CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 7)
Page 7 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3836 | Medium | 5.5 | 2021-12-14 | dbeaver is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-23463 | High | 8.1 | 2021-12-10 | The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object… |
CVE-2021-44557 | Critical | 9.1 | 2021-12-08 | National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/… |
CVE-2021-44556 | Critical | 9.1 | 2021-12-08 | National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsi… |
CVE-2021-42776 | High | 7.7 | 2021-12-01 | CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import. |
CVE-2021-44147 | Medium | 5.5 | 2021-11-22 | An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a craf… |
CVE-2021-43577 | High | 7.1 | 2021-11-12 | Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-43576 | Medium | 6.5 | 2021-11-12 | Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read… |
CVE-2021-21701 | Medium | 6.5 | 2021-11-12 | Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-36172 | Medium | 4.3 | 2021-11-02 | An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who con… |
CVE-2021-20839 | Medium | 6.5 | 2021-11-01 | Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) a… |
CVE-2021-20838 | High | 7.5 | 2021-11-01 | Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) a… |
CVE-2020-26705 | Critical | 9.1 | 2021-10-31 | The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data… |
CVE-2020-25912 | Critical | 9.1 | 2021-10-31 | A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information discl… |
CVE-2020-25911 | Critical | 9.1 | 2021-10-31 | A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure o… |
CVE-2021-3869 | High | 7.5 | 2021-10-19 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-3878 | Critical | 9.8 | 2021-10-15 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2020-19954 | High | 7.5 | 2021-10-14 | An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files. |
CVE-2021-20801 | Medium | 6.5 | 2021-10-13 | Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in t… |
CVE-2021-35496 | High | 7.5 | 2021-10-12 | The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports… |
CVE-2021-40500 | High | 7.5 | 2021-10-12 | SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations… |
CVE-2021-3312 | Medium | 6.5 | 2021-10-08 | An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate file… |
CVE-2021-38298 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. |
CVE-2021-40439 | Medium | 6.5 | 2021-10-07 | Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of servi… |
CVE-2021-41770 | High | 7.5 | 2021-10-07 | Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. |
CVE-2021-34706 | Medium | 6.4 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive… |
CVE-2021-35201 | Medium | 6.5 | 2021-09-30 | NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks. |
CVE-2021-41098 | High | 7.5 | 2021-09-27 | Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX… |
CVE-2021-29831 | High | 8.1 | 2021-09-21 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML… |
CVE-2021-39239 | High | 7.5 | 2021-09-16 | A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the… |
CVE-2021-30137 | High | 7.7 | 2021-09-15 | Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possib… |
CVE-2021-40356 | High | 7.5 | 2021-09-14 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions… |
CVE-2021-38555 | Critical | 9.1 | 2021-09-11 | An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML externa… |
CVE-2021-3055 | Medium | 6.5 | 2021-09-08 | An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administra… |
CVE-2021-34436 | Critical | 9.8 | 2021-09-02 | In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extens… |
CVE-2021-21680 | High | 7.1 | 2021-08-31 | Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks. |
CVE-2021-39371 | High | 7.5 | 2021-08-23 | An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the e… |
CVE-2020-18705 | Critical | 9.8 | 2021-08-16 | XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'. |
CVE-2020-18703 | Critical | 9.8 | 2021-08-16 | XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'. |
CVE-2021-34823 | Critical | 9.1 | 2021-08-13 | The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server. This allows unauthenticat… |
CVE-2021-27741 | Critical | 9.1 | 2021-08-13 | " Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection" |
CVE-2021-38584 | High | 7.2 | 2021-08-11 | The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). |
CVE-2021-37425 | Critical | 9.1 | 2021-08-10 | Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogether… |
CVE-2021-37178 | Medium | 5.5 | 2021-08-10 | A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the underlying XML parse… |
CVE-2021-1630 | High | 7.5 | 2021-08-05 | XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Clou… |
CVE-2020-26564 | Medium | 6.5 | 2021-07-31 | ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey templa… |
CVE-2021-23418 | Medium | 6.3 | 2021-07-29 | The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be v… |
CVE-2021-20399 | Critical | 9.1 | 2021-07-27 | IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote… |
CVE-2021-22523 | High | 7.6 | 2021-07-22 | XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow… |
