CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 5)
Page 5 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27527 | High | 7.5 | 2023-05-10 | Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files o… |
CVE-2022-45876 | Medium | 5.5 | 2023-04-26 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2023-29443 | Medium | 4.9 | 2023-04-26 | Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmi… |
CVE-2023-28009 | Medium | 6.5 | 2023-04-26 | HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi… |
CVE-2023-28008 | High | 7.1 | 2023-04-26 | HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex… |
CVE-2023-26058 | Medium | 6.5 | 2023-04-25 | An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser config… |
CVE-2023-26057 | Medium | 6.5 | 2023-04-25 | An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser… |
CVE-2023-27652 | Medium | 5.5 | 2023-04-20 | An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _d… |
CVE-2022-38840 | High | 7.5 | 2023-04-16 | cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosur… |
CVE-2023-26264 | Medium | 5.5 | 2023-04-13 | All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code. |
CVE-2023-26263 | Medium | 5.5 | 2023-04-13 | All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoin… |
CVE-2023-28828 | Medium | 5.9 | 2023-04-11 | A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This… |
CVE-2023-25955 | Medium | 5.5 | 2023-04-11 | National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially craf… |
CVE-2023-28340 | Medium | 6.5 | 2023-04-11 | Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack. |
CVE-2023-27876 | High | 7.1 | 2023-04-07 | IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to… |
CVE-2023-20030 | Medium | 6.0 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive… |
CVE-2022-43941 | High | 7.1 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endp… |
CVE-2023-28684 | Medium | 6.5 | 2023-04-02 | Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28683 | High | 8.2 | 2023-04-02 | Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28682 | High | 8.2 | 2023-04-02 | Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28681 | High | 8.2 | 2023-04-02 | Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28680 | High | 7.5 | 2023-04-02 | Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43473 | Medium | 5.8 | 2023-03-30 | A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can… |
CVE-2022-36969 | High | 7.1 | 2023-03-29 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). Use… |
CVE-2023-28150 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. |
CVE-2023-28151 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. |
CVE-2023-28152 | Medium | 5.3 | 2023-03-24 | An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. |
CVE-2023-28685 | High | 7.1 | 2023-03-22 | Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-46300 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-46286 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45468 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45121 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-43512 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-41696 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2018-25082 | Medium | 6.3 | 2023-03-21 | A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads… |
CVE-2023-27874 | Critical | 9.9 | 2023-03-21 | IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit… |
CVE-2023-26461 | Medium | 6.8 | 2023-03-14 | SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can sub… |
CVE-2023-1288 | Medium | 6.8 | 2023-03-09 | An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server. |
CVE-2023-27476 | High | 8.2 | 2023-03-08 | OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSL… |
CVE-2023-27480 | High | 7.7 | 2023-03-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a do… |
CVE-2023-20052 | Medium | 5.3 | 2023-03-01 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0… |
CVE-2023-26043 | Medium | 6.5 | 2023-02-27 | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External E… |
CVE-2023-24189 | Critical | 9.8 | 2023-02-24 | An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFil… |
CVE-2023-20855 | High | 8.8 | 2023-02-22 | VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, m… |
CVE-2023-26267 | Medium | 6.5 | 2023-02-21 | php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled… |
CVE-2015-10082 | Medium | 5.5 | 2023-02-21 | A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the comp… |
CVE-2016-15026 | Medium | 5.3 | 2023-02-20 | A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads… |
CVE-2014-125087 | Medium | 5.5 | 2023-02-19 | A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulatio… |
CVE-2021-33950 | High | 7.5 | 2023-02-17 | An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function. |
CVE-2022-39954 | High | 7.3 | 2023-02-16 | An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC versi… |
CVE-2023-23926 | Medium | 5.9 | 2023-02-16 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of AP… |
CVE-2023-22377 | High | 7.4 | 2023-02-15 | Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClini… |
CVE-2023-24187 | High | 7.8 | 2023-02-14 | An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/s… |
CVE-2023-22832 | High | 7.5 | 2023-02-10 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the… |
CVE-2023-24323 | High | 8.8 | 2023-02-09 | Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability. |
CVE-2022-45588 | High | 7.8 | 2023-02-03 | All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the… |
CVE-2022-38389 | High | 7.1 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-22486 | Critical | 10.0 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-47873 | Critical | 9.8 | 2023-01-31 | Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote). |
CVE-2023-22322 | Medium | 5.5 | 2023-01-30 | Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially craf… |
CVE-2023-24443 | Critical | 9.8 | 2023-01-26 | Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24441 | Critical | 9.8 | 2023-01-26 | Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24430 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24429 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about t… |
CVE-2023-21862 | High | 8.1 | 2023-01-18 | Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). The supported version that is affec… |
CVE-2023-22624 | High | 7.5 | 2023-01-17 | Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks. |
CVE-2023-23595 | High | 7.5 | 2023-01-15 | BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine exa… |
CVE-2021-4311 | Medium | 5.5 | 2023-01-09 | A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The ma… |
CVE-2015-10029 | Medium | 5.5 | 2023-01-07 | A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd… |
CVE-2016-15011 | Medium | 5.5 | 2023-01-06 | A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the fil… |
CVE-2020-36641 | Medium | 5.5 | 2023-01-05 | A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main… |
CVE-2020-36640 | Medium | 5.5 | 2023-01-05 | A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerCon… |
CVE-2017-20151 | Medium | 5.5 | 2022-12-30 | A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/Xf… |
CVE-2021-4295 | Medium | 5.5 | 2022-12-29 | A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigu… |
CVE-2022-4818 | Medium | 5.5 | 2022-12-28 | A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-41967 | High | 7.0 | 2022-12-28 | Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (… |
CVE-2022-4607 | Medium | 5.5 | 2022-12-18 | A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2022-47514 | High | 8.8 | 2022-12-18 | An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF… |
CVE-2022-25628 | High | 8.8 | 2022-12-16 | An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 |
CVE-2022-37911 | Low | 3.8 | 2022-12-12 | Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authe… |
CVE-2022-46682 | Critical | 9.8 | 2022-12-12 | Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-46827 | Low | 3.9 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. |
CVE-2022-45326 | Medium | 4.9 | 2022-12-06 | An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-… |
CVE-2022-40771 | Medium | 4.9 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure. |
CVE-2022-3980 | Critical | 9.8 | 2022-11-16 | An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between… |
CVE-2022-20938 | Medium | 4.3 | 2022-11-15 | A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated… |
CVE-2022-45400 | Critical | 9.8 | 2022-11-15 | Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45397 | Critical | 9.8 | 2022-11-15 | Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45396 | Critical | 9.8 | 2022-11-15 | Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45395 | Critical | 9.8 | 2022-11-15 | Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45386 | Medium | 5.5 | 2022-11-15 | Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43689 | Medium | 5.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure. |
CVE-2022-45194 | Low | 3.8 | 2022-11-12 | CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure. |
CVE-2022-43570 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injec… |
CVE-2022-3340 | Medium | 5.9 | 2022-11-04 | XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the admini… |
CVE-2022-42745 | High | 7.5 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE. |
CVE-2022-40747 | Critical | 9.1 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploi… |
CVE-2022-31678 | Critical | 9.1 | 2022-10-28 | VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit… |
CVE-2022-43430 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43415 | High | 7.5 | 2022-10-19 | Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |