Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

xml external entity vulnerabilities and exploits

(subscribe to this query)

5
CVSSv2
CVE-2016-4216
XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue....
Adobe Xmp Toolkit
5
CVSSv2
CVE-2012-4399
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack....
Cakefoundation Cakephp 2.1.0Cakefoundation Cakephp 2.1.1Cakefoundation Cakephp 2.1.2Cakefoundation Cakephp 2.1.3Cakefoundation Cakephp 2.1.4Cakefoundation Cakephp 2.2.0Cakefoundation Cakephp 2.2.0-beta
5.5
CVSSv2
CVE-2016-0882
EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue....
Emc Documentum Xcp 2.1Emc Documentum Xcp 2.2
5
CVSSv2
CVE-2013-3160
Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, and Word Viewer allow remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE)...
Microsoft Office 2003Microsoft Office 2007Microsoft Word 2003Microsoft Word 2007Microsoft Word Viewer
5
CVSSv2
CVE-2013-4295
The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue....
Apache Shindig 2.5.0
5
CVSSv2
CVE-2015-0133
IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue....
Ibm Websphere Commerce 7.0
4.3
CVSSv2
CVE-2014-3529
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue....
Apache Poi 0.1Apache Poi 0.2Apache Poi 0.3Apache Poi 0.4Apache Poi 0.5Apache Poi 0.6Apache Poi 0.7Apache Poi 0.10.0Apache Poi 0.11.0Apache Poi 0.12.0Apache Poi 0.13.0Apache Poi 0.14.0Apache Poi 1.0.0Apache Poi 1.0.1Apache Poi 1.0.2Apache Poi 1.1.0Apache Poi 1.2.0Apache Poi 1.5Apache Poi 1.5.1Apache Poi 1.7Apache Poi 1.8Apache Poi 1.10Apache Poi 2.0Apache Poi 2.5Apache Poi 2.5.1Apache Poi 3.0Apache Poi 3.0.1Apache Poi 3.0.2Apache Poi 3.1Apache Poi 3.2Apache Poi 3.5Apache Poi 3.6Apache Poi 3.7Apache Poi 3.8Apache Poi 3.9Apache PoiApache Poi 3.10
6.8
CVSSv2
CVE-2015-7400
The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue....
Ibm Mashups Center 3.0.0.1
5
CVSSv2
CVE-2016-3255
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka ".NET...
Microsoft .net Framework 2.0Microsoft .net Framework 3.5Microsoft .net Framework 3.5.1Microsoft .net Framework 4.5.2Microsoft .net Framework 4.6Microsoft .net Framework 4.6.1
4.3
CVSSv2
CVE-2016-6408
Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCvb17814....
Cisco Prime Home 5.2.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2021-1647CVE-2021-20491CVE-2021-28310CVE-2021-30487CVE-2021-21087XPath injectionbrute forceCVE-2020-7308remote attackers
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook