# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [untangle vulnerable to Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-f83q-2cp7-qrjg.md)
  `GHSA-f83q-2cp7-qrjg`, `CVE-2022-31471`, `PYSEC-2022-244` · PyPI `untangle`: affected `<1.2.1`, fixed in `1.2.1` · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2022 · Tags: XML external entities (XXE)
- [Inductive Automation Ignition](https://agentprime.io/advisories/CVE-2022-1704.md)
  `CVE-2022-1704` · CVE record: Inductive Automation Ignition · CVSS 7.6 High · Not analysed yet · Published 5 Aug 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in Dogtag PKI](https://agentprime.io/advisories/CVE-2022-2414.md)
  `CVE-2022-2414` · CVE record: Dogtag PKI · No CVSS score · EPSS 0.85 · Not analysed yet · Published 29 Jul 2022 · Tags: XML external entities (XXE)
- [VISAM VBASE Editor Improper Restriction of XML](https://agentprime.io/advisories/CVE-2021-42537.md)
  `CVE-2021-42537` · CVE record: VISAM VBASE Pro-RT/ Server-RT (Web Remote) · CVSS 5.9 Medium · Not analysed yet · Published 27 Jul 2022 · Tags: XML external entities (XXE)
- [OpenKM XXE Injection](https://agentprime.io/advisories/CVE-2022-2131.md)
  `CVE-2022-2131` · CVE record: OpenKM OpenKM Document Management Community · CVSS 8.5 High · Not analysed yet · Published 25 Jul 2022 · Tags: XML external entities (XXE)
- [Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection](https://agentprime.io/advisories/CVE-2022-32458.md)
  `CVE-2022-32458` · CVE record: Data Systems Consulting Co., Ltd. BPM · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2022 · Tags: XML external entities (XXE)
- [Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2](https://agentprime.io/advisories/GHSA-j3h2-8mf8-j5r2.md)
  `GHSA-j3h2-8mf8-j5r2`, `CVE-2015-8031` · Maven `org.jvnet.hudson.main:hudson-core`: affected `<3.3.2`, fixed in `3.3.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in SAP SE SAP Business one](https://agentprime.io/advisories/CVE-2022-35168.md)
  `CVE-2022-35168` · CVE record: SAP SE SAP Business one · No CVSS score · Not analysed yet · Published 12 Jul 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Eclipse Lyo](https://agentprime.io/advisories/GHSA-6296-mvgp-27hp.md)
  `GHSA-6296-mvgp-27hp`, `CVE-2021-41042` · Maven `org.eclipse.lyo:lyo-parent`: affected `>=1.0.0, <5.0.0.Final`, fixed in `5.0.0.Final` · CVSS 4.2 Medium · Not analysed yet · Published 8 Jul 2022 · Tags: XML external entities (XXE)
- [Insufficient user input in Apache Jetspeed-2](https://agentprime.io/advisories/GHSA-h975-r69h-4w9p.md)
  `GHSA-h975-r69h-4w9p`, `CVE-2022-32533` · Maven `org.apache.portals.jetspeed-2:jetspeed-commons`: affected `<=2.3.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2022 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF), XML external entities (XXE), Server-side request forgery (SSRF)
- [XML External Entity Reference in Jenkins Recipe Plugin](https://agentprime.io/advisories/GHSA-rm23-6mwv-8q9q.md)
  `GHSA-rm23-6mwv-8q9q`, `CVE-2022-34793` · Maven `org.jenkins-ci.plugins:recipe`: affected `<=1.2`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 1 Jul 2022 · Tags: XML external entities (XXE)
- [SysAid - Okta SSO integration](https://agentprime.io/advisories/CVE-2022-23170.md)
