CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- ocsinventory-ng ocsinventory ngOCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external...9.1 Critical
- jetbrains intellij ideaIntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can...7.5 High
- insteon sap, sap business planning and consolidation +1 moreAn exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC...6.4 Medium
- focalscopeAn exploitable unauthenticated XML external injection vulnerability was identified in FocalScope...9.4 Critical
- apache camelApache is vulnerable to XXE in XSD validation processor9.8 Critical
- [unknown] jboss, redhat jboss enterprise application platform +1 moreIt was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is...8.7 High
- redhat jbpm, kie jbpm-designer, redhat decision manager +1 more +3 moreXML External Entity Reference in jbpmmigration6.5 Medium
- schweitzer engineering laboratories, inc. acselerator architectSEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the...9.8 Critical
- apereo cas serverXML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS...8.8 High
- phpoffice project commonPHPOffice Common Improper Restriction of XML External Entity Reference9.8 Critical
- manageengine applications manager, zohocorp manageengine applications manager +1 moreManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity4.9 Medium
- epubcheckEpubCheck 4.0.1 is vulnerable to external XML entity processing attacks7.8 High
- hp fortify software security centerMFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities7.3 High
- onosproject onosONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE)...9.8 Critical
- onosproject onosONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE)...9.8 Critical
- tencent wechat payWeChat Pay Java SDK allows XXE7.5 High
- ibm content foundation, filenet content manager, filenet p8 platform +2 moreIBM FileNet Content Manager, IBM Content Foundation, and IBM Case Foundation Administration...7.1 High
- apache solr, netapp snapcenter, storage automation store +2 moreXML external entity expansion in org.apache.solr:solr-core5.5 Medium
- dialogic powermedia xmsXML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5...9.1 Critical
- schneider electric se somachine basicSchneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE)...7.5 High
- eclipse jetty, the eclipse foundation eclipse jetty, oracle retail xstore point of service +2 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations5.3 Medium
- [unknown] jboss, redhat jboss enterprise application platform +1 moreIt was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable...9.0 Critical
- umletUmlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can...7.8 High
- triplea-game tripleaTriplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing...7.8 High
- netbeans-mmd-plugin project netbeans-mmd-pluginnetbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD...7.8 High
- loboevolution project loboevolutionLoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity ...7.8 High
- news-articles project news-articlesventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE)...7.5 High
- eclipse jetty, the eclipse foundation eclipse jetty, debian linux +15 more +17 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations9.8 Critical
- eclipse jetty, the eclipse foundation eclipse jetty, debian linux +2 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 High
- carrier automatedlogic webctrlAn XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6...7.5 High
- tibco runtime agent, tibco software inc. runtime agent for z/linux +1 moreXML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent5.8 Medium
- tibco administrator, tibco software inc. administrator - enterprise edition, administrator - enterprise edition for z/linux +2 moreXML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator6.5 Medium
- themidnightcoders weborb for javaThe Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version...9.8 Critical
- exadel flamingo, flamingo amf-serializer +1 moreThe Action Message Format (AMF3) deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages9.8 Critical
- mcafee common ui (cui), common catalog +1 moreExternal Entity Attack vulnerability in McAfee Common UI (CUI)7.6 High
- ibm rational rhapsody design manager, rational software architect design manager +1 moreIBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity...7.1 High
- searchbloxXML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote...9.8 Critical
- jenkins black duck hubXML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin6.5 Medium
- ge mds pulsenet and mds pulsenet enterprise, mds pulsenet +1 moreMultiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the...7.5 High
- citrix xenmobile serverThere is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8...9.8 Critical
- apache nifiImproper Restriction of XML External Entity Reference in Apache NiFi9.8 Critical
- apache solrThere is a XML external entity expansion (XXE) vulnerability in Apache Solr config files5.5 Medium
- adobe coldfusionAdobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have...7.5 High
- igniterealtime user import export, talos open fire user import export plugin +1 moreAn exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2...8.1 High
- modbuspal project modbuspalModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp...5.5 Medium
- broadcom spring data commons, xmlbeam, pivotal software spring data rest +2 moreSpring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references7.5 High
- microsoft .net core, .net framework +1 moreDenial of service vulnerability exists when .NET and .NET Core improperly process XML documents7.5 High
- dell emc rsa authentication manager security console, rsa authentication manager +1 moreRSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External...7.1 High
- dell emc smis, emc solutions enabler virtual appliance, emc unisphere +14 more +16 moreIn Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions...9.8 Critical
- apache uima-as, uimaducc, uimafit +2 more +4 moreImproper Restriction of XML External Entity Reference in Apache uimaj6.5 Medium
- Show moreLoading…