Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.5 Medium
XML external entity injection in FUJI ELECTRIC CO., LTD. FRENIC RHC Loader
- FUJI ELECTRIC CO., LTD. FRENIC RHC Loader
- XML external entities (XXE)
- CVSS 9.1 CriticalCritical · CVSS 9+
XML external entity injection in ArcSight Logger
- ArcSight Logger
- XML external entities (XXE)
- CVSS 7.5 High
xml-rs vulnerable to denial of service via invalid token in XML document
- XML external entities (XXE)
- Denial of service
>=0.8.9, <0.8.14 · fixed in 0.8.14
GHSA-7gf7-jv65-wjmh · CVE-2023-34411 - CVSS 7.7 High
Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication
- Splunk Enterprise
- Splunk Cloud Platform
- XML external entities (XXE)
- CVSS 7.1 High
The client in OpenText Archive Center Administration through 21.2 allows XXE attacks.
- XML external entities (XXE)
- CVSS 5.5 Medium
Weaver e-cology API RequestInfoByXml xml external entity reference
- Weaver e-cology
- XML external entities (XXE)
- CVSS 4.9 Medium
Cisco Identity Services Engine XML External Entity Injection Vulnerabilities
- Cisco Identity Services Engine Software
- XML external entities (XXE)
- CVSS 4.9 Medium
Cisco Identity Services Engine XML External Entity Injection Vulnerabilities
- Cisco Identity Services Engine Software
- XML external entities (XXE)
- CVSS 5.0 Medium
XML external entity injection in Schneider Electric OPC Factory Server (OFS)
- Schneider Electric OPC Factory Server (OFS)
- XML external entities (XXE)
- CVSS 6.3 Medium
IBM WebSphere Application Server XML external entity injection
- IBM WebSphere Application Server
- XML external entities (XXE)
- CVSS 2.5 Low
XML external entity injection in The Ministry of Justice Shinseiyo Sogo Soft
- The Ministry of Justice Shinseiyo Sogo Soft
- XML external entities (XXE)
- CVSS 5.5 Medium
CVE-2022-45876
- VISAM VBASE
- XML external entities (XXE)
- CVSS 4.9 Medium
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a…
- XML external entities (XXE)
- CVSS 6.5 Medium
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page.
- XML external entities (XXE)
- CVSS 6.5 Medium
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page.
- XML external entities (XXE)
- CVSS 5.5 Medium
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _default_.xml file.
- XML external entities (XXE)
- CVSS 7.5 High
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.
- XML external entities (XXE)
- CVSS 5.5 Medium
All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code.
- XML external entities (XXE)
- CVSS 5.5 Medium
All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server.
- XML external entities (XXE)
- CVSS 5.9 Medium
XML external entity injection in Siemens Polarion ALM
- Siemens Polarion ALM
- XML external entities (XXE)
- CVSS 6.5 Medium
Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in Ministry of Land, Infrastructure, Transport and Tourism…
- Ministry of Land, Infrastructure, Transport and Tourism, Japan National land numerical information data conversion tool
- XML external entities (XXE)
- CVSS 7.1 High
IBM TRIRIGA Application Platform XML external entity injection
- IBM TRIRIGA Application Platform
- XML external entities (XXE)
- CVSS 6.0 Medium
Cisco Identity Services Engine XML External Entity Injection Vulnerability
- Cisco Identity Services Engine Software
- XML external entities (XXE)
- CVSS 7.1 High
Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
- Hitachi Vantara Pentaho Business Analytics Server
- XML external entities (XXE)
- CVSS 7.1 High
Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacks
- XML external entities (XXE)
<=0.9 · no fixed version yet
GHSA-vq5h-qgxm-2m39 · CVE-2023-28680 - CVSS 7.1 High
Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks
- XML external entities (XXE)
<=1.7 · no fixed version yet
GHSA-8j88-2hfc-5rf3 · CVE-2023-28681 - CVSS 7.1 High
Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks
- XML external entities (XXE)
<=2.1.5 · no fixed version yet
GHSA-w4g6-8xqp-g92m · CVE-2023-28683 - CVSS 7.1 High
Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacks
- XML external entities (XXE)
<=8.09 · no fixed version yet
GHSA-qgm7-m77f-j8pf · CVE-2023-28682 - CVSS 7.1 High
Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks
- XML external entities (XXE)
<=0.0.3 · no fixed version yet
GHSA-58ch-c2jf-5g23 · CVE-2023-28684 - CVSS 5.8 Medium
XML external entity injection in ManageEngine OpManager
- ManageEngine OpManager
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in AVEVA Edge
- AVEVA Edge
- XML external entities (XXE)
- CVSS 5.3 Medium
An issue was discovered in Independentsoft JWord before 1.1.110.