  `CVE-2022-23170` · CVE record: Sysaid SysAid - Okta SSO integration · CVSS 5.9 Medium · Not analysed yet · Published 24 Jun 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in drools](https://agentprime.io/advisories/GHSA-rc57-9r3x-98cq.md)
  `GHSA-rc57-9r3x-98cq`, `CVE-2021-41411` · Maven `org.drools:drools-core`: affected `<7.60.0.Final`, fixed in `7.60.0.Final` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in Siemens Mendix SAML Module (Mendix 7 compatible) and others](https://agentprime.io/advisories/CVE-2022-32285.md)
  `CVE-2022-32285` · CVE record: Siemens Mendix SAML Module (Mendix 7 compatible) and 2 more · No CVSS score · Not analysed yet · Published 14 Jun 2022 · Tags: XML external entities (XXE)
- [HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-xrh2-c3rm-35jr.md)
  `GHSA-xrh2-c3rm-35jr`, `CVE-2014-3599` · Maven `org.hornetq.rest:hornetq-rest`: affected `<2.5.0.Beta1`, fixed in `2.5.0.Beta1` · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin](https://agentprime.io/advisories/GHSA-6755-jgp4-8q7h.md)
  `GHSA-6755-jgp4-8q7h`, `CVE-2019-10327` · Maven `org.jenkins-ci.plugins:pipeline-maven`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins pom2config Plugin](https://agentprime.io/advisories/GHSA-ppv9-v43c-xqpp.md)
  `GHSA-ppv9-v43c-xqpp`, `CVE-2021-43576` · Maven `org.jenkins-ci.plugins:pom2config`: affected `<=1.2`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins OWASP Dependency-Check Plugin](https://agentprime.io/advisories/GHSA-mj5v-ggjc-48p5.md)
  `GHSA-mj5v-ggjc-48p5`, `CVE-2021-43577` · Maven `org.jenkins-ci.plugins:dependency-check-jenkins-plugin`: affected `<5.1.2`, fixed in `5.1.2` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Performance Plugin](https://agentprime.io/advisories/GHSA-hr8p-76q8-fxwq.md)
  `GHSA-hr8p-76q8-fxwq`, `CVE-2021-21701` · Maven `org.jenkins-ci.plugins:performance`: affected `<=3.20`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Stanford CoreNLP](https://agentprime.io/advisories/GHSA-8gf7-w3cp-gfh3.md)
  `GHSA-8gf7-w3cp-gfh3`, `CVE-2021-3869` · Maven `edu.stanford.nlp:stanford-corenlp`: affected `<4.3.1`, fixed in `4.3.1` · CVSS 8.6 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Stanford CoreNLP](https://agentprime.io/advisories/GHSA-5h9g-8xcv-qjq9.md)
  `GHSA-5h9g-8xcv-qjq9`, `CVE-2021-3878` · Maven `edu.stanford.nlp:stanford-corenlp`: affected `<4.3.1`, fixed in `4.3.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Nested View Plugin](https://agentprime.io/advisories/GHSA-5wc4-w63v-97c3.md)
  `GHSA-5wc4-w63v-97c3`, `CVE-2021-21680` · Maven `org.jenkins-ci.plugins:nested-view`: affected `<1.21`, fixed in `1.21` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Generic Webhook Trigger Plugin](https://agentprime.io/advisories/GHSA-732f-w585-gmpc.md)
  `GHSA-732f-w585-gmpc`, `CVE-2021-21669` · Maven `org.jenkins-ci.plugins:generic-webhook-trigger`: affected `<1.74`, fixed in `1.74` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [SilverStripe XXE Vulnerability in CSSContentParser](https://agentprime.io/advisories/GHSA-3vjc-5x79-m9r8.md)
  `GHSA-3vjc-5x79-m9r8`, `BIT-silverstripe-2020-25817`, `CVE-2020-25817`, `PKSA-b5cb-66pw-rz2d` · Packagist `silverstripe/framework`: affected `>=4.0.0, <4.7.4`, fixed in `4.7.4` · CVSS 4.8 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XML external entity vulnerability in Jenkins Nuget Plugin](https://agentprime.io/advisories/GHSA-p674-hh8x-rv5h.md)
