WaratekVRT Sign in

CWE-611 CVEs

320 CVEs, 6 exploited, 315 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-611✕
Overview 320 matches · 315 protected · 6 exploited · 1 CISA KEV · 16 public PoC · 8 EPSS ≥ 0.5
320matches 315protected98.4% 6exploited1.9% 1CISA KEV0.3% 16public PoC5.0% 8EPSS ≥ 0.52.5%
Protected by Waratek 315 98.4% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 1.6%
Critical 99 30.9% High 143 44.7% Medium 73 22.8% Low 4 1.2% None 0 0.0% Unknown 1 0.3%
blocked by ARMR today 315 98.4% partly blocked 0 0.0% not blocked 5 1.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 6 1.9% Working exploit published 5 1.6% Proof of concept only 22 6.9% Forecast only 3 0.9% No public exploit 284 88.8%
split by peak 43 / year
No exploit published: 5Protected by Waratek: 315 Unknown: 1Low: 4Medium: 73High: 143Critical: 99 not blocked: 5blocked by ARMR today: 315 No public exploit: 284Forecast only: 3Proof of concept only: 22Working exploit published: 5Exploited: 6
20132 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 No public exploit2 20145 Protected by Waratek5 High1 Medium4 blocked by ARMR today5 Working exploit published1 Forecast only1 No public exploit3 20153 Protected by Waratek3 High1 Medium2 blocked by ARMR today3 No public exploit3 20164 Protected by Waratek4 Critical1 High2 Medium1 blocked by ARMR today4 No public exploit4 201723 Protected by Waratek23 Critical10 High10 Medium3 blocked by ARMR today23 Working exploit published2 Proof of concept only1 No public exploit20 201838 Protected by Waratek38 Critical14 High18 Medium6 blocked by ARMR today38 Proof of concept only1 No public exploit37 201924 Protected by Waratek24 Critical9 High9 Medium6 blocked by ARMR today24 Exploited1 Working exploit published1 Proof of concept only1 No public exploit21 202028 Protected by Waratek28 Critical4 High16 Medium8 blocked by ARMR today28 No public exploit28 202127 Protected by Waratek26 No exploit published1 Critical7 High15 Medium5 blocked by ARMR today26 not blocked1 Forecast only2 No public exploit25 202243 Protected by Waratek43 Critical22 High12 Medium8 Low1 blocked by ARMR today43 Proof of concept only3 No public exploit40 202336 Protected by Waratek35 No exploit published1 Critical13 High16 Medium7 blocked by ARMR today35 not blocked1 Proof of concept only4 No public exploit32 202423 Protected by Waratek20 No exploit published3 Critical5 High10 Medium7 Low1 blocked by ARMR today20 not blocked3 Proof of concept only3 No public exploit20 202522 Protected by Waratek22 Critical9 High6 Medium5 Low2 blocked by ARMR today22 Exploited3 Working exploit published1 Proof of concept only3 No public exploit15 202642 Protected by Waratek42 Critical5 High26 Medium10 Unknown1 blocked by ARMR today42 Exploited2 Proof of concept only6 No public exploit34
2014201620182020202220242026
320 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 4 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2023-3276 High 2023-06-15 Protected by Waratek Proof of concept only A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-27554 Critical 2023-05-11 Protected by Waratek No public exploit IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.
CVE-2022-43941 High 2023-04-03 Protected by Waratek No public exploit Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. 
CVE-2023-28684 Medium 2023-04-02 Protected by Waratek No public exploit Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28683 High 2023-04-02 Protected by Waratek No public exploit Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28682 High 2023-04-02 Protected by Waratek No public exploit Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28681 High 2023-04-02 Protected by Waratek No public exploit Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28680 High 2023-04-02 Protected by Waratek No public exploit Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28685 High 2023-03-22 Protected by Waratek No public exploit Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-27480 High 2023-03-07 Protected by Waratek No public exploit XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. Users unable to upgrade may apply the patch `e3527b98fd` manually.
