# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [XML external entity injection in Lenovo XClarity Administrator (LXCA)](https://agentprime.io/advisories/CVE-2019-6194.md)
  `CVE-2019-6194` · CVE record: Lenovo XClarity Administrator (LXCA) · CVSS 5.7 Medium · Not analysed yet · Published 14 Feb 2020 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in jackson-mapper-asl](https://agentprime.io/advisories/GHSA-r6j9-8759-g62w.md)
  `GHSA-r6j9-8759-g62w`, `CVE-2019-10172` · Maven `org.codehaus.jackson:jackson-mapper-asl`: affected `<=1.9.13`, no fixed version yet · CVSS 5.9 Medium · EPSS 0.17 · Not analysed yet · Published 4 Feb 2020 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache Olingo](https://agentprime.io/advisories/GHSA-mgh8-hcwj-h57v.md)
  `GHSA-mgh8-hcwj-h57v`, `CVE-2019-17554` · Maven `org.apache.olingo:odata-client-core` and 1 more: affected `>=4.0.0, <4.7.0`, fixed in `4.7.0` · CVSS 5.5 Medium · EPSS 0.12 · Not analysed yet · Published 4 Feb 2020 · Tags: XML external entities (XXE)
- [XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))](https://agentprime.io/advisories/GHSA-763g-fqq7-48wg.md)
  `GHSA-763g-fqq7-48wg`, `CVE-2019-10782`, `SNYK-JAVA-COMPUPPYCRAWLTOOLS-543266` · Maven `com.puppycrawl.tools:checkstyle`: affected `<8.29`, fixed in `8.29` · CVSS 5.3 Medium · Not analysed yet · Published 31 Jan 2020 · Tags: XML external entities (XXE)
- [Cisco Data Center Network Manager XML External Entity Read Access Vulnerability](https://agentprime.io/advisories/CVE-2019-15983.md)
  `CVE-2019-15983` · CVE record: Cisco Cisco Data Center Network Manager · CVSS 4.9 Medium · Not analysed yet · Published 6 Jan 2020 · Tags: XML external entities (XXE)
- [XML external entity injection in Dell RSA Authentication Manager](https://agentprime.io/advisories/CVE-2019-3768.md)
  `CVE-2019-3768` · CVE record: Dell RSA Authentication Manager · CVSS 6.5 Medium · Not analysed yet · Published 3 Jan 2020 · Tags: XML external entities (XXE)
- [Apache NiFi information disclosure by XXE](https://agentprime.io/advisories/GHSA-744r-vv2g-2x6g.md)
  `GHSA-744r-vv2g-2x6g`, `CVE-2019-10080` · Maven `org.apache.nifi:nifi` and 1 more: affected `>=1.3.0, <1.10.0`, fixed in `1.10.0` · CVSS 6.5 Medium · Not analysed yet · Published 2 Dec 2019 · Tags: XML external entities (XXE)
- [XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue](https://agentprime.io/advisories/GHSA-vvwv-h69m-wg6f.md)
  `GHSA-vvwv-h69m-wg6f`, `CVE-2019-12331`, `PKSA-hn36-2kk8-hb3y`, `PKSA-zdkr-vbc6-f2vy` · Packagist `phpoffice/phpexcel` and 1 more: affected `<=1.8.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 20 Nov 2019 · Tags: XML external entities (XXE)
- [Information disclosure through processing of external XML entities](https://agentprime.io/advisories/GHSA-427g-2r83-3ccm.md)
  `GHSA-427g-2r83-3ccm`, `CVE-2019-8126`, `PKSA-25tw-5qhs-qn2g`, `PKSA-spcq-d579-ch79` · Packagist `magento/community-edition`: affected `>=2.2, <2.2.10 || >=2.3, <2.3.2-p2`, fixed in `2.2.10`, `2.3.2-p2` · CVSS 4.9 Medium · Not analysed yet · Published 12 Nov 2019 · Tags: XML external entities (XXE), Denial of service
- [XML external entity injection in Advantech WISE-PaaS/RMM](https://agentprime.io/advisories/CVE-2019-18227.md)
  `CVE-2019-18227` · CVE record: Advantech WISE-PaaS/RMM · No CVSS score · Not analysed yet · Published 31 Oct 2019 · Tags: XML external entities (XXE)
