CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 6)
Page 6 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24187 | High | 7.8 | 2023-02-14 | An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/s… |
CVE-2023-22832 | High | 7.5 | 2023-02-10 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the… |
CVE-2023-24323 | High | 8.8 | 2023-02-09 | Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability. |
CVE-2022-45588 | High | 7.8 | 2023-02-03 | All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the… |
CVE-2022-38389 | High | 7.1 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-22486 | Critical | 10.0 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-47873 | Critical | 9.8 | 2023-01-31 | Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote). |
CVE-2023-22322 | Medium | 5.5 | 2023-01-30 | Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially craf… |
CVE-2023-24443 | Critical | 9.8 | 2023-01-26 | Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24441 | Critical | 9.8 | 2023-01-26 | Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24430 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24429 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about t… |
CVE-2023-21862 | High | 8.1 | 2023-01-18 | Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). The supported version that is affec… |
CVE-2023-22624 | High | 7.5 | 2023-01-17 | Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks. |
CVE-2023-23595 | High | 7.5 | 2023-01-15 | BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine exa… |
CVE-2021-4311 | Medium | 5.5 | 2023-01-09 | A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The ma… |
CVE-2015-10029 | Medium | 5.5 | 2023-01-07 | A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd… |
CVE-2016-15011 | Medium | 5.5 | 2023-01-06 | A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the fil… |
CVE-2020-36641 | Medium | 5.5 | 2023-01-05 | A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main… |
CVE-2020-36640 | Medium | 5.5 | 2023-01-05 | A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerCon… |
CVE-2017-20151 | Medium | 5.5 | 2022-12-30 | A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/Xf… |
CVE-2021-4295 | Medium | 5.5 | 2022-12-29 | A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigu… |
CVE-2022-4818 | Medium | 5.5 | 2022-12-28 | A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-41967 | High | 7.0 | 2022-12-28 | Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (… |
CVE-2022-4607 | Medium | 5.5 | 2022-12-18 | A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2022-47514 | High | 8.8 | 2022-12-18 | An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF… |
CVE-2022-25628 | High | 8.8 | 2022-12-16 | An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 |
CVE-2022-37911 | Low | 3.8 | 2022-12-12 | Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authe… |
CVE-2022-46682 | Critical | 9.8 | 2022-12-12 | Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-46827 | Low | 3.9 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. |
CVE-2022-45326 | Medium | 4.9 | 2022-12-06 | An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-… |
CVE-2022-40771 | Medium | 4.9 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure. |
CVE-2022-3980 | Critical | 9.8 | 2022-11-16 | An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between… |
CVE-2022-20938 | Medium | 4.3 | 2022-11-15 | A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated… |
CVE-2022-45400 | Critical | 9.8 | 2022-11-15 | Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45397 | Critical | 9.8 | 2022-11-15 | Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45396 | Critical | 9.8 | 2022-11-15 | Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45395 | Critical | 9.8 | 2022-11-15 | Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45386 | Medium | 5.5 | 2022-11-15 | Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43689 | Medium | 5.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure. |
CVE-2022-45194 | Low | 3.8 | 2022-11-12 | CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure. |
CVE-2022-43570 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injec… |
CVE-2022-3340 | Medium | 5.9 | 2022-11-04 | XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the admini… |
CVE-2022-42745 | High | 7.5 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE. |
CVE-2022-40747 | Critical | 9.1 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploi… |
CVE-2022-31678 | Critical | 9.1 | 2022-10-28 | VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit… |
CVE-2022-43430 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43415 | High | 7.5 | 2022-10-19 | Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-3338 | Medium | 5.4 | 2022-10-18 | An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side R… |
CVE-2022-42341 | High | 7.5 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') v… |
CVE-2022-38419 | High | 7.5 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') v… |
CVE-2022-42307 | Medium | 5.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entit… |
