Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
-
Improper Restriction of XML External Entity Reference in Castor
- XML external entities (XXE)
<=1.0 · no fixed version yet
GHSA-jwwr-fjgh-cv2x · CVE-2014-3004 - CVSS 8.8 High
Improper Restriction of XML External Entity Reference in Spring Framework
- XML external entities (XXE)
>=4.0.0, <4.0.5 || >=3.0.0, <3.2.8 · fixed in 4.0.5, 3.2.8
GHSA-f93f-g33r-8pcp · CVE-2014-0225 -
XML external entity injection in Siemens Teamcenter V12.4 and others
- Siemens Teamcenter V12.4
- Siemens Teamcenter V13.0
- XML external entities (XXE)
- CVSS 7.3 High
External Entity Reference in TwelveMonkeys ImageIO
- XML external entities (XXE)
<3.7.1 · fixed in 3.7.1
GHSA-pjch-4g28-fxx7 · CVE-2021-23792 - CVSS 9.8 CriticalCritical · CVSS 9+
XML External Entity Reference in apache jena
- XML external entities (XXE)
>=4.4.0, <4.5.0 · fixed in 4.5.0
GHSA-gchv-364h-r896 · CVE-2022-28890 - CVSS 5.5 Medium
Delta Electronics DMARS Improper Restriction of XML External Entity Reference
- Delta Electronics DMARS
- XML external entities (XXE)
- CVSS 8.8 High
Multiple XXE vulnerabilities in OBS
- SUSE Open Build Service
- XML external entities (XXE)
- CVSS 7.5 High
Multiple components in Apache NiFi do not restrict XML External Entity references
- XML external entities (XXE)
>=0.0.1, <1.16.1 · fixed in 1.16.1
GHSA-wc97-7623-rxwx · CVE-2022-29265 - CVSS 4.9 Medium
Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
- XML external entities (XXE)
>=2.7, <12.10.10 || >=13.0.0, <13.4.4 || >=13.5-rc-1, <13.8-rc-1 · fixed in 12.10.10, 13.4.4, 13.8-rc-1
GHSA-m2r5-4w96-qxg5 · CVE-2022-24898 - CVSS 7.3 High
XML External Entity Reference in detekt
- XML external entities (XXE)
<1.20.0 · fixed in 1.20.0
GHSA-2cfc-865j-gm4w · CVE-2022-0272 - CVSS 6.1 Medium
ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform
- FANUC ROBOGUIDE
- XML external entities (XXE)
- CVSS 7.5 High
Inline DTD allows XML bomb attack
- XML external entities (XXE)
- Denial of service
<0.7.0 · fixed in 0.7.0
GHSA-qpmc-wprv-x746 · CVE-2019-15160 - CVSS 5.5 Medium
ICSA-22-088-01 Rockwell Automation ISaGRAF
- Rockwell Automation Connected Component Workbench
- Rockwell Automation ISaGRAF
- XML external entities (XXE)
-
Improper Restriction of XML External Entity Reference in wutka jox
- XML external entities (XXE)
<=1.16 · no fixed version yet
GHSA-fcrx-8829-jpqx · CVE-2021-43142 - CVSS 7.1 High
XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin
- XML external entities (XXE)
<=1.3 · no fixed version yet
GHSA-rwg2-w82x-v57j · CVE-2022-28155 - CVSS 8.1 High
XXE vulnerability in Jenkins Flaky Test Handler Plugin
- XML external entities (XXE)
<1.2.2 · fixed in 1.2.2
GHSA-v4rr-65x6-g69f · CVE-2022-28140 - CVSS 7.1 High
enkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability
- XML external entities (XXE)
<=1.1.1 · no fixed version yet
GHSA-8rx6-v5q4-xw3j · CVE-2022-28154 - CVSS 5.5 Medium
XML external entity injection in Schneider Electric SCADAPack Workbench
- Schneider Electric SCADAPack Workbench
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in soa-model
- XML external entities (XXE)
<1.6.4 · fixed in 1.6.4
GHSA-pv39-qp28-4mgh · CVE-2021-43090 - CVSS 7.5 High
GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference
- GE Gas Power ToolBoxST
- XML external entities (XXE)
- CVSS 3.5 Low
ePO XML extended entity vulnerability
- McAfee,LLC McAfee ePolicy Orchestrator (ePO)
- XML external entities (XXE)
- CVSS 7.1 High
XML external entity (XXE) attacks in Jenkins Xcode integration Plugin
- XML external entities (XXE)
<2.0.15 · fixed in 2.0.15
GHSA-wfxp-4qgw-qp3c · CVE-2021-21656 - CVSS 9.1 CriticalCritical · CVSS 9+
XML external entity (XXE) injection in Apache Nutch
