CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 7)
Page 7 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28890 | Critical | 9.8 | 2022-05-05 | A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0… |
CVE-2022-29943 | Medium | 6.5 | 2022-05-04 | Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root o… |
CVE-2022-20780 | Critical | 9.9 | 2022-05-04 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the h… |
CVE-2022-1331 | Medium | 5.5 | 2022-05-03 | In four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project fil… |
CVE-2022-21949 | High | 8.8 | 2022-05-03 | A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in cert… |
CVE-2022-29265 | High | 7.5 | 2022-04-30 | Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer ser… |
CVE-2022-24449 | Critical | 9.8 | 2022-04-28 | Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document. |
CVE-2022-24898 | Medium | 4.9 | 2022-04-28 | org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4… |
CVE-2022-0272 | Critical | 9.8 | 2022-04-21 | Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0. |
CVE-2021-43990 | Medium | 6.1 | 2022-04-20 | The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity… |
CVE-2022-0221 | Medium | 5.5 | 2022-04-13 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solu… |
CVE-2022-28219 | Critical | 9.8 | 2022-04-05 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. |
CVE-2022-1018 | Medium | 5.5 | 2022-04-01 | When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within… |
CVE-2021-43142 | Critical | 9.8 | 2022-03-30 | An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput. |
CVE-2021-33208 | High | 7.2 | 2022-03-30 | The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file. |
CVE-2022-28155 | High | 8.1 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28154 | High | 8.1 | 2022-03-29 | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28140 | High | 8.1 | 2022-03-29 | Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-44477 | High | 7.5 | 2022-03-25 | GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result… |
CVE-2021-43090 | Critical | 9.8 | 2022-03-25 | An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function. |
CVE-2022-0861 | Low | 3.5 | 2022-03-23 | A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a… |
CVE-2021-42194 | High | 7.2 | 2022-03-20 | The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, whic… |
CVE-2022-27193 | Medium | 6.1 | 2022-03-15 | CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated out… |
CVE-2022-26661 | Medium | 6.5 | 2022-03-10 | An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Appli… |
CVE-2022-22835 | Medium | 6.5 | 2022-03-10 | An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE… |
CVE-2022-22795 | Medium | 6.8 | 2022-03-10 | Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is… |
CVE-2022-25312 | Critical | 9.1 | 2022-03-05 | An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML… |
CVE-2022-0839 | Critical | 9.8 | 2022-03-04 | Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0. |
CVE-2022-0265 | Critical | 9.8 | 2022-03-03 | Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1. |
CVE-2022-23640 | Critical | 9.8 | 2022-03-02 | Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was use… |
CVE-2022-24340 | Critical | 9.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. |
CVE-2020-14478 | High | 7.1 | 2022-02-24 | A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A succe… |
CVE-2022-25209 | High | 8.8 | 2022-02-15 | Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-46365 | High | 7.8 | 2022-02-11 | An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. |
CVE-2022-21220 | High | 7.8 | 2022-02-09 | Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable… |
CVE-2022-21205 | High | 7.5 | 2022-02-09 | Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an unauthentic… |
CVE-2021-46660 | Critical | 9.8 | 2022-01-30 | Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks. |
CVE-2022-23031 | Medium | 4.9 | 2022-01-25 | On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerabilit… |
CVE-2020-4876 | High | 8.2 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2020-4875 | High | 8.2 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-0219 | Medium | 5.5 | 2022-01-20 | Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2. |
CVE-2022-21282 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Or… |
CVE-2022-0239 | Critical | 9.8 | 2022-01-17 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-40722 | Critical | 9.8 | 2022-01-13 | AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be ab… |
CVE-2022-0198 | High | 7.1 | 2022-01-13 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-42560 | High | 8.8 | 2022-01-12 | An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are p… |
CVE-2021-44028 | Medium | 5.5 | 2021-12-22 | XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-201… |
CVE-2021-45096 | Medium | 4.7 | 2021-12-16 | KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. |
CVE-2021-3836 | Medium | 5.5 | 2021-12-14 | dbeaver is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-23463 | High | 8.1 | 2021-12-10 | The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object… |
CVE-2021-44557 | Critical | 9.1 | 2021-12-08 | National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/… |
