# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Moderate severity vulnerability that affects org.apache.ignite:ignite-core](https://agentprime.io/advisories/GHSA-8qfc-cvjp-mgpq.md)
  `GHSA-8qfc-cvjp-mgpq`, `CVE-2016-6805` · Maven `org.apache.ignite:ignite-core`: affected `<1.9`, fixed in `1.9` · CVSS 5.9 Medium · Not analysed yet · Published 16 Oct 2018 · Tags: XML external entities (XXE)
- [Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents](https://agentprime.io/advisories/GHSA-35hc-x2cw-2j4v.md)
  `GHSA-35hc-x2cw-2j4v`, `CVE-2018-0765` · NuGet `System.Security.Cryptography.Xml`: affected `<4.4.2`, fixed in `4.4.2` · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in WECON Technology Co., Ltd LeviStudioU](https://agentprime.io/advisories/CVE-2018-10614.md)
  `CVE-2018-10614` · CVE record: WECON Technology Co., Ltd LeviStudioU · No CVSS score · Not analysed yet · Published 9 Oct 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in WECON PI Studio HMI and others](https://agentprime.io/advisories/CVE-2018-17889.md)
  `CVE-2018-17889` · CVE record: WECON PI Studio HMI and 1 more · No CVSS score · Not analysed yet · Published 8 Oct 2018 · Tags: XML external entities (XXE)
- [Cisco Secure Access Control Server XML External Entity Injection Vulnerability](https://agentprime.io/advisories/CVE-2018-0414.md)
  `CVE-2018-0414` · CVE record: Cisco Cisco Secure Access Control Server Solution Engine (ACSE) · No CVSS score · Not analysed yet · Published 5 Oct 2018 · Tags: XML external entities (XXE)
- [External Entity processing in the RegistrationSharing module](https://agentprime.io/advisories/CVE-2018-12471.md)
  `CVE-2018-12471` · CVE record: SUSE Linux SMT · CVSS 6.5 Medium · Not analysed yet · Published 4 Oct 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in \[UNKNOWN\] JBoss](https://agentprime.io/advisories/CVE-2017-7464.md)
  `CVE-2017-7464` · CVE record: \[UNKNOWN\] JBoss · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2018 · Tags: XML external entities (XXE)
- [feedparser denial of service vulnerability](https://agentprime.io/advisories/GHSA-hjf3-r7gw-9rwg.md)
  `GHSA-hjf3-r7gw-9rwg`, `CVE-2012-2921`, `PYSEC-2012-14` · PyPI `feedparser`: affected `<5.1.2`, fixed in `5.1.2` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in Schweitzer Engineering Laboratories, Inc. AcSELerator Architect](https://agentprime.io/advisories/CVE-2018-10600.md)
  `CVE-2018-10600` · CVE record: Schweitzer Engineering Laboratories, Inc. AcSELerator Architect · No CVSS score · Not analysed yet · Published 24 Jul 2018 · Tags: XML external entities (XXE)
- [Pysaml2 does not sanitize XML responses](https://agentprime.io/advisories/GHSA-c2vx-49jm-h3f6.md)
  `GHSA-c2vx-49jm-h3f6`, `CVE-2016-10149`, `PYSEC-2017-25` · PyPI `pysaml2`: affected `<4.5.0`, fixed in `4.5.0` · CVSS 7.5 High · Not analysed yet · Published 16 Jul 2018 · Tags: XML external entities (XXE)
- [ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity](https://agentprime.io/advisories/CVE-2016-9491.md)
  `CVE-2016-9491` · CVE record: ManageEngine Applications Manager · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: XML external entities (XXE)
- [EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks](https://agentprime.io/advisories/CVE-2016-9487.md)
  `CVE-2016-9487` · CVE record: EpubCheck EpubCheck · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in \[UNKNOWN\] jboss](https://agentprime.io/advisories/CVE-2017-7465.md)
  `CVE-2017-7465` · CVE record: \[UNKNOWN\] jboss · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jun 2018 · Tags: XML external entities (XXE)
- [The Action Message Format (AMF3) deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages](https://agentprime.io/advisories/CVE-2017-3206.md)
  `CVE-2017-3206` · CVE record: Exadel Flamingo amf-serializer · No CVSS score · Not analysed yet · Published 11 Jun 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in GE MDS PulseNET and MDS PulseNET Enterprise](https://agentprime.io/advisories/CVE-2018-10613.md)
  `CVE-2018-10613` · CVE record: GE MDS PulseNET and MDS PulseNET Enterprise · No CVSS score · EPSS 0.18 · Not analysed yet · Published 4 Jun 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in Adobe ColdFusion ColdFusion Update 5 and earlier versions…](https://agentprime.io/advisories/CVE-2018-4942.md)
  `CVE-2018-4942` · CVE record: Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions · CVSS 7.5 High · Not analysed yet · Published 19 May 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in spacewalk](https://agentprime.io/advisories/CVE-2018-1077.md)
  `CVE-2018-1077` · CVE record: spacewalk spacewalk · No CVSS score · Not analysed yet · Published 14 Mar 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in Microsoft Corporation Windows Remote Assistance](https://agentprime.io/advisories/CVE-2018-0878.md)
  `CVE-2018-0878` · CVE record: Microsoft Corporation Windows Remote Assistance · CVSS 3.1 Low · EPSS 0.21 · Not analysed yet · Published 14 Mar 2018 · Tags: XML external entities (XXE)
- [A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD…](https://agentprime.io/advisories/CVE-2017-7375.md)
  `CVE-2017-7375` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in Cisco WebEx Meetings Server](https://agentprime.io/advisories/CVE-2018-0108.md)
  `CVE-2018-0108` · CVE record: Cisco WebEx Meetings Server · No CVSS score · Not analysed yet · Published 18 Jan 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in Cisco AnyConnect](https://agentprime.io/advisories/CVE-2018-0100.md)
  `CVE-2018-0100` · CVE record: Cisco AnyConnect · No CVSS score · Not analysed yet · Published 18 Jan 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in Schneider Electric Wonderware Historian Client](https://agentprime.io/advisories/CVE-2017-7907.md)
  `CVE-2017-7907` · CVE record: Schneider Electric Wonderware Historian Client · No CVSS score · Not analysed yet · Published 19 May 2017 · Tags: XML external entities (XXE)
- [BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com\~tc\~bpem\~him\~uwlconn\~provider\~web/bpemuwlconn URI, aka SAP Se…](https://agentprime.io/advisories/CVE-2016-9563.md)
  `CVE-2016-9563` · CVE record · CVSS 6.5 Medium · Critical (KEV) · In CISA KEV · EPSS 0.24 · Not analysed yet · Published 23 Nov 2016 · Tags: XML external entities (XXE)
- [libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened,…](https://agentprime.io/advisories/CVE-2016-9318.md)
  `CVE-2016-9318` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 16 Nov 2016 · Tags: XML external entities (XXE)

Newest: <https://agentprime.io/advisories/tag/xxe.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe&cursor=WyIyMDE4LTEwLTE2VDIzOjA2OjI1LjAwMDAwMFoiLCJHSFNBLTh2Zm0tNDM4OC02cnBjIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/?cursor=WyIyMDE4LTEwLTE2VDIzOjA2OjI1LjAwMDAwMFoiLCJHSFNBLTh2Zm0tNDM4OC02cnBjIl0>. Everything for agents: <https://agentprime.io/llms.txt>.