Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.6 Medium
XML external entity (XXE) injection in OpenOLAT
- OpenOLAT
- XML external entities (XXE)
- CVSS 5.5 Medium
IBM Security Guardium Key Lifecycle Manager XML external entity injection
- IBM Security Guardium Key Lifecycle Manager
- XML external entities (XXE)
- CVSS 6.5 Medium
Apache Ambari XML External Entity injection
- XML external entities (XXE)
>=2.7.0, <2.7.8 · fixed in 2.7.8
GHSA-qrp9-23p7-g5mf · CVE-2023-50380 - CVSS 2.7 Low
Limited data exfiltration in CodeQL CLI
- github codeql-cli-binaries
- XML external entities (XXE)
- CVSS 8.0 High
Liferay Portal has an XXE vulnerability in Java2WsddTask._format
- XML external entities (XXE)
<14.0.0 · fixed in 14.0.0
GHSA-869h-qhfx-w939 · CVE-2024-25606 - CVSS 8.3 HighCritical · CVSS 7+ and EPSS
XML external entity injection in Ivanti ICS and others
- Ivanti ICS
- Ivant ICS
- XML external entities (XXE)
- CVSS 8.6 High
XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)
- SAP_SE SAP NetWeaver AS Java (Guided Procedures)
- XML external entities (XXE)
- CVSS 6.5 Medium
The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.
- XML external entities (XXE)
- CVSS 7.1 High
IBM Security Access Manager Container XML external entity injection
- IBM Security Verify Access Appliance
- IBM Security Verify Access Docker
- XML external entities (XXE)
- CVSS 5.5 Medium
SEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity Reference
- SEW-EURODRIVE MOVITOOLS MotionStudio
- XML external entities (XXE)
- CVSS 4.9 Medium
XML External Entity (XXE) Processing
- OpenText AppBuilder
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in Ministry of Defense Electronic Deliverables Creation Support Tool (Construction… and others
- Ministry of Defense Electronic Deliverables Creation Support Tool (Construction Edition)
- Ministry of Defense Electronic Deliverables Creation Support Tool (Design & Survey Edition)
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in Electronic Delivery Check System (Ministry of Agriculture…
- Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in Ministry of Land, Infrastructure, Transport and Tourism… and others
- Ministry of Land, Infrastructure, Transport and Tourism, Japan Electronic Delivery Check System (Doboku)
- XML external entities (XXE)
- CVSS 6.5 Medium
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig.
- XML external entities (XXE)
- CVSS 7.5 High
fonttools XML External Entity Injection (XXE) Vulnerability
- XML external entities (XXE)
>=4.28.2, <4.43.0 · fixed in 4.43.0
GHSA-6673-4983-2vx5 · CVE-2023-45139 - CVSS 5.7 Medium
Qualys Jenkins Plugin for Policy Compliance XML External Entity vulnerability
- XML external entities (XXE)
<1.0.6 · fixed in 1.0.6
GHSA-8525-52vg-jv6v · CVE-2023-6147 - CVSS 5.7 Medium
Qualys Jenkins Plugin for WAS XML External Entity vulnerability
- XML external entities (XXE)
<2.0.12 · fixed in 2.0.12
GHSA-5gwh-r76w-934h · CVE-2023-6149 - CVSS 9.8 CriticalCritical · CVSS 9+
An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.