- XML external entities (XXE)
- CVSS 5.3 Medium
An issue was discovered in Independentsoft JSpreadsheet before 1.1.110.
- XML external entities (XXE)
- CVSS 5.3 Medium
An issue was discovered in Independentsoft JODF before 1.1.110.
- XML external entities (XXE)
- CVSS 5.5 Medium
CVE-2022-45468
- VISAM VBASE
- XML external entities (XXE)
- CVSS 5.5 Medium
CVE-2022-45121
- VISAM VBASE
- XML external entities (XXE)
- CVSS 5.5 Medium
CVE-2022-41696
- VISAM VBASE
- XML external entities (XXE)
- CVSS 5.5 Medium
CVE-2022-43512
- VISAM VBASE
- XML external entities (XXE)
- CVSS 5.5 Medium
CVE-2022-46300
- VISAM VBASE
- XML external entities (XXE)
- CVSS 9.9 CriticalCritical · CVSS 9+
IBM Aspera Faspex XML external entity injection
- IBM Aspera Faspex
- XML external entities (XXE)
- CVSS 6.8 Medium
XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)
- NetWeaver (SAP Enterprise Portal)
- XML external entities (XXE)
- CVSS 6.8 Medium
ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability
- Dassault Systèmes ENOVIA Live Collaboration
- XML external entities (XXE)
- CVSS 7.7 High
XWiki Platform vulnerable to data leak via Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
>=1.1-milestone-3, <13.10.11 || >=14.0, <14.4.7 || >=14.5, <14.10-rc-1 · fixed in 13.10.11, 14.4.7, 14.10-rc-1
GHSA-gx4f-976g-7g6v · CVE-2023-27480 - CVSS 8.2 High
OWSLib vulnerable to XML External Entity (XXE) Injection
- XML external entities (XXE)
<0.28.1 · fixed in 0.28.1
GHSA-8h9c-r582-mggc · CVE-2023-27476 - CVSS 5.9 Medium
XML External Entity (XXE) vulnerability in apoc.import.graphml
- XML external entities (XXE)
<4.4.0.14 || >=5.0.0, <5.5.0 · fixed in 4.4.0.14, 5.5.0
GHSA-9vx8-f5c4-862x - CVSS 9.8 CriticalCritical · CVSS 9+
An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.
- XML external entities (XXE)
- CVSS 5.5 Medium
UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference
- UIKit0 libplist
- XML external entities (XXE)
- CVSS 6.5 Medium
php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.
- XML external entities (XXE)
- CVSS 8.8 High
XML external entity injection in VMware vRealize Orchestrator, VMware vRealize Automation…
- VMware vRealize Orchestrator, VMware vRealize Automation, VMware Cloud Foundation
- XML external entities (XXE)
- CVSS 5.3 Medium
dd-plist XML External Entitly vulnerability
- XML external entities (XXE)
<1.18 · fixed in 1.18
GHSA-4jx2-hvqw-93j9 · CVE-2016-15026 - CVSS 5.5 Medium
java-xmlbuilder vulnerable to XML External Entity Reference
- XML external entities (XXE)
<1.2 · fixed in 1.2
GHSA-3vrc-rrpw-r5pw · CVE-2014-125087 - CVSS 7.5 High
An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.
- XML external entities (XXE)
- CVSS 5.9 Medium
XML External Entity (XXE) vulnerability in apoc.import.graphml
- XML external entities (XXE)
>=5.0.0, <5.5.0 || <4.4.0.14 · fixed in 5.5.0, 4.4.0.14
GHSA-6wxg-wh7f-rqpr · CVE-2023-23926 - CVSS 6.9 Medium
XML external entity injection in Fortinet FortiNAC
- Fortinet FortiNAC
- XML external entities (XXE)
- CVSS 5.3 Medium
XML external entity injection in Cisco Secure Endpoint
- Cisco Secure Endpoint
- XML external entities (XXE)
- CVSS 7.4 High
XML external entity injection in FUJITSU LIMITED tsClinical Define.xml Generator and tsClinical Metadata Desktop…
- FUJITSU LIMITED tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools
- XML external entities (XXE)
- CVSS 7.8 High
XML External Entity Reference in ureport
- XML external entities (XXE)
<=2.2.9 · no fixed version yet
GHSA-fhj6-gr87-g4cj · CVE-2023-24187 - CVSS 7.5 High
XML External Entity Reference in Apache NiFi
- XML external entities (XXE)
>=1.2.0, <1.20.0 · fixed in 1.20.0
GHSA-hxjp-q6c3-38fx · CVE-2023-22832 - CVSS 8.8 High
Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.
- XML external entities (XXE)