CVE-2024-12298

We found a vulnerability Improper Restriction of XML External Entity Reference CWE-611 in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer...

XML External Entity (XXE)

Unstructured is vulnerable to XML External Entity XXE. The vulnerability is due to improper configuration while setting resolveentities=False for parsing XML with lxml in partitionxml, which allows external entities to be processed...

CVE-2024-55887

Ucum-java (FHIR UCUM services) is vulnerable to XML External Entity (XXE) injections in XML parsing performed by UcumEssenceService in versions before 1.0.9. A crafted XML with a malicious DTD can cause data from the host system to be exposed when external clients submit XML. The fix is Release 1...

PT-2024-26670

Name of the Vulnerable Software and Affected Versions scrapy/scrapy affected versions not specified Description The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This issue...

PT-2024-19376 · Ministry Of Agriculture · Electronic Delivery Check System

Name of the Vulnerable Software and Affected Versions: Electronic Delivery Check System Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version versions 14.0.001.002 and earlier Description: The issue is related to the improper restriction of XML...

EUVD-2022-41399

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

RHEL 8 : pki-core:10.6 (RHSA-2023:1747)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1747 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: access to...

MGASA-2023-0112 Updated python-owslib packages fix security vulnerability

XML External Entity XXE Injection CVE-2023-27476...

CVE-2022-45588

All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity XXE type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are no...

CVE-2022-38389 IBM Tivoli Workload Scheduler XML external entity injection

IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233975...

CVE-2022-45395

Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2022-24380 · Safe · Fme Server

Name of the Vulnerable Software and Affected Versions: Safe Software FME Server versions prior to v2022.0.1.1 Description: The issue allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery SSRF attacks due to a XML External Entity XXE vulnerability...

PT-2022-23863

Name of the Vulnerable Software and Affected Versions DDMAL MEI2Volpiano version 0.8.2 Description The issue is related to an XML External Entity XXE vulnerability, which can lead to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input...

CVE-2021-41411

drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...

Xxe

drools =7.59.x is affected by an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability...

Nokogiri is vulnerable to XML External Entity (XXE) attack

Nokogiri before 1.5.4 is vulnerable to XXE attacks...

LumisXP XML External Entity Injection Vulnerability

LumisXP is an application from the Portuguese company LumisXP. It provides a platform for managing customers. A security vulnerability exists in LumisXP versions prior to 10.0.0 that allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. An attack that exploits this...

Scientific Linux Security Update : postgresql-jdbc on SL7.x (noarch) (20200803)

Security Fixes : - postgresql-jdbc: XML external entity XXE vulnerability in PgSQLXML CVE-2020-13692 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid139354; scriptversion"1.2";...

Remote Code Execution (RCE)

lucene-queryparser is vulnerable to remote code execution. This is possible through the use of an XML external entity expansion XXE attack and the Config API with add-listener command...

CVE-2018-6486 MFSBGN03797 rev.1 - Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), XML External Entity Injection

XML External Entity XXE vulnerability in Micro Focus Fortify Audit Workbench AWB and Micro Focus Fortify Software Security Center SSC, versions 16.10, 16.20, 17.10. This vulnerability could be exploited to allow a XML External Entity XXE injection...