  `GHSA-p674-hh8x-rv5h`, `CVE-2021-21658` · Maven `org.jenkins-ci.plugins:nuget`: affected `<1.1`, fixed in `1.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Filesystem Trigger Plugin](https://agentprime.io/advisories/GHSA-cphv-7cxw-5hcc.md)
  `GHSA-cphv-7cxw-5hcc`, `CVE-2021-21657` · Maven `org.jenkins-ci.plugins:fstrigger`: affected `<0.41`, fixed in `0.41` · CVSS 8.8 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins URLTrigger Plugin](https://agentprime.io/advisories/GHSA-34j5-c4cv-mmg5.md)
  `GHSA-34j5-c4cv-mmg5`, `CVE-2021-21659` · Maven `org.jenkins-ci.plugins:urltrigger`: affected `<0.49`, fixed in `0.49` · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.67 · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in VMware Tools for Windows](https://agentprime.io/advisories/CVE-2022-22977.md)
  `CVE-2022-22977` · CVE record: VMware Tools for Windows · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin](https://agentprime.io/advisories/GHSA-q7xg-hh3q-hc68.md)
  `GHSA-q7xg-hh3q-hc68`, `CVE-2021-21642` · Maven `org.jenkins-ci.plugins:config-file-provider`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.38 · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins CVS Plugin](https://agentprime.io/advisories/GHSA-g9hg-x9c9-7xgr.md)
  `GHSA-g9hg-x9c9-7xgr`, `CVE-2020-2324` · Maven `org.jenkins-ci.plugins:cvs`: affected `<2.17`, fixed in `2.17` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Visualworks Store Plugin](https://agentprime.io/advisories/GHSA-jvjm-j945-8qwc.md)
  `GHSA-jvjm-j945-8qwc`, `CVE-2020-2315` · Maven `org.jenkins-ci.plugins:visualworks-store`: affected `<1.1.4`, fixed in `1.1.4` · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Mercurial Plugin](https://agentprime.io/advisories/GHSA-x58r-wxc3-7pqr.md)
  `GHSA-x58r-wxc3-7pqr`, `CVE-2020-2305` · Maven `org.jenkins-ci.plugins:mercurial`: affected `>=2.11, <2.12 || >=2.10, <2.10.1 || >=2.9, <2.9.1 || <2.8.1`, fixed in `2.12`, `2.10.1`, `2.9.1`, `2.8.1` · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Subversion Plugin](https://agentprime.io/advisories/GHSA-vp5f-8jgw-j53c.md)
  `GHSA-vp5f-8jgw-j53c`, `CVE-2020-2304` · Maven `org.jenkins-ci.plugins:subversion`: affected `<2.13.2`, fixed in `2.13.2` · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Nerrvana Plugin](https://agentprime.io/advisories/GHSA-wcrg-92wp-4h28.md)
  `GHSA-wcrg-92wp-4h28`, `CVE-2020-2298` · Maven `org.jenkins-ci.plugins:nerrvana-plugin`: affected `<=1.02.06`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Liquibase Runner Plugin](https://agentprime.io/advisories/GHSA-xx7g-f287-f9fq.md)
  `GHSA-xx7g-f287-f9fq`, `CVE-2020-2284` · Maven `org.jenkins-ci.plugins:liquibase-runner`: affected `<1.4.7`, fixed in `1.4.7` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [DotPlant2 Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-c49v-35ff-q9f7.md)
  `GHSA-c49v-35ff-q9f7`, `CVE-2020-25750`, `PKSA-xk2c-gr8p-myh2` · Packagist `devgroup/dotplant`: affected `<2020-09-14`, fixed in `2020-09-14` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Klocwork Analysis Plugin](https://agentprime.io/advisories/GHSA-p6c5-737r-2r93.md)
  `GHSA-p6c5-737r-2r93`, `CVE-2020-2247` · Maven `org.jenkins-ci.plugins:klocwork`: affected `<2020.3.1`, fixed in `2020.3.1` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Valgrind Plugin](https://agentprime.io/advisories/GHSA-xq2q-8hxc-7jr2.md)
