CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- bubblesoftapps bubbleupnpIn BubbleUPnP 0.9 update 30, the XML parsing engine for SSDP/UPnP functionality is vulnerable to...9.8 Critical
- tufin securetrackAn issue was discovered in Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final). The Audit...9.9 Critical
- axentra hipserv/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and...9.8 Critical
- ibm infosphere information server, infosphere governance catalog, infosphere information server business glossary +2 more +4 moreIBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity...7.1 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1703 +29 more +31 moreWindows Event Viewer Information Disclosure Vulnerability4.7 Medium
- realobjects pdfreactorXXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to...9.1 Critical
- jenkins token macro, jenkins project token macro plugin +1 moreImproper Restriction of XML External Entity Reference Jenkins Token Macro Plugin7.5 High
- dell emc openmanage server administrator, dell emc openmanage server administrator +1 moreXML External Entity (XXE) Injection Vulnerability7.5 High
- jenkins pipeline maven integration, jenkins project pipeline maven integration plugin +1 moreXML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin8.1 High
- synacor zimbra collaboration suiteZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra...9.8 Critical
- synacor zimbra collaboration suite, zimbra collaboration suite (zcs) +1 moremailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML...9.8 Critical
- apache camel, oracle enterprise data quality, enterprise manager base platform +2 more +4 moreXML External Entity injection in Apache Camel7.5 High
- enghouse contact center\ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has...9.8 Critical
- cyberark enterprise password vaultAn XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk...9.8 Critical
- ibm tririga application platformIBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity...7.1 High
- blogengine blogengine.netBlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.9.8 Critical
- zohocorp manageengine firewall analyzerThe Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224...9.8 Critical
- jenkins project self-organizing swarm plug-in modules plugin, jenkins self-organizing swarm modules +1 moreJenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response9.3 Critical
- nopcommerceLibraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE...4.9 Medium
- printeronAn XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote...7.7 High
- eclipse jetty, the eclipse foundation eclipse jetty, apache activemq +5 more +7 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations6.1 Medium
- kofax front office serverAn XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console...6.5 Medium
- blackberry uem, unified endpoint management +1 moreAn XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12...7.5 High
- apache pdfbox, james, fedoraproject fedora +11 more +13 moreVulnerability that affects org.apache.pdfbox:pdfbox9.8 Critical
- sap hanaSLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML...6.0 Medium
- microsoft windows, windows server, windows 10 +7 more +9 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- microsoft windows, windows server, windows 10 +7 more +9 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- microsoft windows, windows server, windows 10 +7 more +9 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- microsoft windows, windows server, windows 10 +7 more +9 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- microsoft windows, windows server, windows 10 +6 more +8 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- eclipse kura, the eclipse foundation eclipse kura +1 moreIn Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis...7.5 High
- microsoft windows, windows server, windows 10 +7 more +9 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- airsonic project airsonicXXE issue in Airsonic before 10.1.2 during parse.9.8 Critical
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 5.2.0 snf 6.0.0.0 is vulnerable to an XML External...7.1 High
- atlassian application linksThe OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before...8.7 High
- atlassian crowdThe administration backup restore resource in Atlassian Crowd before version 3.0.2 and from...6.5 Medium
- hp arcsight loggerMitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.7.1 High
- zohocorp manageengine servicedesk plusManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items...8.8 High
- blackberry athocAn XML External Entity Injection (XXE) vulnerability in the Management System (console) of...5.9 Medium
- diffplug gradle, maven +1 moreImproper Restriction of XML External Entity Reference in DiffPlug Spotless7.5 High
- phpsheAn XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or...7.5 High
- sap hana extended application servicesSAP HANA extended application services, version 1, advanced does not sufficiently validate an XML...6.5 Medium
- nablarch project nablarch, tis inc. nablarch 5 +1 moreNablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE)...9.1 Critical
- checkstyle, debian linux, fedoraproject fedora +2 moreModerate severity vulnerability that affects com.puppycrawl.tools:checkstyle5.3 Medium
- cisco iot field network director, iot field network director (iot-fnd) +1 moreCisco IoT Field Network Director XML External Entity Vulnerability4.9 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External...7.1 High
- sap advanced business application programming platform kernel, advanced business application programming platform krnl32nuc, advanced business application programming platform krnl32uc +7 more +9 moreSLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a...4.9 Medium
- pmd project pmdImproper Restriction of XML External Entity Reference in PMD8.1 High
- jenkins job import, jenkins project job import plugin +1 moreXXE vulnerability in Jenkins Job Import Plugin9.1 Critical
- ibm security identity manager, security access manager +1 moreIBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack...7.1 High
- Show moreLoading…