cve.bz

OWASP A02:2025 Security Misconfiguration vulnerabilities, newest first, page 22

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A02:2025 at MITRE.

Its weaknesses: 16

CWE-5, CWE-11, CWE-13, CWE-15, CWE-16, CWE-260, CWE-315, CWE-489, CWE-526, CWE-547, CWE-611, CWE-614, CWE-776, CWE-942, CWE-1004, CWE-1174

  1. 8.8CVE-2023-24323EPSS 1.2%

    Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.

  2. 7.8CVE-2022-45588EPSS 0.2%

    All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend R…

  3. 9.1CVE-2022-38389EPSS 1.3%

    IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory …

  4. 9.1CVE-2022-22486EPSS 1.4%

    IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory …

  5. 7.5CVE-2022-33323EPSS 1.1%

    Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass thr…

  6. 6.1CVE-2023-23128EPSS 0.4%

    Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk…

  7. 7.5CVE-2022-47717EPSS 0.7%

    Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).

  8. 9.8CVE-2022-47873EPSS 0.8%

    Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).

  9. 5.5CVE-2023-22322EPSS 0.2%

    Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, sensitive information in the file syste…

  10. 8.8CVE-2022-38715EPSS 3.7%

    A leftover debug code vulnerability exists in the httpd shell.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to remote code execution. An attacker can send an HTTP request to trig…

  11. 9.8CVE-2023-24443EPSS 1.2%

    Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  12. 9.8CVE-2023-24441EPSS 1.2%

    Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  13. 9.8CVE-2023-24430EPSS 1.3%

    Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  14. 9.8CVE-2023-24429EPSS 1.3%

    Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent proces…

  15. 8.1CVE-2023-21862EPSS 0.6%

    Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attac…

  16. 7.5CVE-2023-22624EPSS 3.3%

    Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.

  17. 9.8CVE-2023-22357EPSS 1.2%

    Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote unauthenticated attacker may read/write in arbitrary area of t…

  18. 7.5CVE-2023-23595EPSS 1.0%

    BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .net…

  19. 9.8CVE-2021-4311EPSS 0.7%

    A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31…

  20. 9.8CVE-2015-10029EPSS 0.8%

    A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to…

  21. 9.8CVE-2016-15011EPSS 0.8%

    A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java.…

  22. 9.8CVE-2020-36641EPSS 0.9%

    A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml exte…

  23. 9.8CVE-2020-36640EPSS 0.8%

    A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/Secur…

  24. 5.3CVE-2023-0055EPSS 0.5%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.

  25. 7.5CVE-2018-25060EPSS 0.6%

    A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute…

  26. 9.8CVE-2017-20151EPSS 0.8%

    A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch i…

  27. 9.8CVE-2021-4295EPSS 0.8%

    A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeVali…

  28. 4.3CVE-2022-4818EPSS 0.6%

    A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java.…

  29. 7.5CVE-2022-41967EPSS 0.6%

    Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dr…

  30. 5.3CVE-2019-25091EPSS 0.7%

    A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRF_COOKIE_HTTPONLY l…

  31. 9.8CVE-2022-26969EPSS 1.0%

    In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

  32. 6.5CVE-2022-4683EPSS 0.4%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.

  33. 9.8CVE-2022-31736EPSS 1.1%

    A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.

  34. 5.3CVE-2022-4630EPSS 0.7%

    Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.

  35. 9.8CVE-2022-4607EPSS 0.8%

    A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version …

  36. 8.8CVE-2022-47514EPSS 1.3%

    An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.

  37. 8.8CVE-2022-25628EPSS 0.9%

    An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4

  38. 5.5CVE-2022-37911EPSS 0.7%

    Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the applicati…

  39. 9.8CVE-2022-46682EPSS 1.0%

    Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  40. 7.5CVE-2022-4409EPSS 0.5%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

  41. 5.5CVE-2022-46827EPSS 0.2%

    In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.

  42. 4.9CVE-2022-45326EPSS 1.2%

    An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.

  43. 9.8CVE-2022-43516EPSS 1.0%

    A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)

  44. 3.3CVE-2022-46156EPSS 0.5%

    The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in t…

  45. 4.9CVE-2022-40771EPSS 3.8%

    Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.

  46. 6.5CVE-2022-44641EPSS 1.1%

    In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial o…

  47. 9.8CVE-2022-3980ExploitEPSS 9.8%

    An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.

  48. 4.3CVE-2022-20938EPSS 0.6%

    A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view sensitive information. This vulnerability is due to …

  49. 9.8CVE-2022-45400EPSS 1.1%

    Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  50. 9.8CVE-2022-45397EPSS 1.0%

    Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.