CVE-2014-3005

XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.

• CWE-611

• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2014/Jun/87Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/68075Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1110496Issue Tracking, Third Party Advisory
• https://support.zabbix.com/browse/ZBX-8151Exploit, Patch, Vendor Advisory
• https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273Exploit, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2014/Jun/87Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/68075Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1110496Issue Tracking, Third Party Advisory
• https://support.zabbix.com/browse/ZBX-8151Exploit, Patch, Vendor Advisory
• https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273Exploit, Third Party Advisory

Published

Feb 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2995Multiple cross-site scripting (XSS) vulnerabilities in twitg…
• CVE-2014-2996XCloner Standalone 3.5 and earlier, when enable_db_backup an…
• CVE-2014-3000The TCP reassembly function in the inet module in FreeBSD 8.…
• CVE-2014-3001The device file system (aka devfs) in FreeBSD 10.0 before p2…
• CVE-2014-3003Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-3004The default configuration for the Xerces SAX Parser in Casto…
• CVE-2014-3006Sitepark Information Enterprise Server (IES) 2.9 before 2.9.…
• CVE-2014-3007Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 …
• CVE-2014-3008Unitrends Enterprise Backup 7.3.0 allows remote authenticate…
• CVE-2014-3009The GDS component in IBM InfoSphere Master Data Management -…
• CVE-2014-3010Cross-site scripting (XSS) vulnerability in the Web UI in IB…
• CVE-2014-3011IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote …