Total
1035 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-1018 | 1 Rockwellautomation | 3 Connected Components Workbench, Isagraf, Safety Instrumented Systems Workstation | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality. | |||||
| CVE-2022-0861 | 1 Mcafee | 1 Epolicy Orchestrator | 2024-11-21 | 5.5 MEDIUM | 3.5 LOW |
| A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data. | |||||
| CVE-2022-0839 | 2 Liquibase, Oracle | 2 Liquibase, Sqlcl | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0. | |||||
| CVE-2022-0272 | 1 Detekt | 1 Detekt | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0. | |||||
| CVE-2022-0265 | 1 Hazelcast | 1 Hazelcast | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1. | |||||
| CVE-2022-0239 | 1 Stanford | 1 Corenlp | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| corenlp is vulnerable to Improper Restriction of XML External Entity Reference | |||||
| CVE-2022-0221 | 1 Schneider-electric | 1 Scadapack Workbench | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior) | |||||
| CVE-2022-0219 | 1 Jadx Project | 1 Jadx | 2024-11-21 | 4.3 MEDIUM | 5.5 MEDIUM |
| Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2. | |||||
| CVE-2022-0217 | 1 Prosody | 1 Prosody | 2024-11-21 | N/A | 7.5 HIGH |
| It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611). | |||||
| CVE-2022-0198 | 1 Stanford | 1 Corenlp | 2024-11-21 | 5.8 MEDIUM | 7.1 HIGH |
| corenlp is vulnerable to Improper Restriction of XML External Entity Reference | |||||
| CVE-2021-4311 | 1 Talend | 1 Open Studio | 2024-11-21 | 4.9 MEDIUM | 5.5 MEDIUM |
| A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability. | |||||
| CVE-2021-4295 | 1 Healthit | 1 Code-validator-api | 2024-11-21 | N/A | 5.5 MEDIUM |
| A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability. | |||||
| CVE-2021-47621 | 2024-11-21 | N/A | 7.5 HIGH | ||
| ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks. | |||||
| CVE-2021-46660 | 1 Signiant | 1 Manager\+agents | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks. | |||||
| CVE-2021-46365 | 1 Magnolia-cms | 1 Magnolia Cms | 2024-11-21 | 6.8 MEDIUM | 7.8 HIGH |
| An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. | |||||
| CVE-2021-45981 | 1 Netscout | 1 Ngeniusone | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack. | |||||
| CVE-2021-45096 | 1 Knime | 1 Knime Analytics Platform | 2024-11-21 | 4.3 MEDIUM | 4.7 MEDIUM |
| KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. | |||||
| CVE-2021-45024 | 1 Rocketsoftware | 1 Ags-zena | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE). | |||||
| CVE-2021-44557 | 1 Kb | 1 Multiner | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
| National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/ner.py. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS. | |||||
| CVE-2021-44556 | 1 Kb | 1 Digger | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
| National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS. | |||||