cve.bz

OWASP A02:2025 Security Misconfiguration vulnerabilities, newest first, page 32

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A02:2025 at MITRE.

Its weaknesses: 16

CWE-5, CWE-11, CWE-13, CWE-15, CWE-16, CWE-260, CWE-315, CWE-489, CWE-526, CWE-547, CWE-611, CWE-614, CWE-776, CWE-942, CWE-1004, CWE-1174

  1. 6.5CVE-2019-3768EPSS 1.1%

    RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to cause information disclosure of local system files by …

  2. 8.1CVE-2019-19032ExploitEPSS 4.5%

    XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload.

  3. 8.1CVE-2019-19031ExploitEPSS 5.2%

    Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.

  4. 7.5CVE-2019-19998EPSS 1.1%

    Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.

  5. 7.5CVE-2012-2656EPSS 2.0%

    An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information.

  6. 8.1CVE-2019-16549EPSS 1.0%

    Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.

  7. 6.8CVE-2019-18579EPSS 0.3%

    Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability. The BIOS configuration for the "Enable Thunderbolt (and PCIe behind TBT) pre-boot modules" setting is enabled by default. A loca…

  8. 7.5CVE-2014-3643EPSS 2.2%

    jersey: XXE via parameter entities not disabled by the jersey SAX parser

  9. 7.5CVE-2017-18640EPSS 27%

    The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

  10. 7.5CVE-2019-19702EPSS 1.5%

    The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionali…

  11. 6.5CVE-2019-11216EPSS 1.8%

    BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. X…

  12. 5.5CVE-2019-17554ExploitEPSS 12%

    The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, ca…

  13. 7.5CVE-2011-3600ExploitEPSS 16%

    The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it c…

  14. 6.5CVE-2019-10080EPSS 2.3%

    The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information su…

  15. 6.5CVE-2019-17085EPSS 0.8%

    XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent.

  16. 9.8CVE-2018-20687EPSS 2.5%

    An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) a…

  17. 7.5CVE-2019-10172EPSS 17%

    A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

  18. 10.0CVE-2019-14678EPSS 3.0%

    SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential…

  19. 6.5CVE-2014-3599EPSS 1.2%

    HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy

  20. 6.5CVE-2019-14860EPSS 1.2%

    It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.

  21. 8.8CVE-2019-12331EPSS 1.4%

    PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the …

  22. 4.9CVE-2019-8126EPSS 0.9%

    An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document ty…

  23. 6.5CVE-2013-6461EPSS 2.2%

    Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

  24. 6.5CVE-2013-6460EPSS 2.1%

    Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

  25. 7.5CVE-2019-18227EPSS 3.1%

    Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data.

  26. 7.5CVE-2019-9757ExploitEPSS 37%

    An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.

  27. 7.5CVE-2017-15725EPSS 1.4%

    An XML External Entity Injection vulnerability exists in Dzone AnswerHub.

  28. 7.5CVE-2019-8087EPSS 3.6%

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

  29. 7.5CVE-2019-8086ExploitEPSS 23%

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

  30. 7.5CVE-2019-8082EPSS 3.2%

    Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

  31. 8.8CVE-2019-18213EPSS 2.0%

    XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF (as well as SMB connecti…

  32. 5.5CVE-2019-12415EPSS 1.0%

    In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resource…

  33. 8.1CVE-2019-10466EPSS 1.0%

    An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side req…

  34. 6.5CVE-2019-14276EPSS 1.0%

    WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.

  35. 7.5CVE-2019-11253ExploitEPSS 26%

    Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume e…

  36. 8.8CVE-2019-1060EPSS 14%

    A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.

  37. 6.5CVE-2019-12711EPSS 1.1%

    A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or…

  38. 7.5CVE-2019-16760EPSS 1.3%

    Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1…

  39. 7.1CVE-2019-16188EPSS 0.8%

    HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can send a specially crafted .ozasmt file to a targeted victim and ask the victim to open it. When the …

  40. 4.9CVE-2019-9488EPSS 1.2%

    Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is…

  41. 7.5CVE-2019-12401EPSS 8.5%

    Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a …

  42. 8.8CVE-2019-16174EPSS 2.4%

    An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity.

  43. 7.5CVE-2019-15903EPSS 6.6%

    In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based bu…

  44. 7.5CVE-2019-6179EPSS 1.4%

    An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator (LXCI) for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity I…

  45. 7.5CVE-2019-13608KEVExploitEPSS 30%

    Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

  46. 6.5CVE-2019-15641EPSS 1.5%

    xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.

  47. 8.1CVE-2019-15637ExploitEPSS 14%

    Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.

  48. 8.2CVE-2019-4513EPSS 2.8%

    IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or …

  49. 7.5CVE-2019-14258EPSS 1.7%

    The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.

  50. 8.2CVE-2019-4424EPSS 2.4%

    IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sen…