- [Cisco Unified Communications Manager XML External Expansion Vulnerability](https://agentprime.io/advisories/CVE-2019-12711.md)
  `CVE-2019-12711` · CVE record: Cisco Cisco Unified Communications Manager · CVSS 6.1 Medium · Not analysed yet · Published 2 Oct 2019 · Tags: XML external entities (XXE)
- [Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.](https://agentprime.io/advisories/CVE-2019-13608.md)
  `CVE-2019-13608` · CVE record · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.30 · Not analysed yet · Published 29 Aug 2019 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in ladon](https://agentprime.io/advisories/GHSA-vg35-vc9f-q7x2.md)
  `GHSA-vg35-vc9f-q7x2`, `CVE-2019-1010268`, `PYSEC-2019-184` · PyPI `ladon`: affected `>=0.6.1, <=1.0.7`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jul 2019 · Tags: XML external entities (XXE)
- [XML external entity injection in Mitsubishi Electric FR Configurator2](https://agentprime.io/advisories/CVE-2019-10976.md)
  `CVE-2019-10976` · CVE record: Mitsubishi Electric Mitsubishi Electric FR Configurator2 · No CVSS score · Not analysed yet · Published 25 Jul 2019 · Tags: XML external entities (XXE)
- [Vulnerability that affects org.apache.pdfbox:pdfbox](https://agentprime.io/advisories/GHSA-c9jj-3wvg-q65h.md)
  `GHSA-c9jj-3wvg-q65h`, `CVE-2019-0228` · Maven `org.apache.pdfbox:pdfbox`: affected `>=2.0.14, <2.0.15`, fixed in `2.0.15` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jul 2019 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in DiffPlug Spotless](https://agentprime.io/advisories/GHSA-7v35-qwwj-p98g.md)
  `GHSA-7v35-qwwj-p98g`, `CVE-2019-9843` · Maven `com.diffplug.spotless:spotless-maven-plugin` and 1 more: affected `<1.20.0`, fixed in `1.20.0` · CVSS 7.5 High · Not analysed yet · Published 5 Jul 2019 · Tags: XML external entities (XXE)
- [In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enoug…](https://agentprime.io/advisories/CVE-2018-20843.md)
  `CVE-2018-20843` · CVE record · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2019 · Tags: XML external entities (XXE)
- [Cisco Security Manager XML Entity Expansion Vulnerability](https://agentprime.io/advisories/CVE-2019-1903.md)
  `CVE-2019-1903` · CVE record: Cisco Cisco Security Manager · CVSS 6.5 Medium · Not analysed yet · Published 20 Jun 2019 · Tags: XML external entities (XXE)
- [mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.](https://agentprime.io/advisories/CVE-2019-9670.md)
  `CVE-2019-9670` · CVE record · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 29 May 2019 · Tags: XML external entities (XXE)
- [XML External Entity injection in Apache Camel](https://agentprime.io/advisories/GHSA-h896-mx9x-g32g.md)
  `GHSA-h896-mx9x-g32g`, `CVE-2019-0188` · Maven `org.apache.camel:camel-core` and 1 more: affected `<2.24.0`, fixed in `2.24.0` · CVSS 7.5 High · Not analysed yet · Published 29 May 2019 · Tags: XML external entities (XXE)
- [XML external entity injection in The Eclipse Foundation Eclipse Kura](https://agentprime.io/advisories/CVE-2019-10244.md)
  `CVE-2019-10244` · CVE record: The Eclipse Foundation Eclipse Kura · No CVSS score · Not analysed yet · Published 9 Apr 2019 · Tags: XML external entities (XXE)
- [Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle](https://agentprime.io/advisories/GHSA-gp32-7h29-rpxm.md)
  `GHSA-gp32-7h29-rpxm`, `CVE-2019-9658` · Maven `com.puppycrawl.tools:checkstyle`: affected `<8.18`, fixed in `8.18` · CVSS 5.3 Medium · Not analysed yet · Published 14 Mar 2019 · Tags: XML external entities (XXE)
- [Cisco IoT Field Network Director XML External Entity Vulnerability](https://agentprime.io/advisories/CVE-2019-1698.md)
  `CVE-2019-1698` · CVE record: Cisco Cisco IoT Field Network Director (IoT-FND) · CVSS 4.9 Medium · Not analysed yet · Published 21 Feb 2019 · Tags: XML external entities (XXE)
- [Low severity vulnerability that affects org.springframework.batch:spring-batch-core](https://agentprime.io/advisories/GHSA-3wc8-659g-r88q.md)
  `GHSA-3wc8-659g-r88q`, `CVE-2019-3774` · Maven `org.springframework.batch:spring-batch-core`: affected `<3.0.10.RELEASE || >=4.0.0.RELEASE, <4.0.2.RELEASE || >=4.1.0.RELEASE, <4.1.1.RELEASE`, fixed in `3.0.10.RELEASE`, `4.0.2.RELEASE`, `4.1.1.RELEASE` · No CVSS score · Not analysed yet · Published 25 Jan 2019 · Tags: XML external entities (XXE)
- [Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml](https://agentprime.io/advisories/GHSA-8222-6fc8-mhvf.md)
  `GHSA-8222-6fc8-mhvf`, `CVE-2019-3773` · Maven `org.springframework.ws:spring-ws` and 1 more: affected `<2.4.4 || >=3.0.0, <3.0.6`, fixed in `2.4.4`, `3.0.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jan 2019 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml](https://agentprime.io/advisories/GHSA-wr5r-m8pc-85j9.md)
  `GHSA-wr5r-m8pc-85j9`, `CVE-2019-3772` · Maven `org.springframework.integration:spring-integration-ws` and 1 more: affected `<4.3.19 || >=5.0.0, <5.0.11 || >=5.1.0, <5.1.2`, fixed in `4.3.19`, `5.0.11`, `5.1.2` · No CVSS score · Not analysed yet · Published 25 Jan 2019 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Apache Karaf](https://agentprime.io/advisories/GHSA-92wj-x78c-m4fx.md)
  `GHSA-92wj-x78c-m4fx`, `CVE-2018-11788` · Maven `org.apache.karaf.specs:org.apache.karaf.specs.java.xml`: affected `>=4.2.0, <4.2.2 || <4.1.7`, fixed in `4.2.2`, `4.1.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jan 2019 · Tags: XML external entities (XXE)
- [XML External Entity Reference in mchange:c3p0](https://agentprime.io/advisories/GHSA-q485-j897-qc27.md)
  `GHSA-q485-j897-qc27`, `CVE-2018-20433` · Maven `com.mchange:c3p0`: affected `<0.9.5.3`, fixed in `0.9.5.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jan 2019 · Tags: XML external entities (XXE)
- [XML External Entity Reference (XXE) in jackson-databind](https://agentprime.io/advisories/GHSA-x2w5-5m2g-7h5m.md)
  `GHSA-x2w5-5m2g-7h5m`, `CVE-2018-14720` · Maven `com.fasterxml.jackson.core:jackson-databind`: affected `>=2.9.0, <2.9.7 || >=2.8.0, <2.8.11.3 || >=2.7.0, <2.7.9.5`, fixed in `2.9.7`, `2.8.11.3`, `2.7.9.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jan 2019 · Tags: Insecure deserialization, XML external entities (XXE)
- [XML External Entity (XXE) vulnerability in Square Retrofit](https://agentprime.io/advisories/GHSA-j379-9jr9-w5cq.md)
  `GHSA-j379-9jr9-w5cq`, `CVE-2018-1000844` · Maven `com.squareup.retrofit2:retrofit`: affected `>=2.0.0, <2.5.0`, fixed in `2.5.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Dec 2018 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) vulnerability in bw-calendar-engine](https://agentprime.io/advisories/GHSA-xmvg-w4f9-99r7.md)
  `GHSA-xmvg-w4f9-99r7`, `CVE-2018-1000836` · Maven `org.bedework.caleng:bw-calendar-engine`: affected `<=3.12.2`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Dec 2018 · Tags: XML external entities (XXE)
- [exist-db:exist-core XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-jxm5-5xcw-h57q.md)
  `GHSA-jxm5-5xcw-h57q`, `CVE-2018-1000823` · Maven `org.exist-db:exist-core`: affected `<5.1.0`, fixed in `5.1.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Dec 2018 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) vulnerability in codelibs fess](https://agentprime.io/advisories/GHSA-77hp-pfxw-4w63.md)
  `GHSA-77hp-pfxw-4w63`, `CVE-2018-1000822` · Maven `org.codelibs.fess:fess`: affected `<12.3.2`, fixed in `12.3.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Dec 2018 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) vulnerability in neo4j.procedure:apoc](https://agentprime.io/advisories/GHSA-r2pp-x4mm-4999.md)
  `GHSA-r2pp-x4mm-4999`, `CVE-2018-1000820` · Maven `org.neo4j.procedure:apoc`: affected `<3.4.0.4`, fixed in `3.4.0.4` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Dec 2018 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in bedework:bw-webdav](https://agentprime.io/advisories/GHSA-5p52-j8pw-j7x5.md)
  `GHSA-5p52-j8pw-j7x5`, `CVE-2018-20000` · Maven `org.bedework:bw-webdav`: affected `>=4.0.1, <4.0.3`, fixed in `4.0.3` · CVSS 7.5 High · Not analysed yet · Published 19 Dec 2018 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in pippo-core](https://agentprime.io/advisories/GHSA-rmm5-g63h-m6g9.md)
  `GHSA-rmm5-g63h-m6g9`, `CVE-2018-20059` · Maven `ro.pippo:pippo-core`: affected `<1.12.0`, fixed in `1.12.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Dec 2018 · Tags: XML external entities (XXE)
- [Cisco Energy Management Suite XML External Entity Vulnerability](https://agentprime.io/advisories/CVE-2018-15444.md)
  `CVE-2018-15444` · CVE record: Cisco Cisco Energy Management Suite · CVSS 6.3 Medium · Not analysed yet · Published 8 Nov 2018 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core](https://agentprime.io/advisories/GHSA-qfjv-998w-q48f.md)
  `GHSA-qfjv-998w-q48f`, `CVE-2018-17186` · Maven `org.apache.syncope:syncope-core`: affected `<2.0.11 || >=2.1.0, <2.1.2`, fixed in `2.0.11`, `2.1.2` · CVSS 7.2 High · Not analysed yet · Published 6 Nov 2018 · Tags: XML external entities (XXE)
- [XML external entity injection in CASE Suite](https://agentprime.io/advisories/CVE-2018-17912.md)
  `CVE-2018-17912` · CVE record: unknown CASE Suite · No CVSS score · Not analysed yet · Published 2 Nov 2018 · Tags: XML external entities (XXE)
- [Eclipse RDF4j vulnerable to XML External Entity](https://agentprime.io/advisories/GHSA-6xq8-pvg4-3mf3.md)
  `GHSA-6xq8-pvg4-3mf3`, `CVE-2018-1000644` · Maven `org.eclipse.rdf4j:rdf4j-runtime`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2018 · Tags: XML external entities (XXE)
- [Android SVG vulnerable to XML External Entity (XXE)](https://agentprime.io/advisories/GHSA-g556-x5vx-qh59.md)
  `GHSA-g556-x5vx-qh59`, `CVE-2017-1000498` · Maven `com.caverock:androidsvg`: affected `<1.3`, fixed in `1.3` · CVSS 7.8 High · Not analysed yet · Published 19 Oct 2018 · Tags: XML external entities (XXE)
- [Apache juddi-client vulnerable to XML External Entity (XXE)](https://agentprime.io/advisories/GHSA-p99p-726h-c8v5.md)
  `GHSA-p99p-726h-c8v5`, `CVE-2018-1307` · Maven `org.apache.juddi:juddi-client`: affected `>=3.2, <3.3.5`, fixed in `3.3.5` · CVSS 8.1 High · Not analysed yet · Published 19 Oct 2018 · Tags: XML external entities (XXE)
- [Moderate severity vulnerability that affects com.adobe.xmp:xmpcore](https://agentprime.io/advisories/GHSA-qv32-7r6p-xhhh.md)
  `GHSA-qv32-7r6p-xhhh`, `CVE-2016-4216` · Maven `com.adobe.xmp:xmpcore`: affected `<5.1.3`, fixed in `5.1.3` · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2018 · Tags: XML external entities (XXE)
- [jackson-dataformat-xml vulnerable to server side request forgery (SSRF)](https://agentprime.io/advisories/GHSA-7c2r-3jqf-c9rw.md)
  `GHSA-7c2r-3jqf-c9rw`, `CVE-2016-7051` · Maven `com.fasterxml.jackson.dataformat:jackson-dataformat-xml`: affected `<2.7.8 || >=2.8.0, <2.8.4`, fixed in `2.7.8`, `2.8.4` · CVSS 8.6 High · Not analysed yet · Published 18 Oct 2018 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [jackson-dataformat-xml vulnerable to XML external entity (XXE)](https://agentprime.io/advisories/GHSA-hmq6-frv3-4727.md)
  `GHSA-hmq6-frv3-4727`, `CVE-2016-3720` · Maven `com.fasterxml.jackson.dataformat:jackson-dataformat-xml`: affected `<2.7.4`, fixed in `2.7.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2018 · Tags: XML external entities (XXE)
- [Remote code execution occurs in Apache Solr](https://agentprime.io/advisories/GHSA-mh7g-99w9-xpjm.md)
  `GHSA-mh7g-99w9-xpjm`, `CVE-2017-12629` · Maven `org.apache.solr:solr-core`: affected `>=7.0.0, <7.1.0 || >=6.0.0, <6.6.2 || >=5.5.0, <5.5.5`, fixed in `7.1.0`, `6.6.2`, `5.5.5` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.92 · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [There is a XML external entity expansion (XXE) vulnerability in Apache Solr config files](https://agentprime.io/advisories/GHSA-rc9v-h28f-jcmf.md)
  `GHSA-rc9v-h28f-jcmf`, `CVE-2018-8010` · Maven `org.apache.solr:solr-core`: affected `>=6.6.0, <6.6.4 || >=7.0.0, <7.3.1`, fixed in `6.6.4`, `7.3.1` · CVSS 5.5 Medium · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [There is a XML external entity expansion (XXE) vulnerability in Apache Solr](https://agentprime.io/advisories/GHSA-3pph-2595-cgfh.md)
  `GHSA-3pph-2595-cgfh`, `CVE-2018-1308` · Maven `org.apache.solr:solr-core`: affected `>=1.2, <6.6.3 || >=7.0.0, <7.3.0`, fixed in `6.6.3`, `7.3.0` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [XML external entity expansion in org.apache.solr:solr-core](https://agentprime.io/advisories/GHSA-7px3-6f6g-hxcj.md)
  `GHSA-7px3-6f6g-hxcj`, `CVE-2018-8026` · Maven `org.apache.solr:solr-core`: affected `>=7.0.0, <7.4.0 || >=6.0.0, <6.6.5`, fixed in `7.4.0`, `6.6.5` · CVSS 5.5 Medium · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.](https://agentprime.io/advisories/GHSA-6fvx-r7hx-3vh6.md)
  `GHSA-6fvx-r7hx-3vh6`, `CVE-2018-15531` · Maven `net.bull.javamelody:javamelody-core`: affected `<1.74.0`, fixed in `1.74.0` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [High severity vulnerability that affects org.apache.pdfbox:pdfbox](https://agentprime.io/advisories/GHSA-4c32-xmgj-2g98.md)
