CVE-2019-0790: Improper Restriction of XML External Entity Reference

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795...

CVE-2019-9843: Improper Restriction of XML External Entity Reference

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

CVE-2019-9658: Improper Restriction of XML External Entity Reference

Checkstyle before 8.18 loads external DTDs by default...

CVE-2019-0265: Improper Restriction of XML External Entity Reference

SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT,...

CVE-2019-7722: Improper Restriction of XML External Entity Reference

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it either by direct modification or MITM attacks when using remote rulesets to perform information disclosure, denial of service, or request forgery...

CVE-2018-20733: Improper Restriction of XML External Entity Reference

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE...

XML External Entity (XXE) To Read Files

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

CVE-2019-5748: Improper Restriction of XML External Entity Reference

In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks...

XML External Entity Reference in c3p0:c3p0

c3p0 allows XXE during initialization...

CVE-2018-20664: Improper Restriction of XML External Entity Reference

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...

CVE-2018-7837

An Improper Restriction of XML External Entity Reference 'XXE' vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its outp...

CVE-2018-20318: Improper Restriction of XML External Entity Reference

An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file...

The vulnerability in the web interface of the Cisco Energy Management Suite, related to incorrect restrictions on XML references to external objects (XXE), allows an attacker to disclose or modify sensitive information.

The vulnerability in the web interface of the Cisco Energy Management Suite relates to incorrect restrictions on XML references to external objects XXE. Exploiting this vulnerability could allow an attacker to disclose or modify sensitive information...

CVE-2018-2492: Improper Restriction of XML External Entity Reference

SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50...

CVE-2018-20059: Improper Restriction of XML External Entity Reference

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...

CVE-2018-17186: Improper Restriction of XML External Entity Reference

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution...

CVE-2018-8533: Improper Restriction of XML External Entity Reference

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio SSMS when parsing malicious XML content containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, S...

CVE-2018-12544: Improper Restriction of XML External Entity Reference

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema...

CVE-2018-8527: Improper Restriction of XML External Entity Reference

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio SSMS when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, SQ...

CVE-2018-8494: Improper Restriction of XML External Entity Reference

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012,...