CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 8)
Page 8 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26969 | Medium | 6.5 | 2021-03-05 | A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0… |
CVE-2021-27931 | Critical | 9.1 | 2021-03-03 | LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request craf… |
CVE-2021-26703 | Critical | 9.8 | 2021-03-01 | EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase URI. |
CVE-2021-21517 | High | 7.2 | 2021-03-01 | SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML parser that processes user-supplied DTD i… |
CVE-2019-18943 | Medium | 6.1 | 2021-02-26 | Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations. |
CVE-2021-27184 | High | 7.5 | 2021-02-11 | Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclos… |
CVE-2021-20353 | High | 8.2 | 2021-02-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2021-21266 | Medium | 6.4 | 2021-02-01 | openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity… |
CVE-2020-4949 | High | 8.2 | 2021-01-26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2021-23901 | Critical | 9.1 | 2021-01-25 | An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity i… |
CVE-2020-27858 | High | 7.5 | 2021-01-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. Authentication is not required… |
CVE-2021-22498 | High | 8.1 | 2021-01-19 | XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability aff… |
CVE-2021-23899 | Critical | 9.8 | 2021-01-13 | OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML… |
CVE-2020-26981 | Medium | 6.5 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml… |
CVE-2020-27148 | High | 7.1 | 2021-01-12 | The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-on… |
CVE-2021-21470 | Medium | 4.4 | 2021-01-12 | SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privi… |
CVE-2020-4606 | Medium | 4.4 | 2021-01-08 | IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A local attacker could expl… |
CVE-2020-28736 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only availabl… |
CVE-2020-28734 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. |
CVE-2020-26247 | Low | 2.6 | 2020-12-30 | Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE v… |
CVE-2020-35604 | Critical | 9.8 | 2020-12-21 | An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used. |
CVE-2020-35123 | Medium | 6.5 | 2020-12-17 | In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, whic… |
CVE-2020-29436 | Medium | 6.5 | 2020-12-17 | Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via a… |
CVE-2020-26513 | Medium | 5.5 | 2020-12-07 | An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is pars… |
CVE-2020-25649 | High | 7.5 | 2020-12-03 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity… |
CVE-2020-2324 | High | 7.5 | 2020-12-03 | Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-26229 | Low | 3.7 | 2020-11-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML e… |
CVE-2020-7572 | High | 8.8 | 2020-11-19 | A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause… |
CVE-2020-7032 | Medium | 6.5 | 2020-11-13 | An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request for… |
CVE-2020-24454 | High | 7.5 | 2020-11-12 | Improper Restriction of XML External Entity Reference in subsystem forIntel(R) Quartus(R) Prime Pro Edition before version 20.3 and Intel(R) Quartus(R) Prime S… |
CVE-2020-27017 | Medium | 4.9 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow… |
CVE-2020-15352 | High | 7.2 | 2020-10-27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated ad… |
CVE-2020-25186 | High | 7.5 | 2020-10-22 | An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file disclosure. |
CVE-2020-4772 | High | 8.1 | 2020-10-12 | An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vuln… |
CVE-2020-15232 | Critical | 9.3 | 2020-10-02 | In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style. |
CVE-2020-13940 | Medium | 5.5 | 2020-10-01 | In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators t… |
CVE-2020-8256 | Medium | 4.9 | 2020-09-30 | A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through P… |
CVE-2020-21524 | Critical | 9.1 | 2020-09-30 | There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) nee… |
CVE-2020-2284 | High | 7.1 | 2020-09-23 | Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-4643 | High | 7.5 | 2020-09-21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-14029 | High | 7.5 | 2020-09-18 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an… |
CVE-2020-15772 | Medium | 4.9 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata… |
CVE-2020-25750 | High | 7.5 | 2020-09-18 | An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult… |
CVE-2020-25215 | Critical | 9.8 | 2020-09-17 | yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document. |
CVE-2020-11991 | High | 7.5 | 2020-09-11 | When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any fi… |
CVE-2020-25257 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-17408 | High | 7.5 | 2020-09-10 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not require… |
CVE-2020-24379 | Critical | 9.8 | 2020-09-09 | WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. |
