CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 5)
Page 5 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32755 | Medium | 5.5 | 2023-10-14 | IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit th… |
CVE-2023-36419 | High | 8.8 | 2023-10-10 | Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability |
CVE-2023-41365 | Medium | 4.3 | 2023-10-10 | SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, whi… |
CVE-2023-45612 | High | 8.6 | 2023-10-09 | In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE |
CVE-2023-42445 | Medium | 6.8 | 2023-10-06 | Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML… |
CVE-2023-42132 | Medium | 5.5 | 2023-10-02 | FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML fi… |
CVE-2022-4245 | Medium | 4.3 | 2023-09-25 | A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue mean… |
CVE-2023-38343 | High | 7.5 | 2023-09-21 | An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are en… |
CVE-2023-3892 | Medium | 5.6 | 2023-09-19 | Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML Exte… |
CVE-2023-41369 | Low | 3.5 | 2023-09-12 | The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an at… |
CVE-2023-41933 | High | 8.8 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-41932 | Medium | 6.5 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attacke… |
CVE-2023-35892 | High | 7.1 | 2023-09-05 | IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote at… |
CVE-2023-40239 | High | 7.5 | 2023-09-01 | Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e… |
CVE-2023-41034 | Medium | 6.5 | 2023-08-31 | Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectL… |
CVE-2023-24620 | Medium | 5.5 | 2023-08-25 | An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader… |
CVE-2022-48565 | Critical | 9.8 | 2023-08-22 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoi… |
CVE-2022-46751 | High | 8.2 | 2023-08-21 | Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This is… |
CVE-2023-0871 | Medium | 5.4 | 2023-08-11 | XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE… |
CVE-2023-3823 | High | 8.6 | 2023-08-11 | In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration varia… |
CVE-2023-32567 | Critical | 9.8 | 2023-08-10 | Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236 |
CVE-2023-35389 | Medium | 6.5 | 2023-08-08 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
CVE-2020-26064 | High | 8.1 | 2023-08-04 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that… |
CVE-2023-37497 | High | 8.1 | 2023-08-03 | The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can succes… |
CVE-2023-30951 | Medium | 6.3 | 2023-08-03 | The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE). |
CVE-2023-37364 | Critical | 9.1 | 2023-08-03 | In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read ar… |
CVE-2023-38490 | Medium | 6.8 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the… |
CVE-2023-32639 | Medium | 5.5 | 2023-07-25 | Applicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files… |
CVE-2023-32635 | Medium | 5.5 | 2023-07-19 | XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XBRL file, ar… |
CVE-2023-20918 | Critical | 9.8 | 2023-07-13 | In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privil… |
CVE-2023-37942 | Medium | 6.5 | 2023-07-12 | Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-37200 | Medium | 5.5 | 2023-07-12 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacing a project file o… |
CVE-2023-35786 | Medium | 4.9 | 2023-07-05 | Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files. |
CVE-2020-26710 | High | 7.5 | 2023-06-29 | easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted… |
CVE-2020-26709 | High | 7.5 | 2023-06-29 | py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML f… |
CVE-2020-26708 | High | 7.5 | 2023-06-29 | requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a craft… |
CVE-2023-3113 | High | 8.2 | 2023-06-26 | An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only acce… |
CVE-2023-3276 | Medium | 5.5 | 2023-06-15 | A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the fi… |
CVE-2023-24470 | Critical | 9.1 | 2023-06-13 | Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0. |
CVE-2023-29498 | Medium | 5.5 | 2023-06-13 | Improper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. If a user opens a specially crafted… |
CVE-2023-34411 | High | 7.5 | 2023-06-05 | The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML documen… |
CVE-2023-32706 | High | 7.7 | 2023-06-01 | On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML au… |
CVE-2022-41221 | High | 7.1 | 2023-05-24 | The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client… |
CVE-2023-2806 | Medium | 5.5 | 2023-05-19 | A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the compon… |
CVE-2023-20174 | Medium | 4.9 | 2023-05-18 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read ar… |
CVE-2023-20173 | Medium | 4.9 | 2023-05-18 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read ar… |
CVE-2023-2161 | Medium | 5.0 | 2023-05-16 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a mali… |
