Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.2 CriticalCritical · CVSS 9+
XML Injection in SFS Consulting's ww.Winsure
- SFS Consulting ww.Winsure
- XML external entities (XXE)
- CVSS 8.2 HighCritical · CVSS 7+ and EPSS
XML external entity injection in Ivanti EPM
- Ivanti EPM
- XML external entities (XXE)
- CVSS 8.8 High
Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.
- XML external entities (XXE)
- CVSS 8.6 High
XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`
- XML external entities (XXE)
<6.3.23 · fixed in 6.3.23
GHSA-6cr6-ph3p-f5rf · CVE-2024-45294 - CVSS 6.5 Medium
GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection
- XML external entities (XXE)
<4.0.3 · fixed in 4.0.3
GHSA-mcmc-c59m-pqq8 · CVE-2023-26043 - CVSS 8.8 High
XXE in PHPSpreadsheet encoding is returned
- XML external entities (XXE)
<=1.8.2 · no fixed version yet
GHSA-ghg6-32f9-2jp7 · CVE-2024-45048 - CVSS 8.8 High
XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which cou…
- XML external entities (XXE)
- CVSS 8.2 HighCritical · CVSS 7+ and EPSS
XML external entity injection in Ivanti Avalanche
- Ivanti Avalanche
- XML external entities (XXE)
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Journyx Unauthenticated XML External Entities Injection
- Journyx (jtime)
- XML external entities (XXE)
- CVSS 6.3 Medium
XML External Entity in Akana
- Akana API Platform
- XML external entities (XXE)
- CVSS 8.8 High
XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill
- XML external entities (XXE)
>=1.19.0, <1.21.2 · fixed in 1.21.2
GHSA-v62g-jwj9-rfvx · CVE-2023-48362 - CVSS 4.3 Medium
Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
- XML external entities (XXE)
- CVSS 5.9 Medium
Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<0.5.0 · fixed in 0.5.0
GHSA-f8hx-f4xw-c646 · CVE-2024-6961 - CVSS 6.5 Medium
XML External Entity Injection in PruvaSoft Informatics' Apinizer Management Console
- PruvaSoft Informatics Apinizer Management Console
- XML external entities (XXE)
- CVSS 7.1 High
IBM Engineering Requirements Management DOORS XML external entity injection
- IBM Engineering Requirements Management DOORS
- XML external entities (XXE)
- CVSS 7.5 High
Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
- XML external entities (XXE)
>=2.1.0, <9.0.4 · fixed in 9.0.4
GHSA-683x-4444-jxh8 · CVE-2024-38374 - CVSS 6.5 Medium
ClassGraph XML External Entity Reference
- XML external entities (XXE)
<4.8.112 · fixed in 4.8.112
GHSA-v2xm-76pq-phcf · CVE-2021-47621 - CVSS 7.2 High
XML External Entity Injection in Kiuwan SAST
- Kiuwan SAST
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
- XML external entities (XXE)
<2.4.4-p9 || >=2.4.5-p1, <2.4.5-p8 || >=2.4.6-p1, <2.4.6-p6 · fixed in 2.4.4-p9, 2.4.5-p8, 2.4.6-p6
GHSA-m8cj-3v68-3cxj · CVE-2024-34102 - CVSS 9.8 CriticalCritical · CVSS 9+
Zend-JSON vulnerable to XXE/XEE attacks
- XML external entities (XXE)
- Denial of service
>=2.1.0, <2.1.6 || >=2.2.0, <2.2.6 · fixed in 2.1.6, 2.2.6
GHSA-8x2v-pcg7-94f4 - CVSS 8.6 High
Zendframework Local file disclosure via XXE injection in Zend_XmlRpc
- XML external entities (XXE)
>=1.0.0, <1.11.13 · fixed in 1.11.13
GHSA-229x-22xc-2f2w - CVSS 9.1 CriticalCritical · CVSS 9+
ebookmeta XML External Entity vulnerability
- XML external entities (XXE)
- Denial of service
<1.2.8 · fixed in 1.2.8
GHSA-hx54-pf28-7xch · CVE-2024-37388 - CVSS 9.8 CriticalCritical · CVSS 9+
ZendFramework potential XML eXternal Entity injection vectors
- XML external entities (XXE)
- Denial of service
>=1.12.0, <1.12.4 · fixed in 1.12.4
GHSA-mhpx-3rv8-wrjm - CVSS 7.5 High
ZendFramework potential XML eXternal Entity injection vectors
- XML external entities (XXE)
>=1.11.0, <1.11.15 || >=1.12.0, <1.12.1 · fixed in 1.11.15, 1.12.1
GHSA-4j9x-g4x8-vcmf - CVSS 9.8 CriticalCritical · CVSS 9+
ZendFramework vulnerable to XXE/XEE attacks
- XML external entities (XXE)
- Denial of service
>=2.1.0, <2.1.6 || >=2.2.0, <2.2.6 · fixed in 2.1.6, 2.2.6
GHSA-f4fj-q6m4-cc52 - CVSS 9.8 CriticalCritical · CVSS 9+
Zendframework vulnerable to XXE/XEE attacks
- XML external entities (XXE)
- Denial of service
>=2.1.0, <2.1.6 || >=2.2.0, <2.2.6 · fixed in 2.1.6, 2.2.6
GHSA-qc7w-4567-84wv - CVSS 7.5 High
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via ...
