CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 8)
Page 8 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20595 | High | 8.2 | 2021-07-13 | Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.3.35 and… |
CVE-2021-32754 | Medium | 5.3 | 2021-07-12 | FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed an attacker who had… |
CVE-2021-30201 | High | 7.5 | 2021-07-09 | The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by th… |
CVE-2021-32972 | Medium | 5.5 | 2021-07-09 | Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI a… |
CVE-2012-1102 | High | 7.5 | 2021-07-09 | It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. Thi… |
CVE-2021-21672 | Medium | 4.3 | 2021-06-30 | Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-25951 | High | 7.5 | 2021-06-30 | XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. |
CVE-2021-22338 | Medium | 5.3 | 2021-06-29 | There is an XXE injection vulnerability in eCNS280 V100R005C00 and V100R005C10. A module does not perform the strict operation to the input XML message. Attack… |
CVE-2021-29620 | High | 7.5 | 2021-06-23 | Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the… |
CVE-2021-35066 | Critical | 9.8 | 2021-06-21 | An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. |
CVE-2021-28684 | Medium | 4.3 | 2021-06-21 | The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the… |
CVE-2021-33813 | High | 7.5 | 2021-06-16 | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. |
CVE-2020-5003 | Critical | 9.1 | 2021-06-11 | IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploi… |
CVE-2021-27635 | Medium | 6.5 | 2021-06-09 | SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a… |
CVE-2020-25817 | Medium | 4.8 | 2021-06-08 | SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to… |
CVE-2020-4300 | High | 8.2 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2019-4730 | High | 7.1 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2021-27492 | Medium | 5.5 | 2021-05-27 | When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3… |
CVE-2021-20492 | High | 8.2 | 2021-05-26 | IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2021-32925 | Medium | 6.5 | 2021-05-13 | admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities. |
CVE-2021-22140 | High | 7.5 | 2021-05-13 | Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Usi… |
CVE-2021-30006 | High | 7.5 | 2021-05-11 | In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure. |
CVE-2020-36124 | Medium | 6.5 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the privat… |
CVE-2021-1530 | Medium | 5.4 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco BroadWorks Messaging Server Software could allow an authenticated, remote attacker to access sen… |
CVE-2020-5013 | High | 8.1 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2021-1369 | Medium | 5.4 | 2021-04-29 | A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to gain read and write ac… |
CVE-2021-29140 | High | 8.2 | 2021-04-29 | A remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has rele… |
CVE-2021-25163 | High | 8.1 | 2021-04-29 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2020-7037 | High | 8.1 | 2021-04-28 | An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read… |
CVE-2021-25165 | High | 8.1 | 2021-04-28 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2021-25164 | Medium | 6.5 | 2021-04-28 | A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for Air… |
CVE-2020-7036 | High | 8.1 | 2021-04-23 | An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored… |
CVE-2020-7035 | High | 8.1 | 2021-04-23 | An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker… |
CVE-2021-27736 | Medium | 6.5 | 2021-04-22 | FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentB… |
CVE-2021-21642 | High | 8.1 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-20454 | High | 8.2 | 2021-04-21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attack… |
CVE-2021-20453 | High | 8.2 | 2021-04-20 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker co… |
CVE-2021-29447 | High | 7.1 | 2021-04-15 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE… |
CVE-2021-27604 | Medium | 6.5 | 2021-04-14 | In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA… |
CVE-2021-28973 | Medium | 4.9 | 2021-04-13 | The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configur… |
CVE-2020-6590 | High | 7.5 | 2021-04-08 | Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure. |
CVE-2021-22158 | High | 7.2 | 2021-04-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web Console. The vulner… |
CVE-2021-29421 | High | 7.5 | 2021-04-01 | models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries. |
CVE-2021-20502 | High | 7.1 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vul… |
CVE-2021-20482 | High | 7.1 | 2021-03-30 | IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacke… |
CVE-2021-1628 | Critical | 9.8 | 2021-03-26 | MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-prem… |
CVE-2021-28110 | High | 7.5 | 2021-03-19 | /exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser. |
CVE-2020-28387 | Medium | 5.5 | 2021-03-15 | A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially cr… |
CVE-2021-26969 | Medium | 6.5 | 2021-03-05 | A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0… |
