CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- ibm websphere application serverIBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity...7.1 High
- charlesproxy charlesAn XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option...8.6 High
- cisco energy management suite, energy management suite software +1 moreCisco Energy Management Suite XML External Entity Vulnerability6.3 Medium
- apache syncopeImproper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core7.2 High
- zohocorp manageengine network configuration manager, manageengine opmanager +1 moreAn XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network...7.5 High
- ibm rational engineering lifecycle managerIBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable...7.1 High
- ibm daeja viewoneIBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity...7.1 High
- sauter-controls case suiteAn XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter...7.5 High
- douchatAn XXE issue was discovered in Douchat 4.0.4 because Data\notify.php calls simplexml_load_string....7.5 High
- arcserve udpAn issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is...7.5 High
- ibm security key lifecycle managerIBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity...7.1 High
- ibm filenet content managerIBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to a XML External Entity Injection (XXE...7.1 High
- eclipse vert.x, the eclipse foundation eclipse vert.x +1 moreModerate severity vulnerability that affects io.vertx:vertx-core9.8 Critical
- microsoft sql server management studio 17.9, sql server management studio 18.0, sql server management studio +2 moreAn information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS)...5.5 Medium
- microsoft sql server management studio 17.9, sql server management studio 18.0, sql server management studio +2 moreAn information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS)...5.5 Medium
- microsoft sql server management studio 17.9, sql server management studio 18.0, sql server management studio +2 moreAn information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS)...5.5 Medium
- microsoft windows 10, windows 10 servers, windows 7 +8 more +10 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- apache tikaApache Tika is vulnerable to entity expansions which can lead to a denial of service attack7.5 High
- we-con levistudiouAn XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the...8.8 High
- we-con pi studio, pi studio hmi +1 moreIn WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2...5.3 Medium
- cisco secure access control server solution engine (acse), secure access control server solution engine +1 moreCisco Secure Access Control Server XML External Entity Injection Vulnerability5.7 Medium
- ibm platform symphony, spectrum symphony +1 moreIBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are...7.1 High
- suse linux smt, suse subscription management tool +1 moreExternal Entity processing in the RegistrationSharing module6.5 Medium
- informationbuilders data quality suiteAn XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1...9.8 Critical
- javamelody project javamelodyJavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.9.8 Critical
- ibm datapower gateway cd, datapower gateway, datapower gateways +2 moreIBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1...7.1 High
- ibm rational engineering lifecycle managerIBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable...7.1 High
- ibm rational engineering lifecycle managerIBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through...7.1 High
- symantec messaging gatewayThe Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external...8.8 High
- apache tika, oracle business process management suite +1 moreHigh severity vulnerability that affects org.apache.tika:tika-core7.5 High
- opcfoundation ua-.net-legacy, ua-java +1 moreAn XXE vulnerability in the OPC UA Java and .NET Legacy Stack can allow remote attackers to...8.2 High
- microsoft windows 10, windows 10 servers, windows 7 +8 more +10 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- fspro event log explorerFsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.3.3 Low
- openmrs html form entry, reference application +1 moreAn XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in...9.8 Critical
- pdf-xchange editorPDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service ...7.5 High
- xovis pc2 firmware, pc2r firmware, pc3 firmware +2 moreXovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.4.9 Medium
- ca technologies ppm, broadcom project portfolio management +1 moreAn XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15...9.1 Critical
- ca technologies ppm, broadcom project portfolio management +1 moreAn XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15...7.5 High
- episerverXML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote...7.5 High
- apache cayenneXML External Entity Reference in Apache Cayenne8.1 High
- jabrefJabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML...10.0 Critical
- gchq stroomStroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can...10.0 Critical
- eclipse rdf4jEclipse RDF4j vulnerable to XML External Entity10.0 Critical
- latexdraw project latexdrawLatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing...9.6 Critical
- vuze bittorrent clientIn Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is...9.8 Critical
- plex media serverIn Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is...9.8 Critical
- dell data protection advisor, emc data protection advisor, emc integrated data protection appliance +1 more +3 moreDell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data...8.1 High
- tibco activematrix businessworks, activematrix businessworks distribution for tibco silver fabric, tibco software inc. activematrix businessworks for z/linux +2 moreTIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability7.5 High
- hewlett packard enterprise aruba airwave, hp airwave +1 moreAruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external...8.8 High
- spirton universal media serverIn Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is...9.8 Critical
- Show moreLoading…