Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.7 Medium
XML external entity injection in Lenovo XClarity Administrator (LXCA)
- Lenovo XClarity Administrator (LXCA)
- XML external entities (XXE)
- CVSS 5.9 Medium
Improper Restriction of XML External Entity Reference in jackson-mapper-asl
- XML external entities (XXE)
<=1.9.13 · no fixed version yet
GHSA-r6j9-8759-g62w · CVE-2019-10172 - CVSS 5.5 Medium
Improper Restriction of XML External Entity Reference in Apache Olingo
- XML external entities (XXE)
>=4.0.0, <4.7.0 · fixed in 4.7.0
GHSA-mgh8-hcwj-h57v · CVE-2019-17554 - CVSS 5.3 Medium
XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))
- XML external entities (XXE)
<8.29 · fixed in 8.29
GHSA-763g-fqq7-48wg · CVE-2019-10782 - CVSS 4.9 Medium
Cisco Data Center Network Manager XML External Entity Read Access Vulnerability
- Cisco Data Center Network Manager
- XML external entities (XXE)
- CVSS 6.5 Medium
XML external entity injection in Dell RSA Authentication Manager
- Dell RSA Authentication Manager
- XML external entities (XXE)
- CVSS 6.5 Medium
Apache NiFi information disclosure by XXE
- XML external entities (XXE)
>=1.3.0, <1.10.0 · fixed in 1.10.0
GHSA-744r-vv2g-2x6g · CVE-2019-10080 - CVSS 8.8 High
XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- XML external entities (XXE)
<=1.8.2 · no fixed version yet
GHSA-vvwv-h69m-wg6f · CVE-2019-12331 - CVSS 4.9 Medium
Information disclosure through processing of external XML entities
- XML external entities (XXE)
- Denial of service
>=2.2, <2.2.10 || >=2.3, <2.3.2-p2 · fixed in 2.2.10, 2.3.2-p2
GHSA-427g-2r83-3ccm · CVE-2019-8126 -
XML external entity injection in Advantech WISE-PaaS/RMM
- Advantech WISE-PaaS/RMM
- XML external entities (XXE)
- CVSS 6.1 Medium
Cisco Unified Communications Manager XML External Expansion Vulnerability
- Cisco Unified Communications Manager
- XML external entities (XXE)
- CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in ladon
- XML external entities (XXE)
>=0.6.1, <=1.0.7 · no fixed version yet
GHSA-vg35-vc9f-q7x2 · CVE-2019-1010268 -
XML external entity injection in Mitsubishi Electric FR Configurator2
- Mitsubishi Electric FR Configurator2
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Vulnerability that affects org.apache.pdfbox:pdfbox
- XML external entities (XXE)
>=2.0.14, <2.0.15 · fixed in 2.0.15
GHSA-c9jj-3wvg-q65h · CVE-2019-0228 - CVSS 7.5 High
Improper Restriction of XML External Entity Reference in DiffPlug Spotless
- XML external entities (XXE)
<1.20.0 · fixed in 1.20.0
GHSA-7v35-qwwj-p98g · CVE-2019-9843 - CVSS 7.5 High
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enoug…
- XML external entities (XXE)
- CVSS 6.5 Medium
Cisco Security Manager XML Entity Expansion Vulnerability
- Cisco Security Manager
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
- XML external entities (XXE)
- CVSS 7.5 High
XML External Entity injection in Apache Camel
- XML external entities (XXE)
<2.24.0 · fixed in 2.24.0
GHSA-h896-mx9x-g32g · CVE-2019-0188 -
XML external entity injection in The Eclipse Foundation Eclipse Kura
- The Eclipse Foundation Eclipse Kura
- XML external entities (XXE)
- CVSS 5.3 Medium
Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle
- XML external entities (XXE)
<8.18 · fixed in 8.18
GHSA-gp32-7h29-rpxm · CVE-2019-9658 - CVSS 4.9 Medium
Cisco IoT Field Network Director XML External Entity Vulnerability
- Cisco IoT Field Network Director (IoT-FND)
- XML external entities (XXE)
-
Low severity vulnerability that affects org.springframework.batch:spring-batch-core
