Filtered by CWE-611
Filtered by vendor Subscriptions
Total 1276 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-41221 1 Opentext 1 Archive Center Administration 2025-01-17 7.1 High
The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client (Versions 16.2.3, 21.2, and older versions) could upload XML files to the application that it did not sufficiently validate. As a result, attackers could craft XML files that, when processed by the application, would cause a negative security impact such as data exfiltration or localized denial of service against the application instance and system of the user running it.
CVE-2024-4357 1 Progress 1 Telerik Reporting 2025-01-16 6.5 Medium
An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.
CVE-2023-34411 1 Xml Library Project 1 Xml Library 2025-01-08 7.5 High
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
CVE-2023-24470 1 Microfocus 1 Arcsight Logger 2025-01-06 9.1 Critical
Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.
CVE-2023-29498 1 Fujielectric 1 Frenic Rhc Loader 2025-01-04 5.5 Medium
Improper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. If a user opens a specially crafted project file, sensitive information on the system where the affected product is installed may be disclosed.
CVE-2024-56356 1 Jetbrains 1 Teamcity 2025-01-02 5.9 Medium
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
CVE-2024-31139 1 Jetbrains 1 Teamcity 2024-12-16 5.9 Medium
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
CVE-2023-25926 3 Ibm, Linux, Microsoft 4 Aix, Security Guardium Key Lifecycle Manager, Linux Kernel and 1 more 2024-12-13 5.5 Medium
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 247599.
CVE-2024-11622 1 Hpe 1 Insight Remote Support 2024-12-12 7.3 High
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
CVE-2024-53674 1 Hpe 1 Insight Remote Support 2024-12-12 7.3 High
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
CVE-2024-53675 1 Hpe 1 Insight Remote Support 2024-12-12 7.3 High
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
CVE-2024-25606 1 Liferay 2 Digital Experience Platform, Liferay Portal 2024-12-11 8 High
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
CVE-2023-3113 1 Lenovo 1 Xclarity Administrator 2024-12-03 8.2 High
An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.
CVE-2018-0100 1 Cisco 1 Anyconnect Secure Mobility Client 2024-12-03 N/A
A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by injecting a crafted XML file with malicious entries, which could allow the attacker to read and write files. Cisco Bug IDs: CSCvg19341.
CVE-2018-0108 1 Cisco 1 Webex Meetings Server 2024-12-03 N/A
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996.
CVE-2018-0207 1 Cisco 1 Secure Access Control Server Solution Engine 2024-12-02 3.3 Low
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70595.
CVE-2018-0218 1 Cisco 1 Secure Access Control Server Solution Engine 2024-12-02 3.3 Low
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70616.
CVE-2018-16303 1 Pdf-xchange 1 Pdf-xchange Editor 2024-11-27 N/A
PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.
CVE-2020-26708 1 Requests-xml Project 1 Requests-xml 2024-11-27 7.5 High
requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
CVE-2020-26709 1 Py-xml Project 1 Py-xml 2024-11-27 7.5 High
py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.