Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
untangle vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<1.2.1 · fixed in 1.2.1
GHSA-f83q-2cp7-qrjg · CVE-2022-31471 - CVSS 7.6 High
Inductive Automation Ignition
- Inductive Automation Ignition
- XML external entities (XXE)
-
XML external entity injection in Dogtag PKI
- Dogtag PKI
- XML external entities (XXE)
- CVSS 5.9 Medium
VISAM VBASE Editor Improper Restriction of XML
- VISAM VBASE Pro-RT/ Server-RT (Web Remote)
- XML external entities (XXE)
- CVSS 8.5 High
OpenKM XXE Injection
- OpenKM Document Management Community
- XML external entities (XXE)
- CVSS 7.5 High
Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection
- Data Systems Consulting Co., Ltd. BPM
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2
- XML external entities (XXE)
<3.3.2 · fixed in 3.3.2
GHSA-j3h2-8mf8-j5r2 · CVE-2015-8031 -
XML external entity injection in SAP SE SAP Business one
- SAP SE SAP Business one
- XML external entities (XXE)
- CVSS 4.2 Medium
XML External Entity Reference in Eclipse Lyo
- XML external entities (XXE)
>=1.0.0, <5.0.0.Final · fixed in 5.0.0.Final
GHSA-6296-mvgp-27hp · CVE-2021-41042 - CVSS 9.8 CriticalCritical · CVSS 9+
Insufficient user input in Apache Jetspeed-2
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
<=2.3.1 · no fixed version yet
GHSA-h975-r69h-4w9p · CVE-2022-32533 - CVSS 7.1 High
XML External Entity Reference in Jenkins Recipe Plugin
- XML external entities (XXE)
<=1.2 · no fixed version yet
GHSA-rm23-6mwv-8q9q · CVE-2022-34793 - CVSS 5.9 Medium
SysAid - Okta SSO integration
- SysAid - Okta SSO integration
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
XML External Entity Reference in drools
- XML external entities (XXE)
<7.60.0.Final · fixed in 7.60.0.Final
GHSA-rc57-9r3x-98cq · CVE-2021-41411 -
XML external entity injection in Siemens Mendix SAML Module (Mendix 7 compatible) and others
- Siemens Mendix SAML Module (Mendix 7 compatible)
- Siemens Mendix SAML Module (Mendix 8 compatible)
- XML external entities (XXE)
- CVSS 6.5 Medium
HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<2.5.0.Beta1 · fixed in 2.5.0.Beta1
GHSA-xrh2-c3rm-35jr · CVE-2014-3599 - CVSS 8.1 High
XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin
- XML external entities (XXE)
<3.7.1 · fixed in 3.7.1
GHSA-6755-jgp4-8q7h · CVE-2019-10327 - CVSS 6.5 Medium
XXE vulnerability in Jenkins pom2config Plugin
- XML external entities (XXE)
<=1.2 · no fixed version yet
GHSA-ppv9-v43c-xqpp · CVE-2021-43576 - CVSS 7.1 High
XXE vulnerability in Jenkins OWASP Dependency-Check Plugin
- XML external entities (XXE)
<5.1.2 · fixed in 5.1.2
GHSA-mj5v-ggjc-48p5 · CVE-2021-43577 - CVSS 6.5 Medium
XXE vulnerability in Jenkins Performance Plugin
- XML external entities (XXE)
<=3.20 · no fixed version yet
GHSA-hr8p-76q8-fxwq · CVE-2021-21701 - CVSS 8.6 High
Improper Restriction of XML External Entity Reference in Stanford CoreNLP
- XML external entities (XXE)
<4.3.1 · fixed in 4.3.1
GHSA-8gf7-w3cp-gfh3 · CVE-2021-3869 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Restriction of XML External Entity Reference in Stanford CoreNLP
- XML external entities (XXE)
<4.3.1 · fixed in 4.3.1
GHSA-5h9g-8xcv-qjq9 · CVE-2021-3878 - CVSS 7.1 High
