Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
-
XML Entity Expansion (XEE) in Django
- XML external entities (XXE)
>=1.3.0, <1.3.6 || >=1.4.0, <1.4.4 · fixed in 1.3.6, 1.4.4
GHSA-qrh7-x6fp-c2mp · CVE-2013-1664 -
XML External Entity (XXE) in Django
- Information disclosure
- XML external entities (XXE)
>=1.3.0, <1.3.6 || >=1.4.0, <1.4.4 · fixed in 1.3.6, 1.4.4
GHSA-x64m-686f-fmm3 · CVE-2013-1665 - CVSS 7.5 HighCritical · CVSS 7+ and EPSS
CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references
- XML external entities (XXE)
>=2.1.0-alpha, <2.1.5 || >=2.2.0-beta, <2.2.1 · fixed in 2.1.5, 2.2.1
GHSA-5964-pq8r-4q62 · CVE-2012-4399 - CVSS 7.3 HighCritical · CVSS 7+ and EPSS
Zend Framework XXE Vulnerability
- XML external entities (XXE)
>=1.0.0, <1.11.12 || >=1.12.0-rc1, <1.12.0 · fixed in 1.11.12, 1.12.0
GHSA-7pg4-5233-82jv · CVE-2012-3363 -
Improper Restriction of XML External Entity Reference in Apache Solr
- XML external entities (XXE)
<4.1.0 · fixed in 4.1.0
GHSA-6cpj-3g83-q2j4 · CVE-2012-6612 -
SOAPpy vulnerable to XML External Entity attacks
- XML external entities (XXE)
<=0.12.5 · no fixed version yet
GHSA-52wr-3vww-rmpq · CVE-2014-3242 -
PHPExcel vulnerable to XXE attacks through libxml
- XML external entities (XXE)
<1.8.0 · fixed in 1.8.0
GHSA-28rm-rj57-qjpv · CVE-2014-2054 -
Apache Solr UpdateRequestHandler for XML resolves XML External Entities
- XML external entities (XXE)
<4.1.0 · fixed in 4.1.0
GHSA-998j-j6v9-5846 · CVE-2013-6407 -
XML External Entity Reference in RESTEasy
- XML external entities (XXE)
- CWE-20
<3.0.11.Final · fixed in 3.0.11.Final
GHSA-pc54-pchm-xcw6 · CVE-2014-7839 -
ZendXml and Zend Framework contain XXE and XEE Vulnerabilities
- XML external entities (XXE)
- Denial of service
>=1.12.0, <1.12.14 || >=2.0.0, <2.4.6 || >=2.5.0, <2.5.2 · fixed in 1.12.14, 2.4.6, 2.5.2
GHSA-xp8p-9rq5-4wgv · CVE-2015-5161 -
getID3 is vulnerable to XML External Entity (XXE)
- XML external entities (XXE)
<1.9.9 · fixed in 1.9.9
GHSA-5v43-55m5-qr8f · CVE-2014-2053 - CVSS 8.2 High
Improper Restriction of XML External Entity Reference in Openpyxl
- XML external entities (XXE)
<2.4.2 · fixed in 2.4.2
GHSA-chqf-hx79-gxc6 · CVE-2017-5992 - CVSS 9.0 CriticalCritical · CVSS 9+
PySAML2 XML external entity attack
- XML external entities (XXE)
<4.5.0 · fixed in 4.5.0
GHSA-m269-wj6g-c459 · CVE-2016-10127 - CVSS 10.0 CriticalCritical · CVSS 9+
Apache OpenMeetings does not correctly validate uploaded XML documents
- XML external entities (XXE)
>=3.1.0, <3.3.0 · fixed in 3.3.0
GHSA-67q3-gwww-pm4g · CVE-2017-7664 - CVSS 9.8 CriticalCritical · CVSS 9+
XML External Entity Reference in Apache Sling
- XML external entities (XXE)
<1.0.12 · fixed in 1.0.12
GHSA-7g54-vgp6-jj5w · CVE-2016-6798 - CVSS 6.5 Medium
phpMyAdmin vulnerable to XML external entity (XXE) injection attack
- Information disclosure
- XML external entities (XXE)
>=3.3.0, <3.3.10.5 || >=3.4.0, <3.4.7.1 · fixed in 3.3.10.5, 3.4.7.1
GHSA-q4mm-89q2-xffg · CVE-2011-4107 -
Improper Restriction of XML External Entity Reference in Apache POI
- XML external entities (XXE)
<3.10.1 · fixed in 3.10.1
GHSA-q56h-jjj6-52mf · CVE-2014-3529 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in Jelly
- XML external entities (XXE)
<1.0.1 · fixed in 1.0.1
GHSA-6g33-82gc-3pw5 · CVE-2017-12621 - CVSS 5.5 Medium
Umbraco CMS XXE Vulnerability
- XML external entities (XXE)
<7.7.3 · fixed in 7.7.3
GHSA-h2vq-7gf2-qw9v · CVE-2017-15280 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in Apache OpenNLP
