CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- maltegoMaltego before 4.2.12 allows XXE attacks.6.5 Medium
- wso2 api manager, api microgateway +1 moreThe Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML...9.1 Critical
- wso2 api manager, api manager analytics, api microgateway +2 more +4 moreThe Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates....6.5 Medium
- moog exvf5c-2 firmware, exvp7c2-3 firmware +1 moreSeveral XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3...9.1 Critical
- ibm urbancode deployIBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML...8.2 High
- ibm cognos analyticsIBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack...8.2 High
- ibm maximo asset managementIBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection...8.2 High
- samsung open source one, veeam one firmware +1 moreThis vulnerability allows remote attackers to disclose sensitive information on affected...7.5 High
- samsung open source one, veeam one firmware +1 moreThis vulnerability allows remote attackers to disclose sensitive information on affected...7.5 High
- cisco sd-wan vmanage, sd-wan firmware +1 moreCisco SD-WAN vManage Software XML External Entity Vulnerability6.5 Medium
- ibm external authentication server, sterling external authentication server, sterling secure proxy +2 moreIBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling...8.2 High
- inetsoftware i-net clear reportsXXE injection can occur in i-net Clear Reports 2019 19.0.287 (Designer), as used in i-net...9.8 Critical
- eclipse web tools platform, the eclipse foundation eclipse web tools platform, debian linux +2 moreIn all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files...7.1 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when...7.6 High
- rockwellautomation studio 5000 logix designerRockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an...3.3 Low
- eclipse jetty, the eclipse foundation eclipse jetty +1 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations9.4 Critical
- mapfish mapfish-print, print +1 moreXML External Entity attack in mapfish-print9.3 Critical
- mitsubishi electric corporation electoric fa engineering software, mitsubishielectric cpu module logging configuration tool, cw configurator +18 more +20 moreMitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y...7.5 High
- herac tuxguitarAn issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses...7.5 High
- ibi webfocus business intelligenceIn WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to...8.2 High
- open-xchange appsuiteOX App Suite through 7.10.3 allows XXE attacks.6.5 Medium
- wso2 api manager, api microgateway, identity server as key manager +2 moreIn WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5...5.5 Medium
- postgresql jdbc driver, debian linux, fedoraproject fedora +2 more +4 moreImproper Restriction of XML External Entity Reference7.7 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when...7.6 High
- ibm security identity governance and intelligenceIBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity...7.1 High
- palo alto networks pan-osPAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak7.5 High
- apache log4net, fedoraproject fedora, netapp manageability software development kit +4 more +6 moreXML External Entity attack in log4net9.8 Critical
- techsmith snagitIn TechSmith SnagIt before 20.1.1, an XML External Entity (XXE) injection issue exists that would...5.5 Medium
- wso2 api manager, api manager analytics, api microgateway +4 more +6 moreXXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and...8.7 High
- cisco hosted collaboration mediation fulfillmentCisco Hosted Collaboration Mediation Fulfillment XML External Expansion Vulnerability4.9 Medium
- reportportal service-apiXXE vulnerability in Launch import7.5 High
- dom4j project dom4j, canonical ubuntu linux, netapp oncommand api services +35 more +37 moredom4j allows External Entities by default which might enable XXE attacks9.8 Critical
- wso2 enterprise integratorWSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin...4.0 Medium
- jenkins parasoft findings, jenkins project parasoft findings plugin +1 moreXXE vulnerability in Jenkins Parasoft Findings Plugin7.1 High
- sap se commerce, sap commerce cloud +1 moreSAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the...9.3 Critical
- advantech webaccess/nms, webaccess\/nms +1 moreWebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input...7.5 High
- hcltech appscan, ibm corporation hcl appscan standard edition +1 moreHCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing...8.2 High
- jenkins code coverage api, jenkins project code coverage api plugin +1 moreXXE vulnerability in Jenkins Code Coverage API Plugin6.5 Medium
- cipplanner cipaceAn XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated...9.8 Critical
- accenture mercuryAn XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core...9.8 Critical
- mulesoft aplkitWithdrawn Advisory: Improper Restriction of XML External Entity Reference in Mulesoft APIkit9.8 Critical
- azkaban project azkabanAzkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user...9.8 Critical
- osmandOsmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.9.1 Critical
- jenkins rapiddeploy, jenkins project rapiddeploy plugin +1 moreXXE vulnerability in Jenkins RapidDeploy Plugin8.8 High
- rbsoft autoupdater.netAutoUpdater.NET allows XXE9.8 Critical
- svglib project svglibSVGlib Vulnerable to XXE Attacks9.8 Critical
- sync oxygen xml editor, oxygen xml author, oxygen xml developer +2 moreOxygen XML Editor 21.1.1 allows XXE to read any file.7.5 High
- zohocorp manageengine desktop centralAn XML external entity (XXE) vulnerability iin Zoho ManageEngine Desktop Central before the 07...9.8 Critical
- sap netweaver application server java, sap se netweaver application server java (user management engine) +1 moreSAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30,...5.5 Medium
- johnnson controls metasys system configuration tool (sct), johnson controls metasys application and data server (ads, ads-lite), metasys extended application and data server (adx) +20 more +22 moreMetasys Improper Restriction of XML External Entity Reference7.5 High
- Show moreLoading…