CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- ibm security key lifecycle managerIBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity...8.1 High
- xmlbundle project xmlbundleXXE Vulnerability in XMLBundle 0.1.77.5 High
- androidsvg project androidsvgAndroid SVG vulnerable to XML External Entity (XXE)7.8 High
- pepperminty-wiki project pepperminty-wikiPepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting...9.8 Critical
- commsyCommsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality...8.8 High
- lightbend play frameworkXML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2...9.8 Critical
- changehealthcare conserus image repositoryA security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image...9.8 Critical
- adobe coldfusionAdobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4...7.5 High
- restletRestlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request7.5 High
- restletRestlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider7.5 High
- simplexml project simplexml, apache solr +1 moreSimpleXML has XML External Entity (XXE) vulnerability9.1 Critical
- tablepressTablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks...4.3 Medium
- ibm security access manager, security access manager 9.0 firmware +1 moreIBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE...8.1 High
- itextpdf itextImproper Restriction of XML External Entity Reference in iText8.8 High
- apache activemqImproper Restriction of XML External Entity Reference in Apache ActiveMQ9.8 Critical
- apache activemq apolloApache ActiveMQ Apollo XXE Vulnerability9.8 Critical
- apache xml-rpcApache XML-RPC XXE Vulnerability7.8 High
- getmura mura cmstasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access...6.5 Medium
- mediawikiThe getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote...9.8 Critical
- apache solr, canonical ubuntu linux, debian linux +1 more +3 moreRemote code execution occurs in Apache Solr9.8 Critical
- juniper contrailContrail: XML External Entity (XXE) vulnerability5.0 Medium
- umbraco cmsUmbraco CMS XXE Vulnerability5.5 Medium
- apache nifiXML External Entity Reference in Apache NiFi6.5 Medium
- lansweeperXML external entity (XXE) vulnerability in the import package functionality of the deployment...9.9 Critical
- apache rollerThe XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML...9.8 Critical
- opentext document sciences xpressionOpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 ...9.8 Critical
- apache opennlpImproper Restriction of XML External Entity Reference in Apache OpenNLP9.8 Critical
- apache tikaApache Tika does not properly initialize the XML parser or choose handlers7.8 High
- opentext documentum webtop, documentum administrator +1 moreMultiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160...8.8 High
- opentext documentum administrator, documentum webtop +1 moreMultiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2...8.8 High
- apache commons jellyImproper Restriction of XML External Entity Reference in Jelly9.8 Critical
- ibm business process manager, business process manager advanced +1 moreIBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection ...8.1 High
- microsoft windows 7, windows server 2008, microsoft corporation common console document (.msc) +2 moreThe Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2...5.5 Medium
- blackwave dive assistantXXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows...5.5 Medium
- vmware single sign-on for pivotal cloud foundryIn Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x...6.5 Medium
- divinglog diving logXXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml...5.5 Medium
- cisco socialminerA vulnerability in the web-based user interface of Cisco SocialMiner could allow an...8.8 High
- paloaltonetworks pan-osXML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway...9.8 Critical
- sap netweaverXML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.9.8 Critical
- beaker-project beakerXML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote...4.3 Medium
- ibm qradar network securityIBM QRadar Network Security 5.4 is vulnerable to a XML External Entity Injection (XXE) attack...8.1 High
- automatedlogic i-vu, sitescan web, carrier automatedlogic webctrl +2 moreAn XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5...7.3 High
- ocpfoundation local discovery server, ua .net, siemens simatic pcs7 +1 more +3 moreAn XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21...8.2 High
- adobe digital editionsAdobe Digital Editions 4.5.4 and earlier has a security bypass vulnerability.7.5 High
- apache cxfImproper Restriction of XML External Entity Reference in Apache CXF JAX-RS7.5 High
- ibm sterling b2b integratorIBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection (XXE) attack...8.2 High
- apache winkXML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers...7.4 High
- trendmicro control managerXML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if...7.5 High
- ibm sterling b2b integrator, sterling file gateway +1 moreXML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM...6.5 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity...9.1 Critical
- Show moreLoading…