CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 9)
Page 9 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-7968 | Medium | 4.3 | 2020-03-09 | nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/… |
CVE-2020-9352 | Critical | 9.8 | 2020-02-23 | An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tool… |
CVE-2020-1693 | High | 8.6 | 2020-02-17 | A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote att… |
CVE-2019-6194 | Medium | 5.7 | 2020-02-14 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information… |
CVE-2020-1975 | Medium | 6.8 | 2020-02-12 | Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that… |
CVE-2020-6187 | Medium | 4.9 | 2020-02-12 | SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised a… |
CVE-2020-2120 | High | 8.8 | 2020-02-12 | Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2115 | High | 8.8 | 2020-02-12 | Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2014-2052 | Critical | 9.8 | 2020-02-11 | Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or… |
CVE-2013-4334 | Critical | 9.8 | 2020-02-07 | opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities |
CVE-2019-10782 | Medium | 5.3 | 2020-01-30 | All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658. |
CVE-2020-2108 | High | 7.6 | 2020-01-29 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configur… |
CVE-2019-4707 | High | 7.1 | 2020-01-28 | IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could… |
CVE-2013-4333 | Critical | 9.1 | 2020-01-24 | OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability |
CVE-2015-1811 | High | 7.5 | 2020-01-15 | XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a craf… |
CVE-2015-1809 | High | 7.5 | 2020-01-15 | XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPa… |
CVE-2020-2092 | High | 8.8 | 2020-01-15 | Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Config… |
CVE-2019-18412 | High | 7.5 | 2020-01-15 | JetBrains IDETalk plugin before version 193.4099.10 allows XXE |
CVE-2015-8549 | High | 7.1 | 2020-01-15 | XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action… |
CVE-2014-5238 | High | 7.8 | 2020-01-14 | XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary… |
CVE-2020-6958 | Critical | 9.1 | 2020-01-14 | An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate… |
CVE-2019-17020 | Medium | 6.5 | 2020-01-08 | If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the con… |
CVE-2019-15983 | Medium | 4.9 | 2020-01-06 | A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information th… |
CVE-2019-20153 | Medium | 4.9 | 2020-01-05 | An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload… |
CVE-2019-3768 | Medium | 6.5 | 2020-01-03 | RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially expl… |
CVE-2019-19032 | High | 8.1 | 2019-12-30 | XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is… |
CVE-2019-19031 | High | 8.1 | 2019-12-30 | Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resources. The component… |
CVE-2019-19998 | High | 7.5 | 2019-12-26 | Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php. |
CVE-2012-2656 | High | 7.5 | 2019-12-18 | An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information. |
CVE-2019-16549 | High | 8.1 | 2019-12-17 | Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle atta… |
CVE-2014-3643 | High | 7.5 | 2019-12-15 | jersey: XXE via parameter entities not disabled by the jersey SAX parser |
CVE-2019-19702 | High | 7.5 | 2019-12-10 | The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp… |
CVE-2019-11216 | Medium | 6.5 | 2019-12-04 | BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to downl… |
CVE-2019-17554 | Medium | 5.5 | 2019-12-04 | The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with c… |
CVE-2011-3600 | High | 7.5 | 2019-11-26 | The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable pa… |
CVE-2019-10080 | Medium | 6.5 | 2019-11-19 | The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has th… |
CVE-2019-17085 | Medium | 6.5 | 2019-11-18 | XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability coul… |
CVE-2018-20687 | Critical | 9.8 | 2019-11-18 | An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticat… |
CVE-2019-10172 | High | 7.5 | 2019-11-18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus ja… |
CVE-2019-14678 | Critical | 10.0 | 2019-11-14 | SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Readi… |
CVE-2014-3599 | Medium | 6.5 | 2019-11-12 | HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy |
CVE-2019-12331 | High | 8.8 | 2019-11-07 | PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared i… |
CVE-2019-8126 | Medium | 4.9 | 2019-11-05 | An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft docu… |
CVE-2019-18227 | High | 7.5 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data. |
CVE-2019-9757 | High | 7.5 | 2019-10-29 | An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-expor… |
CVE-2017-15725 | High | 7.5 | 2019-10-28 | An XML External Entity Injection vulnerability exists in Dzone AnswerHub. |
CVE-2019-8087 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive inf… |
CVE-2019-8086 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive inf… |
CVE-2019-8082 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive informat… |
CVE-2019-18213 | High | 8.8 | 2019-10-23 | XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, all… |
