484 matches found
CVE-2020-8541: Improper Restriction of XML External Entity Reference
OX App Suite through 7.10.3 allows XXE attacks...
CVE-2020-13692: Improper Restriction of XML External Entity Reference
PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE...
CVE-2020-6238: Improper Restriction of XML External Entity Reference
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability partially of SAP Commerce...
CVE-2020-10629: Improper Restriction of XML External Entity Reference
WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...
CVE-2020-10990: Improper Restriction of XML External Entity Reference
An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component...
CVE-2020-10991: Improper Restriction of XML External Entity Reference
Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java...
CVE-2020-10993: Improper Restriction of XML External Entity Reference
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java...
CVE-2019-20627: Improper Restriction of XML External Entity Reference
AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE...
Johnson Controls Metasys
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Johnson Controls Equipment: Metasys Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability can allow a...
CVE-2020-6187: Improper Restriction of XML External Entity Reference
SAP NetWeaver Guided Procedures, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service...
CVE-2013-4334: Improper Restriction of XML External Entity Reference
opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities...
CVE-2013-4333: Improper Restriction of XML External Entity Reference
OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability...
CVE-2019-18412: Improper Restriction of XML External Entity Reference
JetBrains IDETalk plugin before version 193.4099.10 allows XXE...
CVE-2019-17020: Improper Restriction of XML External Entity Reference
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...
CVE-2019-19998: Improper Restriction of XML External Entity Reference
Xiuno BBS 4.0 allows XXE via plugin/xnwechatpublic/route/token.php...
CVE-2019-17085: Improper Restriction of XML External Entity Reference
XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent...
CVE-2019-1060: Improper Restriction of XML External Entity Reference
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'...
CVE-2019-12711: Improper Restriction of XML External Entity Reference
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service DoS condition. The vulnerability ...
CVE-2019-13608: Improper Restriction of XML External Entity Reference
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks...