- XML external entities (XXE)
<1.18 · fixed in 1.18
GHSA-fxhp-wrw9-3r97 · CVE-2021-23901 - CVSS 6.1 Medium
XML External Entities Vulnerability in CVRF-CSAF-Converter
- Information disclosure
- XML external entities (XXE)
<1.0.0rc2 · fixed in 1.0.0rc2
GHSA-m8gq-83gh-v42v · CVE-2022-27193 - CVSS 7.1 High
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
- XML external entities (XXE)
- Server-side request forgery (SSRF)
<1.14 · fixed in 1.14
GHSA-x3m3-g8w6-mf28 · CVE-2022-27201 - CVSS 6.5 Medium
Improper Restriction of XML External Entity Reference in trytond and proteus
- XML external entities (XXE)
>=5.0.0, <5.0.12 || >=6.0.0, <6.0.5 || >=6.1.0, <6.2.2 · fixed in 5.0.12, 6.0.5, 6.2.2
GHSA-cj78-rgw3-4h5p · CVE-2022-26661 - CVSS 6.8 Medium
Signiant - Manager+Agents XML External Entity (XXE)
- Signiant
- XML external entities (XXE)
- CVSS 9.1 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in Any23
- XML external entities (XXE)
<2.7 · fixed in 2.7
GHSA-2rmm-87v7-34rj · CVE-2022-25312 - CVSS 7.3 High
Improper Restriction of XML External Entity Reference in Liquibase
- XML external entities (XXE)
<4.8.0 · fixed in 4.8.0
GHSA-jvfv-hrrc-6q72 · CVE-2022-0839 - CVSS 7.3 High
XML External Entity Reference in Hazelcast
- XML external entities (XXE)
>=5.1-beta1, <5.1 · fixed in 5.1
GHSA-99wh-973f-779p · CVE-2022-0265 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer
- XML external entities (XXE)
- Denial of service
<2.1.0 · fixed in 2.1.0
GHSA-xvm2-9xvc-hx7f · CVE-2022-23640 - CVSS 7.1 High
IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
- Rockwell Automation FactoryTalk Services Platform
- XML external entities (XXE)
- CVSS 7.1 High
Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
- XML external entities (XXE)
<=1.20 · no fixed version yet
GHSA-38w8-h222-wrpp · CVE-2022-25209 - CVSS 7.8 High
Improper Restriction of XML External Entity Reference in Magnolia CMS
- XML external entities (XXE)
<6.2.4 · fixed in 6.2.4
GHSA-3qpg-33wr-533j · CVE-2021-46365 - CVSS 7.7 High
Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
>=9.4.1212.jre6, <42.2.13 · fixed in 42.2.13
GHSA-88cc-g835-76rp · CVE-2020-13692 - CVSS 7.8 High
XML external entity injection in Intel(R) Quartus(R) Prime Pro Edition
- Intel(R) Quartus(R) Prime Pro Edition
- XML external entities (XXE)
- CVSS 7.5 High
XML external entity injection in Intel(R) Quartus(R) Prime Pro Edition
- Intel(R) Quartus(R) Prime Pro Edition
- XML external entities (XXE)
-
XML external entity injection in BIG-IP FPS, ASM, and Advanced WAF
- BIG-IP FPS, ASM, and Advanced WAF
- XML external entities (XXE)
- CVSS 4.7 Medium
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<4.4.0 · fixed in 4.4.0
GHSA-75vw-3m5v-fprh · CVE-2022-0239 - CVSS 5.5 Medium
Improper Restriction of XML External Entity Reference in skylot/jadx
- XML external entities (XXE)
<1.3.2 · fixed in 1.3.2
GHSA-r8j4-96mx-rjcc · CVE-2022-0219 - CVSS 5.3 Medium
XML external entity injection in Oracle Corporation Java SE JDK and JRE
- Oracle Corporation Java SE JDK and JRE
- XML external entities (XXE)
- CVSS 6.1 Medium
XML External Entity Reference in edu.stanford.nlp:stanford-corenlp
- XML external entities (XXE)
<=4.3.2 · no fixed version yet
GHSA-mh83-jcw5-rjh8 · CVE-2022-0198 - CVSS 9.8 CriticalCritical · CVSS 9+
AEM Forms Improper Restriction of XML External Entity Reference
- Adobe Experience Manager
- XML external entities (XXE)
- CVSS 5.5 Medium
Improper Restriction of XML External Entity Reference in Apache NiFi
- XML external entities (XXE)
>=1.0.0, <1.12.0-RC1 · fixed in 1.12.0-RC1
GHSA-q4xf-3pmq-3hw8 · CVE-2020-13940 - CVSS 8.1 High
Improper Restriction of XML External Entity Reference in com.h2database:h2.
