XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to the DocumentBuilderFactory used in the XunitXmlPlugin.java file, which is used without disabling DTDs or external entities.. An attacker can access arbitrary files on the file system or initiate...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to insufficient validation of XML input in crafted URL paths. An attacker can read files from the server's filesystem or perform denial-of-service attacks by supplying malicious XML content. Note:...

Security issue with external entity loading in XML without enabling it

...

PT-2023-23927 · Unknown · Applicant Programme

Name of the Vulnerable Software and Affected Versions: Applicant Programme versions 7.06 and earlier Description: The issue is related to the improper restriction of XML external entity references XXE in the Applicant Programme. This allows an attacker to read arbitrary files on the system by...

PT-2022-27946 · Jenkins · Jenkins Plot Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Plot Plugin versions 2.1.11 and earlier Description: The issue allows attackers who can control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of...