Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.8 High
All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks.
- XML external entities (XXE)
- CVSS 7.1 High
IBM Tivoli Workload Scheduler XML external entity injection
- IBM Tivoli Workload Scheduler
- XML external entities (XXE)
- CVSS 10.0 CriticalCritical · CVSS 9+
IBM Tivoli Workload Scheduler XML external entity injection
- IBM Tivoli Workload Scheduler
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in OMRON Corporation CX-Motion Pro
- OMRON Corporation CX-Motion Pro
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
- XML external entities (XXE)
<1.15 · fixed in 1.15
GHSA-pcc2-w6m8-x5w4 · CVE-2023-24429 - CVSS 9.8 CriticalCritical · CVSS 9+
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
- XML external entities (XXE)
<1.15 · fixed in 1.15
GHSA-h8p8-6378-649p · CVE-2023-24430 - CVSS 9.8 CriticalCritical · CVSS 9+
XML Entity Expansion in Jenkins TestComplete support Plugin
- XML external entities (XXE)
- Denial of service
<2.9 · fixed in 2.9
GHSA-g5mj-c26g-vmpm · CVE-2023-24443 - CVSS 9.8 CriticalCritical · CVSS 9+
XML external entity vulnerability on agents in Jenkins MSTest Plugin
- XML external entities (XXE)
- Denial of service
<1.0.1 · fixed in 1.0.1
GHSA-3ppr-72x5-x67q · CVE-2023-24441 - CVSS 6.5 Medium
OpenStack Swift XML external entities (XXE) Injection
- Information disclosure
- XML external entities (XXE)
<2.28.1 || >=2.29.0, <2.29.2 || >=2.30.0, <2.30.1 · fixed in 2.28.1, 2.29.2, 2.30.1
GHSA-274c-rx2j-2v3x · CVE-2022-47950 - CVSS 8.1 High
XML external entity injection in Oracle Corporation Web Services Manager
- Oracle Corporation Web Services Manager
- XML external entities (XXE)
- CVSS 7.5 High
Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.
- XML external entities (XXE)
- CVSS 7.5 High
BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files.
- XML external entities (XXE)
- CVSS 5.5 Medium
Talend Open Studio for MDM XML xml external entity reference
- Talend Open Studio for MDM
- XML external entities (XXE)
- CVSS 5.5 Medium
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<3.1.1 · fixed in 3.1.1
GHSA-rh3m-pr36-xh2f · CVE-2015-10029 - CVSS 5.5 Medium
dssp vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<1.3.2 · fixed in 1.3.2
GHSA-77cc-w3wm-6whp · CVE-2016-15011 - CVSS 5.5 Medium
bonita-connector-webservice XML External Entity vulnerability
- XML external entities (XXE)
<1.3.1 · fixed in 1.3.1
GHSA-wg99-5vrx-j2gg · CVE-2020-36640 - CVSS 5.5 Medium
aXMLRPC XML External Entity vulnerability
- XML external entities (XXE)
<1.12.1 · fixed in 1.12.1
GHSA-g4r8-28fp-f255 · CVE-2020-36641 - CVSS 5.5 Medium
iText RUPS XML External Entity vulnerability
- XML external entities (XXE)
<=7.0.1 · no fixed version yet
GHSA-j69f-fgh5-f7mc · CVE-2017-20151 - CVSS 5.5 Medium
ONC code-validator-api XML CodeValidatorApiConfiguration.java vocabularyValidationConfigurations xml external entity reference
- ONC code-validator-api
- XML external entities (XXE)
- CVSS 5.5 Medium
Talend Open Studio for MDM SystemStorageWrapper.java xml external entity reference
- Talend Open Studio for MDM
- XML external entities (XXE)
- CVSS 7.0 High
Improper Restriction of XML External Entity Reference in Dragonfly
- HyperaDev Dragonfly
- XML external entities (XXE)
- CVSS 5.5 Medium
3D City Database OGC Web Feature Service xml external entity reference
- 3D City Database OGC Web Feature Service
- XML external entities (XXE)
- CVSS 8.8 High
XML external entity injection in Symantec Identity Governance and Administration
- Symantec Identity Governance and Administration
- XML external entities (XXE)
- CVSS 7.1 High
Jenkins Plot Plugin XML External Entity Reference vulnerability
- XML external entities (XXE)
<2.1.12 · fixed in 2.1.12
GHSA-wgpp-g6v9-7hxp · CVE-2022-46682 - CVSS 3.9 Low
XML external entity injection in JetBrains IntelliJ IDEA
- JetBrains IntelliJ IDEA
- XML external entities (XXE)
- CVSS 4.9 Medium
An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.