- XML external entities (XXE)
<3.0.10.RELEASE || >=4.0.0.RELEASE, <4.0.2.RELEASE || >=4.1.0.RELEASE, <4.1.1.RELEASE · fixed in 3.0.10.RELEASE, 4.0.2.RELEASE, 4.1.1.RELEASE
GHSA-3wc8-659g-r88q · CVE-2019-3774 - CVSS 9.8 CriticalCritical · CVSS 9+
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
- XML external entities (XXE)
<2.4.4 || >=3.0.0, <3.0.6 · fixed in 2.4.4, 3.0.6
GHSA-8222-6fc8-mhvf · CVE-2019-3773 -
Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml
- XML external entities (XXE)
<4.3.19 || >=5.0.0, <5.0.11 || >=5.1.0, <5.1.2 · fixed in 4.3.19, 5.0.11, 5.1.2
GHSA-wr5r-m8pc-85j9 · CVE-2019-3772 - CVSS 9.8 CriticalCritical · CVSS 9+
XML External Entity Reference in Apache Karaf
- XML external entities (XXE)
>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7
GHSA-92wj-x78c-m4fx · CVE-2018-11788 - CVSS 9.8 CriticalCritical · CVSS 9+
XML External Entity Reference in mchange:c3p0
- XML external entities (XXE)
<0.9.5.3 · fixed in 0.9.5.3
GHSA-q485-j897-qc27 · CVE-2018-20433 - CVSS 9.8 CriticalCritical · CVSS 9+
XML External Entity Reference (XXE) in jackson-databind
- Insecure deserialization
- XML external entities (XXE)
>=2.9.0, <2.9.7 || >=2.8.0, <2.8.11.3 || >=2.7.0, <2.7.9.5 · fixed in 2.9.7, 2.8.11.3, 2.7.9.5
GHSA-x2w5-5m2g-7h5m · CVE-2018-14720 - CVSS 9.1 CriticalCritical · CVSS 9+
XML External Entity (XXE) vulnerability in Square Retrofit
- XML external entities (XXE)
>=2.0.0, <2.5.0 · fixed in 2.5.0
GHSA-j379-9jr9-w5cq · CVE-2018-1000844 - CVSS 9.0 CriticalCritical · CVSS 9+
XML External Entity (XXE) vulnerability in bw-calendar-engine
- XML external entities (XXE)
<=3.12.2 · no fixed version yet
GHSA-xmvg-w4f9-99r7 · CVE-2018-1000836 - CVSS 10.0 CriticalCritical · CVSS 9+
exist-db:exist-core XML External Entity (XXE) vulnerability
- XML external entities (XXE)
<5.1.0 · fixed in 5.1.0
GHSA-jxm5-5xcw-h57q · CVE-2018-1000823 - CVSS 10.0 CriticalCritical · CVSS 9+
XML External Entity (XXE) vulnerability in codelibs fess
- XML external entities (XXE)
<12.3.2 · fixed in 12.3.2
GHSA-77hp-pfxw-4w63 · CVE-2018-1000822 - CVSS 10.0 CriticalCritical · CVSS 9+
XML External Entity (XXE) vulnerability in neo4j.procedure:apoc
- XML external entities (XXE)
<3.4.0.4 · fixed in 3.4.0.4
GHSA-r2pp-x4mm-4999 · CVE-2018-1000820 - CVSS 7.5 High
Improper Restriction of XML External Entity Reference in bedework:bw-webdav
- XML external entities (XXE)
>=4.0.1, <4.0.3 · fixed in 4.0.3
GHSA-5p52-j8pw-j7x5 · CVE-2018-20000 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in pippo-core
- XML external entities (XXE)
<1.12.0 · fixed in 1.12.0
GHSA-rmm5-g63h-m6g9 · CVE-2018-20059 - CVSS 6.3 Medium
Cisco Energy Management Suite XML External Entity Vulnerability
- Cisco Energy Management Suite
- XML external entities (XXE)
- CVSS 7.2 High
Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core
- XML external entities (XXE)
<2.0.11 || >=2.1.0, <2.1.2 · fixed in 2.0.11, 2.1.2
GHSA-qfjv-998w-q48f · CVE-2018-17186 -
XML external entity injection in CASE Suite
- CASE Suite
- XML external entities (XXE)
- CVSS 10.0 CriticalCritical · CVSS 9+
Eclipse RDF4j vulnerable to XML External Entity
- XML external entities (XXE)
<2.4.0 · fixed in 2.4.0
GHSA-6xq8-pvg4-3mf3 · CVE-2018-1000644 - CVSS 7.8 High
Android SVG vulnerable to XML External Entity (XXE)
- XML external entities (XXE)
<1.3 · fixed in 1.3
GHSA-g556-x5vx-qh59 · CVE-2017-1000498 - CVSS 8.1 High
Apache juddi-client vulnerable to XML External Entity (XXE)
- XML external entities (XXE)
>=3.2, <3.3.5 · fixed in 3.3.5