XXE vulnerability in Jenkins Nested View Plugin
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-5wc4-w63v-97c3 · CVE-2021-21680 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
XXE vulnerability in Jenkins Generic Webhook Trigger Plugin
- XML external entities (XXE)
<1.74 · fixed in 1.74
GHSA-732f-w585-gmpc · CVE-2021-21669 - CVSS 4.8 Medium
SilverStripe XXE Vulnerability in CSSContentParser
- XML external entities (XXE)
>=4.0.0, <4.7.4 · fixed in 4.7.4
GHSA-3vjc-5x79-m9r8 · CVE-2020-25817 - CVSS 9.1 CriticalCritical · CVSS 9+
XML external entity vulnerability in Jenkins Nuget Plugin
- XML external entities (XXE)
<1.1 · fixed in 1.1
GHSA-p674-hh8x-rv5h · CVE-2021-21658 - CVSS 8.8 High
XXE vulnerability in Jenkins Filesystem Trigger Plugin
- XML external entities (XXE)
<0.41 · fixed in 0.41
GHSA-cphv-7cxw-5hcc · CVE-2021-21657 - CVSS 8.1 HighCritical · CVSS 7+ and EPSS
XXE vulnerability in Jenkins URLTrigger Plugin
- XML external entities (XXE)
<0.49 · fixed in 0.49
GHSA-34j5-c4cv-mmg5 · CVE-2021-21659 - CVSS 7.1 High
XML external entity injection in VMware Tools for Windows
- VMware Tools for Windows
- XML external entities (XXE)
- CVSS 8.1 HighCritical · CVSS 7+ and EPSS
XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin
- XML external entities (XXE)
<3.7.1 · fixed in 3.7.1
GHSA-q7xg-hh3q-hc68 · CVE-2021-21642 - CVSS 7.5 High
XXE vulnerability in Jenkins CVS Plugin
- XML external entities (XXE)
<2.17 · fixed in 2.17
GHSA-g9hg-x9c9-7xgr · CVE-2020-2324 - CVSS 6.5 Medium
XXE vulnerability in Jenkins Visualworks Store Plugin
- XML external entities (XXE)
<1.1.4 · fixed in 1.1.4
GHSA-jvjm-j945-8qwc · CVE-2020-2315 - CVSS 6.5 Medium
XXE vulnerability in Jenkins Mercurial Plugin
- XML external entities (XXE)
>=2.11, <2.12 || >=2.10, <2.10.1 || >=2.9, <2.9.1 || <2.8.1 · fixed in 2.12, 2.10.1, 2.9.1, 2.8.1
GHSA-x58r-wxc3-7pqr · CVE-2020-2305 - CVSS 6.5 Medium
XXE vulnerability in Jenkins Subversion Plugin
- XML external entities (XXE)
<2.13.2 · fixed in 2.13.2
GHSA-vp5f-8jgw-j53c · CVE-2020-2304 - CVSS 6.5 Medium
XXE vulnerability in Jenkins Nerrvana Plugin
- XML external entities (XXE)
<=1.02.06 · no fixed version yet
GHSA-wcrg-92wp-4h28 · CVE-2020-2298 - CVSS 7.1 High
XXE vulnerability in Jenkins Liquibase Runner Plugin
- XML external entities (XXE)
<1.4.7 · fixed in 1.4.7
GHSA-xx7g-f287-f9fq · CVE-2020-2284 - CVSS 7.5 High
DotPlant2 Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<2020-09-14 · fixed in 2020-09-14
GHSA-c49v-35ff-q9f7 · CVE-2020-25750 - CVSS 7.1 High
XXE vulnerability in Jenkins Klocwork Analysis Plugin
- XML external entities (XXE)
<2020.3.1 · fixed in 2020.3.1
GHSA-p6c5-737r-2r93 · CVE-2020-2247 - CVSS 7.1 High
XXE vulnerability in Jenkins Valgrind Plugin
- XML external entities (XXE)
<=0.28 · no fixed version yet
GHSA-xq2q-8hxc-7jr2 · CVE-2020-2245 - CVSS 7.1 High
XXE vulnerability in Jenkins Parasoft Findings Plugin
- XML external entities (XXE)
<10.4.4 · fixed in 10.4.4
GHSA-2rh4-xgmq-63jp · CVE-2020-2178 - CVSS 7.1 High
XXE vulnerability in Jenkins Code Coverage API Plugin
- XML external entities (XXE)
- Denial of service
<1.1.5 · fixed in 1.1.5
GHSA-cmgm-q8hf-p7jc · CVE-2020-2172 - CVSS 9.8 Critical
Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Mulesoft APIkit
- XML external entities (XXE)
<1.3.1 · fixed in 1.3.1
GHSA-jffq-528j-mp6c · CVE-2020-10991 - CVSS 7.6 High
XXE vulnerability in Jenkins RapidDeploy Plugin
- XML external entities (XXE)
<4.2.1 · fixed in 4.2.1
GHSA-g7w4-r4mg-gvhx · CVE-2020-2171 - CVSS 9.8 CriticalCritical · CVSS 9+
AutoUpdater.NET allows XXE
- XML external entities (XXE)
<1.5.8 · fixed in 1.5.8
GHSA-75p2-hgw4-g7f7 · CVE-2019-20627 - CVSS 7.1 High
XXE vulnerability in Jenkins Cobertura Plugin
- XML external entities (XXE)
<1.16 · fixed in 1.16
GHSA-vpfj-5gg5-fvfm · CVE-2020-2138 - CVSS 7.1 High
XXE vulnerability in Rundeck Plugin
- XML external entities (XXE)
<3.6.7 · fixed in 3.6.7
GHSA-5xh7-6v3x-vrhj · CVE-2020-2144 - CVSS 7.6 High
XXE vulnerability in FitNesse Plugin
- XML external entities (XXE)
<1.31 · fixed in 1.31
GHSA-c3cg-mv5w-cvw8 · CVE-2020-2120 - CVSS 7.6 High
XXE vulnerability in NUnit Plugin
- XML external entities (XXE)
<0.26 · fixed in 0.26
GHSA-xvhf-q744-5xm8 · CVE-2020-2115 - CVSS 7.6 High
XXE vulnerability in Jenkins WebSphere Deployer Plugin
- XML external entities (XXE)
<=1.6.1 · no fixed version yet
GHSA-f5wx-w2f9-82gh · CVE-2020-2108 - CVSS 7.6 High
XXE vulnerability in Jenkins Robot Framework Plugin
- XML external entities (XXE)
<2.0.1 · fixed in 2.0.1
GHSA-m53p-f25q-q6fg · CVE-2020-2092 - CVSS 7.1 High
PyAMF vulnerable to XML external entity (XXE)
- XML external entities (XXE)
<0.8.0 · fixed in 0.8.0
GHSA-m7m4-4vm8-55wg · CVE-2015-8549 - CVSS 7.5 High
XML external entity (XXE) vulnerability in Jenkins
- XML external entities (XXE)
>=1.597, <1.600 || <1.596.1 · fixed in 1.600, 1.596.1
GHSA-qj27-w92h-fc9r · CVE-2015-1809 - CVSS 7.1 High
Jenkins Maven Release Plug-in Plugin XXE vulnerability
- XML external entities (XXE)
<0.16.2 · fixed in 0.16.2
GHSA-7mf5-79gv-66gh · CVE-2019-16549 - CVSS 5.5 Medium
Improper Restriction of XML External Entity Reference in Apache POI
- XML external entities (XXE)
<4.1.1 · fixed in 4.1.1
GHSA-9jwc-q6j3-8g9g · CVE-2019-12415 - CVSS 8.1 High
Jenkins 360 FireLine Plugin vulnerable to XML External Entity Reference
- XML external entities (XXE)
<=1.7.2 · no fixed version yet
GHSA-346g-jrx9-jgf4 · CVE-2019-10466 - CVSS 9.8 CriticalCritical · CVSS 9+
CodeIgniter Rest Server XXE Vulnerability
- XML external entities (XXE)
<2.7.2 · fixed in 2.7.2
GHSA-cc7g-9pcj-7gwm · CVE-2015-3907 - CVSS 7.5 High
Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin
- XML external entities (XXE)
<2.8 · fixed in 2.8
GHSA-g6h2-4x64-c59x · CVE-2019-10337 - CVSS 6.1 Medium
Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response
- XML external entities (XXE)
<=3.15 · no fixed version yet
GHSA-w898-3ph8-5pgm · CVE-2019-10309 - CVSS 7.1 High
XML External Entity Reference in Jenkins Storable Configs Plugin
- XML external entities (XXE)
<=1.0 · no fixed version yet
GHSA-wqmp-2p5r-rhfv · CVE-2022-30971 - CVSS 8.1 High
jersey: XXE via parameter entities
- XML external entities (XXE)
<1.13 · fixed in 1.13
GHSA-5m48-vr54-vmh3 · CVE-2014-3643 -
Zend Framework XXE Vulnerability
- Information disclosure
- XML external entities (XXE)
<1.11.15 || >=1.12.0-rc1, <1.12.1 · fixed in 1.11.15, 1.12.1
GHSA-9m5v-vq4f-mrvf · CVE-2012-5657