CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 4)
Page 4 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50442 | Medium | 6.5 | 2024-10-28 | Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows XML Injection.This issue a… |
CVE-2024-4690 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4189 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4184 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-45072 | Medium | 5.5 | 2024-10-16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could e… |
CVE-2024-21255 | High | 8.8 | 2024-10-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). Supported versions that are affected are 8.59… |
CVE-2024-8602 | | 2024-10-14 | When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External E… | |
CVE-2024-28168 | High | 7.5 | 2024-10-09 | Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. User… |
CVE-2024-39586 | Low | 2.9 | 2024-10-09 | Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially e… |
CVE-2024-45293 | High | 7.5 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader… |
CVE-2024-45745 | Medium | 5.0 | 2024-09-27 | TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access U… |
CVE-2024-46985 | High | 7.5 | 2024-09-23 | DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static res… |
CVE-2024-46984 | High | 8.6 | 2024-09-19 | The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location rou… |
CVE-2024-7098 | Critical | 9.8 | 2024-09-16 | Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4… |
CVE-2024-37397 | High | 8.2 | 2024-09-12 | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthen… |
CVE-2023-37233 | High | 8.8 | 2024-09-10 | Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks. |
CVE-2024-45294 | High | 8.6 | 2024-09-06 | The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperabil… |
CVE-2024-45490 | High | 7.5 | 2024-08-30 | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. |
CVE-2024-45048 | High | 8.8 | 2024-08-28 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XX… |
CVE-2024-22218 | High | 8.8 | 2024-08-15 | XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit maliciou… |
CVE-2024-38653 | High | 7.5 | 2024-08-14 | XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server. |
CVE-2024-6893 | High | 7.5 | 2024-08-08 | The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read… |
CVE-2024-3930 | Medium | 6.3 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. |
CVE-2023-48362 | High | 8.8 | 2024-07-24 | XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malici… |
CVE-2024-40075 | Medium | 4.3 | 2024-07-22 | Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability. |
CVE-2024-6961 | Medium | 5.9 | 2024-07-21 | RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from… |
CVE-2024-5625 | Medium | 6.5 | 2024-07-18 | Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External Ent… |
CVE-2023-50304 | High | 7.1 | 2024-07-18 | IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A rem… |
CVE-2024-38374 | High | 7.5 | 2024-06-28 | The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deseria… |
CVE-2021-47621 | High | 7.5 | 2024-06-21 | ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks. |
CVE-2023-49110 | High | 7.2 | 2024-06-20 | When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data … |
CVE-2024-34102 | Critical | 9.8 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulner… |
CVE-2024-37388 | Critical | 9.1 | 2024-06-07 | An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cau… |
CVE-2024-36827 | High | 7.5 | 2024-06-07 | An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information o… |
CVE-2023-45192 | High | 8.2 | 2024-06-06 | IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A r… |
CVE-2024-3969 | High | 7.8 | 2024-05-28 | XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload |
CVE-2024-4357 | Medium | 6.5 | 2024-05-15 | An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to re… |
CVE-2024-3486 | High | 7.8 | 2024-05-15 | XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution. |
CVE-2024-30043 | Medium | 6.5 | 2024-05-14 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2024-34345 | High | 8.1 | 2024-05-14 | The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, whe… |
CVE-2023-51605 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51604 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51602 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51601 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51600 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51591 | High | 7.5 | 2024-05-03 | Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to dis… |
CVE-2023-44412 | High | 8.2 | 2024-05-03 | D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive… |
CVE-2023-42035 | Medium | 6.5 | 2024-05-03 | Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to di… |
CVE-2023-40507 | High | 7.5 | 2024-05-03 | LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensit… |
CVE-2023-40506 | High | 7.5 | 2024-05-03 | LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensit… |
CVE-2023-40503 | High | 7.5 | 2024-05-03 | LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensit… |
