Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

CVEs (1,303)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-45397 1Jenkins 1Osf Builder Suite \ Jun 17, 2026 Nov 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45396 1Jenkins 1Sourcemonitor Jun 17, 2026 Nov 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45395 1Jenkins 1Cccc Jun 17, 2026 Nov 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45386 1Jenkins 1Violations Jun 17, 2026 Nov 15, 2022 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-43689 1Concretecms 1Concrete Cms Jun 17, 2026 Nov 14, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.
CVE-2022-45194 1Bruhn Newtech 1Cbrn Analysis Jun 17, 2026 Nov 12, 2022 N/A· v4 4.7 MEDIUM· v3 N/A· v2 CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.
CVE-2022-43570 1Splunk 2Splunk Splunk Cloud Platform Jun 17, 2026 Nov 4, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web t...Show more In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an error. Show less
CVE-2022-3340 1Trellix 1Intrusion Prevention System Manager Jun 17, 2026 Nov 4, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved...Show more XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported.Show less
CVE-2022-42745 1Auieosoftware 1Candidats Jun 17, 2026 Nov 3, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
CVE-2022-40747 1Ibm 1Infosphere Information Server Jun 17, 2026 Nov 3, 2022 N/A· v4 9.1 CRITICAL· v3 N/A· v2 "IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consu...Show more "IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 236584."Show less
CVE-2022-31678 1Vmware 2Cloud Foundation Nsx Data Center Jun 17, 2026 Oct 28, 2022 N/A· v4 9.1 CRITICAL· v3 N/A· v2 VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unint...Show more VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.Show less
CVE-2022-43430 1Jenkins 1Compuware Topaz For Total Test Jun 17, 2026 Oct 19, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-43415 1Jenkins 1Repo Jun 17, 2026 Oct 19, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-3338 1Mcafee 1Epolicy Orchestrator Jun 17, 2026 Oct 18, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the...Show more An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.Show less
CVE-2022-42341 1Adobe 1Coldfusion Jun 17, 2026 Oct 14, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read....Show more Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.Show less
CVE-2022-38419 1Adobe 1Coldfusion Jun 17, 2026 Oct 14, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read....Show more Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.Show less
CVE-2022-42307 1Veritas 1Netbackup Jun 17, 2026 Oct 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service...Show more An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.Show less
CVE-2022-42301 1Veritas 1Netbackup Jun 17, 2026 Oct 3, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.
CVE-2022-34348 1Ibm 1Sterling Partner Engagement Manager Jun 17, 2026 Sep 23, 2022 N/A· v4 7.1 HIGH· v3 N/A· v2 IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or c...Show more IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 230017.Show less
CVE-2022-40705 1Apache 1Soap Jun 17, 2026 Sep 22, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later version...Show more An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainerShow less

Previous 1...252627...66 Next