  `GHSA-4c32-xmgj-2g98`, `CVE-2016-2175` · Maven `org.apache.pdfbox:pdfbox`: affected `<1.8.12 || >=2.0.0, <2.0.1`, fixed in `1.8.12`, `2.0.1` · CVSS 7.8 High · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references](https://agentprime.io/advisories/GHSA-m929-7fr6-cvjg.md)
  `GHSA-m929-7fr6-cvjg`, `CVE-2018-1259` · Maven `org.springframework.data:spring-data-commons`: affected `>=1.13.0, <1.13.12 || >=2.0.0, <2.0.7`, fixed in `1.13.12`, `2.0.7` · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [Moderate severity vulnerability that affects io.vertx:vertx-core](https://agentprime.io/advisories/GHSA-qh3m-qw6v-qvhg.md)
  `GHSA-qh3m-qw6v-qvhg`, `CVE-2018-12544` · Maven `io.vertx:vertx-core`: affected `>=3.5.0, <3.5.4`, fixed in `3.5.4` · No CVSS score · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [High severity vulnerability that affects org.apache.tika:tika-core](https://agentprime.io/advisories/GHSA-6jq2-789q-fff2.md)
  `GHSA-6jq2-789q-fff2`, `CVE-2018-11761` · Maven `org.apache.tika:tika-core`: affected `>=0.1, <1.19.1`, fixed in `1.19.1` · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [Apache Tika does not properly initialize the XML parser or choose handlers](https://agentprime.io/advisories/GHSA-4xr4-4c65-hj7f.md)
  `GHSA-4xr4-4c65-hj7f`, `CVE-2016-4434` · Maven `org.apache.tika:tika-core`: affected `<1.13`, fixed in `1.13` · CVSS 7.8 High · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack](https://agentprime.io/advisories/GHSA-h8q5-g2cj-qr5h.md)
  `GHSA-h8q5-g2cj-qr5h`, `CVE-2018-11796` · Maven `org.apache.tika:tika-core`: affected `>=0.1, <1.19.1`, fixed in `1.19.1` · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [Restlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider](https://agentprime.io/advisories/GHSA-2mp8-qvqm-3xwq.md)
  `GHSA-2mp8-qvqm-3xwq`, `CVE-2017-14868` · Maven `org.restlet.jse:org.restlet.ext.jaxrs`: affected `<2.3.11`, fixed in `2.3.11` · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request](https://agentprime.io/advisories/GHSA-cvj4-g3gx-8vqq.md)
  `GHSA-cvj4-g3gx-8vqq`, `CVE-2017-14949` · Maven `org.restlet.jse:org.restlet`: affected `<2.3.12`, fixed in `2.3.12` · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2018 · Tags: XML external entities (XXE)
- [Apache Camel XML External Entity vulnerability](https://agentprime.io/advisories/GHSA-3hrc-f439-727g.md)
  `GHSA-3hrc-f439-727g`, `CVE-2015-0263` · Maven `org.apache.camel:camel-core`: affected `<2.13.4 || >=2.14.0, <2.14.2`, fixed in `2.13.4`, `2.14.2` · No CVSS score · Not analysed yet · Published 16 Oct 2018 · Tags: XML external entities (XXE)
- [Apache is vulnerable to XXE in XSD validation processor](https://agentprime.io/advisories/GHSA-8vfm-4388-6rpc.md)
  `GHSA-8vfm-4388-6rpc`, `CVE-2018-8027` · Maven `org.apache.camel:camel-core`: affected `>=2.20.0, <2.20.4 || >=2.21.0, <2.21.1`, fixed in `2.20.4`, `2.21.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2018 · Tags: XML external entities (XXE)

Newest: <https://agentprime.io/advisories/tag/xxe.md>
Older: <https://agentprime.io/advisories/tag/xxe.md?cursor=WyIyMDE4LTEwLTE2VDIzOjA2OjI1LjAwMDAwMFoiLCJHSFNBLTh2Zm0tNDM4OC02cnBjIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe&cursor=WyIyMDIwLTAyLTE3VDE5OjM1OjQzLjAwMDAwMFoiLCJDVkUtMjAyMC0xNjkzIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/?cursor=WyIyMDIwLTAyLTE3VDE5OjM1OjQzLjAwMDAwMFoiLCJDVkUtMjAyMC0xNjkzIl0>. Everything for agents: <https://agentprime.io/llms.txt>.