- XML external entities (XXE)
>=1.5.0, <1.8.2 · fixed in 1.8.2
GHSA-h22x-hm8g-rxpg · CVE-2017-12620 - CVSS 6.5 Medium
XML External Entity Reference in Apache NiFi
- XML external entities (XXE)
>=1.0.0, <1.4.0 · fixed in 1.4.0
GHSA-qj7f-j6h9-g5rq · CVE-2017-12623 -
XML External Entity Reference in org.picketlink:picketlink-common
- XML external entities (XXE)
<2.7.0.Final · fixed in 2.7.0.Final
GHSA-2c9q-qwrc-f486 · CVE-2014-3530 - CVSS 7.5 High
XXE Vulnerability in XMLBundle 0.1.7
- XML external entities (XXE)
<=0.1.7 · no fixed version yet
GHSA-qvwf-w35m-6r95 · CVE-2017-1000477 - CVSS 8.8 High
XXE vulnerability in Jenkins DRY Plugin
- XML external entities (XXE)
<2.50 · fixed in 2.50
GHSA-x7qf-qh3r-mx22 · CVE-2018-1000010 - CVSS 8.8 High
XXE vulnerability in Jenkins Checkstyle Plugin
- XML external entities (XXE)
<3.50 · fixed in 3.50
GHSA-jfj9-7j5w-6xgx · CVE-2018-1000009 - CVSS 8.8 High
XXE vulnerability in Jenkins PMD Plugin
- XML external entities (XXE)
<3.50 · fixed in 3.50
GHSA-687x-269m-7cv9 · CVE-2018-1000008 - CVSS 8.8 High
XML External Entity Reference in Jenkins FindBugs Plugin
- XML external entities (XXE)
<=4.7.1 · no fixed version yet
GHSA-pr9h-g7p7-rrqh · CVE-2018-1000011 - CVSS 8.8 High
XXE vulnerability Jenkins Warnings Plugin
- XML external entities (XXE)
<4.65 · fixed in 4.65
GHSA-p498-rpcw-3578 · CVE-2018-1000012 - CVSS 8.3 High
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
- XML external entities (XXE)
<1.24 · fixed in 1.24
GHSA-4rj6-9pjh-882r · CVE-2018-1000056 - CVSS 8.3 High
XXE vulnerability in Jenkins Android Lint Plugin
- XML external entities (XXE)
<2.6 · fixed in 2.6
GHSA-3vcx-w94h-68vg · CVE-2018-1000055 - CVSS 9.8 CriticalCritical · CVSS 9+
mxGraph vulnerable to XXE attacks
- XML external entities (XXE)
<3.7.6 · fixed in 3.7.6
GHSA-wvpv-8524-wg6x · CVE-2017-18197 - CVSS 8.3 High
Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<3.2 · fixed in 3.2
GHSA-c4mp-h3m2-h5mc · CVE-2018-1000054 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in Apache NiFi
- XML external entities (XXE)
>=0.1.0, <1.6.0 · fixed in 1.6.0
GHSA-42wx-65g4-5cxv · CVE-2018-1309 - CVSS 6.5 Medium
XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin
- XML external entities (XXE)
<4.0.0 · fixed in 4.0.0
GHSA-8rc4-3jc3-83pm · CVE-2018-1000198 - CVSS 7.5 High
WeChat Pay Java SDK allows XXE
- XML external entities (XXE)
<=3 · no fixed version yet
GHSA-gqgv-2gp3-qqp3 · CVE-2018-13439 - CVSS 9.8 CriticalCritical · CVSS 9+
PHPOffice Common Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<0.2.9 · fixed in 0.2.9
GHSA-2853-hf2g-9843 · CVE-2018-14065 - CVSS 9.8 Critical
Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Apache ActiveMQ
- XML external entities (XXE)
<2.23.1 · fixed in 2.23.1
GHSA-x6rc-54xp-ccxx · CVE-2015-3208 - CVSS 8.1 High
XML External Entity Reference in Apache Cayenne
- XML external entities (XXE)
<3.1.3 || >=4.0, <4.1 · fixed in 3.1.3, 4.1
GHSA-85hw-w436-c725 · CVE-2018-11758 - CVSS 7.8 High
Apache XML-RPC XXE Vulnerability
- XML external entities (XXE)
<=3.1.3 · no fixed version yet
GHSA-wp35-6jqv-r33m · CVE-2016-5002 - CVSS 9.8 CriticalCritical · CVSS 9+
XML External Entity Reference in weixin-java-tools
- XML external entities (XXE)
<3.3.2.B · fixed in 3.3.2.B
GHSA-h755-h99p-9ffv · CVE-2019-5312 - CVSS 8.1 High
Improper Restriction of XML External Entity Reference in PMD
- XML external entities (XXE)
<6.0.0 · fixed in 6.0.0