CVE-2021-2401 | Medium | 5.3 | 2021-07-21 | Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5… |
CVE-2020-5323 | Medium | 5.4 | 2021-07-19 | Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an injection vulnerabili… |
CVE-2019-3752 | High | 8.2 | 2021-07-16 | Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4… |
CVE-2021-20595 | High | 8.2 | 2021-07-13 | Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and… |
CVE-2021-32754 | Medium | 5.3 | 2021-07-12 | FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed an attacker who had… |
CVE-2021-30201 | High | 7.5 | 2021-07-09 | The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by th… |
CVE-2021-32972 | Medium | 5.5 | 2021-07-09 | Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI a… |
CVE-2012-1102 | High | 7.5 | 2021-07-09 | It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. Thi… |
CVE-2021-21672 | Medium | 4.3 | 2021-06-30 | Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-25951 | High | 7.5 | 2021-06-30 | XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. |
CVE-2021-22338 | Medium | 5.3 | 2021-06-29 | There is an XXE injection vulnerability in eCNS280 V100R005C00 and V100R005C10. A module does not perform the strict operation to the input XML message. Attack… |
CVE-2021-29620 | High | 7.5 | 2021-06-23 | Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the… |
CVE-2021-35066 | Critical | 9.8 | 2021-06-21 | An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. |
CVE-2021-28684 | Medium | 4.3 | 2021-06-21 | The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the… |
CVE-2021-33813 | High | 7.5 | 2021-06-16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. |
CVE-2020-5003 | Critical | 9.1 | 2021-06-11 | IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploi… |
CVE-2021-27635 | Medium | 6.5 | 2021-06-09 | SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a… |
CVE-2020-25817 | Medium | 4.8 | 2021-06-08 | SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to… |
CVE-2020-4300 | High | 8.2 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2019-4730 | High | 7.1 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2021-27492 | Medium | 5.5 | 2021-05-27 | When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3… |
CVE-2021-20492 | High | 8.2 | 2021-05-26 | IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2021-32925 | Medium | 6.5 | 2021-05-13 | admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities. |
CVE-2021-22140 | High | 7.5 | 2021-05-13 | Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Usi… |
CVE-2021-30006 | High | 7.5 | 2021-05-11 | In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure. |
CVE-2020-36124 | Medium | 6.5 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the privat… |
CVE-2021-1530 | Medium | 5.4 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco BroadWorks Messaging Server Software could allow an authenticated, remote attacker to access sen… |
CVE-2020-5013 | High | 8.1 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2021-1369 | Medium | 5.4 | 2021-04-29 | A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to gain read and write ac… |
CVE-2021-29140 | High | 8.2 | 2021-04-29 | A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has rele… |
CVE-2021-25163 | High | 8.1 | 2021-04-29 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2020-7037 | High | 8.1 | 2021-04-28 | An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read… |
CVE-2021-25165 | High | 8.1 | 2021-04-28 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-25164 | Medium | 6.5 | 2021-04-28 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2020-7036 | High | 8.1 | 2021-04-23 | An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored… |
CVE-2020-7035 | High | 8.1 | 2021-04-23 | An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker… |
CVE-2021-27736 | Medium | 6.5 | 2021-04-22 | FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentB… |
CVE-2021-21642 | High | 8.1 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-20454 | High | 8.2 | 2021-04-21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attack… |
CVE-2021-20453 | High | 8.2 | 2021-04-20 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker co… |
CVE-2021-29447 | High | 7.1 | 2021-04-15 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE… |
CVE-2021-27604 | Medium | 6.5 | 2021-04-14 | In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA… |
CVE-2021-28973 | Medium | 4.9 | 2021-04-13 | The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configur… |
CVE-2020-6590 | High | 7.5 | 2021-04-08 | Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure. |
CVE-2021-22158 | High | 7.2 | 2021-04-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web Console. The vulner… |
CVE-2021-29421 | High | 7.5 | 2021-04-01 | models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries. |
CVE-2021-20502 | High | 7.1 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vul… |
CVE-2021-20482 | High | 7.1 | 2021-03-30 | IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacke… |
CVE-2021-1628 | Critical | 9.8 | 2021-03-26 | MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-prem… |
CVE-2021-28110 | High | 7.5 | 2021-03-19 | /exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser. |
CVE-2020-28387 | Medium | 5.5 | 2021-03-15 | A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially cr… |