9.8 | 2017-10-03 | When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications… |
CVE-2016-4434 | High | 7.8 | 2017-09-30 | Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE)… |
CVE-2017-14527 | High | 8.8 | 2017-09-28 | Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arb… |
CVE-2017-14526 | High | 8.8 | 2017-09-28 | Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents… |
CVE-2017-12621 | Critical | 9.8 | 2017-09-28 | During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the bod… |
CVE-2017-1527 | High | 8.1 | 2017-09-26 | IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could… |
CVE-2017-8710 | Medium | 5.5 | 2017-09-13 | The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an X… |
CVE-2017-8918 | Medium | 5.5 | 2017-09-12 | XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template… |
CVE-2017-8040 | Medium | 6.5 | 2017-09-09 | In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was disc… |
CVE-2017-9095 | Medium | 5.5 | 2017-09-08 | XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import. |
CVE-2017-12216 | High | 8.8 | 2017-09-07 | A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to informati… |
CVE-2017-9458 | Critical | 9.8 | 2017-09-07 | XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7… |
CVE-2015-7241 | Critical | 9.8 | 2017-09-06 | XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. |
CVE-2015-3160 | Medium | 4.3 | 2017-09-06 | XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submi… |
CVE-2017-1458 | High | 8.1 | 2017-09-05 | IBM QRadar Network Security 5.4 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vu… |
CVE-2016-5795 | High | 7.3 | 2017-08-31 | An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-V… |
CVE-2017-12069 | High | 8.2 | 2017-08-30 | An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the af… |
CVE-2017-11272 | High | 7.5 | 2017-08-11 | Adobe Digital Editions 4.5.4 and earlier has a security bypass vulnerability. |
CVE-2016-8739 | High | 7.5 | 2017-08-10 | The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera P… |
CVE-2017-1192 | High | 8.2 | 2017-08-10 | IBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this v… |
CVE-2010-2245 | High | 7.4 | 2017-08-08 | XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a cra… |
CVE-2017-11390 | High | 7.5 | 2017-08-02 | XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-470… |
CVE-2015-0194 | Medium | 6.5 | 2017-08-02 | XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read ar… |
CVE-2017-1383 | Critical | 9.1 | 2017-08-02 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2017-9233 | High | 7.5 | 2017-07-25 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malfo… |
CVE-2017-11457 | Medium | 6.5 | 2017-07-25 | XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct… |
CVE-2017-1219 | Medium | 6.5 | 2017-07-19 | IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulner… |
CVE-2016-6798 | Critical | 9.8 | 2017-07-19 | In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which al… |
CVE-2017-7664 | Critical | 10.0 | 2017-07-17 | Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. |
CVE-2017-1000061 | High | 7.1 | 2017-07-17 | xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or d… |
CVE-2017-1000021 | High | 8.8 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. |
CVE-2017-8557 | Medium | 5.5 | 2017-07-11 | Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows… |
CVE-2017-0170 | Medium | 6.5 | 2017-07-11 | Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold… |
CVE-2017-1254 | High | 7.1 | 2017-07-05 | IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnera… |
CVE-2017-10670 | Critical | 9.8 | 2017-06-30 | An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitab… |
CVE-2017-1322 | High | 8.2 | 2017-06-27 | IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi… |
CVE-2017-6662 | High | 8.0 | 2017-06-26 | A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated… |
CVE-2017-9231 | High | 7.5 | 2017-06-16 | XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecifie… |
CVE-2016-9698 | High | 8.1 | 2017-06-08 | IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remo… |
CVE-2016-0254 | Medium | 6.5 | 2017-06-07 | IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML… |
CVE-2015-7326 | Critical | 9.8 | 2017-06-07 | XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3. |
CVE-2017-2308 | Medium | 6.5 | 2017-05-30 | An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files… |
CVE-2017-9295 | Medium | 6.5 | 2017-05-29 | XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users to read arbitrary… |
CVE-2016-6256 | Critical | 9.6 | 2017-05-26 | SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exe… |
CVE-2014-0225 | High | 8.8 | 2017-05-25 | When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by… |
CVE-2017-8913 | High | 8.8 | 2017-05-23 | The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a cra… |
CVE-2017-1289 | High | 8.2 | 2017-05-22 | IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnera… |
CVE-2017-7907 | Medium | 6.6 | 2017-05-19 | An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML… |
CVE-2017-7503 | Critical | 9.8 | 2017-05-18 | It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to… |
CVE-2017-1103 | High | 8.1 | 2017-05-10 | IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker… |
CVE-2016-9691 | High | 8.6 | 2017-05-05 | IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing… |
CVE-2017-1149 | High | 8.1 | 2017-04-25 | IBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML d… |
CVE-2017-8110 | Critical | 10.0 | 2017-04-25 | www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php. |
CVE-2017-3548 | Medium | 6.5 | 2017-04-24 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are… |
CVE-2017-8056 | Medium | 5.3 | 2017-04-22 | WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent p… |
CVE-2017-5662 | High | 7.3 | 2017-04-18 | In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG fil… |
CVE-2017-5661 | High | 7.3 | 2017-04-18 | In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files… |
CVE-2016-7051 | High | 8.6 | 2017-04-14 | XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-si… |
CVE-2017-7457 | Medium | 5.0 | 2017-04-14 | XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure. |
CVE-2015-7273 | Critical | 9.8 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE. |
CVE-2016-6805 | Medium | 5.9 | 2017-04-07 | Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents. |
CVE-2016-9707 | High | 8.1 | 2017-03-31 | IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker co… |
CVE-2016-6111 | Critical | 9.1 | 2017-03-31 | IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing X… |
CVE-2016-9924 | Critical | 9.8 | 2017-03-29 | Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks. |
CVE-2016-10149 | High | 7.5 | 2017-03-24 | XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response. |
CVE-2017-6895 | Critical | 9.8 | 2017-03-23 | USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml. |
CVE-2016-5749 | Medium | 5.5 | 2017-03-23 | NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to… |
CVE-2016-5748 | Medium | 5.5 | 2017-03-23 | External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be… |
CVE-2016-4931 | Medium | 6.5 | 2017-03-20 | XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. |
CVE-2017-3811 | Medium | 6.5 | 2017-03-17 | An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the informatio… |
CVE-2016-9724 | High | 8.1 | 2017-03-07 | IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could e… |
CVE-2016-10127 | Critical | 9.0 | 2017-03-03 | PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response. |
CVE-2017-6344 | Medium | 5.9 | 2017-02-27 | XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document. |
CVE-2016-8974 | High | 8.1 | 2017-02-23 | IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remot… |
CVE-2017-3839 | Medium | 4.3 | 2017-02-22 | An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote att… |
CVE-2017-6055 | High | 7.8 | 2017-02-17 | XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or… |
CVE-2016-4312 | High | 7.5 | 2017-02-17 | XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated… |
CVE-2017-5992 | High | 8.2 | 2017-02-15 | Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document. |
CVE-2016-9706 | Critical | 9.1 | 2017-02-15 | IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE)… |
CVE-2016-8348 | Critical | 9.8 | 2017-02-13 | An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious input to Liebert Site… |
CVE-2016-8980 | High | 8.1 | 2017-02-01 | IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacke… |
CVE-2016-6059 | High | 8.1 | 2017-02-01 | IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remo… |
CVE-2016-3027 | Medium | 6.5 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A re… |