GHSA-p99p-726h-c8v5 · CVE-2018-1307 - CVSS 7.5 High
Moderate severity vulnerability that affects com.adobe.xmp:xmpcore
- XML external entities (XXE)
<5.1.3 · fixed in 5.1.3
GHSA-qv32-7r6p-xhhh · CVE-2016-4216 - CVSS 8.6 High
jackson-dataformat-xml vulnerable to server side request forgery (SSRF)
- XML external entities (XXE)
- Server-side request forgery (SSRF)
<2.7.8 || >=2.8.0, <2.8.4 · fixed in 2.7.8, 2.8.4
GHSA-7c2r-3jqf-c9rw · CVE-2016-7051 - CVSS 9.8 CriticalCritical · CVSS 9+
jackson-dataformat-xml vulnerable to XML external entity (XXE)
- XML external entities (XXE)
<2.7.4 · fixed in 2.7.4
GHSA-hmq6-frv3-4727 · CVE-2016-3720 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Remote code execution occurs in Apache Solr
- XML external entities (XXE)
>=7.0.0, <7.1.0 || >=6.0.0, <6.6.2 || >=5.5.0, <5.5.5 · fixed in 7.1.0, 6.6.2, 5.5.5
GHSA-mh7g-99w9-xpjm · CVE-2017-12629 - CVSS 5.5 Medium
There is a XML external entity expansion (XXE) vulnerability in Apache Solr config files
- XML external entities (XXE)
>=6.6.0, <6.6.4 || >=7.0.0, <7.3.1 · fixed in 6.6.4, 7.3.1
GHSA-rc9v-h28f-jcmf · CVE-2018-8010 - CVSS 7.5 HighCritical · CVSS 7+ and EPSS
There is a XML external entity expansion (XXE) vulnerability in Apache Solr
- XML external entities (XXE)
>=1.2, <6.6.3 || >=7.0.0, <7.3.0 · fixed in 6.6.3, 7.3.0
GHSA-3pph-2595-cgfh · CVE-2018-1308 - CVSS 5.5 Medium
XML external entity expansion in org.apache.solr:solr-core
- XML external entities (XXE)
>=7.0.0, <7.4.0 || >=6.0.0, <6.6.5 · fixed in 7.4.0, 6.6.5
GHSA-7px3-6f6g-hxcj · CVE-2018-8026 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
- XML external entities (XXE)
<1.74.0 · fixed in 1.74.0
GHSA-6fvx-r7hx-3vh6 · CVE-2018-15531 - CVSS 7.8 High
High severity vulnerability that affects org.apache.pdfbox:pdfbox
- XML external entities (XXE)
<1.8.12 || >=2.0.0, <2.0.1 · fixed in 1.8.12, 2.0.1
GHSA-4c32-xmgj-2g98 · CVE-2016-2175 - CVSS 7.5 High
Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
- XML external entities (XXE)
>=1.13.0, <1.13.12 || >=2.0.0, <2.0.7 · fixed in 1.13.12, 2.0.7
GHSA-m929-7fr6-cvjg · CVE-2018-1259 -
Moderate severity vulnerability that affects io.vertx:vertx-core
- XML external entities (XXE)
>=3.5.0, <3.5.4 · fixed in 3.5.4
GHSA-qh3m-qw6v-qvhg · CVE-2018-12544 - CVSS 7.5 High
High severity vulnerability that affects org.apache.tika:tika-core
- XML external entities (XXE)
>=0.1, <1.19.1 · fixed in 1.19.1
GHSA-6jq2-789q-fff2 · CVE-2018-11761 - CVSS 7.8 High
Apache Tika does not properly initialize the XML parser or choose handlers
- XML external entities (XXE)
<1.13 · fixed in 1.13
GHSA-4xr4-4c65-hj7f · CVE-2016-4434 - CVSS 7.5 High
Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
- XML external entities (XXE)
>=0.1, <1.19.1 · fixed in 1.19.1
GHSA-h8q5-g2cj-qr5h · CVE-2018-11796 - CVSS 7.5 High
Restlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider
- XML external entities (XXE)
<2.3.11 · fixed in 2.3.11
GHSA-2mp8-qvqm-3xwq · CVE-2017-14868 - CVSS 7.5 High
Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request
- XML external entities (XXE)
<2.3.12 · fixed in 2.3.12
GHSA-cvj4-g3gx-8vqq · CVE-2017-14949 -
Apache Camel XML External Entity vulnerability
- XML external entities (XXE)
<2.13.4 || >=2.14.0, <2.14.2 · fixed in 2.13.4, 2.14.2
GHSA-3hrc-f439-727g · CVE-2015-0263 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache is vulnerable to XXE in XSD validation processor
- XML external entities (XXE)
>=2.20.0, <2.20.4 || >=2.21.0, <2.21.1 · fixed in 2.20.4, 2.21.1
GHSA-8vfm-4388-6rpc · CVE-2018-8027