Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
XML External Entity Reference
- XML external entities (XXE)
<4.3.12 || >=5.0.0, <5.1.1 · fixed in 4.3.12, 5.1.1
GHSA-7qfm-6m33-rgg9 -
XML external entity injection in Siemens Solid Edge SE2021
- Siemens Solid Edge SE2021
- XML external entities (XXE)
- CVSS 6.3 Medium
XML External Entity Reference in Glances
- XML external entities (XXE)
<3.2.1 · fixed in 3.2.1
GHSA-r2mj-8wgq-73m6 · CVE-2021-23418 - CVSS 7.5 HighCritical · CVSS 7+ and EPSS
XML External Entity (XXE) Injection in JDOM
- XML external entities (XXE)
<=2.0.2 · no fixed version yet
GHSA-2363-cqg2-863c · CVE-2021-33813 - CVSS 5.4 Medium
XML external entity injection in Dell OpenManage Enterprise
- Dell OpenManage Enterprise
- XML external entities (XXE)
- CVSS 8.2 High
XML external entity injection in Dell Avamar
- Dell Avamar
- XML external entities (XXE)
- CVSS 5.3 Medium
Improper Restriction of XML External Entity Reference in de.tud.sse
- secure-software-engineering FlowDroid
- XML external entities (XXE)
-
XML external entity injection in perl-xml-atom
- perl-xml-atom
- XML external entities (XXE)
-
XML external entity injection in Panasonic FPWIN Pro
- Panasonic FPWIN Pro
- XML external entities (XXE)
- CVSS 7.5 High
XML2Dict XML Entity Expansion Vulnerability
- XML external entities (XXE)
- Denial of service
<=0.2.2 · no fixed version yet
GHSA-gp6m-vqhm-5cm5 · CVE-2021-25951 - CVSS 4.3 Medium
XXE vulnerability in Jenkins Selenium HTML report Plugin
- XML external entities (XXE)
<1.1 · fixed in 1.1
GHSA-hxxp-6546-wv6r · CVE-2021-21672 - CVSS 7.5 High
XXE vulnerability in Launch import
- XML external entities (XXE)
>=3.1.0, <4.3.12 || >=5.0.0, <5.1.1 · fixed in 4.3.12, 5.1.1
GHSA-2jx8-v4hv-gx3h · CVE-2020-12642 - CVSS 7.5 High
XXE vulnerability on Launch import with externally-defined DTD file
- XML external entities (XXE)
>=3.1.0, <5.4.0 · fixed in 5.4.0
GHSA-24wf-7vf2-pv59 · CVE-2021-29620 - CVSS 9.8 CriticalCritical · CVSS 9+
Arbitrary code injection in json-sanitizer
- XML external entities (XXE)
<1.2.2 · fixed in 1.2.2
GHSA-mm8j-9x84-m9cv · CVE-2021-23899 -
XML external entity injection in Datakit Software libraries embedded in Luxion KeyShot software
- Datakit Software libraries embedded in Luxion KeyShot software
- XML external entities (XXE)
-
XML external entity injection in Elastic App Search
- Elastic App Search
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in MPXJ
- XML external entities (XXE)
<8.1.4 · fixed in 8.1.4
GHSA-wcp5-m52f-mhh5 · CVE-2020-25020 - CVSS 9.8 CriticalCritical · CVSS 9+
SVGlib Vulnerable to XXE Attacks
- XML external entities (XXE)
<0.9.4 · fixed in 0.9.4
GHSA-3vcg-8p79-jpcv · CVE-2020-10799 - CVSS 5.4 Medium
Cisco BroadWorks Messaging Server XML External Entity Injection Vulnerability
- Cisco BroadWorks
- XML external entities (XXE)
- CVSS 7.5 High
REXML round-trip instability
- XML external entities (XXE)
- CWE-115
<3.2.5 · fixed in 3.2.5
GHSA-8cr8-4vfw-mr7h · CVE-2021-28965 - CVSS 5.4 Medium
Cisco Firepower Device Manager On-Box Software XML External Entity Vulnerability
- Cisco Firepower Threat Defense Software
- XML external entities (XXE)
- CVSS 8.1 High
Avaya Equinox Conferencing XXE vulnerability
- Avaya Meetings Server
- XML external entities (XXE)
- CVSS 8.1 High
XXE in Avaya Callback Assist Administration
- Avaya Callback Assist
- XML external entities (XXE)
- CVSS 8.1 High
XXE in Avaya Aura Orchestration Designer
- Avaya Aura Orchestration Designer
- XML external entities (XXE)
- CVSS 7.5 High
Improper Restriction of XML External Entity Reference in pikepdf
- XML external entities (XXE)
>=1.3.0, <2.10.0 · fixed in 2.10.0
GHSA-ccgm-3xw4-h5p8 · CVE-2021-29421 - CVSS 7.1 HighCritical · CVSS 7+ and EPSS
WordPress Authenticated XXE attack when installation is running PHP 8
- wordpress-develop
- XML external entities (XXE)
- CVSS 7.7 High
XML external entity injection in SAP SE SAP Process Integration (Enterprise Service Repository JAVA Mappings)
- SAP SE SAP Process Integration (Enterprise Service Repository JAVA Mappings)
- XML external entities (XXE)
-
XML external entity injection in Forcepoint Web Security Content Gateway
- Forcepoint Web Security Content Gateway
- XML external entities (XXE)
- CVSS 8.8 High
Improper Restriction of XML External Entity Reference in Plone
- XML external entities (XXE)
<5.2.3 · fixed in 5.2.3
GHSA-2c8c-84w2-j38j · CVE-2020-28736 - CVSS 8.8 High
Improper Restriction of XML External Entity Reference in Plone
- XML external entities (XXE)
<5.2.3 · fixed in 5.2.3
GHSA-wq6x-g685-w5f2 · CVE-2020-28734 -