CVE-2016-15026 High 2023-02-20 Protected by Waratek No public exploit A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The patch is identified as 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability.
CVE-2014-125087 Critical 2023-02-19 Protected by Waratek No public exploit A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.
CVE-2023-23926 High 2023-02-16 Protected by Waratek No public exploit APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this. External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application. Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. The minimum version containing a patch for this vulnerability is 5.5.0. Those who cannot upgrade the library can control the allowlist of the procedures that can be used in your system.
CVE-2023-24187 High 2023-02-14 Protected by Waratek Proof of concept only An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
CVE-2023-22832 High 2023-02-10 Protected by Waratek No public exploit The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.
CVE-2023-24443 Critical 2023-01-26 Protected by Waratek No public exploit Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-24441 Critical 2023-01-26 Protected by Waratek No public exploit Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-24430 Critical 2023-01-26 Protected by Waratek No public exploit Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-24429 Critical 2023-01-26 Protected by Waratek No public exploit Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVE-2023-21862 High 2023-01-18 No exploit published No public exploit Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Web Services Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
CVE-2016-15011 Critical 2023-01-06 Protected by Waratek No public exploit A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 is able to address this issue. The identifier of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability.
CVE-2020-36641 Critical 2023-01-05 Protected by Waratek No public exploit A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.
CVE-2020-36640 Critical 2023-01-05 Protected by Waratek No public exploit A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
CVE-2017-20151 Critical 2022-12-30 Protected by Waratek No public exploit A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.
CVE-2022-46682 Critical 2022-12-12 Protected by Waratek No public exploit Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45400 Critical 2022-11-15 Protected by Waratek No public exploit Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45397 Critical 2022-11-15 Protected by Waratek No public exploit Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45396 Critical 2022-11-15 Protected by Waratek No public exploit Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45395 Critical 2022-11-15 Protected by Waratek No public exploit Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45386 Medium 2022-11-15 Protected by Waratek No public exploit Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-43430 High 2022-10-19 Protected by Waratek No public exploit Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-43415 High 2022-10-19 Protected by Waratek No public exploit Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-3338 Medium 2022-10-18 Protected by Waratek No public exploit An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.
CVE-2022-40705 High 2022-09-22 Protected by Waratek No public exploit An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2022-41241 Critical 2022-09-21 Protected by Waratek No public exploit Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-41226 Critical 2022-09-21 Protected by Waratek No public exploit Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-39135 Critical 2022-09-11 Protected by Waratek No public exploit Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.
CVE-2020-14379 Medium 2022-08-16 Protected by Waratek No public exploit A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure.
CVE-2015-8031 Critical 2022-07-18 Protected by Waratek No public exploit Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.
CVE-2021-41042 Medium 2022-07-07 Protected by Waratek No public exploit In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.
CVE-2022-32533 Critical 2022-07-06 Protected by Waratek No public exploit Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue
CVE-2022-34793 High 2022-06-30 Protected by Waratek No public exploit Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-41411 Critical 2022-06-16 Protected by Waratek No public exploit drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
CVE-2022-30971 High 2022-05-17 Protected by Waratek No public exploit Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-23792 Critical 2022-05-06 Protected by Waratek No public exploit The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.
CVE-2022-28890 Critical 2022-05-05 Protected by Waratek No public exploit A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.
CVE-2022-29265 High 2022-04-30 Protected by Waratek No public exploit Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - EvaluateXPath - EvaluateXQuery - ValidateXml Apache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations in the default configuration for these Processors, and disallows XML External Entity resolution in standard services.
CVE-2022-24898 Medium 2022-04-28 Protected by Waratek Proof of concept only org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.
CVE-2022-0272 Critical 2022-04-21 Protected by Waratek No public exploit Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
CVE-2021-43142 Critical 2022-03-30 Protected by Waratek No public exploit An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.
CVE-2022-28155 High 2022-03-29 Protected by Waratek No public exploit Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-28154 High 2022-03-29 Protected by Waratek No public exploit Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-28140 High 2022-03-29 Protected by Waratek No public exploit Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-43090 Critical 2022-03-25 Protected by Waratek No public exploit An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
CVE-2022-0861 Low 2022-03-23 Protected by Waratek No public exploit A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.
CVE-2022-27201 Medium 2022-03-15 Protected by Waratek No public exploit Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVE-2022-25312 Critical 2022-03-05 Protected by Waratek No public exploit An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.
CVE-2022-0839 Critical 2022-03-04 Protected by Waratek No public exploit Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
CVE-2022-0265 Critical 2022-03-03 Protected by Waratek Proof of concept only Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
CVE-2022-23640 Critical 2022-03-02 Protected by Waratek No public exploit Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.
CVE-2022-25209 High 2022-02-15 Protected by Waratek No public exploit Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-46365 High 2022-02-11 Protected by Waratek No public exploit An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.
CVE-2022-0219 Medium 2022-01-20 Protected by Waratek No public exploit Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
CVE-2022-21282 Medium 2022-01-19 Protected by Waratek No public exploit Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2022-0239 Critical 2022-01-17 Protected by Waratek Proof of concept only corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVE-2022-0198 High 2022-01-13 Protected by Waratek No public exploit corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVE-2021-23463 Critical 2021-12-10 Protected by Waratek No public exploit The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
CVE-2021-43577 High 2021-11-12 Protected by Waratek No public exploit Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-43576 Medium 2021-11-12 Protected by Waratek No public exploit Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVE-2021-21701 Medium 2021-11-12 Protected by Waratek No public exploit Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-3869 High 2021-10-19 Protected by Waratek No public exploit corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVE-2021-3878 Critical 2021-10-15 Protected by Waratek No public exploit corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVE-2021-3312 Medium 2021-10-08 Protected by Waratek No public exploit An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
CVE-2021-39239 High 2021-09-16 Protected by Waratek No public exploit A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.
CVE-2021-38555 Critical 2021-09-11 Protected by Waratek No public exploit An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.
CVE-2021-21680 High 2021-08-31 Protected by Waratek No public exploit Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.
CVE-2021-2401 Medium 2021-07-21 No exploit published Forecast only Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2021-21672 Medium 2021-06-30 Protected by Waratek No public exploit Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-29620 High 2021-06-23 Protected by Waratek No public exploit Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.
CVE-2021-21669 Critical 2021-06-18 Protected by Waratek No public exploit Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-33813 High 2021-06-16 Protected by Waratek No public exploit An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
CVE-2021-20492 High 2021-05-26 Protected by Waratek No public exploit IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.
CVE-2021-21659 High 2021-05-25 Protected by Waratek Forecast only Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21658 Critical 2021-05-25 Protected by Waratek No public exploit Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21657 High 2021-05-25 Protected by Waratek No public exploit Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21656 High 2021-05-11 Protected by Waratek No public exploit Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21642 High 2021-04-21 Protected by Waratek No public exploit Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-20454 High 2021-04-21 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649.
CVE-2021-20453 High 2021-04-20 Protected by Waratek No public exploit IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196648.
CVE-2021-20353 High 2021-02-10 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882.
CVE-2020-4949 High 2021-01-26 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192025.
CVE-2021-23901 Critical 2021-01-25 Protected by Waratek No public exploit An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.
CVE-2021-23899 Critical 2021-01-13 Protected by Waratek No public exploit OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
CVE-2020-25649 High 2020-12-03 Protected by Waratek No public exploit A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2020-2324 High 2020-12-03 Protected by Waratek No public exploit Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2315 Medium 2020-11-04 Protected by Waratek No public exploit Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2305 Medium 2020-11-04 Protected by Waratek No public exploit Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2304 Medium 2020-11-04 Protected by Waratek No public exploit Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2298 Medium 2020-10-08 Protected by Waratek No public exploit Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-15232 Critical 2020-10-02 Protected by Waratek No public exploit In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.
‹ prev page 2 of 4 next ›