cve.bz

OWASP A02:2025 Security Misconfiguration vulnerabilities, newest first, page 26

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A02:2025 at MITRE.

Its weaknesses: 16

CWE-5, CWE-11, CWE-13, CWE-15, CWE-16, CWE-260, CWE-315, CWE-489, CWE-526, CWE-547, CWE-611, CWE-614, CWE-776, CWE-942, CWE-1004, CWE-1174

  1. 4.3CVE-2021-45096EPSS 1.1%

    KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.

  2. 5.5CVE-2021-3836EPSS 0.9%

    dbeaver is vulnerable to Improper Restriction of XML External Entity Reference

  3. 9.1CVE-2021-23463EPSS 2.8%

    The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML()…

  4. 6.5CVE-2021-23861EPSS 0.8%

    By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations o…

  5. 9.1CVE-2021-44557EPSS 1.3%

    National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/ner.py. Since XML parsing resolves external entities, a malicious XML stream cou…

  6. 9.1CVE-2021-44556EPSS 1.3%

    National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files …

  7. 7.7CVE-2021-42776EPSS 0.8%

    CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import.

  8. 9.1CVE-2021-42115EPSS 1.3%

    Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via steali…

  9. 8.8CVE-2021-22957EPSS 0.9%

    A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor who has convinced a privileged user to access a URL with malicious code to take over said user’s ac…

  10. 7.8CVE-2021-35033EPSS 0.4%

    A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles t…

  11. 5.5CVE-2021-44147EPSS 1.2%

    An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks.

  12. 7.1CVE-2021-43577EPSS 1.0%

    Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  13. 6.5CVE-2021-43576EPSS 2.4%

    Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses ext…

  14. 6.5CVE-2021-21701EPSS 1.7%

    Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  15. 8.1CVE-2021-36172EPSS 0.8%

    An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of…

  16. 6.5CVE-2021-20839EPSS 1.1%

    Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by proce…

  17. 7.5CVE-2021-20838EPSS 1.5%

    Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition by processing a specially cra…

  18. 9.1CVE-2020-26705EPSS 1.3%

    The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into …

  19. 9.1CVE-2020-25912EPSS 1.4%

    A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).

  20. 9.1CVE-2020-25911EPSS 2.4%

    A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

  21. 5.3CVE-2021-35236EPSS 0.5%

    The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help…

  22. 5.3CVE-2021-35235EPSS 1.3%

    The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra in…

  23. 5.3CVE-2021-35233EPSS 1.0%

    The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTT…

  24. 9.1CVE-2021-38453EPSS 1.1%

    Some API functions allow interaction with the registry, which includes reading values as well as data modification.

  25. 9.1CVE-2021-31381EPSS 1.2%

    A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to d…

  26. 5.3CVE-2021-31380EPSS 1.1%

    A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP res…

  27. 7.5CVE-2021-3869EPSS 1.4%

    corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  28. 9.8CVE-2021-3878EPSS 1.9%

    corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  29. 7.5CVE-2020-19954EPSS 1.2%

    An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.

  30. 6.8CVE-2021-3882EPSS 1.1%

    LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be…

  31. 6.5CVE-2021-20801EPSS 1.1%

    Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Fi…

  32. 7.5CVE-2021-35496EPSS 0.6%

    The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Ser…

  33. 7.5CVE-2021-40500EPSS 1.3%

    SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over …

  34. 6.5CVE-2021-3312EPSS 1.3%

    An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

  35. 9.8CVE-2021-38298EPSS 2.6%

    Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.

  36. 6.5CVE-2021-40439EPSS 3.9%

    Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML f…

  37. 7.5CVE-2021-41770EPSS 1.0%

    Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.

  38. 5.4CVE-2021-34706EPSS 0.7%

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an a…

  39. 6.5CVE-2021-35201EPSS 1.0%

    NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.

  40. 7.5CVE-2021-41098EPSS 1.5%

    Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who pa…

  41. 8.1CVE-2021-29831EPSS 1.5%

    IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive inf…

  42. 5.5CVE-2021-31842EPSS 0.2%

    XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack throug…

  43. 7.5CVE-2021-39239EPSS 4.3%

    A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.

  44. 6.5CVE-2021-39210EPSS 1.0%

    GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal t…

  45. 8.2CVE-2021-30137EPSS 0.7%

    Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.

  46. 7.5CVE-2021-3706EPSS 1.1%

    adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag

  47. 7.5CVE-2021-40356EPSS 1.0%

    A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The application conta…

  48. 9.1CVE-2021-38555EPSS 2.8%

    An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allo…

  49. 6.5CVE-2021-3055EPSS 1.1%

    An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically craf…

  50. 9.8CVE-2021-34436EPSS 2.2%

    In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language supp…