CVE-2019-12415 | Medium | 5.5 | 2019-10-23 | In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an at… |
CVE-2019-10466 | High | 8.1 | 2019-10-23 | An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities… |
CVE-2019-14276 | Medium | 6.5 | 2019-10-23 | WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body. |
CVE-2019-1060 | High | 8.8 | 2019-10-10 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-12711 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-16188 | High | 7.1 | 2019-09-25 | HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can send a specially cr… |
CVE-2019-9488 | Medium | 4.9 | 2019-09-11 | Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be… |
CVE-2019-16174 | High | 8.8 | 2019-09-09 | An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or co… |
CVE-2019-6179 | High | 7.5 | 2019-09-03 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator… |
CVE-2019-13608 | High | 7.5 | 2019-08-29 | Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. |
CVE-2019-15641 | Medium | 6.5 | 2019-08-26 | xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi. |
CVE-2019-15637 | High | 8.1 | 2019-08-26 | Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects T… |
CVE-2019-4513 | High | 8.2 | 2019-08-26 | IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remo… |
CVE-2019-14258 | High | 7.5 | 2019-08-21 | The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988. |
CVE-2019-4424 | High | 8.2 | 2019-08-20 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when proce… |
CVE-2019-4340 | High | 8.2 | 2019-08-20 | IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote atta… |
CVE-2019-4433 | High | 8.2 | 2019-08-20 | IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attac… |
CVE-2019-4419 | High | 8.2 | 2019-08-20 | IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2019-1187 | Medium | 5.5 | 2019-08-14 | A denial of service vulnerability exists when the XmlLite runtime (XmlLite.dll) improperly parses XML input. An attacker who successfully exploited this vulner… |
CVE-2019-1057 | High | 7.5 | 2019-08-14 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the… |
CVE-2019-0340 | Medium | 5.4 | 2019-08-14 | The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. T… |
CVE-2019-14693 | High | 8.5 | 2019-08-08 | Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could… |
CVE-2019-13176 | High | 7.5 | 2019-08-08 | An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XX… |
CVE-2018-14383 | High | 7.5 | 2019-08-07 | The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2… |
CVE-2017-18438 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). |
CVE-2019-4456 | High | 7.1 | 2019-07-30 | IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A r… |
CVE-2019-4062 | High | 7.1 | 2019-07-30 | IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2019-10266 | High | 7.5 | 2019-07-26 | An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file struc… |
CVE-2019-10264 | High | 7.2 | 2019-07-26 | An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Impor… |
CVE-2019-13990 | Critical | 9.8 | 2019-07-26 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. |
CVE-2019-10976 | Medium | 5.5 | 2019-07-26 | Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsi… |
CVE-2019-2861 | Medium | 4.2 | 2019-07-23 | Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Diffic… |
CVE-2019-1010202 | Medium | 6.5 | 2019-07-23 | Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/ma… |
CVE-2019-7847 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successfu… |
CVE-2019-1010268 | Critical | 9.8 | 2019-07-18 | Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading fi… |
CVE-2019-13625 | Critical | 9.1 | 2019-07-17 | NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file. |
CVE-2018-17152 | Medium | 6.4 | 2019-07-11 | Intersystems Cache 2017.2.2.865.0 allows XXE. |
CVE-2019-12924 | Critical | 9.8 | 2019-07-08 | MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was po… |
CVE-2019-13358 | High | 7.5 | 2019-07-05 | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a… |
CVE-2015-3907 | Critical | 9.8 | 2019-07-03 | CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks. |
CVE-2019-13031 | High | 8.1 | 2019-06-28 | LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification serv… |
CVE-2019-9843 | High | 7.5 | 2019-06-28 | In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP… |
CVE-2018-20843 | High | 7.5 | 2019-06-24 | In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM a… |
CVE-2019-11392 | High | 7.5 | 2019-06-21 | BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd. |
CVE-2019-10718 | High | 7.5 | 2019-06-21 | BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs. |
CVE-2019-1903 | Medium | 6.5 | 2019-06-20 | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) co… |
CVE-2018-15506 | Critical | 9.8 | 2019-06-19 | In BubbleUPnP 0.9 update 30, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauth… |
CVE-2018-18471 | Critical | 9.8 | 2019-06-19 | /api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chaine… |
CVE-2018-18406 | Critical | 9.9 | 2019-06-19 | An issue was discovered in Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final). The Audit Report module is affected by a blind XXE vulnerability when a… |
CVE-2018-1845 | High | 7.1 | 2019-06-17 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacke… |