CVE-2020-35604: Improper Restriction of XML External Entity Reference

An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used...

CVE-2020-35123: Improper Restriction of XML External Entity Reference

In Zimbra Collaboration Suite Network Edition versions 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suite Network edition 9.0.0 Patch 10 and 8.8.15 Patch 17...

CVE-2020-29436: Improper Restriction of XML External Entity Reference

Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0...

CVE-2020-7572: Improper Restriction of XML External Entity Reference

A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server...

CVE-2020-24454: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in subsystem forIntelR QuartusR Prime Pro Edition before version 20.3 and IntelR QuartusR Prime Standard Edition before version 20.2 may allow unauthenticated user to potentially enable information disclosure via network access...

CVE-2020-11991: Improper Restriction of XML External Entity Reference

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system...

CVE-2020-24379: Improper Restriction of XML External Entity Reference

WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...

CVE-2020-25020: Improper Restriction of XML External Entity Reference

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components...

CVE-2020-17376: Improper Restriction of XML External Entity Reference

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths ...

WECON LeviStudioU (Update C)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: WECON Technology Co., Ltd WECON Equipment: LeviStudioU --------- Begin Update C Part 1 of 3 --------- Vulnerabilities: Stack-based Buffer Overflow, Improper Restriction of XML External Entity Reference, Heap-based...

CVE-2020-15419: Improper Restriction of XML External Entity Reference

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.75020200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ReporterImportLicense class. Due to the improper restriction of...

CVE-2019-17637: Improper Restriction of XML External Entity Reference

In all versions of Eclipse Web Tools Platform through release 3.18 2020-06, XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences...

Mitsubishi Electric Factory Automation Engineering Software Products

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: Factory Automation Engineering Software Products Vulnerabilities: Improper Restriction of XML External Entity Reference and Uncontrolled Resource Consumption 2. RISK...

CVE-2020-8541: Improper Restriction of XML External Entity Reference

OX App Suite through 7.10.3 allows XXE attacks...

CVE-2020-13692: Improper Restriction of XML External Entity Reference

PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE...

CVE-2020-6238: Improper Restriction of XML External Entity Reference

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability partially of SAP Commerce...

CVE-2020-10629: Improper Restriction of XML External Entity Reference

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

CVE-2020-10991: Improper Restriction of XML External Entity Reference

Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java...

CVE-2020-10993: Improper Restriction of XML External Entity Reference

Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java...

CVE-2020-10990: Improper Restriction of XML External Entity Reference

An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component...