- XML external entities (XXE)
- CVSS 6.5 Medium
XML external entity injection in Ivanti Avalanche
- Ivanti Avalanche
- XML external entities (XXE)
- CVSS 7.2 High
XML External Entity Reference on 52North WPS
- 52North WPS
- XML external entities (XXE)
- CVSS 4.6 Medium
WSO2 products vulnerable to XML External Entity attack
- XML external entities (XXE)
<4.0.0-beta · fixed in 4.0.0-beta
GHSA-cr8h-fr86-8vfv · CVE-2023-6836 - CVSS 8.3 High
Improper Restriction of XML External Entity Reference in Repox
- Repox
- XML external entities (XXE)
- CVSS 2.8 Low
XML external entity injection in Eclipse Foundation Eclipse Memory Analyzer (tools.mat)
- Eclipse Foundation Eclipse Memory Analyzer (tools.mat)
- XML external entities (XXE)
- CVSS 5.0 Medium
Eclipse IDE XXE in eclipse.platform
- XML external entities (XXE)
<3.30.0 · fixed in 3.30.0
GHSA-j24h-xcpc-9jw8 · CVE-2023-4218 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability
- XML external entities (XXE)
>=2.2.0, <2.3.0 · fixed in 2.3.0
GHSA-77jg-cpw9-73vg · CVE-2023-49733 - CVSS 7.1 High
Jenkins MATLAB Plugin XML External Entity vulnerability
- XML external entities (XXE)
<2.11.1 · fixed in 2.11.1
GHSA-82q9-88m2-4v68 · CVE-2023-49656 - CVSS 7.5 High
ZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability
- Adobe RoboHelp
- XML external entities (XXE)
- CVSS 7.5 High
XML external entity injection in Siemens OPC UA Modelling Editor (SiOME)
- Siemens OPC UA Modelling Editor (SiOME)
- XML external entities (XXE)
- CVSS 5.0 Medium
Duplicate Advisory: Eclipse IDE XXE in eclipse.platform
- XML external entities (XXE)
<4.29 · fixed in 4.29
GHSA-cc4w-3cff-j8fw - CVSS 5.5 Medium
Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX
- NI TopoGrafix DataPlugin for GPX
- NI DIAdem
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
OpenCRX allows a remote attacker to execute arbitrary code via a crafted request
- XML external entities (XXE)
- Server-side request forgery (SSRF)
<5.3.0 · fixed in 5.3.0
GHSA-q74f-rf27-8hxc · CVE-2023-46502 - CVSS 4.9 Medium
XML external entity injection in Dell Unity
- Dell Unity
- XML external entities (XXE)
- CVSS 5.9 Medium
svg_optimizer rubygem external XML entity (XXE) vulnerability
- XML external entities (XXE)
- Denial of service
>=0.2.6, <0.3.0 · fixed in 0.3.0
GHSA-6hvg-62q8-95v7 · CVE-2023-46035 - CVSS 7.5 HighCritical · KEVKEV
XML external entity injection in North Grid Corporation Proself Enterprise/Standard Edition and others
- North Grid Corporation Proself Enterprise/Standard Edition
- North Grid Corporation Proself Gateway Edition
- XML external entities (XXE)
- CVSS 8.8 High
Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability
- Microsoft Azure HDInsight
- XML external entities (XXE)
- CVSS 4.3 Medium
Information Disclosure vulnerability in SAP Business One (B1i)
- SAP_SE SAP Business One (B1i)
- XML external entities (XXE)
- CVSS 8.6 High
XML external entity injection in JetBrains Ktor
- JetBrains Ktor
- XML external entities (XXE)
- CVSS 6.8 Medium
Possible local file exfiltration by XML External entity injection
- gradle
- XML external entities (XXE)
- CVSS 4.3 Medium
codehaus-plexus vulnerable to XML injection
- Other injection
- XML external entities (XXE)
<3.0.24 · fixed in 3.0.24
GHSA-jcwr-x25h-x5fh · CVE-2022-4245 - CVSS 5.6 Medium
Unsafe XML parsing of 3rd party DICOM private tags may lead to XXE
- MIM Software MIM Assistant
- MIM Software MIM Client
- XML external entities (XXE)
- CVSS 3.5 Low
The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file...
