690 matches found
CVE-2013-4334: Improper Restriction of XML External Entity Reference
opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities...
GHSA-MGH8-HCWJ-H57V Improper Restriction of XML External Entity Reference in Apache Olingo
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...
CVE-2013-4333: Improper Restriction of XML External Entity Reference
OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability...
CVE-2019-18412: Improper Restriction of XML External Entity Reference
JetBrains IDETalk plugin before version 193.4099.10 allows XXE...
CVE-2019-17020: Improper Restriction of XML External Entity Reference
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...
CVE-2019-19998: Improper Restriction of XML External Entity Reference
Xiuno BBS 4.0 allows XXE via plugin/xnwechatpublic/route/token.php...
CVE-2019-17085: Improper Restriction of XML External Entity Reference
XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent...
Advantech WISE-PaaS/RMM
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WISE-PaaS/RMM Vulnerabilities: Path Traversal, Missing Authorization, Improper Restriction of XML External Entity Reference, SQL Injection 2. RISK EVALUATION Successful...
CVE-2019-1060: Improper Restriction of XML External Entity Reference
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'...
CVE-2019-12711: Improper Restriction of XML External Entity Reference
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service DoS condition. The vulnerability ...
CVE-2019-13608: Improper Restriction of XML External Entity Reference
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks...
CVE-2019-1187: Improper Restriction of XML External Entity Reference
A denial of service vulnerability exists when the XmlLite runtime XmlLite.dll improperly parses XML input. An attacker who successfully exploited this vulnerability could cause a denial of service against an XML application. A remote unauthenticated attacker could exploit this vulnerability by...
CVE-2017-18438: Improper Restriction of XML External Entity Reference
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...
CVE-2019-10266: Improper Restriction of XML External Entity Reference
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication...
CVE-2019-10976: Improper Restriction of XML External Entity Reference
Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file .frc2. Once a user opens the file, the attacker could read arbitrary files...
Mitsubishi Electric FR Configurator2
1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low skill level to exploit Vendor: Mitsubishi Electric Equipment: Mitsubishi Electric FR Configurator2 Vulnerabilities: Improper Restriction of XML External Entity Reference, Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation...
CVE-2019-2861: Improper Restriction of XML External Entity Reference
Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion subcomponent: Security. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful...
CVE-2018-17152: Improper Restriction of XML External Entity Reference
Intersystems Cache 2017.2.2.865.0 allows XXE...
Improper Restriction of XML External Entity Reference in DiffPlug Spotless
In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...