CVE-2023-27554 | Medium | 6.3 | 2023-05-11 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could… |
CVE-2023-27527 | High | 7.5 | 2023-05-10 | Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files o… |
CVE-2022-45876 | Medium | 5.5 | 2023-04-26 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2023-29443 | Medium | 4.9 | 2023-04-26 | Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmi… |
CVE-2023-28009 | Medium | 6.5 | 2023-04-26 | HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi… |
CVE-2023-28008 | High | 7.1 | 2023-04-26 | HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex… |
CVE-2023-26058 | Medium | 6.5 | 2023-04-25 | An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser config… |
CVE-2023-26057 | Medium | 6.5 | 2023-04-25 | An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser… |
CVE-2023-27652 | Medium | 5.5 | 2023-04-20 | An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _d… |
CVE-2022-38840 | High | 7.5 | 2023-04-16 | cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosur… |
CVE-2023-26264 | Medium | 5.5 | 2023-04-13 | All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code. |
CVE-2023-26263 | Medium | 5.5 | 2023-04-13 | All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoin… |
CVE-2023-28828 | Medium | 5.9 | 2023-04-11 | A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This… |
CVE-2023-25955 | Medium | 5.5 | 2023-04-11 | National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially craf… |
CVE-2023-28340 | Medium | 6.5 | 2023-04-11 | Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack. |
CVE-2023-27876 | High | 7.1 | 2023-04-07 | IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to… |
CVE-2023-20030 | Medium | 6.0 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive… |
CVE-2022-43941 | High | 7.1 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endp… |
CVE-2023-28684 | Medium | 6.5 | 2023-04-02 | Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28683 | High | 8.2 | 2023-04-02 | Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28682 | High | 8.2 | 2023-04-02 | Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28681 | High | 8.2 | 2023-04-02 | Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28680 | High | 7.5 | 2023-04-02 | Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43473 | Medium | 5.8 | 2023-03-30 | A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can… |
CVE-2022-36969 | High | 7.1 | 2023-03-29 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). Use… |
CVE-2023-28150 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. |
CVE-2023-28151 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. |
CVE-2023-28152 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. |
CVE-2023-28685 | High | 7.1 | 2023-03-22 | Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-46300 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-46286 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45468 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45121 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-43512 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-41696 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2018-25082 | Medium | 6.3 | 2023-03-21 | A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads… |
CVE-2023-27874 | Critical | 9.9 | 2023-03-21 | IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit… |
CVE-2023-26461 | Medium | 6.8 | 2023-03-14 | SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can sub… |
CVE-2023-1288 | Medium | 6.8 | 2023-03-09 | An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server. |
CVE-2023-27476 | High | 8.2 | 2023-03-08 | OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSL… |
CVE-2023-27480 | High | 7.7 | 2023-03-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a do… |
CVE-2023-20052 | Medium | 5.3 | 2023-03-01 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0… |
CVE-2023-26043 | Medium | 6.5 | 2023-02-27 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External E… |
CVE-2023-24189 | Critical | 9.8 | 2023-02-24 | An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFil… |
CVE-2023-20855 | High | 8.8 | 2023-02-22 | VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, m… |
CVE-2023-26267 | Medium | 6.5 | 2023-02-21 | php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled… |
CVE-2015-10082 | Medium | 5.5 | 2023-02-21 | A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the comp… |
CVE-2016-15026 | Medium | 5.3 | 2023-02-20 | A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads… |
CVE-2014-125087 | Medium | 5.5 | 2023-02-19 | A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulatio… |
CVE-2021-33950 | High | 7.5 | 2023-02-17 | An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function. |
CVE-2022-39954 | High | 7.3 | 2023-02-16 | An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC versi… |
CVE-2023-23926 | Medium | 5.9 | 2023-02-16 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of AP… |
CVE-2023-22377 | High | 7.4 | 2023-02-15 | Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClini… |