Overview 365 matches · 8 exploited · 2 CISA KEV · 19 public PoC · 7 EPSS ≥ 0.5
Protected by Waratek
365
100.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
blocked by ARMR today
365
100.0%
partly blocked
0
0.0%
not blocked
0
0.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 48 / year
20081
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
20090
20100
20110
20122
Protected by Waratek2
Medium2
blocked by ARMR today2
No public exploit2
20134
Protected by Waratek4
High2
Medium2
blocked by ARMR today4
No public exploit4
201417
Protected by Waratek17
High3
Medium14
blocked by ARMR today17
Working exploit published1
No public exploit16
201513
Protected by Waratek13
High3
Medium10
blocked by ARMR today13
Working exploit published1
No public exploit12
20165
Protected by Waratek5
High3
Medium2
blocked by ARMR today5
Exploited1
No public exploit4
201722
Protected by Waratek22
Critical10
High9
Medium3
blocked by ARMR today22
Working exploit published2
Proof of concept only1
No public exploit19
201840
Protected by Waratek40
Critical14
High20
Medium6
blocked by ARMR today40
Proof of concept only1
No public exploit39
201930
Protected by Waratek30
Critical10
High13
Medium7
blocked by ARMR today30
Exploited2
Working exploit published1
Proof of concept only3
No public exploit24
202029
Protected by Waratek29
Critical4
High17
Medium8
blocked by ARMR today29
No public exploit29
202129
Protected by Waratek29
Critical9
High16
Medium4
blocked by ARMR today29
Forecast only1
No public exploit28
202242
Protected by Waratek42
Critical22
High12
Medium7
Low1
blocked by ARMR today42
Proof of concept only3
No public exploit39
202338
Protected by Waratek38
Critical13
High18
Medium7
blocked by ARMR today38
Proof of concept only4
No public exploit34
202422
Protected by Waratek22
Critical5
High10
Medium6
Low1
blocked by ARMR today22
Proof of concept only4
No public exploit18
202523
Protected by Waratek23
Critical8
High8
Medium5
Low2
blocked by ARMR today23
Exploited3
Proof of concept only3
No public exploit17
202648
Protected by Waratek48
Critical5
High29
Medium13
Unknown1
blocked by ARMR today48
Exploited2
Proof of concept only6
No public exploit40
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-41933 | High | 2023-09-06 | Protected by Waratek | No public exploit | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-41932 | Medium | 2023-09-06 | Protected by Waratek | No public exploit | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'. |
| CVE-2023-41034 | Critical | 2023-08-31 | Protected by Waratek | No public exploit | Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2023-24620 | Medium | 2023-08-25 | Protected by Waratek | Proof of concept only | An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception. |
| CVE-2023-40612 | High | 2023-08-23 | Protected by Waratek | No public exploit | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable to XXE injection attacks. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue. |
| CVE-2022-46751 | High | 2023-08-21 | Protected by Waratek | No public exploit | Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used. This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways. Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed. Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide". |
| CVE-2023-0871 | Medium | 2023-08-11 | Protected by Waratek | No public exploit | XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter and Moshe Apelbaum for reporting this issue. |
| CVE-2023-37942 | Medium | 2023-07-12 | Protected by Waratek | No public exploit | Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-3276 | High | 2023-06-15 | Protected by Waratek | Proof of concept only | A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2023-27554 | Critical | 2023-05-11 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185. |
| CVE-2022-43941 | High | 2023-04-03 | Protected by Waratek | No public exploit | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. |
| CVE-2023-28684 | Medium | 2023-04-02 | Protected by Waratek | No public exploit | Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-28683 | High | 2023-04-02 | Protected by Waratek | No public exploit | Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-28682 | High | 2023-04-02 | Protected by Waratek | No public exploit | Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-28681 | High | 2023-04-02 | Protected by Waratek | No public exploit | Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-28680 | High | 2023-04-02 | Protected by Waratek | No public exploit | Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-28685 | High | 2023-03-22 | Protected by Waratek | No public exploit | Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-28118 | High | 2023-03-20 | Protected by Waratek | No public exploit | kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds. |
| CVE-2023-27480 | High | 2023-03-07 | Protected by Waratek | No public exploit | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. Users unable to upgrade may apply the patch `e3527b98fd` manually. |
| CVE-2016-15026 | High | 2023-02-20 | Protected by Waratek | No public exploit | A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The patch is identified as 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability. |
| CVE-2014-125087 | Critical | 2023-02-19 | Protected by Waratek | No public exploit | A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480. |
