cve.bz

OWASP A02:2025 Security Misconfiguration vulnerabilities, newest first, page 31

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A02:2025 at MITRE.

Its weaknesses: 16

CWE-5, CWE-11, CWE-13, CWE-15, CWE-16, CWE-260, CWE-315, CWE-489, CWE-526, CWE-547, CWE-611, CWE-614, CWE-776, CWE-942, CWE-1004, CWE-1174

  1. 6.1CVE-2019-19089EPSS 1.1%

    For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack …

  2. 6.1CVE-2019-19003EPSS 0.8%

    For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting.

  3. 5.4CVE-2019-19002EPSS 0.8%

    For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting.

  4. 6.5CVE-2019-19001EPSS 1.6%

    For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing s…

  5. 6.5CVE-2019-19000EPSS 1.1%

    For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information.

  6. 4.3CVE-2020-1769EPSS 1.2%

    In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior…

  7. 9.1CVE-2020-10993EPSS 1.3%

    Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.

  8. 9.8CVE-2020-10992EPSS 1.3%

    Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.

  9. 9.8CVE-2020-10991EPSS 1.4%

    Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java

  10. 9.8CVE-2020-10990EPSS 1.2%

    An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.

  11. 8.8CVE-2020-2171EPSS 1.1%

    Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  12. 9.8CVE-2019-20627EPSS 2.3%

    AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.

  13. 9.8CVE-2020-10799EPSS 1.5%

    The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.

  14. 7.5CVE-2019-20191EPSS 1.1%

    Oxygen XML Editor 21.1.1 allows XXE to read any file.

  15. 9.8CVE-2020-8540EPSS 13%

    An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted D…

  16. 9.1CVE-2020-9044EPSS 1.3%

    XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite…

  17. 7.1CVE-2020-2144EPSS 1.1%

    Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  18. 7.1CVE-2020-2138EPSS 0.9%

    Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

  19. 4.3CVE-2015-7968EPSS 0.6%

    nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI.

  20. 9.8CVE-2020-9352EPSS 1.9%

    An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parame…

  21. 7.5CVE-2012-6685EPSS 2.2%

    Nokogiri before 1.5.4 is vulnerable to XXE attacks

  22. 9.8CVE-2014-2228EPSS 3.3%

    The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages.

  23. 9.8CVE-2020-1693EPSS 4.3%

    A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a…

  24. 5.5CVE-2019-6194EPSS 0.7%

    An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure.

  25. 8.8CVE-2020-1975EPSS 1.0%

    Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier …

  26. 4.9CVE-2020-6187EPSS 0.9%

    SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service.

  27. 8.8CVE-2020-2120EPSS 1.1%

    Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

  28. 8.8CVE-2020-2115EPSS 1.1%

    Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

  29. 9.8CVE-2014-2052EPSS 2.5%

    Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

  30. 9.8CVE-2013-4335EPSS 2.5%

    opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities

  31. 9.8CVE-2013-4334EPSS 1.4%

    opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities

  32. 6.5CVE-2020-6856EPSS 0.9%

    An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specif…

  33. 7.5CVE-2019-20104EPSS 2.4%

    The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.

  34. 5.3CVE-2019-10782EPSS 1.5%

    All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.

  35. 7.6CVE-2020-2108EPSS 0.9%

    Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.

  36. 7.5CVE-2020-5227EPSS 2.2%

    Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tre…

  37. 7.1CVE-2019-4707EPSS 1.4%

    IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory res…

  38. 7.5CVE-2015-9541EPSS 2.6%

    Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.

  39. 9.1CVE-2013-4333EPSS 2.2%

    OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability

  40. 7.5CVE-2015-1811EPSS 1.4%

    XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.

  41. 7.5CVE-2015-1809EPSS 1.4%

    XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.

  42. 8.8CVE-2020-2092EPSS 1.4%

    Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.

  43. 7.5CVE-2019-18412EPSS 1.0%

    JetBrains IDETalk plugin before version 193.4099.10 allows XXE

  44. 7.1CVE-2015-8549EPSS 1.8%

    XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.

  45. 7.8CVE-2014-5238EPSS 1.9%

    XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text docu…

  46. 9.1CVE-2020-6958EPSS 2.4%

    An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate data from remote hosts and potentially cause denial-of-service.

  47. 6.5CVE-2019-17020EPSS 1.1%

    If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would…

  48. 9.1CVE-2019-14837EPSS 1.7%

    A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the em…

  49. 4.9CVE-2019-15983EPSS 1.3%

    A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker w…

  50. 4.9CVE-2019-20153EPSS 1.2%

    An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload definition feature in definition_upload_attach.jsp allows authenticated remote …