cve.bz

OWASP A02:2025 Security Misconfiguration vulnerabilities, newest first, page 25

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A02:2025 at MITRE.

Its weaknesses: 16

CWE-5, CWE-11, CWE-13, CWE-15, CWE-16, CWE-260, CWE-315, CWE-489, CWE-526, CWE-547, CWE-611, CWE-614, CWE-776, CWE-942, CWE-1004, CWE-1174

  1. 8.8CVE-2022-21949EPSS 1.9%

    A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be…

  2. 7.5CVE-2022-29265EPSS 2.6%

    Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted X…

  3. 9.8CVE-2022-24449EPSS 1.9%

    Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document.

  4. 4.9CVE-2022-24898EPSS 1.5%

    org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the u…

  5. 6.7CVE-2021-3972EPSS 2.9%

    A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modi…

  6. 6.7CVE-2021-3971EPSS 1.2%

    A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware pro…

  7. 6.5CVE-2021-20464EPSS 1.4%

    IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.

  8. 9.8CVE-2022-0272EPSS 1.4%

    Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.

  9. 5.3CVE-2021-43990EPSS 0.7%

    The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call.

  10. 7.2CVE-2020-25156EPSS 1.2%

    Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.

  11. 7.5CVE-2022-22183EPSS 1.0%

    An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a specific open IPv4 port, which in affected releases should otherwise be unreachable, …

  12. 5.5CVE-2022-0221EPSS 1.0%

    A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploi…

  13. 9.8CVE-2022-28219ExploitEPSS 97%

    Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.

  14. 5.5CVE-2022-1018EPSS 2.2%

    When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from lo…

  15. 9.8CVE-2021-43142EPSS 1.5%

    An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.

  16. 7.2CVE-2021-33208EPSS 1.2%

    The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file.

  17. 8.1CVE-2022-28155EPSS 0.8%

    Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  18. 8.1CVE-2022-28154EPSS 1.0%

    Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  19. 8.1CVE-2022-28140EPSS 1.0%

    Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  20. 7.5CVE-2021-44477EPSS 1.1%

    GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of…

  21. 9.8CVE-2021-43090EPSS 1.9%

    An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.

  22. 3.8CVE-2022-0861EPSS 0.5%

    A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is lim…

  23. 7.2CVE-2021-42194EPSS 1.1%

    The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (…

  24. 5.5CVE-2022-27193EPSS 0.7%

    CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the syst…

  25. 7.5CVE-2022-26662EPSS 2.0%

    An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x throu…

  26. 6.5CVE-2022-26661EPSS 1.4%

    An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through …

  27. 6.5CVE-2022-22835EPSS 14%

    An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE vulnerability to read arbitrary files from the filesystem.

  28. 9.1CVE-2022-22795EPSS 1.1%

    Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which al…

  29. 9.1CVE-2022-25312EPSS 2.9%

    An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability t…

  30. 9.8CVE-2022-0839EPSS 3.0%

    Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.

  31. 9.8CVE-2022-0265EPSS 2.8%

    Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.

  32. 9.8CVE-2022-23640EPSS 1.3%

    Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. U…

  33. 9.8CVE-2022-24340EPSS 1.0%

    In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.

  34. 7.1CVE-2020-14478EPSS 0.3%

    A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow th…

  35. 8.8CVE-2022-25209EPSS 1.1%

    Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  36. 7.8CVE-2021-46365EPSS 1.7%

    An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.

  37. 7.8CVE-2022-21220EPSS 0.2%

    Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

  38. 7.5CVE-2022-21205EPSS 1.1%

    Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an unauthenticated user to potentially enable information disclosure via network access.

  39. 9.8CVE-2021-46660EPSS 1.2%

    Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.

  40. 7.5CVE-2021-40419EPSS 1.2%

    A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of network requests can lead to arbitrary firmware update. An attacker can send a sequence of requests to tr…

  41. 4.9CVE-2022-23031EPSS 0.8%

    On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Adv…

  42. 8.2CVE-2020-4876EPSS 1.7%

    IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory …

  43. 8.2CVE-2020-4875EPSS 1.7%

    IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory …

  44. 5.5CVE-2022-0219EPSS 1.1%

    Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.

  45. 5.3CVE-2022-21282EPSS 2.9%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: …

  46. 9.8CVE-2022-0239EPSS 1.2%

    corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  47. 9.8CVE-2021-40722EPSS 3.3%

    AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

  48. 7.1CVE-2022-0198EPSS 0.7%

    corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  49. 8.8CVE-2021-42560EPSS 2.1%

    An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks (e.g., File Exfil…

  50. 5.5CVE-2021-44028EPSS 3.1%

    XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.