CVE-2023-39472 | Medium | 6.5 | 2024-05-03 | Inductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers t… |
CVE-2024-29010 | High | 7.1 | 2024-05-01 | The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensiti… |
CVE-2024-22354 | High | 7.0 | 2024-04-17 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injec… |
CVE-2024-21082 | Critical | 9.8 | 2024-04-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.0.0.0.0 and 12.2.1… |
CVE-2024-21048 | Medium | 4.3 | 2024-04-16 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: XML input). Supported versions that are affecte… |
CVE-2023-49234 | Medium | 6.3 | 2024-03-29 | An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltra… |
CVE-2024-25971 | Medium | 5.5 | 2024-03-28 | Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exp… |
CVE-2024-31139 | Medium | 5.9 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector |
CVE-2024-2826 | Medium | 6.3 | 2024-03-22 | A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designe… |
CVE-2024-28039 | Medium | 5.8 | 2024-03-18 | Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain… |
CVE-2024-27266 | High | 8.2 | 2024-03-14 | IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit t… |
CVE-2023-50168 | High | 7.7 | 2024-03-14 | Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. |
CVE-2024-28198 | Medium | 4.6 | 2024-03-11 | OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when usin… |
CVE-2023-25926 | Medium | 5.5 | 2024-02-29 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML… |
CVE-2023-50380 | Medium | 6.5 | 2024-02-27 | XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oo… |
CVE-2024-25129 | Low | 2.7 | 2024-02-22 | The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various a… |
CVE-2024-25606 | High | 8.0 | 2024-02-20 | XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 befor… |
CVE-2024-22024 | High | 8.3 | 2024-02-13 | An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which… |
CVE-2024-24743 | High | 8.6 | 2024-02-13 | SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over t… |
CVE-2023-52239 | Medium | 6.5 | 2024-02-06 | The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport. |
CVE-2023-32327 | High | 7.1 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2024-1167 | Medium | 5.5 | 2024-02-01 | When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur. |
CVE-2023-4554 | Medium | 4.9 | 2024-01-29 | Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System F… |
CVE-2024-22380 | Medium | 5.5 | 2024-01-24 | Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era e… |
CVE-2024-21796 | Medium | 5.5 | 2024-01-24 | Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Editi… |
CVE-2024-21765 | Medium | 5.5 | 2024-01-24 | Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check S… |
CVE-2024-23525 | Medium | 6.5 | 2024-01-18 | The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig. |
CVE-2023-45139 | High | 7.5 | 2024-01-10 | fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an… |
CVE-2023-6149 | Medium | 5.7 | 2024-01-09 | Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check whi… |
CVE-2023-6147 | Medium | 5.7 | 2024-01-09 | Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permissi… |
CVE-2023-26999 | Critical | 9.8 | 2024-01-09 | An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file. |
CVE-2023-52252 | Critical | 9.8 | 2023-12-30 | Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint. |
CVE-2023-46265 | Critical | 9.8 | 2023-12-19 | An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). |
CVE-2023-6280 | High | 7.2 | 2023-12-19 | An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of ext… |
CVE-2023-6836 | Medium | 4.6 | 2023-12-15 | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML p… |
CVE-2023-6721 | High | 8.3 | 2023-12-13 | An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function… |
CVE-2023-6194 | Low | 2.8 | 2023-12-11 | In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) references to extern… |
CVE-2023-49733 | Critical | 9.8 | 2023-11-30 | Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are reco… |
CVE-2023-49656 | Critical | 9.8 | 2023-11-29 | Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-22274 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead… |
CVE-2023-46590 | High | 7.5 | 2023-11-14 | A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE)… |
CVE-2023-4218 | Medium | 5.0 | 2023-11-09 | In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any ev… |
CVE-2023-5136 | Medium | 5.5 | 2023-11-08 | An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability b… |
CVE-2023-46802 | Medium | 5.5 | 2023-11-06 | e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By proc… |
CVE-2023-46502 | Critical | 9.8 | 2023-10-30 | An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory. |
CVE-2022-34832 | Medium | 6.5 | 2023-10-27 | An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component. |
CVE-2023-43067 | Medium | 4.9 | 2023-10-23 | Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local f… |
CVE-2023-43624 | Medium | 5.5 | 2023-10-23 | CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability… |
CVE-2023-45727 | High | 7.5 | 2023-10-18 | Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier all… |