- XML external entities (XXE)
* · no fixed version yet
PYSEC-2023-172 · CVE-2023-41369 - CVSS 8.8 High
Job Configuration History Plugin's path traversal allows exploiting XXE vulnerability
- XML external entities (XXE)
<1229.v3039470161a_d · fixed in 1229.v3039470161a_d
GHSA-ghjw-fcf6-rpr9 · CVE-2023-41933 - CVSS 6.5 Medium
Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin
- XML external entities (XXE)
<1229.v3039470161a_d · fixed in 1229.v3039470161a_d
GHSA-cgh7-rgqg-hrcx · CVE-2023-41932 - CVSS 7.1 High
IBM Financial Transaction Manager for SWIFT Services XML external entity injection
- IBM Financial Transaction Manager for SWIFT Services
- XML external entities (XXE)
- CVSS 6.5 Medium
DDFFileParser is vulnerable to XXE Attacks
- XML external entities (XXE)
<1.5.0 || >=2.0.0-M1, <2.0.0-M13 · fixed in 1.5.0, 2.0.0-M13
GHSA-wc9j-gc65-3cm7 · CVE-2023-41034 - CVSS 5.5 Medium
Esoteric YamlBeans XML Entity Expansion vulnerability
- Denial of service
- XML external entities (XXE)
<=1.15 · no fixed version yet
GHSA-vj49-j7rc-h54f · CVE-2023-24620 - CVSS 8.2 High
Apache Ivy External Entity Reference vulnerability
- Other injection
- XML external entities (XXE)
<2.5.2 · fixed in 2.5.2
GHSA-2jc4-r94c-rp7h · CVE-2022-46751 - CVSS 5.4 Medium
OpenNMS Horizon XXE Injection Vulnerability
- XML external entities (XXE)
>=31.0.8, <32.0.2 · fixed in 32.0.2
GHSA-2qc8-r663-v864 · CVE-2023-0871 - CVSS 6.5 Medium
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- Microsoft Dynamics 365 (on-premises) version 9.0
- XML external entities (XXE)
- CVSS 6.5 Medium
XML external entity injection in Cisco SD-WAN vManage
- Cisco SD-WAN vManage
- XML external entities (XXE)
- CVSS 6.3 Medium
CVE-2023-30951
- com.palantir.magritte:magritte-rest-source-bundle
- XML external entities (XXE)
- CVSS 6.8 Medium
XML External Entity (XXE) vulnerability in the XML data handler
- XML external entities (XXE)
- Denial of service
<3.5.8.3 || >=3.6.0, <3.6.6.3 || >=3.7.0, <3.7.5.2 || >=3.8.0, <3.8.4.1 || >=3.9.0, <3.9.6 · fixed in 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
GHSA-q386-w6fg-gmgp · CVE-2023-38490 -
XML external entity injection in Google Android
- Google Android
- XML external entities (XXE)
- CVSS 6.5 Medium
Jenkins External Monitor Job Type Plugin XML external entity vulnerability
- XML external entities (XXE)
<207.v98a · fixed in 207.v98a
GHSA-g4c3-4f3v-84x8 · CVE-2023-37942 - CVSS 5.5 Medium
XML external entity injection in Schneider Electric EcoStruxure OPC UA Server Expert
- Schneider Electric EcoStruxure OPC UA Server Expert
- XML external entities (XXE)
- CVSS 3.9 Low
Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations
- XML external entities (XXE)
>=10.0.0-alpha0, <10.0.16 || >=11.0.0-alpha0, <11.0.16 || >=12.0.0.alpha0, <12.0.0 || <9.4.52.v20230823 · fixed in 10.0.16, 11.0.16, 12.0.0, 9.4.52.v20230823
GHSA-58qw-p7qm-5rvh - CVSS 7.1 High
Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability
- XML external entities (XXE)
<=1.1.0 · no fixed version yet
GHSA-wf8m-qr47-xc9m · CVE-2023-28685 - CVSS 8.2 High
XML external entity injection in Lenovo XClarity Administrator
- Lenovo XClarity Administrator
- XML external entities (XXE)
- CVSS 5.5 Medium
HuTool XML parsing module has blind XXE vulnerability
- XML external entities (XXE)
<=5.8.19 · no fixed version yet
GHSA-p2qf-9vp6-3jjq · CVE-2023-3276