CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 9)
Page 9 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24656 | Medium | 6.5 | 2020-08-26 | Maltego before 4.2.12 allows XXE attacks. |
CVE-2020-24591 | Medium | 6.5 | 2020-08-21 | The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics… |
CVE-2020-24589 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. |
CVE-2020-24052 | Critical | 9.1 | 2020-08-21 | Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary file… |
CVE-2020-4481 | High | 8.2 | 2020-08-05 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A re… |
CVE-2020-4377 | Critical | 9.1 | 2020-08-03 | IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this… |
CVE-2020-4463 | High | 8.2 | 2020-07-29 | IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker coul… |
CVE-2020-15419 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not… |
CVE-2020-15418 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not… |
CVE-2020-3405 | High | 7.3 | 2020-07-16 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that… |
CVE-2020-4462 | High | 8.2 | 2020-07-16 | IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an… |
CVE-2020-12684 | Critical | 9.8 | 2020-07-15 | XXE injection can occur in i-net Clear Reports 2019 19.0.287 (Designer), as used in i-net HelpDesk and other products, when XML input containing a reference to… |
CVE-2019-17637 | High | 7.1 | 2020-07-15 | In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the c… |
CVE-2020-4510 | Medium | 5.5 | 2020-07-14 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2020-12025 | Low | 3.3 | 2020-07-14 | Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an at… |
CVE-2020-5602 | High | 7.5 | 2020-06-30 | Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Softwar… |
CVE-2020-14940 | High | 7.5 | 2020-06-23 | An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 (.gpx) and GP7… |
CVE-2020-14204 | High | 8.2 | 2020-06-22 | In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests… |
CVE-2020-8541 | Medium | 6.5 | 2020-06-16 | OX App Suite through 7.10.3 allows XXE attacks. |
CVE-2020-13883 | Medium | 6.7 | 2020-06-06 | In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition… |
CVE-2020-13692 | High | 7.7 | 2020-06-04 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. |
CVE-2020-4509 | High | 7.6 | 2020-06-04 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2020-4246 | High | 7.1 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-2012 | High | 7.5 | 2020-05-13 | Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated att… |
CVE-2018-1285 | Critical | 9.8 | 2020-05-11 | Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in appli… |
CVE-2020-11541 | Medium | 5.5 | 2020-05-08 | In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltrate data under the l… |
CVE-2020-12719 | High | 7.2 | 2020-05-08 | XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microga… |
CVE-2020-3256 | Medium | 4.9 | 2020-05-06 | A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) Software could allow an authenticated, remote… |
CVE-2020-12642 | High | 7.5 | 2020-05-04 | An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUn… |
CVE-2020-10683 | Critical | 9.8 | 2020-05-01 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular exte… |
CVE-2020-11885 | High | 7.2 | 2020-04-17 | WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network… |
CVE-2020-2178 | High | 7.1 | 2020-04-16 | Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-6238 | Critical | 9.3 | 2020-04-14 | SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Valida… |
CVE-2020-10629 | High | 7.5 | 2020-04-09 | WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files. |
CVE-2019-4391 | High | 8.2 | 2020-04-07 | HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data |
CVE-2020-11586 | Critical | 9.8 | 2020-04-06 | An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data. |
CVE-2020-10993 | Critical | 9.1 | 2020-03-27 | Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java. |
CVE-2020-10992 | Critical | 9.8 | 2020-03-27 | Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java. |
CVE-2020-10991 | Critical | 9.8 | 2020-03-27 | Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java |
CVE-2020-10990 | Critical | 9.8 | 2020-03-27 | An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component. |
CVE-2020-2171 | High | 8.8 | 2020-03-25 | Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2019-20627 | Critical | 9.8 | 2020-03-23 | AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE. |
CVE-2020-10799 | Critical | 9.8 | 2020-03-20 | The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call. |
CVE-2019-20191 | High | 7.5 | 2020-03-16 | Oxygen XML Editor 21.1.1 allows XXE to read any file. |
CVE-2020-8540 | Critical | 9.8 | 2020-03-11 | An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbit… |
CVE-2020-9044 | High | 7.5 | 2020-03-10 | XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. T… |
CVE-2020-2144 | High | 7.1 | 2020-03-09 | Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2138 | High | 7.1 | 2020-03-09 | Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2015-7968 | Medium | 4.3 | 2020-03-09 | nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/… |
CVE-2020-9352 | Critical | 9.8 | 2020-02-23 | An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tool… |
