An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this fil…

CVE-2020-1693HIGHCVSS 8.6EG 8.6

2020-02-17

A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a…

CVE-2020-17376HIGHCVSS 8.3EG 8.3

2020-08-26

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain acc…

CVE-2020-17408HIGHCVSS 7.5EG 7.5

2020-09-10

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc ex…

CVE-2020-18703CRITICALCVSS 9.8EG 9.8

2021-08-16

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.

CVE-2020-18705CRITICALCVSS 9.8EG 9.8

2021-08-16

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.

CVE-2020-1975MEDIUMCVSS 6.8EG 6.8

2020-02-12

Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier …

CVE-2020-19954HIGHCVSS 7.5EG 7.5

2021-10-14

An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.

CVE-2020-2012HIGHCVSS 7.5EG 7.5

2020-05-13

Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrar…

CVE-2020-2092HIGHCVSS 8.8EG 8.8

2020-01-15

Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.

CVE-2020-2108HIGHCVSS 7.6EG 7.6

2020-01-29

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.

CVE-2020-2115HIGHCVSS 8.8EG 8.8

2020-02-12

Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2120HIGHCVSS 8.8EG 8.8

2020-02-12

Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2138HIGHCVSS 7.1EG 7.1

2020-03-09

Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2144HIGHCVSS 7.1EG 7.1

2020-03-09

Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-21524CRITICALCVSS 9.1EG 9.1

2020-09-30

There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerab…

CVE-2020-21641HIGHCVSS 7.5EG 7.5

2022-08-15

Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file.

CVE-2020-2171HIGHCVSS 8.8EG 8.8

2020-03-25

Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2178HIGHCVSS 7.1EG 7.1

2020-04-16

Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2245HIGHCVSS 7.1EG 7.1

2020-09-01

Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2247MEDIUMCVSS 6.5EG 6.5

2020-09-01

Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2284HIGHCVSS 7.1EG 7.1

2020-09-23

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2298MEDIUMCVSS 6.5EG 6.5

2020-10-08

Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-2324HIGHCVSS 7.5EG 7.5

2020-12-03

Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2020-24052CRITICALCVSS 9.1EG 9.1

2020-08-21

Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition (DTD) in an XML request.

CVE-2020-24379CRITICALCVSS 9.8EG 9.8

2020-09-09

WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.

CVE-2020-24454HIGHCVSS 7.5EG 7.5

2020-11-12

Improper Restriction of XML External Entity Reference in subsystem forIntel(R) Quartus(R) Prime Pro Edition before version 20.3 and Intel(R) Quartus(R) Prime Standard Edition before version 20.2 may allow unauthenticated user to potentiall…

CVE-2020-24589CRITICALCVSS 9.1EG 9.1

2020-08-21

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.

CVE-2020-24591MEDIUMCVSS 6.5EG 6.5

2020-08-21

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, …

CVE-2020-24656MEDIUMCVSS 6.5EG 6.5

2020-08-26

Maltego before 4.2.12 allows XXE attacks.

CVE-2020-25020CRITICALCVSS 9.8EG 9.8

2020-08-29

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.

CVE-2020-25186HIGHCVSS 7.5EG 7.5

2020-10-22

An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file disclosure.

CVE-2020-25215CRITICALCVSS 9.8EG 9.8

2020-09-17

yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document.

CVE-2020-25257CRITICALCVSS 9.8EG 9.8

2020-09-11

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows XXE attacks for read/write access to arbitrary files.

CVE-2020-25649HIGHCVSS 7.5EG 7.5

2020-12-03

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

CVE-2020-25750HIGHCVSS 7.5EG 7.5

2020-09-18

An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string with…

CVE-2020-25817MEDIUMCVSS 4.8EG 4.8

2021-06-08

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for pu…

CVE-2020-25911CRITICALCVSS 9.1EG 9.1

2021-10-31

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

CVE-2020-25912CRITICALCVSS 9.1EG 9.1

2021-10-31

A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).

CVE-2020-26064HIGHCVSS 8.1EG 6.5

2023-08-04

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling…

CVE-2020-26066MEDIUMCVSS 6.5EG 6.5

2024-11-18

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper hand…

CVE-2020-26229LOWCVSS 3.7EG 3.7

2020-11-23

TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical …

CVE-2020-26247LOWCVSS 2.6EG 2.6

2020-12-30

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default…

CVE-2020-26513MEDIUMCVSS 5.5EG 5.5

2020-12-07

An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML Ext…

CVE-2020-26564MEDIUMCVSS 6.5EG 6.5

2021-07-31

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the surve…

CVE-2020-26705CRITICALCVSS 9.1EG 9.1

2021-10-31

The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into …

CVE-2020-26708HIGHCVSS 7.5EG 7.5

2023-06-29

requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.

CVE-2020-26709HIGHCVSS 7.5EG 7.5

2023-06-29

py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.

CVE-2020-26710HIGHCVSS 7.5EG 7.5

2023-06-29

easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.

CVE-2020-26981MEDIUMCVSS 6.5EG 6.5

2021-01-12

A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This i…

CWE-611— Improper Restriction of XML External Entity Reference (XXE)

CVEs classified under CWE-611page 9 of 23

Map vulnerabilities like CWE-611 to your infrastructure