CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- cisco secure access control systemAn XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access...4.3 Medium
- eparaksts eparakstitajs 3XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib...7.8 High
- wso2 identity serverXML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0...7.5 High
- python openpyxlImproper Restriction of XML External Entity Reference in Openpyxl8.2 High
- ibm integration bus, websphere message broker +1 moreIBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a...9.1 Critical
- emerson liebert sitescan webAn XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5,...9.8 Critical
- hcl software bigfix inventory, ibm license metric tool +1 moreIBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity...8.1 High
- ibm infosphere information server, infosphere datastage, infosphere information server on cloud +2 moreIBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External...8.1 High
- ibm corporation access manager, ibm security access manager 9.0 firmware, security access manager for mobile 8.0 firmware +1 more +3 moreIBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML...6.5 Medium
- ibm security access manager 9.0 firmware, security access manager for mobile 8.0 firmware, security access manager for web 8.0 firmware +1 more +3 moreIBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information,...9.1 Critical
- paessler prtg network monitorXML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote...6.5 Medium
- pysaml2 project pysaml2, debian linux +1 morePysaml2 does not sanitize XML responses7.5 High
- forgerock openamXML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access...7.5 High
- vmware vrealize automationThe Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and...9.1 Critical
- vmware vcenter serverVMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read...7.7 High
- vmware vsphere clientVMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi...5.8 Medium
- image-info project for perlperl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An...7.1 High
- xmltwig xml-twig for perlperl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity...9.1 Critical
- python-openxml project python-docxImproper Restriction of XML External Entity Reference in python-docx8.8 High
- open-xchange appsuiteAn issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external...4.3 Medium
- ibm filenet workplaceIBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read...8.1 High
- ibm appscan sourceIBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files...8.1 High
- ibm rational collaborative lifecycle management, rational doors next generation, rational engineering lifecycle manager +4 more +6 moreThe XML parser in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0...5.4 Medium
- sap netweaver, netweaver application server java +1 moreBC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML...6.5 Medium
- xmlsoft libxml2, canonical ubuntu linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreCVE-2016-9318 does not affect BellSoft software5.5 Medium
- zend framework, fedoraproject fedora +1 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpc9.8 Critical
- apache derbyImproper Restriction of XML External Entity Reference in Apace Derby9.1 Critical
- ibm security privileged identity manager virtual applianceIBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows...7.1 High
- cisco prime homeCisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document...7.5 High
- adobe coldfusionThe Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update...8.6 High
- apache poiApache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability5.5 Medium
- zend framework, fedoraproject fedora +1 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpc9.8 Critical
- adobe xmp toolkitModerate severity vulnerability that affects com.adobe.xmp:xmpcore7.5 High
- apache pdfbox, debian linux +1 moreHigh severity vulnerability that affects org.apache.pdfbox:pdfbox7.8 High
- fasterxml jackson-dataformat-xml, fedoraproject fedora +1 morejackson-dataformat-xml vulnerable to XML external entity (XXE)9.8 Critical
- php, canonical ubuntu linux, opensuse leap +3 more +5 moreext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not...9.6 Critical
- sap netweaver application server javaXML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1...9.1 Critical
- jenkins, redhat openshift +1 moreJenkins has XML External Entity (XXE) Vulnerability in Job Configuration via CLI5.0 Medium
- zend framework, debian linux +1 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpc9.8 Critical
- doctrine-project annotations, cache, common +7 more +9 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpc7.8 High
- zend frameworkZendframework Local file disclosure via XXE injection in Zend_XmlRpc6.8 Medium
- hp webinspectUnspecified vulnerability in HP WebInspect 7.x through 10.4 before 10.4 update 1 allows remote...4.0 Medium
- apache camelApache Camel XML External Entity vulnerability5.0 Medium
- pivotal spring frameworkImproper Restriction of XML External Entity Reference in Spring Framework8.8 High
- canonical ubuntu linux, debian linux, fedoraproject fedora +2 more +4 moreThe _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option...5.0 Medium
- apache standard taglibs, canonical ubuntu linux +1 moreXXE in Apache Standard Taglibs7.5 High
- redhat resteasyXML External Entity Reference in RESTEasy6.4 Medium
- zend framework, fedoraproject fedora, redhat enterprise linux +2 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpc9.8 Critical
- zabbix, fedoraproject fedora +1 moreXML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1,...9.8 Critical
- zend frameworkZendframework Local file disclosure via XXE injection in Zend_XmlRpc5.0 Medium
- Show moreLoading…