CVE-2020-1693 | High | 8.6 | 2020-02-17 | A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote att… |
CVE-2019-6194 | Medium | 5.7 | 2020-02-14 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information… |
CVE-2020-1975 | Medium | 6.8 | 2020-02-12 | Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that… |
CVE-2020-6187 | Medium | 4.9 | 2020-02-12 | SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised a… |
CVE-2020-2120 | High | 8.8 | 2020-02-12 | Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2115 | High | 8.8 | 2020-02-12 | Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2014-2052 | Critical | 9.8 | 2020-02-11 | Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or… |
CVE-2013-4334 | Critical | 9.8 | 2020-02-07 | opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities |
CVE-2019-10782 | Medium | 5.3 | 2020-01-30 | All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658. |
CVE-2020-2108 | High | 7.6 | 2020-01-29 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configur… |
CVE-2019-4707 | High | 7.1 | 2020-01-28 | IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could… |
CVE-2013-4333 | Critical | 9.1 | 2020-01-24 | OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability |
CVE-2015-1811 | High | 7.5 | 2020-01-15 | XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a craf… |
CVE-2015-1809 | High | 7.5 | 2020-01-15 | XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPa… |
CVE-2020-2092 | High | 8.8 | 2020-01-15 | Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Config… |
CVE-2019-18412 | High | 7.5 | 2020-01-15 | JetBrains IDETalk plugin before version 193.4099.10 allows XXE |
CVE-2015-8549 | High | 7.1 | 2020-01-15 | XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action… |
CVE-2014-5238 | High | 7.8 | 2020-01-14 | XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary… |
CVE-2020-6958 | Critical | 9.1 | 2020-01-14 | An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate… |
CVE-2019-17020 | Medium | 6.5 | 2020-01-08 | If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the con… |
CVE-2019-15983 | Medium | 4.9 | 2020-01-06 | A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information th… |
CVE-2019-20153 | Medium | 4.9 | 2020-01-05 | An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload… |
CVE-2019-3768 | Medium | 6.5 | 2020-01-03 | RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially expl… |
CVE-2019-19032 | High | 8.1 | 2019-12-30 | XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is… |
CVE-2019-19031 | High | 8.1 | 2019-12-30 | Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resources. The component… |
CVE-2019-19998 | High | 7.5 | 2019-12-26 | Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php. |
CVE-2012-2656 | High | 7.5 | 2019-12-18 | An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information. |
CVE-2019-16549 | High | 8.1 | 2019-12-17 | Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle atta… |
CVE-2014-3643 | High | 7.5 | 2019-12-15 | jersey: XXE via parameter entities not disabled by the jersey SAX parser |
CVE-2019-19702 | High | 7.5 | 2019-12-10 | The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp… |
CVE-2019-11216 | Medium | 6.5 | 2019-12-04 | BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to downl… |
CVE-2019-17554 | Medium | 5.5 | 2019-12-04 | The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with c… |
CVE-2011-3600 | High | 7.5 | 2019-11-26 | The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable pa… |
CVE-2019-10080 | Medium | 6.5 | 2019-11-19 | The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has th… |
CVE-2019-17085 | Medium | 6.5 | 2019-11-18 | XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability coul… |
CVE-2018-20687 | Critical | 9.8 | 2019-11-18 | An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticat… |
CVE-2019-10172 | High | 7.5 | 2019-11-18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus ja… |
CVE-2019-14678 | Critical | 10.0 | 2019-11-14 | SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Readi… |
CVE-2014-3599 | Medium | 6.5 | 2019-11-12 | HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy |
CVE-2019-12331 | High | 8.8 | 2019-11-07 | PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared i… |
CVE-2019-8126 | Medium | 4.9 | 2019-11-05 | An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft docu… |
CVE-2019-18227 | High | 7.5 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data. |
CVE-2019-9757 | High | 7.5 | 2019-10-29 | An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-expor… |
CVE-2017-15725 | High | 7.5 | 2019-10-28 | An XML External Entity Injection vulnerability exists in Dzone AnswerHub. |
CVE-2019-8087 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive inf… |
CVE-2019-8086 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive inf… |
CVE-2019-8082 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive informat… |
CVE-2019-18213 | High | 8.8 | 2019-10-23 | XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, all… |
CVE-2019-12415 | Medium | 5.5 | 2019-10-23 | In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an at… |
CVE-2019-10466 | High | 8.1 | 2019-10-23 | An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities… |