534 matches found
CVE-2019-17637: Improper Restriction of XML External Entity Reference
In all versions of Eclipse Web Tools Platform through release 3.18 2020-06, XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences...
CVE-2020-12684: Improper Restriction of XML External Entity Reference
XXE injection can occur in i-net Clear Reports 2019 19.0.287 Designer, as used in i-net HelpDesk and other products, when XML input containing a reference to an external entity is processed by a weakly configured XML parser...
Mitsubishi Electric Factory Automation Engineering Software Products
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: Factory Automation Engineering Software Products Vulnerabilities: Improper Restriction of XML External Entity Reference and Uncontrolled Resource Consumption 2. RISK...
CVE-2020-8541: Improper Restriction of XML External Entity Reference
OX App Suite through 7.10.3 allows XXE attacks...
CVE-2020-13692: Improper Restriction of XML External Entity Reference
PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE...
CVE-2020-10683: Improper Restriction of XML External Entity Reference
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...
CVE-2020-6238: Improper Restriction of XML External Entity Reference
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability partially of SAP Commerce...
CVE-2020-10629: Improper Restriction of XML External Entity Reference
WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...
CVE-2020-10991: Improper Restriction of XML External Entity Reference
Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java...
CVE-2020-10993: Improper Restriction of XML External Entity Reference
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java...
CVE-2020-10990: Improper Restriction of XML External Entity Reference
An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component...
CVE-2019-20627: Improper Restriction of XML External Entity Reference
AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE...
Johnson Controls Metasys
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Johnson Controls Equipment: Metasys Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability can allow a...
CVE-2020-6187: Improper Restriction of XML External Entity Reference
SAP NetWeaver Guided Procedures, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service...
CVE-2013-4334: Improper Restriction of XML External Entity Reference
opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities...
GHSA-MGH8-HCWJ-H57V Improper Restriction of XML External Entity Reference in Apache Olingo
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks...
CVE-2013-4333: Improper Restriction of XML External Entity Reference
OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability...
CVE-2019-18412: Improper Restriction of XML External Entity Reference
JetBrains IDETalk plugin before version 193.4099.10 allows XXE...
CVE-2019-17020: Improper Restriction of XML External Entity Reference
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...