CVE-2021-44477

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.

• CWE-611
• CWE-611

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01Mitigation, Third Party Advisory, US Government Resource
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01Mitigation, Third Party Advisory, US Government Resource

Published

Mar 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44466Bitmask Riseup VPN 0.21.6 contains a local privilege escalat…7.3
• CVE-2021-44467A broken access control vulnerability in the KillDupUsr_func…7.5
• CVE-2021-4447The Essential Addons for Elementor plugin for WordPress is …8.8
• CVE-2021-44470Incorrect default permissions for the Intel(R) Connect M And…5.5
• CVE-2021-44471DIAEnergie Version 1.7.5 and prior is vulnerable to stored c…6.1
• CVE-2021-44476A sandboxing issue in Odoo Community 15.0 and earlier and Od…6.8
• CVE-2021-44478A vulnerability has been identified in Polarion ALM (All ver…6.1
• CVE-2021-44479NXP Kinetis K82 devices have a buffer over-read via a crafte…5.5
• CVE-2021-4448The Kaswara Modern VC Addons plugin for WordPress is vulnera…9.8
• CVE-2021-44480Wokka Lokka Q50 devices through 2021-11-30 allow remote atta…8.1
• CVE-2021-44481An issue was discovered in YottaDB through r1.32 and V7.0-00…7.5
• CVE-2021-44482An issue was discovered in YottaDB through r1.32 and V7.0-00…7.5