Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

CVEs (1,359)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-14485 1Blogengine 1Blogengine.net Nov 21, 2024 May 7, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
CVE-2019-11677 1Zohocorp 1Manageengine Firewall Analyzer Jun 17, 2026 May 2, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.
CVE-2019-10309 1Jenkins 1Self Organizing Swarm Modules Jun 17, 2026 Apr 30, 2019 N/A· v4 9.3 CRITICAL· v3 4.8 MEDIUM· v2 Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attacker...Show more Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.Show less
CVE-2019-11519 1Nopcommerce 1Nopcommerce Jun 17, 2026 Apr 25, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.
CVE-2018-17289 1Kofax 1Front Office Server Nov 21, 2024 Apr 18, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package...Show more An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration (.ZIP file) within the Kofax/KFS/Admin/PackageService/package/upload file parameter.Show less
CVE-2019-8999 1Blackberry 1Unified Endpoint Management Jun 17, 2026 Apr 18, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.
CVE-2019-0228 3Apache FedoraprojectOracle 14Banking Corporate Lending Process Management Banking Credit Facilities Process ManagementBanking Supply Chain Finance+11 more Jun 17, 2026 Apr 17, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
CVE-2019-0284 1Sap 1Hana Jun 17, 2026 Apr 10, 2019 N/A· v4 6.0 MEDIUM· v3 3.6 LOW· v2 SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML E...Show more SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.Show less
CVE-2019-0795 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more Jun 17, 2026 Apr 9, 2019 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-07...Show more A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0792, CVE-2019-0793.Show less
CVE-2019-0793 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more Jun 17, 2026 Apr 9, 2019 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-07...Show more A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0792, CVE-2019-0795.Show less
CVE-2019-0792 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more Jun 17, 2026 Apr 9, 2019 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-07...Show more A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0793, CVE-2019-0795.Show less
CVE-2019-0791 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more Jun 17, 2026 Apr 9, 2019 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-07...Show more A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795.Show less
CVE-2019-0790 1Microsoft 7Windows 10 Windows 7Windows 8.1+4 more Jun 17, 2026 Apr 9, 2019 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0791, CVE-2019-07...Show more A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795.Show less
CVE-2019-10244 1Eclipse 1Kura Jun 17, 2026 Apr 9, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XX...Show more In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.Show less
CVE-2019-0756 1Microsoft 8Windows 10 Windows 7Windows 8.1+5 more Jun 17, 2026 Apr 9, 2019 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.
CVE-2018-20222 1Airsonic Project 1Airsonic Nov 21, 2024 Apr 4, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 XXE issue in Airsonic before 10.1.2 during parse.
CVE-2019-4043 1Ibm 1Sterling B2b Integrator Jun 17, 2026 Apr 2, 2019 N/A· v4 7.1 HIGH· v3 5.5 MEDIUM· v2 IBM Sterling B2B Integrator Standard Edition 5.2.0 snf 6.0.0.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensiti...Show more IBM Sterling B2B Integrator Standard Edition 5.2.0 snf 6.0.0.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 156239.Show less
CVE-2017-18111 1Atlassian 1Application Links Nov 21, 2024 Mar 29, 2019 N/A· v4 8.7 HIGH· v3 5.5 MEDIUM· v2 The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when cons...Show more The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.Show less
CVE-2017-18110 1Atlassian 1Crowd Nov 21, 2024 Mar 29, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.
CVE-2019-3481 1Hp 1Arcsight Logger Jun 17, 2026 Mar 25, 2019 N/A· v4 7.1 HIGH· v3 7.5 HIGH· v2 Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.

Previous 1...495051...68 Next