CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins rundeck, jenkins project rundeck plugin +1 moreXXE vulnerability in Rundeck Plugin7.1 High
- jenkins cobertura, jenkins project cobertura plugin +1 moreXXE vulnerability in Jenkins Cobertura Plugin7.1 High
- sap netweaver application servernwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks...6.4 Medium
- smartclientAn issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur...9.8 Critical
- red hat spacewalkA flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity...8.6 High
- lenovo xclarity administrator (lxca), xclarity administrator +1 moreAn XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity...5.7 Medium
- palo alto networks pan-osMissing XML Validation in PAN-OS Web Interface6.8 Medium
- sap se netweaver (guided procedures), sap netweaver guided procedures +1 moreSAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not...4.9 Medium
- jenkins fitnesse, jenkins project fitnesse plugin +1 moreXXE vulnerability in FitNesse Plugin8.8 High
- jenkins nunit, jenkins project nunit plugin +1 moreXXE vulnerability in NUnit Plugin8.8 High
- owncloud, owncloud server +1 moreZend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote...9.8 Critical
- opwebapipluginopWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities9.8 Critical
- checkstyleXML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))5.3 Medium
- jenkins websphere deployer, jenkins project websphere deployer plugin +1 moreXXE vulnerability in Jenkins WebSphere Deployer Plugin7.6 High
- ibm security access manager appliance, security access manager +1 moreIBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection ...7.1 High
- openpneOpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection...9.1 Critical
- cloudbees jenkins, jenkins cloudbees, cloudbees jenkins lts +2 moreXML external entity (XXE) vulnerability in Jenkins7.5 High
- cloudbees jenkins, jenkins cloudbees, cloudbees jenkins lts +2 moreXML external entity (XXE) vulnerability in Jenkins7.5 High
- jenkins robot framework, jenkins project robot framework plugin +1 moreXXE vulnerability in Jenkins Robot Framework Plugin8.8 High
- jetbrains idetalkJetBrains IDETalk plugin before version 193.4099.10 allows XXE7.5 High
- pyamfPyAMF vulnerable to XML external entity (XXE)7.1 High
- open-xchange appsuiteXML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6...7.8 High
- yet another java service wrapper project another java service wrapperAn XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in...9.1 Critical
- mozilla firefox, canonical ubuntu linux +1 moreIf an XML file is served with a Content Security Policy and the XML file includes an XSL...6.5 Medium
- cisco data center network managerCisco Data Center Network Manager XML External Entity Read Access Vulnerability4.9 Medium
- determine contract lifecycle managementAn issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in...4.9 Medium
- dell rsa authentication managerRSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability...6.5 Medium
- xmlblueprintXMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is:...8.1 High
- edit-xml easy xml editorEasy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is:...8.1 High
- xiuno xiunobbsXiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.7.5 High
- talend restletAn XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport,...7.5 High
- jenkins maven, jenkins project maven release plugin +1 moreJenkins Maven Release Plug-in Plugin XXE vulnerability8.1 High
- eclipse foundation jerseyjersey: XXE via parameter entities7.5 High
- modoboa modoboa-dmarcModoboa is vulnerable to an XML External Entity Injection (XXE)7.5 High
- bmc remedy smart reportingBMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One...6.5 Medium
- apache olingoImproper Restriction of XML External Entity Reference in Apache Olingo5.5 Medium
- php, zend framework, zendframework +1 more +3 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpc9.8 Critical
- apache ofbizThe /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External...7.5 High
- apache nifiApache NiFi information disclosure by XXE6.5 Medium
- micro focus international operations agentXXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12...6.5 Medium
- raritan commandcenter secure gatewayAn XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan...9.8 Critical
- fasterxml jackson-mapper-asl, apache spark, debian linux +2 more +4 moreImproper Restriction of XML External Entity Reference in jackson-mapper-asl5.9 Medium
- sas xml mapper, base sas +1 moreSAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by...10.0 Critical
- hornetq rest rest, redhat hornetq +1 moreHornetQ REST vulnerable to Improper Restriction of XML External Entity Reference6.5 Medium
- phpoffice phpspreadsheetXXE in PHPSpreadsheet due to incomplete fix for previous encoding issue8.8 High
- adobe systems incorporated magento 2, magento +1 moreInformation disclosure through processing of external XML entities4.9 Medium
- advantech wise-paas\/rmmAdvantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow...7.5 High
- labkey serverAn issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the...7.5 High
- devada dzone answerhubAn XML External Entity Injection vulnerability exists in Dzone AnswerHub.7.5 High
- adobe experience managerAdobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection...7.5 High
- Show moreLoading…