CVE-2022-42301 | Medium | 5.4 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entit… |
CVE-2022-34348 | High | 7.1 | 2022-09-23 | IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex… |
CVE-2022-40705 | High | 7.5 | 2022-09-22 | An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP… |
CVE-2022-41241 | Critical | 9.1 | 2022-09-21 | Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-41226 | Critical | 9.8 | 2022-09-21 | Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-38342 | High | 8.5 | 2022-09-13 | Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attack… |
CVE-2022-1700 | High | 7.5 | 2022-09-12 | Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also levera… |
CVE-2022-39135 | Critical | 9.8 | 2022-09-11 | Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in… |
CVE-2022-37189 | High | 7.5 | 2022-09-07 | DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' lib… |
CVE-2022-36773 | High | 8.1 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker coul… |
CVE-2022-2759 | Medium | 5.5 | 2022-08-31 | Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML docu… |
CVE-2022-2330 | Medium | 6.5 | 2022-08-30 | Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Age… |
CVE-2022-0217 | High | 7.5 | 2022-08-26 | It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given… |
CVE-2022-22489 | Critical | 9.1 | 2022-08-19 | IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attack… |
CVE-2020-14379 | Medium | 5.6 | 2022-08-16 | A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information di… |
CVE-2022-2838 | Medium | 5.3 | 2022-08-16 | In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection… |
CVE-2020-21641 | High | 7.5 | 2022-08-15 | Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enume… |
CVE-2022-2458 | High | 8.2 | 2022-08-10 | XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs whe… |
CVE-2022-1704 | High | 7.6 | 2022-08-05 | Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack… |
CVE-2022-31775 | Critical | 9.1 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entit… |
CVE-2022-2414 | High | 7.5 | 2022-07-29 | Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retriev… |
CVE-2022-27873 | High | 7.8 | 2022-07-29 | An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document… |
CVE-2021-42537 | Medium | 5.9 | 2022-07-27 | VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of cont… |
CVE-2022-31471 | High | 7.5 | 2022-07-26 | untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By… |
CVE-2022-2131 | High | 8.5 | 2022-07-25 | OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowin… |
CVE-2022-32458 | High | 7.5 | 2022-07-20 | Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perfo… |
CVE-2022-34001 | Medium | 6.5 | 2022-07-19 | Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously. |
CVE-2022-22358 | High | 7.1 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2015-8031 | Critical | 9.8 | 2022-07-18 | Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks. |
CVE-2022-35741 | Critical | 9.8 | 2022-07-18 | Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) in… |
CVE-2022-35168 | High | 7.5 | 2022-07-12 | Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system tem… |
CVE-2021-41042 | Medium | 5.3 | 2022-07-07 | In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This… |
CVE-2022-34793 | High | 8.8 | 2022-06-30 | Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-23170 | Medium | 5.9 | 2022-06-24 | SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that uses the Okta SSO integration… |
CVE-2021-40510 | High | 7.5 | 2022-06-21 | XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs. |
CVE-2021-45024 | Critical | 9.8 | 2022-06-17 | ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE). |
CVE-2021-41411 | Critical | 9.8 | 2022-06-16 | drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in… |
CVE-2022-32285 | High | 7.5 | 2022-06-14 | A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All version… |
CVE-2022-31447 | High | 7.5 | 2022-06-14 | An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file. |
CVE-2021-45981 | Critical | 9.8 | 2022-06-02 | NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack. |
CVE-2022-22977 | High | 7.1 | 2022-05-24 | VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user p… |
CVE-2022-31261 | High | 7.5 | 2022-05-24 | An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In orde… |
CVE-2022-29801 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The application contains a XM… |
CVE-2022-30971 | High | 8.8 | 2022-05-17 | Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-27777 | High | 7.5 | 2022-05-12 | XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attacke… |
CVE-2021-42646 | Critical | 9.1 | 2022-05-11 | XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0… |
CVE-2022-22774 | High | 8.6 | 2022-05-10 | The DOM XML parser and SAX XML parser components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Cente… |
CVE-2021-23792 | High | 7.3 | 2022-05-06 | The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML… |