Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.3 Medium
XML external entity injection in RSA Authentication Manager
- RSA Authentication Manager
- XML external entities (XXE)
- CVSS 5.3 Medium
ywoa WXCallBack Interface XMLParse.java extract xml external entity reference
- ywoa
- XML external entities (XXE)
- CWE-610
- CVSS 7.1 High
IBM EntireX XML external entity injection
- IBM EntireX
- XML external entities (XXE)
- CVSS 7.1 High
IBM Cognos Anaytics XML external entity injection
- IBM Cognos Analytics
- XML external entities (XXE)
- CVSS 8.6 High
XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`
- XML external entities (XXE)
<1.7.4 · fixed in 1.7.4
GHSA-8c3x-hq82-gjcm · CVE-2024-52807 - CVSS 2.5 Low
HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks
- HCL Software BigFix Patch Management Download Plug-ins
- XML external entities (XXE)
- CVSS 7.5 High
Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie
- Apache Software Foundation Apache Ambari
- XML external entities (XXE)
- CVSS 8.4 High
XML external entity injection in Schneider Electric Web Designer for BMXNOR0200H and others
- Schneider Electric Web Designer for BMXNOR0200H
- Schneider Electric Web Designer for BMXNOE0110(H)
- XML external entities (XXE)
- CVSS 5.5 Medium
Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer
- OMRON Corporation Programable Terminals NB-Designer
- XML external entities (XXE)
- CVSS 7.5 High
An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (DoS) via a crafted XML payload.
- XML external entities (XXE)
- CVSS 7.5 High
An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier.
- XML external entities (XXE)
- CVSS 2.1 Low
GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins
- gocd
- XML external entities (XXE)
- CVSS 2.1 Low
GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality
- gocd
- XML external entities (XXE)
- CVSS 9.1 CriticalCritical · CVSS 9+
XML external entity injection in libxml2
- libxml2
- XML external entities (XXE)
- CVSS 5.9 Medium
XML external entity injection in JetBrains TeamCity
- JetBrains TeamCity
- XML external entities (XXE)
- CVSS 5.3 Medium
XML external entity injection in OpenText™ Operations Bridge Manager
- OpenText™ Operations Bridge Manager
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input.
- XML external entities (XXE)
- CVSS 8.6 High
Ucum-java has an XXE vulnerability in XML parsing
- XML external entities (XXE)
<1.0.9 · fixed in 1.0.9
GHSA-w9j7-phm3-f97j · CVE-2024-55887 - CVSS 9.8 CriticalCritical · CVSS 9+
http4k has a potential XXE (XML External Entity Injection) vulnerability
- Information disclosure
- XML external entities (XXE)
<6.50.0.0 · fixed in 6.50.0.0
GHSA-7mj5-hjjj-8rgw · CVE-2024-55875 - CVSS 9.8 CriticalCritical · CVSS 9+
CVE-2024-46455 in github.com/Unstructured-IO/unstructured
- XML external entities (XXE)
* · no fixed version yet
GHSA-32r8-54hf-c9p3 · CVE-2024-46455 - CVSS 6.3 Medium
Acrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe Acrobat Reader
- XML external entities (XXE)
- CVSS 6.5 Medium
Microsoft SharePoint Information Disclosure Vulnerability
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- XML external entities (XXE)
- CVSS 5.9 Medium
XML external entity injection in Siemens COMOS V10.3 and others
- Siemens COMOS V10.3
- Siemens COMOS V10.4.0
- XML external entities (XXE)
- CVSS 5.7 Medium
XML external entity injection in Siemens COMOS V10.3 and others
- Siemens COMOS V10.3
- Siemens COMOS V10.4.0
- XML external entities (XXE)
- CVSS 5.3 Medium
XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA
- SAP_SE SAP NetWeaver AS JAVA
- XML external entities (XXE)
- CVSS 8.3 High
SimpleSAMLphp vulnerable to XXE in parsing SAML messages
- XML external entities (XXE)
<2.0.15 || >=2.1.0, <2.1.7 || >=2.2.0, <2.2.4 || >=2.3.0, <2.3.4 · fixed in 2.0.15, 2.1.7, 2.2.4, 2.3.4
GHSA-j5g2-q29x-cw3h - CVSS 8.3 High
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
- XML external entities (XXE)
<4.6.14 · fixed in 4.6.14
GHSA-pxm4-r5ph-q2m2 · CVE-2024-52806 - CVSS 2.3 Low
veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability
- XML external entities (XXE)
<1.26.2 · fixed in 1.26.2
GHSA-4cx5-89vm-833x · CVE-2024-52800 - CVSS 8.8 High
SimpleSAMLphp xml-common XXE vulnerability
- XML external entities (XXE)
<1.20.0 · fixed in 1.20.0
GHSA-2x65-fpch-2fcm · CVE-2024-52596 - CVSS 4.6 Medium
XML External Entity (XXE) Vulnerability in EasyTax
