CVE-2020-11991: Improper Restriction of XML External Entity Reference

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system...

CVE-2020-24379: Improper Restriction of XML External Entity Reference

WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...

CVE-2020-25020: Improper Restriction of XML External Entity Reference

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...

CVE-2020-17376: Improper Restriction of XML External Entity Reference

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths ...

WECON LeviStudioU (Update C)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: WECON Technology Co., Ltd WECON Equipment: LeviStudioU --------- Begin Update C Part 1 of 3 --------- Vulnerabilities: Stack-based Buffer Overflow, Improper Restriction of XML External Entity Reference, Heap-based...

CVE-2020-15419: Improper Restriction of XML External Entity Reference

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.75020200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ReporterImportLicense class. Due to the improper restriction of...

CVE-2020-12684: Improper Restriction of XML External Entity Reference

XXE injection can occur in i-net Clear Reports 2019 19.0.287 Designer, as used in i-net HelpDesk and other products, when XML input containing a reference to an external entity is processed by a weakly configured XML parser...

CVE-2019-17637: Improper Restriction of XML External Entity Reference

In all versions of Eclipse Web Tools Platform through release 3.18 2020-06, XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences...

Mitsubishi Electric Factory Automation Engineering Software Products

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: Factory Automation Engineering Software Products Vulnerabilities: Improper Restriction of XML External Entity Reference and Uncontrolled Resource Consumption 2. RISK...

CVE-2020-8541: Improper Restriction of XML External Entity Reference

OX App Suite through 7.10.3 allows XXE attacks...

CVE-2020-13692: Improper Restriction of XML External Entity Reference

PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE...

CVE-2020-10683: Improper Restriction of XML External Entity Reference

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

CVE-2020-6238: Improper Restriction of XML External Entity Reference

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability partially of SAP Commerce...

CVE-2020-10629: Improper Restriction of XML External Entity Reference

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

CVE-2020-10993: Improper Restriction of XML External Entity Reference

Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java...

CVE-2020-10991: Improper Restriction of XML External Entity Reference

Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java...

CVE-2020-10990: Improper Restriction of XML External Entity Reference

An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component...

CVE-2019-20627: Improper Restriction of XML External Entity Reference

AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Johnson Controls Equipment: Metasys Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability can allow a...

CVE-2020-6187: Improper Restriction of XML External Entity Reference

SAP NetWeaver Guided Procedures, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service...