CVE-2020-2247 | Medium | 6.5 | 2020-09-01 | Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2245 | High | 7.1 | 2020-09-01 | Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-25020 | Critical | 9.8 | 2020-08-29 | MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components. |
CVE-2020-17376 | High | 8.3 | 2020-08-26 | An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot… |
CVE-2020-24656 | Medium | 6.5 | 2020-08-26 | Maltego before 4.2.12 allows XXE attacks. |
CVE-2020-24591 | Medium | 6.5 | 2020-08-21 | The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics… |
CVE-2020-24589 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. |
CVE-2020-24052 | Critical | 9.1 | 2020-08-21 | Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary file… |
CVE-2020-4481 | High | 8.2 | 2020-08-05 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A re… |
CVE-2020-4377 | Critical | 9.1 | 2020-08-03 | IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this… |
CVE-2020-4463 | High | 8.2 | 2020-07-29 | IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker coul… |
CVE-2020-15419 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not… |
CVE-2020-15418 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not… |
CVE-2020-3405 | High | 7.3 | 2020-07-16 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that… |
CVE-2020-4462 | High | 8.2 | 2020-07-16 | IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an… |
CVE-2020-12684 | Critical | 9.8 | 2020-07-15 | XXE injection can occur in i-net Clear Reports 2019 19.0.287 (Designer), as used in i-net HelpDesk and other products, when XML input containing a reference to… |
CVE-2019-17637 | High | 7.1 | 2020-07-15 | In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the c… |
CVE-2020-4510 | Medium | 5.5 | 2020-07-14 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2020-12025 | Low | 3.3 | 2020-07-14 | Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an at… |
CVE-2020-5602 | High | 7.5 | 2020-06-30 | Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Softwar… |
CVE-2020-14940 | High | 7.5 | 2020-06-23 | An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 (.gpx) and GP7… |
CVE-2020-14204 | High | 8.2 | 2020-06-22 | In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests… |
CVE-2020-8541 | Medium | 6.5 | 2020-06-16 | OX App Suite through 7.10.3 allows XXE attacks. |
CVE-2020-13883 | Medium | 6.7 | 2020-06-06 | In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition… |
CVE-2020-13692 | High | 7.7 | 2020-06-04 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. |
CVE-2020-4509 | High | 7.6 | 2020-06-04 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2020-4246 | High | 7.1 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-2012 | High | 7.5 | 2020-05-13 | Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated att… |
CVE-2018-1285 | Critical | 9.8 | 2020-05-11 | Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in appli… |
CVE-2020-11541 | Medium | 5.5 | 2020-05-08 | In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltrate data under the l… |
CVE-2020-12719 | High | 7.2 | 2020-05-08 | XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microga… |
CVE-2020-3256 | Medium | 4.9 | 2020-05-06 | A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) Software could allow an authenticated, remote… |
CVE-2020-12642 | High | 7.5 | 2020-05-04 | An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUn… |
CVE-2020-10683 | Critical | 9.8 | 2020-05-01 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular exte… |
CVE-2020-11885 | High | 7.2 | 2020-04-17 | WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network… |
CVE-2020-2178 | High | 7.1 | 2020-04-16 | Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-6238 | Critical | 9.3 | 2020-04-14 | SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Valida… |
CVE-2020-10629 | High | 7.5 | 2020-04-09 | WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files. |
CVE-2019-4391 | High | 8.2 | 2020-04-07 | HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data |
CVE-2020-11586 | Critical | 9.8 | 2020-04-06 | An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data. |
CVE-2020-10993 | Critical | 9.1 | 2020-03-27 | Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java. |
CVE-2020-10992 | Critical | 9.8 | 2020-03-27 | Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java. |
CVE-2020-10991 | Critical | 9.8 | 2020-03-27 | Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java |
CVE-2020-10990 | Critical | 9.8 | 2020-03-27 | An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component. |
CVE-2020-2171 | High | 8.8 | 2020-03-25 | Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2019-20627 | Critical | 9.8 | 2020-03-23 | AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE. |
CVE-2020-10799 | Critical | 9.8 | 2020-03-20 | The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call. |
CVE-2019-20191 | High | 7.5 | 2020-03-16 | Oxygen XML Editor 21.1.1 allows XXE to read any file. |
CVE-2020-8540 | Critical | 9.8 | 2020-03-11 | An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbit… |
CVE-2020-9044 | High | 7.5 | 2020-03-10 | XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. T… |
CVE-2020-2144 | High | 7.1 | 2020-03-09 | Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2138 | High | 7.1 | 2020-03-09 | Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |