CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- adobe experience managerAdobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection...7.5 High
- adobe experience managerAdobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection...7.5 High
- eclipse wild web developer, theia xml extension project xml extension, xml language server project server project +2 moreXML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka...8.8 High
- apache poi, oracle application testing suite, banking enterprise originations +24 more +26 moreImproper Restriction of XML External Entity Reference in Apache POI5.5 Medium
- jenkins 360 fireline, jenkins project 360 fireline plugin +1 moreJenkins 360 FireLine Plugin vulnerable to XML External Entity Reference8.1 High
- xnatWUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.6.5 Medium
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +9 more +11 moreA remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser...8.8 High
- cisco unified communications managerCisco Unified Communications Manager XML External Expansion Vulnerability6.1 Medium
- hcltech appscan sourceHCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple...7.1 High
- trend micro deep security, vulnerability protection, trend micro, inc. micro deep security +1 more +3 moreTrend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable...4.9 Medium
- limesurveyAn XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote...8.8 High
- lenovo xclarity administrator (lxca), xclarity integrator (lxci) for microsoft system center, xclarity integrator (lxci) for vmware vcenter +2 more +4 moreAn XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity...5.3 Medium
- citrix storefront serverCitrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 ...7.5 High
- webminxmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin...6.5 Medium
- tableau desktop, public desktop, reader +1 more +3 moreNumerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data...7.1 High
- ibm security access manager for enterprise single sign-onIBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External...8.2 High
- zenossThe XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information...7.5 High
- ibm business automation workflow, business process manager +1 moreIBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is...7.1 High
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity...7.1 High
- ibm infosphere global name management, infosphere identity insight +1 moreIBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0...7.1 High
- ibm intelligent operations center, intelligent operations center for emergency management, water operations for waternamics +2 moreIBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity...7.1 High
- kbrw sweet xmlInline DTD allows XML bomb attack7.5 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1703 +29 more +31 moreXmlLite Runtime Denial of Service Vulnerability5.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1703 +29 more +31 moreMS XML Remote Code Execution Vulnerability7.5 High
- sap enable nowThe XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened...5.4 Medium
- zohocorp manageengine assetexplorerZoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE)...8.5 High
- 3cxAn issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through...7.5 High
- ttpsc the schedulerThe Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly...7.5 High
- cpanelcPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).6.3 Medium
- ibm daeja viewoneIBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML...7.1 High
- ibm i2 analyst's notebook, i2 intelligent analysis platform +1 moreIBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity...7.1 High
- ahsay cloud backup suiteAn issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of...7.5 High
- ahsay cloud backup suiteAn issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator...7.2 High
- axway securetransportAxway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is...9.8 Critical
- softwareag quartz, apache tomee, atlassian jira service management +28 more +30 moreXML external entity injection in Terracotta Quartz Scheduler9.8 Critical
- mitsubishi electric fr configurator2, mitsubishielectric electric fr configurator2 firmware +1 moreMitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered...5.5 Medium
- oracle hyperion planningVulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent:...4.2 Medium
- jeesiteJeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information...6.5 Medium
- adobe campaignAdobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of...7.5 High
- ladonImproper Restriction of XML External Entity Reference in ladon9.8 Critical
- nsa ghidraNSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported,...9.1 Critical
- intersystems cacheIntersystems Cache 2017.2.2.865.0 allows XXE.6.4 Medium
- mailenableMailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks...9.8 Critical
- opencatslib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files...7.5 High
- codeigniter-restserver project codeigniter-restserverCodeIgniter Rest Server XXE Vulnerability9.8 Critical
- debian linux, lemonldap-ng lemonldap\ +1 moreLemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification...8.1 High
- libexpat project libexpat, canonical ubuntu linux, debian linux +9 more +11 moreIn libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of...7.5 High
- dotnetblogengine blogengine.netBlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to...7.5 High
- dotnetblogengine blogengine.netBlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.7.5 High
- cisco security managerCisco Security Manager XML Entity Expansion Vulnerability6.5 Medium
- Show moreLoading…