| CVE-2023-23926 | High | 2023-02-16 | Protected by Waratek | No public exploit | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this. External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application. Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. The minimum version containing a patch for this vulnerability is 5.5.0. Those who cannot upgrade the library can control the allowlist of the procedures that can be used in your system. |
| CVE-2023-24187 | High | 2023-02-14 | Protected by Waratek | Proof of concept only | An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile. |
| CVE-2023-22832 | High | 2023-02-10 | Protected by Waratek | No public exploit | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor. |
| CVE-2023-24443 | Critical | 2023-01-26 | Protected by Waratek | No public exploit | Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-24441 | Critical | 2023-01-26 | Protected by Waratek | No public exploit | Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-24430 | Critical | 2023-01-26 | Protected by Waratek | No public exploit | Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-24429 | Critical | 2023-01-26 | Protected by Waratek | No public exploit | Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. |
| CVE-2016-15011 | Critical | 2023-01-06 | Protected by Waratek | No public exploit | A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 is able to address this issue. The identifier of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability. |
| CVE-2020-36641 | Critical | 2023-01-05 | Protected by Waratek | No public exploit | A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability. |
| CVE-2020-36640 | Critical | 2023-01-05 | Protected by Waratek | No public exploit | A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443. |
| CVE-2017-20151 | Critical | 2022-12-30 | Protected by Waratek | No public exploit | A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability. |
| CVE-2022-46682 | Critical | 2022-12-12 | Protected by Waratek | No public exploit | Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45400 | Critical | 2022-11-15 | Protected by Waratek | No public exploit | Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45397 | Critical | 2022-11-15 | Protected by Waratek | No public exploit | Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45396 | Critical | 2022-11-15 | Protected by Waratek | No public exploit | Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45395 | Critical | 2022-11-15 | Protected by Waratek | No public exploit | Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45386 | Medium | 2022-11-15 | Protected by Waratek | No public exploit | Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-43430 | High | 2022-10-19 | Protected by Waratek | No public exploit | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-43415 | High | 2022-10-19 | Protected by Waratek | No public exploit | Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-3338 | Medium | 2022-10-18 | Protected by Waratek | No public exploit | An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API. |
| CVE-2022-40705 | High | 2022-09-22 | Protected by Waratek | No public exploit | An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer |
| CVE-2022-41241 | Critical | 2022-09-21 | Protected by Waratek | No public exploit | Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-41226 | Critical | 2022-09-21 | Protected by Waratek | No public exploit | Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-39135 | Critical | 2022-09-11 | Protected by Waratek | No public exploit | Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators. |
| CVE-2020-14379 | Medium | 2022-08-16 | Protected by Waratek | No public exploit | A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure. |
| CVE-2015-8031 | Critical | 2022-07-18 | Protected by Waratek | No public exploit | Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks. |
| CVE-2021-41042 | Medium | 2022-07-07 | Protected by Waratek | No public exploit | In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved. |
| CVE-2022-32533 | Critical | 2022-07-06 | Protected by Waratek | No public exploit | Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue |
| CVE-2022-34793 | High | 2022-06-30 | Protected by Waratek | No public exploit | Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-41411 | Critical | 2022-06-16 | Protected by Waratek | No public exploit | drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability. |
| CVE-2022-30971 | High | 2022-05-17 | Protected by Waratek | No public exploit | Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-23792 | Critical | 2022-05-06 | Protected by Waratek | No public exploit | The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered. |
| CVE-2022-28890 | Critical | 2022-05-05 | Protected by Waratek | No public exploit | A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities. |
| CVE-2022-29265 | High | 2022-04-30 | Protected by Waratek | No public exploit | Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - EvaluateXPath - EvaluateXQuery - ValidateXml Apache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations in the default configuration for these Processors, and disallows XML External Entity resolution in standard services. |
| CVE-2022-24898 | Medium | 2022-04-28 | Protected by Waratek | Proof of concept only | org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights. |
| CVE-2022-0272 | Critical | 2022-04-21 | Protected by Waratek | No public exploit | Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0. |
| CVE-2021-43142 | Critical | 2022-03-30 | Protected by Waratek | No public exploit | An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput. |
