Vulnerabilities > Improper Restriction of XML External Entity Reference ('XXE')

DATE CVE VULNERABILITY TITLE RISK
2016-11-16 CVE-2016-9318 XXE vulnerability in multiple products
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
local
low complexity
xmlsoft canonical CWE-611
5.5
2016-10-03 CVE-2015-1832 XXE vulnerability in Apache Derby
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
network
low complexity
apache CWE-611
critical
9.1
2016-09-26 CVE-2016-5971 XXE vulnerability in IBM Security Privileged Identity Manager Virtual Appliance 2.0/2.0.2
IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
network
low complexity
ibm CWE-611
7.1
2016-09-24 CVE-2016-6408 XXE vulnerability in Cisco Prime Home 5.2.0
Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCvb17814.
network
low complexity
cisco CWE-611
7.5
2016-09-01 CVE-2016-4264 XXE vulnerability in Adobe Coldfusion 10.0/11.0
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
network
low complexity
adobe CWE-611
8.6
2016-08-05 CVE-2016-5000 XXE vulnerability in Apache POI
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
local
low complexity
apache CWE-611
5.5
2016-05-22 CVE-2015-8866 XXE vulnerability in multiple products
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
network
low complexity
php canonical suse opensuse CWE-611
critical
9.6
2016-04-07 CVE-2016-3974 XXE vulnerability in SAP Netweaver Application Server Java
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994.
network
low complexity
sap CWE-611
critical
9.1
2013-02-13 CVE-2012-3363 XXE vulnerability in multiple products
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
network
low complexity
zend fedoraproject debian CWE-611
critical
9.1
2013-01-18 CVE-2012-5656 XXE vulnerability in multiple products
The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.
5.5