An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown wh…

CVE-2022-40747CRITICALCVSS 9.1EG 9.1

2022-11-03

"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources…

CVE-2022-40771MEDIUMCVSS 4.9EG 4.9

2022-11-23

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.

CVE-2022-41221HIGHCVSS 7.1EG 7.1

2023-05-24

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client (Versions 16.2.3, 21.2, and older versions) could upload XML files to the applic…

CVE-2022-41226CRITICALCVSS 9.8EG 9.8

2022-09-21

Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-41241CRITICALCVSS 9.1EG 5.9

2022-09-21

Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-41696MEDIUMCVSS 5.5EG 5.5

2023-03-21

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

CVE-2022-41967HIGHCVSS 7.0EG 7.0

2022-12-28

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dr…

CVE-2022-42301MEDIUMCVSS 5.4EG 8.8

2022-10-03

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.

CVE-2022-42307MEDIUMCVSS 5.3EG 9.8

2022-10-03

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.

CVE-2022-42341HIGHCVSS 7.5EG 7.5

2022-10-14

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of th…

CVE-2022-4245MEDIUMCVSS 4.3EG 4.3

2023-09-25

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allo…

CVE-2022-42745HIGHCVSS 7.5EG 7.5

2022-11-03

CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.

CVE-2022-43415HIGHCVSS 7.5EG 7.5

2022-10-19

Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-43430HIGHCVSS 7.5EG 7.5

2022-10-19

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-43473MEDIUMCVSS 5.8EG 5.4

2023-03-30

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this v…

CVE-2022-43512MEDIUMCVSS 5.5EG 5.5

2023-03-21

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

CVE-2022-43570HIGHCVSS 8.8EG 6.5

2022-11-04

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect d…

CVE-2022-43689MEDIUMCVSS 5.3EG 5.3

2022-11-14

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.

CVE-2022-43941HIGHCVSS 7.1EG 6.5

2023-04-03

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference…

CVE-2022-45121MEDIUMCVSS 5.5EG 5.5

2023-03-21

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

CVE-2022-45194LOWCVSS 3.8EG 4.7

2022-11-12

CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.

CVE-2022-45326MEDIUMCVSS 4.9EG 4.9

2022-12-06

An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.

CVE-2022-45386MEDIUMCVSS 5.5EG 5.4

2022-11-15

Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-45395CRITICALCVSS 9.8EG 9.8

2022-11-15

Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-45396CRITICALCVSS 9.8EG 5.4

2022-11-15

Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-45397CRITICALCVSS 9.8EG 5.4

2022-11-15

Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-45400CRITICALCVSS 9.8EG 7.1

2022-11-15

Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-45468MEDIUMCVSS 5.5EG 5.5

2023-03-21

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

CVE-2022-45588HIGHCVSS 7.8EG 9.8

2023-02-03

All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend R…

CVE-2022-45876MEDIUMCVSS 5.5EG 5.5

2023-04-26

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

CVE-2022-4607MEDIUMCVSS 5.5EG 9.8

2022-12-18

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version …

CVE-2022-46286MEDIUMCVSS 5.5EG 5.5

2023-03-21

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

CVE-2022-46300MEDIUMCVSS 5.5EG 5.5

2023-03-21

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

CVE-2022-46682CRITICALCVSS 9.8EG 9.8

2022-12-12

Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-46751HIGHCVSS 8.2EG 8.2

2023-08-21

Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to …

CVE-2022-46827LOWCVSS 3.9EG 5.5

2022-12-08

In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.

CVE-2022-47514HIGHCVSS 8.8EG 8.8

2022-12-18

An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.

CVE-2022-47873CRITICALCVSS 9.8EG 9.8

2023-01-31

Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).

CVE-2022-4818MEDIUMCVSS 5.5EG 4.3

2022-12-28

A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java.…

CVE-2022-48565CRITICALCVSS 9.8EG 9.8

2023-08-22

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

CVE-2022-50899MEDIUMCVSS 6.5EG 6.5

2026-01-13

Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server. Attackers can exploit the insecure XML parser by crafting a malicious XML docum…

CVE-2023-0871MEDIUMCVSS 5.4EG 5.4

2023-08-11

XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary …

CVE-2023-1288MEDIUMCVSS 6.8EG 9.8

2023-03-09

An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.

CVE-2023-20030MEDIUMCVSS 6.0EG 6.0

2023-04-05

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an aff…

CVE-2023-20052MEDIUMCVSS 5.3EG 5.3

2023-03-01

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauth…

CVE-2023-20173MEDIUMCVSS 4.9EG 4.9

2023-05-18

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an …

CVE-2023-20174MEDIUMCVSS 4.9EG 4.9

2023-05-18

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an …

CVE-2023-20855HIGHCVSS 8.8EG 8.8

2023-02-22

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions lea…

CVE-2023-20918CRITICALCVSS 9.8EG 9.8

2023-07-13

In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.

CWE-611— Improper Restriction of XML External Entity Reference (XXE)

CVEs classified under CWE-611page 15 of 23

Map vulnerabilities like CWE-611 to your infrastructure