- XML external entities (XXE)
- CVSS 4.9 Medium
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
- XML external entities (XXE)
- CVSS 5.4 Medium
XXE vulnerability on agents in Jenkins SourceMonitor Plugin
- XML external entities (XXE)
<=0.2 · no fixed version yet
GHSA-h4wx-78p9-fwxw · CVE-2022-45396 - CVSS 9.8 CriticalCritical · CVSS 9+
XML External Entity Reference in Jenkins CCCC Plugin
- XML external entities (XXE)
<=0.6 · no fixed version yet
GHSA-f3gj-hvv4-f57v · CVE-2022-45395 - CVSS 5.4 Medium
XXE vulnerability on agents in Jenkins OSF Builder Suite : : XML Linter Plugin
- XML external entities (XXE)
<=1.0.2 · no fixed version yet
GHSA-8847-xvjw-9g43 · CVE-2022-45397 - CVSS 7.1 High
XXE vulnerability in Jenkins JAPEX Plugin
- XML external entities (XXE)
<=1.7 · no fixed version yet
GHSA-8538-25v4-25pg · CVE-2022-45400 - CVSS 5.4 Medium
XML External Entity Reference in Jenkins Violations Plugin
- XML external entities (XXE)
<=0.7.11 · no fixed version yet
GHSA-4598-wcg8-x56g · CVE-2022-45386 - CVSS 9.8 CriticalCritical · CVSS 9+
XML external entity injection in Sophos Mobile managed on-premises
- Sophos Mobile managed on-premises
- XML external entities (XXE)
- CVSS 5.3 Medium
Concrete CMS vulnerable to XML External Entity
- XML external entities (XXE)
<8.5.10 || >=9.0.0, <9.1.2 · fixed in 8.5.10, 9.1.2
GHSA-q48r-xg9h-78m8 · CVE-2022-43689 - CVSS 3.8 Low
CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.
- XML external entities (XXE)
- CVSS 4.3 Medium
XML external entity injection in Cisco Firepower Management Center
- Cisco Firepower Management Center
- XML external entities (XXE)
- CVSS 8.8 High
XML External Entity Injection through a custom View in Splunk Enterprise
- Splunk Enterprise
- XML external entities (XXE)
- CVSS 5.9 Medium
Trellix IPS Manager vulnerable to XXE
- Trellix IPS Manager
- XML external entities (XXE)
- CVSS 3.8 Low
XML external entity injection in Hewlett Packard Enterprise Aruba Mobility Conductor (formerly Mobility Master)…
- Hewlett Packard Enterprise Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
- XML external entities (XXE)
- CVSS 9.1 CriticalCritical · CVSS 9+
XML external entity injection in IBM InfoSphere Information Server
- IBM InfoSphere Information Server
- XML external entities (XXE)
- CVSS 9.1 CriticalCritical · CVSS 9+
XML external entity injection in VMware Cloud Foundation (NSX-V)
- VMware Cloud Foundation (NSX-V)
- XML external entities (XXE)
- CVSS 9.8 Critical
Duplicate Advisory: Improper Restriction of XML External Entity Reference in pikepdf
- XML external entities (XXE)
>=1.2.0, <2.10.0 · fixed in 2.10.0
GHSA-x58j-j539-w8mv · CVE-2021-46849 - CVSS 7.1 High
XXE vulnerability in Jenkins Compuware Topaz for Total Test Plugin
- XML external entities (XXE)
<2.4.9 · fixed in 2.4.9
GHSA-vhwv-8897-jm7q · CVE-2022-43430 - CVSS 7.1 High
XXE vulnerability in Jenkins REPO Plugin
- XML external entities (XXE)
<1.16.0 · fixed in 1.16.0
GHSA-2w2m-ccf8-57cq · CVE-2022-43415 - CVSS 5.4 Medium
XXE in Trellix ePO server
- Trellix ePolicy Orchestrator (ePO)
- XML external entities (XXE)
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read
- Adobe ColdFusion
- XML external entities (XXE)
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read
- Adobe ColdFusion
- XML external entities (XXE)
- CVSS 7.1 High
XML external entity injection in IBM Partner Engagement Manager
- IBM Partner Engagement Manager
- XML external entities (XXE)
- CVSS 7.5 High
Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP
- XML external entities (XXE)
>=2.2, <=2.3.1 · no fixed version yet
GHSA-jq8c-j47c-vvwm · CVE-2022-40705 - CVSS 5.9 Medium
Jenkins RQM Plugin vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<=2.8 · no fixed version yet
GHSA-j8xr-2279-88qj · CVE-2022-41241 - CVSS 7.1 High
Jenkins Compuware Common Configuration Plugin vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<1.0.15 · fixed in 1.0.15
GHSA-g43x-pcc9-f472 · CVE-2022-41226 - CVSS 7.5 High
XML external entity injection in Forcepoint Data Loss Prevention (DLP) and others
- Forcepoint Data Loss Prevention (DLP)
- Forcepoint One Endpoint (F1E) with Policy Engine
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack
- XML external entities (XXE)
>=1.22.0, <1.32.0 · fixed in 1.32.0
GHSA-fj2m-w3wv-x9pr · CVE-2022-39135 - CVSS 7.5 High
MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)
- XML external entities (XXE)
<=0.8.2 · no fixed version yet
GHSA-6xm7-3cc5-47f9 · CVE-2022-37189 - CVSS 5.5 Medium
XML external entity injection in Delta Electronics Delta Robot Automation Studio (DRAS)
- Delta Electronics Delta Robot Automation Studio (DRAS)
- XML external entities (XXE)
- CVSS 6.5 Medium
XXE vulnerability in DLP Endpoint for Windows
- Trellix DLP Endpoint for Windows
- XML external entities (XXE)
-
XML external entity injection in Red Hat AMQ
- Red Hat AMQ
- XML external entities (XXE)
-
XML external entity injection in The Eclipse Foundation Eclipse Sphinx
- The Eclipse Foundation Eclipse Sphinx
- XML external entities (XXE)
-
mofh Vulnerable to Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
<1.0.1 · fixed in 1.0.1
GHSA-7r9x-qrpr-3cxw