XML external entity injection in Siemens Solid Edge SE2020 and others
- Siemens Solid Edge SE2020
- Siemens Solid Edge SE2021
- XML external entities (XXE)
- CVSS 7.2 High
XML external entity injection in Dell SRS Policy Manager
- Dell SRS Policy Manager
- XML external entities (XXE)
- CVSS 6.1 Medium
XML External Entity processing
- Micro Focus Solutions Business Manager
- XML external entities (XXE)
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
XML External Entity (XXE) Injection in Jackson Databind
- XML external entities (XXE)
>=2.6.0, <2.6.7.4 || >=2.7.0.0, <2.9.10.7 || >=2.10.0.0, <2.10.5.1 · fixed in 2.6.7.4, 2.9.10.7, 2.10.5.1
GHSA-288c-cq4h-88gq · CVE-2020-25649 - CVSS 6.4 Medium
XXE vulnerability in OpenHAB
- openhab-addons
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
XML External Entity attack in log4net
- XML external entities (XXE)
<2.0.10 · fixed in 2.0.10
GHSA-2cwj-8chv-9pp9 · CVE-2018-1285 - CVSS 7.5 HighCritical · CVSS 7+ and EPSS
XML external entity injection in Arcserve D2D
- Arcserve D2D
- XML external entities (XXE)
-
XML external entity injection in Siemens JT2Go and others
- Siemens JT2Go
- Siemens Teamcenter Visualization
- XML external entities (XXE)
- CVSS 2.6 Low
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
- XML external entities (XXE)
<1.11.0 · fixed in 1.11.0
GHSA-vr8q-g5c7-m54m · CVE-2020-26247 - CVSS 9.8 CriticalCritical · CVSS 9+
XXE in petl
- XML external entities (XXE)
<1.6.8 · fixed in 1.6.8
GHSA-f5gc-p5m3-v347 · CVE-2020-29128 - CVSS 3.7 Low
XML External Entity in Dashboard Widget
- XML external entities (XXE)
>=10.0.0, <10.4.10 · fixed in 10.4.10
GHSA-q9cp-mc96-m4w2 · CVE-2020-26229 -
XML external entity injection in EcoStruxure Building Operation WebReports V1.9 - V3.1
- EcoStruxure Building Operation WebReports V1.9 - V3.1
- XML external entities (XXE)
- CVSS 6.5 Medium
Avaya WebLM Improper Restriction of XML External Entity Reference
- Avaya WebLM
- Avaya System Manager
- XML external entities (XXE)
- CVSS 5.6 Medium
Authenticated XML External Entity Processing
- XML external entities (XXE)
<6.3.2.1 · fixed in 6.3.2.1
GHSA-8xv9-qcr9-ww9j -
XML external entity injection in Pulse Connect Secure
- Pulse Connect Secure
- XML external entities (XXE)
-
XXE in Apache Standard Taglibs
- XML external entities (XXE)
<1.2.3 · fixed in 1.2.3
GHSA-6x4w-8w53-xrvv · CVE-2015-0254 - CVSS 7.5 HighCritical · CVSS 7+ and EPSS
XML external entity injection in NEC ExpressCluster
- NEC ExpressCluster
- XML external entities (XXE)
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
XML external entity injection in Veeam ONE
- Veeam ONE
- XML external entities (XXE)
- CVSS 7.5 High
XML external entity injection in Veeam ONE
- Veeam ONE
- XML external entities (XXE)
- CVSS 6.5 Medium
Cisco SD-WAN vManage Software XML External Entity Vulnerability
- Cisco SD-WAN vManage
- XML external entities (XXE)
-
XML external entity injection in The Eclipse Foundation Eclipse Web Tools Platform
- The Eclipse Foundation Eclipse Web Tools Platform
- XML external entities (XXE)
-
XML external entity injection in Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02
- Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02
- XML external entities (XXE)
- CVSS 9.3 CriticalCritical · CVSS 9+
XXE attack in Mapfish Print
- XML external entities (XXE)
>=3.0, <3.24 · fixed in 3.24
GHSA-vjv6-gq77-3mjw · CVE-2020-15232 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
XML external entity injection in Terracotta Quartz Scheduler
- XML external entities (XXE)
<2.3.2 · fixed in 2.3.2
GHSA-9qcf-c26r-x5rf · CVE-2019-13990 - CVSS 9.8 CriticalCritical · CVSS 9+
dom4j allows External Entities by default which might enable XXE attacks
- XML external entities (XXE)
<=1.6.1 · no fixed version yet
GHSA-hwj3-m3p6-hj38 · CVE-2020-10683 - CVSS 7.5 High
PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak
- Palo Alto Networks PAN-OS
- XML external entities (XXE)
- CVSS 4.9 Medium
Cisco Hosted Collaboration Mediation Fulfillment XML External Expansion Vulnerability
- Cisco Hosted Collaboration Mediation Fulfillment
- XML external entities (XXE)
-
XML external entity injection in WebAccess/NMS
- WebAccess/NMS
- XML external entities (XXE)
- CVSS 7.5 High
Metasys Improper Restriction of XML External Entity Reference
- Johnson Controls Metasys Application and Data Server (ADS, ADS-Lite)
- Johnson Controls Metasys Extended Application and Data Server (ADX)
- XML external entities (XXE)
- CVSS 8.6 High
XML external entity injection in Red Hat spacewalk
- Red Hat spacewalk
- XML external entities (XXE)