Total
1155 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-0219 | 1 Jadx Project | 1 Jadx | 2024-11-21 | 5.5 Medium |
| Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2. | ||||
| CVE-2022-0217 | 1 Prosody | 1 Prosody | 2024-11-21 | 7.5 High |
| It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611). | ||||
| CVE-2022-0198 | 1 Stanford | 1 Corenlp | 2024-11-21 | 7.1 High |
| corenlp is vulnerable to Improper Restriction of XML External Entity Reference | ||||
| CVE-2021-4295 | 1 Healthit | 1 Code-validator-api | 2024-11-21 | 5.5 Medium |
| A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability. | ||||
| CVE-2021-46660 | 1 Signiant | 1 Manager\+agents | 2024-11-21 | 9.8 Critical |
| Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks. | ||||
| CVE-2021-46365 | 1 Magnolia-cms | 1 Magnolia Cms | 2024-11-21 | 7.8 High |
| An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. | ||||
| CVE-2021-45981 | 1 Netscout | 1 Ngeniusone | 2024-11-21 | 9.8 Critical |
| NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack. | ||||
| CVE-2021-45096 | 1 Knime | 1 Knime Analytics Platform | 2024-11-21 | 4.7 Medium |
| KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. | ||||
| CVE-2021-45024 | 1 Rocketsoftware | 1 Ags-zena | 2024-11-21 | 9.8 Critical |
| ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE). | ||||
| CVE-2021-44557 | 1 Kb | 1 Multiner | 2024-11-21 | 9.1 Critical |
| National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/ner.py. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS. | ||||
| CVE-2021-44556 | 1 Kb | 1 Digger | 2024-11-21 | 9.1 Critical |
| National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS. | ||||
| CVE-2021-44147 | 1 Claris | 2 Filemaker Pro, Filemaker Server | 2024-11-21 | 5.5 Medium |
| An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks. | ||||
| CVE-2021-44028 | 1 Quest | 1 Kace Desktop Authority | 2024-11-21 | 5.5 Medium |
| XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285. | ||||
| CVE-2021-43577 | 1 Jenkins | 1 Owasp Dependency-check | 2024-11-21 | 7.1 High |
| Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||||
| CVE-2021-43576 | 1 Jenkins | 1 Pom2config | 2024-11-21 | 6.5 Medium |
| Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. | ||||
| CVE-2021-43142 | 1 Jox Project | 1 Jox | 2024-11-21 | 9.8 Critical |
| An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput. | ||||
| CVE-2021-43090 | 1 Predic8 | 1 Soa Model | 2024-11-21 | 9.8 Critical |
| An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function. | ||||
| CVE-2021-42776 | 1 Cloverdx | 1 Cloverdx | 2024-11-21 | 7.7 High |
| CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import. | ||||
| CVE-2021-42646 | 1 Wso2 | 3 Api Manager, Identity Server, Identity Server As Key Manager | 2024-11-21 | 9.1 Critical |
| XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests. | ||||
| CVE-2021-42560 | 1 Mitre | 1 Caldera | 2024-11-21 | 8.8 High |
| An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks (e.g., File Exfiltration, Server Side Request Forgery, Out of Band Exfiltration, etc.). | ||||