CVE-2023-28683

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2023-21900 · Jenkins · Jenkins Visual Studio Code Metrics Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Visual Studio Code Metrics Plugin versions 1.7 and earlier Description: The issue is related to the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can control VS Code Metrics File...

CVE-2023-28685

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

XXE vulnerability in absint-a3

absint-a3 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control 'Project File APX' contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controlle...

SUSE CVE-2009-1699

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a...

SUSE CVE-2015-0254

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity XXE attacks via a crafted XSLT extension in a 1 or 2 JSTL XML tag...

SUSE CVE-2018-1285

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files...

SUSE CVE-2020-25649

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity...

JSA10401 - Pulse Connect Secure (PCS) product - PCS Security Bundle - Internal System Function

Last Modified Date Aug 24, 2026 12:34:59 AM...

PT-2023-12701 · Ibm · Ibm Tivoli Workload Scheduler

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Workload Scheduler versions 9.4 through 10.1 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume...

Ubuntu: Security Advisory (USN-4774-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

XXE vulnerability in TestComplete

TestComplete 2.8.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the zip archive input file for the 'TestComplete Test' build step to have Jenkins parse a crafted file that uses external entities for extraction of...

CVE-2023-24430

Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2023-19601 · Jenkins · Jenkins Mstest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MSTest Plugin version 1.0.0 and earlier Description: The issue is related to the configuration of the XML parser, which does not prevent XML external entity XXE attacks. Recommendations: For Jenkins MSTest Plugin version 1.0.0 and...

PT-2023-18594 · Zoho · Zoho Manageengine Exchange Reporter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Exchange Reporter Plus versions prior to 5708 Description: The issue allows attackers to conduct XXE XML External Entity attacks. This type of attack occurs when an application parses XML input that contains malicious extern...

CVE-2022-40771

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure...

CVE-2022-40771

CVE-2022-40771 affects Zoho ManageEngine ServiceDesk Plus versions 13010 and earlier. The vulnerability is an XML External Entity (XXE) issue in the Analytics Plus integration that can lead to information disclosure. The CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N with a base score of...

Information Disclosure

pki-core is vulnerable to Information Disclosure. An attacker is able to retrieve the content of arbitrary files by sending specially crafted HTTP requests causing xml external entity attacks...

PT-2022-27498 · Jenkins · Jenkins Sourcemonitor Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SourceMonitor Plugin versions 0.2 and earlier Description: The issue allows attackers to control XML input files for the 'Publish SourceMonitor results' post-build step, enabling them to have agent processes parse a crafted file that...

XXE vulnerability on agents in cccc

cccc 0.6 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the contents of the report file for the 'Publish CCCC Report' post-build step to have agent processes parse a crafted file that uses external entities for...