cve.bz

OWASP A02:2025 Security Misconfiguration vulnerabilities, newest first, page 21

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A02:2025 at MITRE.

Its weaknesses: 16

CWE-5, CWE-11, CWE-13, CWE-15, CWE-16, CWE-260, CWE-315, CWE-489, CWE-526, CWE-547, CWE-611, CWE-614, CWE-776, CWE-942, CWE-1004, CWE-1174

  1. 5.5CVE-2023-25955EPSS 0.2%

    National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.

  2. 6.5CVE-2023-28340EPSS 3.2%

    Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.

  3. 7.1CVE-2023-27876EPSS 1.1%

    IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 2499…

  4. 6.0CVE-2023-20030EPSS 0.8%

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an aff…

  5. 6.5CVE-2022-43941EPSS 0.5%

    Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.

  6. 6.5CVE-2023-28684EPSS 0.7%

    Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  7. 8.2CVE-2023-28683EPSS 0.6%

    Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  8. 8.2CVE-2023-28682EPSS 0.6%

    Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  9. 8.2CVE-2023-28681EPSS 0.6%

    Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  10. 7.5CVE-2023-28680EPSS 0.8%

    Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  11. 5.4CVE-2022-43473EPSS 20%

    A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this v…

  12. 9.8CVE-2023-1712EPSS 0.9%

    Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.

  13. 7.1CVE-2022-36969EPSS 14%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must …

  14. 2.7CVE-2022-27597EPSS 0.7%

    A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating …

  15. 9.8CVE-2023-28150EPSS 0.7%

    An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.

  16. 9.8CVE-2023-28151EPSS 0.8%

    An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.

  17. 9.8CVE-2023-28152EPSS 0.7%

    An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.

  18. 7.1CVE-2023-28685EPSS 0.6%

    Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  19. 5.5CVE-2022-46300EPSS 4.1%

    Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

  20. 5.5CVE-2022-45468EPSS 1.8%

    Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

  21. 5.5CVE-2022-45121EPSS 0.3%

    Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

  22. 5.5CVE-2022-43512EPSS 0.3%

    Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

  23. 5.5CVE-2022-41696EPSS 0.3%

    Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

  24. 9.8CVE-2018-25082EPSS 0.8%

    A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgradi…

  25. 8.8CVE-2023-27874EPSS 1.3%

    IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.

  26. 7.5CVE-2023-28118EPSS 1.0%

    kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to r…

  27. 4.9CVE-2023-26461EPSS 0.5%

    SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modi…

  28. 7.5CVE-2023-1288EPSS 0.5%

    An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.

  29. 7.5CVE-2023-27476EPSS 1.0%

    OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable en…

  30. 7.7CVE-2023-27480EPSS 0.7%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to…

  31. 5.3CVE-2023-20052EPSS 7.0%

    On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauth…

  32. 6.5CVE-2023-26043EPSS 0.8%

    GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to …

  33. 9.8CVE-2023-24189EPSS 1.2%

    An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.

  34. 8.8CVE-2023-20855EPSS 1.3%

    VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions lea…

  35. 9.8CVE-2022-45677EPSS 0.9%

    SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student_login.process.php.

  36. 6.5CVE-2023-26267EPSS 0.5%

    php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.

  37. 9.8CVE-2015-10082EPSS 0.7%

    A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The …

  38. 7.8CVE-2016-15026EPSS 0.5%

    A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrad…

  39. 9.8CVE-2014-125087EPSS 1.2%

    A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to ad…

  40. 7.5CVE-2021-33950EPSS 0.7%

    An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.

  41. 9.1CVE-2022-39954EPSS 0.5%

    An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version …

  42. 8.1CVE-2023-23926EPSS 0.9%

    APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph d…

  43. 7.5CVE-2023-23464EPSS 0.5%

    Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.

  44. 7.4CVE-2023-22377EPSS 0.7%

    Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability…

  45. 7.8CVE-2023-24187EPSS 0.9%

    An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.

  46. 7.8CVE-2022-33233EPSS 0.1%

    Memory corruption due to configuration weakness in modem wile sending command to write protected files.

  47. 6.5CVE-2022-34366EPSS 0.5%

    Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.

  48. 7.5CVE-2023-22832EPSS 1.4%

    The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that …

  49. 6.1CVE-2022-21940EPSS 0.4%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

  50. 6.1CVE-2022-21939EPSS 0.5%

    Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.