CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- sap netweaver application server javaXML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows...6.5 Medium
- ibm bigfix family, bigfix platform +1 moreIBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when...6.5 Medium
- apache slingXML External Entity Reference in Apache Sling9.8 Critical
- apache openmeetingsApache OpenMeetings does not correctly validate uploaded XML documents10.0 Critical
- xmlsec project xmlsecxmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted...7.1 High
- logicaldocLogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.8.8 High
- microsoft windows 10, windows 7, windows 8.1 +5 more +7 moreWindows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows...5.5 Medium
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreWindows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,...6.5 Medium
- ibm security guardiumIBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when...7.1 High
- xoev osci transport libraryAn XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library...9.8 Critical
- ibm api connectIBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when...8.2 High
- cisco evolved programmable network manager, prime infrastructure +1 moreA vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved...8.0 High
- xmlsoft libxml2, debian linux, google android +3 more +5 moreA flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the...9.8 Critical
- libexpat project libexpat, debian linux, python +2 moreXML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows...7.5 High
- citrix xenmobile serverXML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3...7.5 High
- eclipse jetty, debian linux, oracle communications cloud native core policy +4 more +6 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 High
- ibm rational rhapsody design managerIBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External...8.1 High
- ibm cognos business intelligenceIBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an...6.5 Medium
- milton webdavXML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.9.8 Critical
- juniper junos spaceAn XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to...6.5 Medium
- hitachi device managerXXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager...6.5 Medium
- sap business oneSAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE)...9.6 Critical
- sap netweaver application server javaThe Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote...8.8 High
- ibm sdk, runtimes for java technology +1 moreIBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when...8.2 High
- schneider-electric wonderware historian clientAn Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware...6.6 Medium
- red hat, inc. jboss enterprise application platformIt was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform...9.8 Critical
- ibm rational collaborative lifecycle management, rational quality manager, rational team concert +2 moreIBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity...8.1 High
- ibm websphere cast iron solution, ibm corporation websphere cast iron cloud integration +1 moreIBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused...8.6 High
- ibm urbancode deployIBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an...8.1 High
- modified-shop modified ecommerce shopsoftwarewww.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht...10.0 Critical
- oracle peoplesoft enterprise peopletools, oracle corporation peoplesoft enterprise pt peopletools +1 moreVulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products ...6.5 Medium
- watchguard firewareWatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity ...5.3 Medium
- apache batikImproper Restriction of XML External Entity Reference in Apache Batik7.3 High
- apache software foundation fop, apache formatting objects processor +1 moreImproper Restriction of XML External Entity Reference in Apache FOP7.3 High
- fasterxml jackson-dataformat-xmljackson-dataformat-xml vulnerable to server side request forgery (SSRF)8.6 High
- moxa mx-aopc serverXML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file...5.0 Medium
- dell integrated remote access controller firmwareDell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.9.8 Critical
- apache igniteModerate severity vulnerability that affects org.apache.ignite:ignite-core5.9 Medium
- ibm rational collaborative lifecycle management, rational doors next generation, rational engineering lifecycle manager +4 more +6 moreIBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity...8.1 High
- ibm curam social program management, cram social program management +1 moreIBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by...9.1 Critical
- synacor zimbra collaboration suiteZimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External...9.8 Critical
- usb pratirodh project pratirodhUSB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data...9.8 Critical
- netiq access manager, opentext netiq access manager +1 moreNetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML...5.5 Medium
- netiq access manager, opentext netiq access manager +1 moreExternal Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access...5.5 Medium
- juniper junos spaceXML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.6.5 Medium
- cisco webex meetings serverAn XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated,...6.5 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection ...8.1 High
- pysaml2 project pysaml2PySAML2 XML external entity attack9.0 Critical
- grails pdf pluginXML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read...5.9 Medium
- ibm rational rhapsody design managerIBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External...8.1 High
- Show moreLoading…