- XML external entities (XXE)
>=1.4.198, <2.0.202 · fixed in 2.0.202
GHSA-7rpj-hg47-cx62 · CVE-2021-23463 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in dbeaver/dbeaver
- dbeaver/dbeaver
- XML external entities (XXE)
- CVSS 9.1 CriticalCritical · CVSS 9+
XML External Entity vulnerability in MODX CMS
- XML external entities (XXE)
<2.8.0 · fixed in 2.8.0
GHSA-vhfp-9wvj-gwvg · CVE-2020-25911 - CVSS 6.5 Medium
XML External Entity Reference in org.opencms:opencms-core
- XML external entities (XXE)
>=11.0.0, <12.0.0 · fixed in 12.0.0
GHSA-g6v7-vqhx-6v6c · CVE-2021-3312 -
XML external entity injection in SAP SE SAP BusinessObjects Business Intelligence Platform (Crystal Reports)
- SAP SE SAP BusinessObjects Business Intelligence Platform (Crystal Reports)
- XML external entities (XXE)
-
Billion Laughs
- Apache Software Foundation Apache OpenOffice
- XML external entities (XXE)
- CVSS 6.4 Medium
Cisco Identity Services Engine XML External Entity Injection Vulnerability
- Cisco Identity Services Engine Software
- XML external entities (XXE)
- CVSS 7.5 High
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
- XML external entities (XXE)
<1.12.5 · fixed in 1.12.5
GHSA-2rr5-8q37-2w7h · CVE-2021-41098 -
XML External Entity Reference in Apache Jena
- XML external entities (XXE)
<4.2.0 · fixed in 4.2.0
GHSA-7rp6-w7mg-h8rw · CVE-2021-39239 -
XML external entity injection in Siemens Teamcenter V12.4 and others
- Siemens Teamcenter V12.4
- Siemens Teamcenter V13.0
- XML external entities (XXE)
- CVSS 9.1 CriticalCritical · CVSS 9+
XML Injection in Any23
- XML external entities (XXE)
<2.5 · fixed in 2.5
GHSA-838r-hvwh-24h8 · CVE-2021-38555 - CVSS 6.5 Medium
PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface
- Palo Alto Networks PAN-OS
- XML external entities (XXE)
-
XML external entity injection in The Eclipse Foundation Eclipse Theia
- The Eclipse Foundation Eclipse Theia
- Path traversal
- XML external entities (XXE)
- CVSS 7.5 High
XML External Entity Injection in PyWPS
- Other injection
- XML external entities (XXE)
<4.5.0 · fixed in 4.5.0
GHSA-p9wf-3xpg-c9g5 · CVE-2021-39371 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in Quokka
- XML external entities (XXE)
<=0.4.0 · no fixed version yet
GHSA-4q2r-qxp6-h5j6 · CVE-2020-18705 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in Quokka
- XML external entities (XXE)
<=0.4.0 · no fixed version yet
GHSA-3xg5-6c3j-vp8x · CVE-2020-18703