CVE-2021-44556 | Critical | 9.1 | 2021-12-08 | National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsi… |
CVE-2021-42776 | High | 7.7 | 2021-12-01 | CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import. |
CVE-2021-44147 | Medium | 5.5 | 2021-11-22 | An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a craf… |
CVE-2021-43577 | High | 7.1 | 2021-11-12 | Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-43576 | Medium | 6.5 | 2021-11-12 | Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read… |
CVE-2021-21701 | Medium | 6.5 | 2021-11-12 | Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-36172 | Medium | 4.3 | 2021-11-02 | An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who con… |
CVE-2021-20839 | Medium | 6.5 | 2021-11-01 | Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) a… |
CVE-2021-20838 | High | 7.5 | 2021-11-01 | Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) a… |
CVE-2020-26705 | Critical | 9.1 | 2021-10-31 | The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data… |
CVE-2020-25912 | Critical | 9.1 | 2021-10-31 | A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information discl… |
CVE-2020-25911 | Critical | 9.1 | 2021-10-31 | A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure o… |
CVE-2021-3869 | High | 7.5 | 2021-10-19 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2021-3878 | Critical | 9.8 | 2021-10-15 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2020-19954 | High | 7.5 | 2021-10-14 | An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files. |
CVE-2021-20801 | Medium | 6.5 | 2021-10-13 | Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in t… |
CVE-2021-35496 | High | 7.5 | 2021-10-12 | The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports… |
CVE-2021-40500 | High | 7.5 | 2021-10-12 | SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations… |
CVE-2021-3312 | Medium | 6.5 | 2021-10-08 | An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate file… |
CVE-2021-38298 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. |
CVE-2021-40439 | Medium | 6.5 | 2021-10-07 | Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of servi… |
CVE-2021-41770 | High | 7.5 | 2021-10-07 | Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. |
CVE-2021-34706 | Medium | 6.4 | 2021-10-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive… |
CVE-2021-35201 | Medium | 6.5 | 2021-09-30 | NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks. |
CVE-2021-41098 | High | 7.5 | 2021-09-27 | Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX… |
CVE-2021-29831 | High | 8.1 | 2021-09-21 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML… |
CVE-2021-39239 | High | 7.5 | 2021-09-16 | A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the… |
CVE-2021-30137 | High | 7.7 | 2021-09-15 | Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possib… |
CVE-2021-40356 | High | 7.5 | 2021-09-14 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions… |
CVE-2021-38555 | Critical | 9.1 | 2021-09-11 | An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML externa… |
CVE-2021-3055 | Medium | 6.5 | 2021-09-08 | An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administra… |
CVE-2021-34436 | Critical | 9.8 | 2021-09-02 | In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extens… |
CVE-2021-21680 | High | 7.1 | 2021-08-31 | Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks. |
CVE-2021-39371 | High | 7.5 | 2021-08-23 | An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the e… |
CVE-2020-18705 | Critical | 9.8 | 2021-08-16 | XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'. |
CVE-2020-18703 | Critical | 9.8 | 2021-08-16 | XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'. |
CVE-2021-34823 | Critical | 9.1 | 2021-08-13 | The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server. This allows unauthenticat… |
CVE-2021-27741 | Critical | 9.1 | 2021-08-13 | " Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection" |
CVE-2021-38584 | High | 7.2 | 2021-08-11 | The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). |
CVE-2021-37425 | Critical | 9.1 | 2021-08-10 | Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogether… |
CVE-2021-37178 | Medium | 5.5 | 2021-08-10 | A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the underlying XML parse… |
CVE-2021-1630 | High | 7.5 | 2021-08-05 | XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Clou… |
CVE-2020-26564 | Medium | 6.5 | 2021-07-31 | ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey templa… |
CVE-2021-23418 | Medium | 6.3 | 2021-07-29 | The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be v… |
CVE-2021-20399 | Critical | 9.1 | 2021-07-27 | IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote… |
CVE-2021-22523 | High | 7.6 | 2021-07-22 | XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulnerability could allow… |
CVE-2021-2401 | Medium | 5.3 | 2021-07-21 | Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5… |
CVE-2020-5323 | Medium | 5.4 | 2021-07-19 | Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an injection vulnerabili… |
CVE-2019-3752 | High | 8.2 | 2021-07-16 | Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4… |