CVE-2021-27931 | Critical | 9.1 | 2021-03-03 | LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request craf… |
CVE-2021-26703 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase URI. |
CVE-2021-21517 | High | 7.2 | 2021-03-01 | SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes user-supplied DTD i… |
CVE-2019-18943 | Medium | 6.1 | 2021-02-26 | Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations. |
CVE-2021-27184 | High | 7.5 | 2021-02-11 | Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclos… |
CVE-2021-20353 | High | 8.2 | 2021-02-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2021-21266 | Medium | 6.4 | 2021-02-01 | openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity… |
CVE-2020-4949 | High | 8.2 | 2021-01-26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2021-23901 | Critical | 9.1 | 2021-01-25 | An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity i… |
CVE-2020-27858 | High | 7.5 | 2021-01-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. Authentication is not required… |
CVE-2021-22498 | High | 8.1 | 2021-01-19 | XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability aff… |
CVE-2021-23899 | Critical | 9.8 | 2021-01-13 | OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML… |
CVE-2020-26981 | Medium | 6.5 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml… |
CVE-2020-27148 | High | 7.1 | 2021-01-12 | The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-on… |
CVE-2021-21470 | Medium | 4.4 | 2021-01-12 | SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privi… |
CVE-2020-4606 | Medium | 4.4 | 2021-01-08 | IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A local attacker could expl… |
CVE-2020-28736 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only availabl… |
CVE-2020-28734 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. |
CVE-2020-26247 | Low | 2.6 | 2020-12-30 | Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE v… |
CVE-2020-35604 | Critical | 9.8 | 2020-12-21 | An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used. |
CVE-2020-35123 | Medium | 6.5 | 2020-12-17 | In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, whic… |
CVE-2020-29436 | Medium | 6.5 | 2020-12-17 | Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via a… |
CVE-2020-26513 | Medium | 5.5 | 2020-12-07 | An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is pars… |
CVE-2020-25649 | High | 7.5 | 2020-12-03 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity… |
CVE-2020-2324 | High | 7.5 | 2020-12-03 | Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-26229 | Low | 3.7 | 2020-11-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML e… |
CVE-2020-7572 | High | 8.8 | 2020-11-19 | A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause… |
CVE-2020-7032 | Medium | 6.5 | 2020-11-13 | An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request for… |
CVE-2020-24454 | High | 7.5 | 2020-11-12 | Improper Restriction of XML External Entity Reference in subsystem forIntel(R) Quartus(R) Prime Pro Edition before version 20.3 and Intel(R) Quartus(R) Prime S… |
CVE-2020-27017 | Medium | 4.9 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow… |
CVE-2020-15352 | High | 7.2 | 2020-10-27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated ad… |
CVE-2020-25186 | High | 7.5 | 2020-10-22 | An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file disclosure. |
CVE-2020-4772 | High | 8.1 | 2020-10-12 | An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vuln… |
CVE-2020-15232 | Critical | 9.3 | 2020-10-02 | In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style. |
CVE-2020-13940 | Medium | 5.5 | 2020-10-01 | In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators t… |
CVE-2020-8256 | Medium | 4.9 | 2020-09-30 | A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through P… |
CVE-2020-21524 | Critical | 9.1 | 2020-09-30 | There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) nee… |
CVE-2020-2284 | High | 7.1 | 2020-09-23 | Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-4643 | High | 7.5 | 2020-09-21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-14029 | High | 7.5 | 2020-09-18 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an… |
CVE-2020-15772 | Medium | 4.9 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata… |
CVE-2020-25750 | High | 7.5 | 2020-09-18 | An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult… |
CVE-2020-25215 | Critical | 9.8 | 2020-09-17 | yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document. |
CVE-2020-11991 | High | 7.5 | 2020-09-11 | When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any fi… |
CVE-2020-25257 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-17408 | High | 7.5 | 2020-09-10 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not require… |
CVE-2020-24379 | Critical | 9.8 | 2020-09-09 | WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. |
CVE-2020-2247 | Medium | 6.5 | 2020-09-01 | Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2245 | High | 7.1 | 2020-09-01 | Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-25020 | Critical | 9.8 | 2020-08-29 | MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components. |
CVE-2020-17376 | High | 8.3 | 2020-08-26 | An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot… |