CVE-2019-20627: Improper Restriction of XML External Entity Reference

AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Johnson Controls Equipment: Metasys Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability can allow a...

CVE-2020-6187: Improper Restriction of XML External Entity Reference

SAP NetWeaver Guided Procedures, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service...

CVE-2013-4334: Improper Restriction of XML External Entity Reference

opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities...

CVE-2013-4333: Improper Restriction of XML External Entity Reference

OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability...

CVE-2019-18412: Improper Restriction of XML External Entity Reference

JetBrains IDETalk plugin before version 193.4099.10 allows XXE...

CVE-2019-17020: Improper Restriction of XML External Entity Reference

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...

CVE-2019-19998: Improper Restriction of XML External Entity Reference

Xiuno BBS 4.0 allows XXE via plugin/xnwechatpublic/route/token.php...

CVE-2019-17085: Improper Restriction of XML External Entity Reference

XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent...

CVE-2019-1060: Improper Restriction of XML External Entity Reference

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'...

CVE-2019-12711: Improper Restriction of XML External Entity Reference

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service DoS condition. The vulnerability ...

CVE-2019-13608: Improper Restriction of XML External Entity Reference

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks...

CVE-2019-1187: Improper Restriction of XML External Entity Reference

A denial of service vulnerability exists when the XmlLite runtime XmlLite.dll improperly parses XML input. An attacker who successfully exploited this vulnerability could cause a denial of service against an XML application. A remote unauthenticated attacker could exploit this vulnerability by...

CVE-2017-18438: Improper Restriction of XML External Entity Reference

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...

CVE-2019-10266: Improper Restriction of XML External Entity Reference

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication...

CVE-2019-10976: Improper Restriction of XML External Entity Reference

Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file .frc2. Once a user opens the file, the attacker could read arbitrary files...

Mitsubishi Electric FR Configurator2

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low skill level to exploit Vendor: Mitsubishi Electric Equipment: Mitsubishi Electric FR Configurator2 Vulnerabilities: Improper Restriction of XML External Entity Reference, Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation...

CVE-2019-2861: Improper Restriction of XML External Entity Reference

Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion subcomponent: Security. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful...

CVE-2018-17152: Improper Restriction of XML External Entity Reference

Intersystems Cache 2017.2.2.865.0 allows XXE...

Improper Restriction of XML External Entity Reference in DiffPlug Spotless

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...