| CVE-2022-28155 | High | 2022-03-29 | Protected by Waratek | No public exploit | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-28154 | High | 2022-03-29 | Protected by Waratek | No public exploit | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-28140 | High | 2022-03-29 | Protected by Waratek | No public exploit | Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-43090 | Critical | 2022-03-25 | Protected by Waratek | No public exploit | An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function. |
| CVE-2022-0861 | Low | 2022-03-23 | Protected by Waratek | No public exploit | A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data. |
| CVE-2022-27201 | Medium | 2022-03-15 | Protected by Waratek | No public exploit | Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. |
| CVE-2022-25312 | Critical | 2022-03-05 | Protected by Waratek | No public exploit | An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7. |
| CVE-2022-0839 | Critical | 2022-03-04 | Protected by Waratek | No public exploit | Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0. |
| CVE-2022-0265 | Critical | 2022-03-03 | Protected by Waratek | Proof of concept only | Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1. |
| CVE-2022-23640 | Critical | 2022-03-02 | Protected by Waratek | No public exploit | Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround. |
| CVE-2022-25209 | High | 2022-02-15 | Protected by Waratek | No public exploit | Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-46365 | High | 2022-02-11 | Protected by Waratek | No public exploit | An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. |
| CVE-2022-0219 | Medium | 2022-01-20 | Protected by Waratek | No public exploit | Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2. |
| CVE-2022-0239 | Critical | 2022-01-17 | Protected by Waratek | Proof of concept only | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
| CVE-2022-0198 | High | 2022-01-13 | Protected by Waratek | No public exploit | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
| CVE-2021-23463 | Critical | 2021-12-10 | Protected by Waratek | No public exploit | The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability. |
| CVE-2021-43577 | High | 2021-11-12 | Protected by Waratek | No public exploit | Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-43576 | Medium | 2021-11-12 | Protected by Waratek | No public exploit | Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. |
| CVE-2021-21701 | Medium | 2021-11-12 | Protected by Waratek | No public exploit | Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-3869 | High | 2021-10-19 | Protected by Waratek | No public exploit | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
| CVE-2021-3878 | Critical | 2021-10-15 | Protected by Waratek | No public exploit | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
| CVE-2021-3312 | Medium | 2021-10-08 | Protected by Waratek | No public exploit | An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document. |
| CVE-2021-39239 | High | 2021-09-16 | Protected by Waratek | No public exploit | A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server. |
| CVE-2021-38555 | Critical | 2021-09-11 | Protected by Waratek | No public exploit | An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. |
| CVE-2021-21680 | High | 2021-08-31 | Protected by Waratek | No public exploit | Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks. |
| CVE-2021-21672 | Medium | 2021-06-30 | Protected by Waratek | No public exploit | Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-29620 | High | 2021-06-23 | Protected by Waratek | No public exploit | Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release. |
| CVE-2021-21669 | Critical | 2021-06-18 | Protected by Waratek | No public exploit | Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-33813 | High | 2021-06-16 | Protected by Waratek | No public exploit | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. |
| CVE-2021-32623 | High | 2021-06-16 | Protected by Waratek | No public exploit | Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue. |
| CVE-2021-20492 | High | 2021-05-26 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793. |
| CVE-2021-21659 | High | 2021-05-25 | Protected by Waratek | Forecast only | Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-21658 | Critical | 2021-05-25 | Protected by Waratek | No public exploit | Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-21657 | High | 2021-05-25 | Protected by Waratek | No public exploit | Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-21656 | High | 2021-05-11 | Protected by Waratek | No public exploit | Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-21642 | High | 2021-04-21 | Protected by Waratek | No public exploit | Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-20454 | High | 2021-04-21 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649. |
| CVE-2021-20453 | High | 2021-04-20 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196648. |
| CVE-2021-21350 | Critical | 2021-03-23 | Protected by Waratek | No public exploit | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. |
| CVE-2021-21347 | Critical | 2021-03-23 | Protected by Waratek | No public exploit | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. |
| CVE-2021-20353 | High | 2021-02-10 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882. |
| CVE-2020-4949 | High | 2021-01-26 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192025. |