CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- ibm app connect, integration bus, websphere message broker +2 moreIBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13,...5.3 Medium
- princexmlPrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against...8.6 High
- broadcom spring batch, spring batch +1 moreSpring Batch XML External Entity Injection (XXE)9.8 Critical
- broadcom spring web services, spring web services, oracle financial services analytical applications infrastructure +1 more +3 moreSpring Web Services XML External Entity Injection (XXE)9.8 Critical
- spring integration, vmware spring integration, oracle retail customer management and segmentation foundation +2 moreSpring Integration XML External Entity Injection (XXE)9.8 Critical
- atlassian universal plugin managerThe Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows...6.5 Medium
- ibm security identity managerIBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity...7.1 High
- sas web infrastructure platformBI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.7.5 High
- mailenableMailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.10.0 Critical
- japan computer emergency response team coordination center (jpcert/cc) logontracerLogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity (XXE)...8.8 High
- traccar serverIn Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.9.8 Critical
- apache karafXML External Entity Reference in Apache Karaf9.8 Critical
- wxjava project wxjavaXML External Entity Reference in weixin-java-tools9.8 Critical
- zohocorp manageengine adselfservice plusZoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.9.8 Critical
- sdl web content managerThe SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that...6.5 Medium
- fasterxml jackson-databind, debian linux, oracle banking platform +9 more +11 moreXML External Entity Reference (XXE) in jackson-databind9.8 Critical
- logisim-evolution project logisim-evolutionLogisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability...8.8 High
- schneider electric se iiot monitor 3.1.38, schneider-electric iiot monior +1 moreAn Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous...7.5 High
- mchange c3p0, debian linux +1 moreXML External Entity Reference in mchange:c3p09.8 Critical
- wxjava project wxjavaAn issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the...9.8 Critical
- elastic elasticsearchImproper Restriction of XML External Entity Reference in Elasticsearch5.9 Medium
- squareup retrofitXML External Entity (XXE) vulnerability in Square Retrofit9.1 Critical
- processingProcessing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE)...6.5 Medium
- sleuthkit autopsyautopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML...10.0 Critical
- obeo uml designerUML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser...10.0 Critical
- apereo bw-calendar-engineXML External Entity (XXE) vulnerability in bw-calendar-engine9.0 Critical
- keepassdx keepass dxKeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx...10.0 Critical
- runeliterunelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in...9.0 Critical
- k9mail k-9 mailK9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response...10.0 Critical
- xr3player project xr3playerXR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser...10.0 Critical
- anyplace project anyplaceAnyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man...9.0 Critical
- frostwireFrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE)...9.0 Critical
- freecolFreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in...10.0 Critical
- exist-db existexist-db:exist-core XML External Entity (XXE) vulnerability10.0 Critical
- codelibs fessXML External Entity (XXE) vulnerability in codelibs fess10.0 Critical
- micromathematics project micromathematicsMicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability...10.0 Critical
- neo4j awesome procedures on cyperXML External Entity (XXE) vulnerability in neo4j.procedure:apoc10.0 Critical
- s3browser s3 browserS3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote...6.5 Medium
- openrefineThe data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE)...7.5 High
- ibm operational decision management, operational decision manager +1 moreIBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External...7.1 High
- sap netweaver application server java, netweaver application server (java library) +1 moreSAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents...7.1 High
- pippoImproper Restriction of XML External Entity Reference in pippo-core9.8 Critical
- accusoft prizmdocAccusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE)...9.1 Critical
- apereo bw-webdavImproper Restriction of XML External Entity Reference in bedework:bw-webdav7.5 High
- arubanetworks clearpass policy manager, hewlett packard enterprise aruba clearpass policy manager +1 moreIn Aruba ClearPass, disabled API admins can still perform read/write operations. In certain...8.1 High
- ibm marketing platformIBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable to a XML External Entity Injection ...7.1 High
- ibm marketing platformIBM Marketing Platform 9.1.0, 9.1.2, and 10.1 is vulnerable to a XML External Entity Injection ...7.1 High
- ge cimplicityXXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.09.1 Critical
- solarwinds sftp\/scp serverSolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and...9.1 Critical
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection (XXE) attack when...7.1 High
- Show moreLoading…