GHSA-57qj-79gh-69w8 · CVE-2019-7722 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache ActiveMQ Apollo XXE Vulnerability
- XML external entities (XXE)
>=1.0.0, <1.7.1 · fixed in 1.7.1
GHSA-wmhw-hpwh-44pg · CVE-2014-3579 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
- XML external entities (XXE)
>=5.0.0, <5.10.1 · fixed in 5.10.1
GHSA-4vhf-2hv7-8mrx · CVE-2014-3600 - CVSS 6.5 Medium
Improper Restriction of XML External Entity Reference in Apache uimaj
- XML external entities (XXE)
<2.4.0 · fixed in 2.4.0
GHSA-wp2f-hrg2-3r5m · CVE-2017-15691 -
Several Zend Products Vulnerable to XXE and XEE attacks
- XML external entities (XXE)
- Denial of service
<1.12.4 · fixed in 1.12.4
GHSA-gp39-h9c2-qw79 · CVE-2014-2682 -
Several Zend Products Vulnerable to XXE and XEE attacks
- XML external entities (XXE)
- Denial of service
<1.12.4 · fixed in 1.12.4
GHSA-5wm2-38q5-5rxv · CVE-2014-2683 -
Several Zend Products Vulnerable to XXE and XEE attacks
- XML external entities (XXE)
<1.12.4 · fixed in 1.12.4
GHSA-43xg-87xw-jpv8 · CVE-2014-2681 - CVSS 9.1 CriticalCritical · CVSS 9+
SimpleXML has XML External Entity (XXE) vulnerability
- XML external entities (XXE)
<2.7.1 · fixed in 2.7.1
GHSA-f5qf-vh69-9q4r · CVE-2017-1000190 - CVSS 6.5 Medium
XML External Entity Reference in jbpmmigration
- XML external entities (XXE)
<=0.15 · no fixed version yet
GHSA-vc3x-72q4-g3p5 · CVE-2017-7545 - CVSS 5.9 Medium
Improper Restriction of XML External Entity Reference in Elasticsearch
- XML external entities (XXE)
>=6.5.0, <6.5.2 · fixed in 6.5.2
GHSA-ccmr-qj26-845g · CVE-2018-17247 - CVSS 9.1 CriticalCritical · CVSS 9+
XXE vulnerability in Jenkins Job Import Plugin
- XML external entities (XXE)
<3.0 · fixed in 3.0
GHSA-882r-r8fw-p538 · CVE-2019-1003015 - CVSS 4.0, no score published
Jenkins has XML External Entity (XXE) Vulnerability in Job Configuration via CLI
- XML external entities (XXE)
>=1.626, <1.638 || <1.625.2 · fixed in 1.638, 1.625.2
GHSA-3j9c-cp7m-8w8g · CVE-2015-5319 - CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Improper Restriction of XML External Entity Reference in Apace Derby
- XML external entities (XXE)
<10.12.1.1 · fixed in 10.12.1.1
GHSA-wr69-g62g-2r9h · CVE-2015-1832 - CVSS 5.5 Medium
Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability
- XML external entities (XXE)
<3.14 · fixed in 3.14
GHSA-pmqq-7wfv-jfff · CVE-2016-5000 - CVSS 7.3 High
Improper Restriction of XML External Entity Reference in Apache Batik
- XML external entities (XXE)
<1.9 · fixed in 1.9
GHSA-qwgx-59jw-qfg9 · CVE-2017-5662 - CVSS 8.8 High
Improper Restriction of XML External Entity Reference in iText
- XML external entities (XXE)
<5.5.12 || >=7.0.0, <7.0.3 · fixed in 5.5.12, 7.0.3
GHSA-86p9-x5pw-94qx · CVE-2017-9096 -
Moodle Arbitrary File Read via XML External Entity vulnerability
- XML external entities (XXE)
<2.4.11 || >=2.5.0, <2.5.7 || >=2.6.0, <2.6.4 || >=2.7.0, <2.7.1 · fixed in 2.4.11, 2.5.7, 2.6.4, 2.7.1
GHSA-27j2-c838-c3qg · CVE-2014-3543 - CVSS 7.5 High
Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS
- XML external entities (XXE)
<3.0.12 || >=3.1.0, <3.1.9 · fixed in 3.0.12, 3.1.9
GHSA-x7xf-253v-x3w8 · CVE-2016-8739 - CVSS 7.3 High
Improper Restriction of XML External Entity Reference in Apache FOP
- XML external entities (XXE)
<2.2 · fixed in 2.2
GHSA-5hg8-r9vq-gjqp · CVE-2017-5661 - CVSS 8.8 High
Improper Restriction of XML External Entity Reference in python-docx
- XML external entities (XXE)
<0.8.6 · fixed in 0.8.6
GHSA-34wj-p5jm-2p96 · CVE-2016-5851