- XML external entities (XXE)
<1.2.8 · fixed in 1.2.8
GHSA-whf4-fpj8-pgg8 · CVE-2024-36827 - CVSS 8.2 High
IBM Engineering Requirements Management DOORS Next XML external entity injection
- IBM Engineering Requirements Management DOORS Next
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Symfony XML decoding attack vector through external entities
- XML external entities (XXE)
>=2.0.0, <2.0.11 · fixed in 2.0.11
GHSA-j68w-pg49-f6vx - CVSS 7.5 High
Symfony XXE security vulnerability
- XML external entities (XXE)
>=2.0.0, <2.0.17 · fixed in 2.0.17
GHSA-rjpm-qmq7-q85w - CVSS 7.5 High
Symfony XML Entity Expansion security vulnerability
- XML external entities (XXE)
>=2.0.0, <2.0.17 · fixed in 2.0.17
GHSA-c636-cg5r-2498 - CVSS 7.8 High
XML External Entity injection vulnerability in iManager
- OpenText iManager
- XML external entities (XXE)
- CVSS 6.5 Medium
XML External Entity Processing Information Disclosure
- Progress Software Telerik Report Server
- XML external entities (XXE)
- CVSS 7.8 High
XML External Entity injection vulnerability in iManager
- OpenText iManager
- XML external entities (XXE)
- CVSS 6.5 Medium
Microsoft SharePoint Server Information Disclosure Vulnerability
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- XML external entities (XXE)
- CVSS 8.1 High
@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
- XML external entities (XXE)
>=6.7.0, <6.7.1 · fixed in 6.7.1
GHSA-38gf-rh2w-gmj7 · CVE-2024-34345 - CVSS 5.5 Medium
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
- Honeywell Saia PG5 Controls Suite
- XML external entities (XXE)
- CVSS 5.5 Medium
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
- Honeywell Saia PG5 Controls Suite
- XML external entities (XXE)
- CVSS 5.5 Medium
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
- Honeywell Saia PG5 Controls Suite
- XML external entities (XXE)
- CVSS 5.5 Medium
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
- Honeywell Saia PG5 Controls Suite
- XML external entities (XXE)
- CVSS 5.5 Medium
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability
- Honeywell Saia PG5 Controls Suite
- XML external entities (XXE)
- CVSS 6.5 Medium
Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability
- Voltronic Power ViewPower Pro
- XML external entities (XXE)
- CVSS 8.2 HighCritical · CVSS 7+ and EPSS
D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability
- D-Link D-View
- XML external entities (XXE)
- CVSS 6.5 Medium
Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability
- Visualware MyConnection Server
- XML external entities (XXE)
- CVSS 7.5 High
LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability
- LG Simple Editor
- XML external entities (XXE)
- CVSS 7.5 High
LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability
- LG Simple Editor
- XML external entities (XXE)
- CVSS 7.5 High
LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability
- LG Simple Editor
- XML external entities (XXE)
- CVSS 6.5 Medium
Inductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability
- Inductive Automation Ignition
- XML external entities (XXE)
- CVSS 7.1 High
XML external entity injection in SonicWall GMS
- SonicWall GMS
- XML external entities (XXE)
- CVSS 7.0 High
IBM WebSphere Application Server XML external entity injection
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
XML external entity injection in Oracle Corporation BI Publisher (formerly XML Publisher)
- Oracle Corporation BI Publisher (formerly XML Publisher)
- XML external entities (XXE)
- CVSS 4.3 Medium
XML external entity injection in Oracle Corporation Web Applications Desktop Integrator
- Oracle Corporation Web Applications Desktop Integrator
- XML external entities (XXE)
- CVSS 5.3 Medium
Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE
- XML external entities (XXE)
- CWE-20
>=0.8.0, <0.11.0 · fixed in 0.11.0
GHSA-rr59-h6rh-v84v · CVE-2022-47894 - CVSS 6.3 Medium
An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8.
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in Dell PowerProtect Data Manager
- Dell PowerProtect Data Manager
- XML external entities (XXE)
- CVSS 5.9 Medium
XML external entity injection in JetBrains TeamCity
- JetBrains TeamCity
- XML external entities (XXE)
- CVSS 6.3 Medium
lakernote EasyAdmin saveReportFile xml external entity reference
- lakernote EasyAdmin
- XML external entities (XXE)
- CVSS 5.8 Medium
XML external entity injection in unclebob FitNesse
- unclebob FitNesse
- XML external entities (XXE)
- CVSS 8.2 High
IBM Maximo Application Suite XML external entity injection
- IBM Maximo Asset Management
- XML external entities (XXE)
- CVSS 7.7 High
XML external entity injection in Pegasystems Pega Platform
- Pegasystems Pega Platform
- XML external entities (XXE)