  `GHSA-xq2q-8hxc-7jr2`, `CVE-2020-2245` · Maven `org.jenkins-ci.plugins:valgrind`: affected `<=0.28`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Parasoft Findings Plugin](https://agentprime.io/advisories/GHSA-2rh4-xgmq-63jp.md)
  `GHSA-2rh4-xgmq-63jp`, `CVE-2020-2178` · Maven `com.parasoft:parasoft-findings`: affected `<10.4.4`, fixed in `10.4.4` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Code Coverage API Plugin](https://agentprime.io/advisories/GHSA-cmgm-q8hf-p7jc.md)
  `GHSA-cmgm-q8hf-p7jc`, `CVE-2020-2172` · Maven `io.jenkins.plugins:code-coverage-api`: affected `<1.1.5`, fixed in `1.1.5` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE), Denial of service
- [Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Mulesoft APIkit](https://agentprime.io/advisories/GHSA-jffq-528j-mp6c.md)
  `GHSA-jffq-528j-mp6c`, `CVE-2020-10991` · Maven `org.mule.modules:mule-apikit-module`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins RapidDeploy Plugin](https://agentprime.io/advisories/GHSA-g7w4-r4mg-gvhx.md)
  `GHSA-g7w4-r4mg-gvhx`, `CVE-2020-2171` · Maven `org.jenkins-ci.plugins:rapiddeploy-jenkins`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 7.6 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [AutoUpdater.NET allows XXE](https://agentprime.io/advisories/GHSA-75p2-hgw4-g7f7.md)
  `GHSA-75p2-hgw4-g7f7`, `CVE-2019-20627` · NuGet `Autoupdater.NET.Official`: affected `<1.5.8`, fixed in `1.5.8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Cobertura Plugin](https://agentprime.io/advisories/GHSA-vpfj-5gg5-fvfm.md)
  `GHSA-vpfj-5gg5-fvfm`, `CVE-2020-2138` · Maven `org.jenkins-ci.plugins:cobertura`: affected `<1.16`, fixed in `1.16` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Rundeck Plugin](https://agentprime.io/advisories/GHSA-5xh7-6v3x-vrhj.md)
  `GHSA-5xh7-6v3x-vrhj`, `CVE-2020-2144` · Maven `org.jenkins-ci.plugins:rundeck`: affected `<3.6.7`, fixed in `3.6.7` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in FitNesse Plugin](https://agentprime.io/advisories/GHSA-c3cg-mv5w-cvw8.md)
  `GHSA-c3cg-mv5w-cvw8`, `CVE-2020-2120` · Maven `org.jenkins-ci.plugins:fitnesse`: affected `<1.31`, fixed in `1.31` · CVSS 7.6 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in NUnit Plugin](https://agentprime.io/advisories/GHSA-xvhf-q744-5xm8.md)
  `GHSA-xvhf-q744-5xm8`, `CVE-2020-2115` · Maven `org.jenkins-ci.plugins:nunit`: affected `<0.26`, fixed in `0.26` · CVSS 7.6 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins WebSphere Deployer Plugin](https://agentprime.io/advisories/GHSA-f5wx-w2f9-82gh.md)
  `GHSA-f5wx-w2f9-82gh`, `CVE-2020-2108` · Maven `org.jenkins-ci.plugins:websphere-deployer`: affected `<=1.6.1`, no fixed version yet · CVSS 7.6 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Robot Framework Plugin](https://agentprime.io/advisories/GHSA-m53p-f25q-q6fg.md)
  `GHSA-m53p-f25q-q6fg`, `CVE-2020-2092` · Maven `org.jenkins-ci.plugins:robot`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 7.6 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [PyAMF vulnerable to XML external entity (XXE)](https://agentprime.io/advisories/GHSA-m7m4-4vm8-55wg.md)
  `GHSA-m7m4-4vm8-55wg`, `CVE-2015-8549`, `PYSEC-2020-339` · PyPI `pyamf`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XML external entity (XXE) vulnerability in Jenkins](https://agentprime.io/advisories/GHSA-qj27-w92h-fc9r.md)
  `GHSA-qj27-w92h-fc9r`, `CVE-2015-1809` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=1.597, <1.600 || <1.596.1`, fixed in `1.600`, `1.596.1` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [Jenkins Maven Release Plug-in Plugin XXE vulnerability](https://agentprime.io/advisories/GHSA-7mf5-79gv-66gh.md)
  `GHSA-7mf5-79gv-66gh`, `CVE-2019-16549` · Maven `org.jenkins-ci.plugins.m2release:m2release`: affected `<0.16.2`, fixed in `0.16.2` · CVSS 7.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache POI](https://agentprime.io/advisories/GHSA-9jwc-q6j3-8g9g.md)
  `GHSA-9jwc-q6j3-8g9g`, `CVE-2019-12415` · Maven `org.apache.poi:poi`: affected `<4.1.1`, fixed in `4.1.1` · CVSS 5.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [Jenkins 360 FireLine Plugin vulnerable to XML External Entity Reference](https://agentprime.io/advisories/GHSA-346g-jrx9-jgf4.md)
  `GHSA-346g-jrx9-jgf4`, `CVE-2019-10466` · Maven `org.jenkins-ci.plugins.plugin:fireline`: affected `<=1.7.2`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [CodeIgniter Rest Server XXE Vulnerability](https://agentprime.io/advisories/GHSA-cc7g-9pcj-7gwm.md)
  `GHSA-cc7g-9pcj-7gwm`, `CVE-2015-3907`, `PKSA-fhqk-745m-6p82` · Packagist `chriskacerguis/codeigniter-restserver`: affected `<2.7.2`, fixed in `2.7.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin](https://agentprime.io/advisories/GHSA-g6h2-4x64-c59x.md)
  `GHSA-g6h2-4x64-c59x`, `CVE-2019-10337` · Maven `org.jenkins-ci.plugins:token-macro`: affected `<2.8`, fixed in `2.8` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response](https://agentprime.io/advisories/GHSA-w898-3ph8-5pgm.md)
  `GHSA-w898-3ph8-5pgm`, `CVE-2019-10309` · Maven `org.jenkins-ci.plugins:swarm`: affected `<=3.15`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 24 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Jenkins Storable Configs Plugin](https://agentprime.io/advisories/GHSA-wqmp-2p5r-rhfv.md)
  `GHSA-wqmp-2p5r-rhfv`, `CVE-2022-30971` · Maven `org.jvnet.hudson.plugins:storable-configs-plugin`: affected `<=1.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 18 May 2022 · Tags: XML external entities (XXE)
- [jersey: XXE via parameter entities](https://agentprime.io/advisories/GHSA-5m48-vr54-vmh3.md)
  `GHSA-5m48-vr54-vmh3`, `CVE-2014-3643` · Maven `com.sun.jersey:jersey-core`: affected `<1.13`, fixed in `1.13` · CVSS 8.1 High · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Zend Framework XXE Vulnerability](https://agentprime.io/advisories/GHSA-9m5v-vq4f-mrvf.md)
  `GHSA-9m5v-vq4f-mrvf`, `CVE-2012-5657`, `PKSA-6k49-tm57-6c4z` · Packagist `zendframework/zendframework1`: affected `<1.11.15 || >=1.12.0-rc1, <1.12.1`, fixed in `1.11.15`, `1.12.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Information disclosure, XML external entities (XXE)

Newest: <https://agentprime.io/advisories/tag/xxe.md>
Older: <https://agentprime.io/advisories/tag/xxe.md?cursor=WyIyMDIyLTA1LTE3VDA1OjEwOjQ2LjAwMDAwMFoiLCJHSFNBLTltNXYtdnE0Zi1tcnZmIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe&cursor=WyIyMDIyLTA4LTExVDE4OjA2OjA1LjAwMDAwMFoiLCJHSFNBLTdyOXgtcXJwci0zY3h3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/?cursor=WyIyMDIyLTA4LTExVDE4OjA2OjA1LjAwMDAwMFoiLCJHSFNBLTdyOXgtcXJwci0zY3h3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.