- msg Suisse AG EasyTax
- XML external entities (XXE)
- CVSS 7.5 High
Possible XML External Entity Injection in OpenText iManager
- OpenText iManager
- XML external entities (XXE)
- CVSS 7.5 High
XXE in PHPSpreadsheet's XLSX reader
- XML external entities (XXE)
<=1.8.2 · no fixed version yet
GHSA-7cc9-j4mv-vcjp · CVE-2024-48917 - CVSS 7.5 High
XmlScanner bypass leads to XXE
- XML external entities (XXE)
<=1.8.2 · no fixed version yet
GHSA-jw4x-v69f-hh5w · CVE-2024-47873 - CVSS 6.5 Medium
Cisco SD-WAN vManage Software XML External Entity Vulnerability
- Cisco Catalyst SD-WAN Manager
- XML external entities (XXE)
- CVSS 6.5 Medium
An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via…
- XML external entities (XXE)
- CVSS 6.4 Medium
Cisco SD-WAN vManage Software XML External Entity Vulnerability
- Cisco Catalyst SD-WAN Manager
- XML external entities (XXE)
- CVSS 8.2 High
IBM Engineering Insights XML external entity injection
- IBM Engineering Insights
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in dompdf/dompdf
- XML external entities (XXE)
<2.0.0 · fixed in 2.0.0
GHSA-3vjh-xrhf-v9xh · CVE-2021-3902 - CVSS 5.1 Medium
PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- XML external entities (XXE)
- CVSS 9.2 CriticalCritical · CVSS 9+
TIBCO Hawk Stored-XEE Vulnerability
- TIBCO Software Inc TIBCO Hawk
- TIBCO Software Inc TIBCO Operational Intelligence
- XML external entities (XXE)
- CVSS 8.6 High
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
- XML external entities (XXE)
<6.4.0 · fixed in 6.4.0
GHSA-gr3c-q7xf-47vh · CVE-2024-52007 - CVSS 8.5 High
XML External Entity
- ManageEngine SharePoint Manager Plus
- XML external entities (XXE)
- CVSS 4.0, no score published
PHPExcel XXE Vulnerability
- XML external entities (XXE)
<1.8.1 · fixed in 1.8.1
GHSA-3m9x-2qfj-xvq4 · CVE-2015-3542 - CVSS 5.5 Medium
Cisco Identity Services Engine XML External Entity Injection Vulnerability
- Cisco Identity Services Engine Software
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
HAPI FHIR XML External Entity (XXE) vulnerability
- Open redirect
- XML external entities (XXE)
<6.4.0 · fixed in 6.4.0
GHSA-4cf2-cxp3-rjr7 · CVE-2024-51132 - CVSS 5.5 Medium
IBM WebSphere Application Server XML external entity injection
- IBM WebSphere Application Server
- XML external entities (XXE)
- CVSS 6.5 Medium
WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability
- WP Royal Royal Elementor Addons
- XML external entities (XXE)
- CVSS 5.1 Medium
Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools
- OpenText Application Automation Tools
- XML external entities (XXE)
- CVSS 5.9 Medium
Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools
- OpenText Application Automation Tools
- XML external entities (XXE)
- CVSS 5.9 Medium
Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools
- OpenText Application Automation Tools
- XML external entities (XXE)
- CVSS 5.5 Medium
IBM WebSphere Application Server XML external entity injection
- IBM WebSphere Application Server
- XML external entities (XXE)
- CVSS 8.8 High
XML external entity injection in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- XML external entities (XXE)
- CVSS 6.3 Medium
XML Eternal Entity Attack in the Software Library taxstatement.jar
- Schweizerische Steuerkonferenz Library taxstatement.jar
- XML external entities (XXE)
- CVSS 5.3 Medium
Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability
- XML external entities (XXE)
<2.10 · fixed in 2.10
GHSA-jqfv-jrvq-95jm · CVE-2024-28168 - CVSS 2.9 Low
XML external entity injection in Dell AppSync
- Dell AppSync
- XML external entities (XXE)
- CVSS 7.5 High
XXE in PHPSpreadsheet's XLSX reader
- XML external entities (XXE)
<=1.8.2 · no fixed version yet
GHSA-6hwr-6v2f-3m88 · CVE-2024-45293 - CVSS 5.0 Medium
TopQuadrant TopBraid EDG JavaScript console XXE
- TopQuadrant TopBraid EDG
- XML external entities (XXE)
- CVSS 7.5 High
DataEase has an XML External Entity Reference vulnerability
- XML external entities (XXE)
<2.10.1 · fixed in 2.10.1
GHSA-4m9p-7xg6-f4mm · CVE-2024-46985 - CVSS 8.6 High
Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack
- XML external entities (XXE)
<2.5.1 · fixed in 2.5.1
GHSA-68j8-fp38-p48q · CVE-2024-46984 - CVSS 6.5 Medium
Kimai has an XXE Leading to Local File Read
- XML external entities (XXE)
- CWE-1395
<2.21.0 · fixed in 2.21.0
GHSA-534c-hcr7-67jg