CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- digitalguardian management consoleDigital Guardian Management Console 7.1.2.0015 has an XXE issue.6.5 Medium
- vertiv watchdog consoleXML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote...4.9 Medium
- ibm rational clearquestMultiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest...7.1 High
- ibm rational clearcaseMultiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2)...9.1 Critical
- check point software technologies ltd. eclipse, eclipse ide +1 moreEclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an...7.5 High
- symantec management console, symantec corporation itms +1 moreThe Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7...8.0 High
- apache solr, debian linux +1 moreThere is a XML external entity expansion (XXE) vulnerability in Apache Solr7.5 High
- ibm datapower gateways, datapower gateway +1 moreIBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML...7.1 High
- wiremockAn XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to...9.1 Critical
- ibm connectionsXML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0...6.5 Medium
- opencartThe Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows...9.8 Critical
- trend micro email encryption gatewayAn XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5...4.3 Medium
- redwood sap business process automation, sap se business process automation (bpa) by redwood +1 moreSAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document...5.4 Medium
- red hat spacewalk, redhat satellite +1 moreSpacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially...7.5 High
- microsoft windows 10, windows 7, windows 8.1 +5 more +7 moreWindows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows...3.1 Low
- scilico i\, librarianI Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE)...10.0 Critical
- textpatterntextpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature...7.5 High
- freeplane, debian linux +1 moreFreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML...5.5 Medium
- aurea jive-nThe Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for...6.5 Medium
- ibm infosphere information serverXML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3...5.4 Medium
- schneider electric se pelco sarix professional, schneider-electric ibp1110-1er firmware, ibp219-1er firmware +18 more +20 moreA XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component...8.8 High
- ibm financial transaction managerXML external entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for ACH...4.3 Medium
- cisco secure access control server solution engineA vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior...3.3 Low
- cisco secure access control server solution engineA vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior...3.3 Low
- netiq identity manager, identity manager plug-ins +1 moreiManager - XML External Entity vulnerabilities5.4 Medium
- jgraph mxgraphmxGraph vulnerable to XXE attacks9.8 Critical
- microfocus project and portfolio management centerXML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center,...9.8 Critical
- ibm control center, financial transaction manager, transformation extender advanced +2 moreIBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and...7.1 High
- ibm forms experience builderXML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6...2.7 Low
- hewlett packard enterprise aruba clearpass policy managerAn arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x...8.1 High
- sap internet graphics serverUnder certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53,...7.5 High
- sap internet graphics serverUnder certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53,...7.5 High
- jenkins junitImproper Restriction of XML External Entity Reference in Jenkins JUnit Plugin8.3 High
- jenkins android lintXXE vulnerability in Jenkins Android Lint Plugin8.3 High
- jenkins ccmJenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference8.3 High
- trend micro control managerA external entity processing information disclosure (XXE) vulnerability in Trend Micro Control...6.5 Medium
- apache juddiApache juddi-client vulnerable to XML External Entity (XXE)8.1 High
- extremewireless wingAn issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x...7.5 High
- micro focus fortify audit workbench (awb) and micro focus fortify software security center (ssc), microfocus fortify audit workbench, fortify software security center +2 moreMFSBGN03797 rev.1 - Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), XML External Entity Injection7.3 High
- sugarcrmXML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17...9.8 Critical
- ibm content navigatorIBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack...8.2 High
- asus dsl-ac51 firmware, dsl-ac52u firmware, dsl-ac55u firmware +13 more +15 moreMultiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL...6.5 Medium
- jenkins warningsXXE vulnerability Jenkins Warnings Plugin8.8 High
- jenkins findbugsXML External Entity Reference in Jenkins FindBugs Plugin8.8 High
- jenkins dryXXE vulnerability in Jenkins DRY Plugin8.8 High
- jenkins checkstyleXXE vulnerability in Jenkins Checkstyle Plugin8.8 High
- jenkins pmdXXE vulnerability in Jenkins PMD Plugin8.8 High
- cisco webex meetings serverA vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to...5.3 Medium
- cisco anyconnect secure mobility clientA vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow...4.4 Medium
- ibm rational team concert, rational collaborative lifecycle management, rational doors next generation +5 more +7 moreXML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7...6.5 Medium
- Show moreLoading…