CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity...8.2 High
- apache nutch, netapp snap creator framework +1 moreAn XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser9.1 Critical
- arcserve d2dThis vulnerability allows remote attackers to disclose sensitive information on affected...7.5 High
- microfocus application lifecycle managementXML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management ...8.1 High
- owasp json-sanitizerArbitrary code injection in json-sanitizer9.8 Critical
- siemens jt2go, teamcenter visualization +1 moreA vulnerability has been identified in JT2Go (All Versions < V13.1.0), Teamcenter Visualization ...6.5 Medium
- tibco ebx add-onsTIBCO EBX EXML External Entity7.1 High
- sap se epm add-in for microsoft office, epm add-in for sap analysis office, sap enterprise performance management +2 moreSAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office,...3.6 Low
- ibm security verify privilege managerIBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE...5.7 Medium
- ploneImproper Restriction of XML External Entity Reference in Plone8.8 High
- ploneImproper Restriction of XML External Entity Reference in Plone8.8 High
- nokogiri, debian linux +1 moreXXE in Nokogiri2.6 Low
- kronos web time and attendanceAn XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.9.8 Critical
- zimbra collaborationIn Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists...6.5 Medium
- sonatype nexus repository managerSonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to...6.5 Medium
- intland codebeamerAn issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used...5.5 Medium
- jenkins cvs, jenkins project cvs plugin +1 moreXXE vulnerability in Jenkins CVS Plugin7.5 High
- petl project petlDuplicate Advisory: XML Injection in petl9.8 Critical
- typo3, typo3 typo3.cms +1 moreXML External Entity in Dashboard Widget3.7 Low
- schneider-electric webreportsA CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in...8.8 High
- avaya weblm, aura system manager, system manager +2 moreAvaya WebLM Improper Restriction of XML External Entity Reference6.5 Medium
- intel quartus primeImproper Restriction of XML External Entity Reference in subsystem forIntel(R) Quartus(R) Prime...7.5 High
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML...4.9 Medium
- jenkins visualworks store, jenkins project visualworks store plugin +1 moreXXE vulnerability in Jenkins Visualworks Store Plugin6.5 Medium
- jenkins mercurial, jenkins project mercurial plugin +1 moreXXE vulnerability in Jenkins Mercurial Plugin6.5 Medium
- jenkins subversion, jenkins project subversion plugin +1 moreXXE vulnerability in Jenkins Subversion Plugin6.5 Medium
- ivanti connect secure, policy secure, pulsesecure pulse connect secure +1 more +3 moreAn XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse...7.2 High
- eclipse jetty, the eclipse foundation eclipse jetty, apache beam +16 more +18 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.0 High
- we-con levistudiouAn XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing...7.5 High
shopware/corePackagist,shopware/platformPackagist +1 moreAuthenticated XML External Entity Processing5.6 Medium- apache iotdb, fasterxml jackson-databind, fedoraproject fedora +36 more +38 moreXML External Entity (XXE) Injection in Jackson Databind7.5 High
- ibm curam social program management, curam spm +1 moreAn XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program...7.1 High
- jenkins nerrvana, jenkins project nerrvana plugin +1 moreXXE vulnerability in Jenkins Nerrvana Plugin6.5 Medium
- apache nifiImproper Restriction of XML External Entity Reference in Apache NiFi5.5 Medium
- haloThere is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing...9.1 Critical
- ivanti connect secure, pulsesecure pulse connect secure +1 moreA vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an...4.9 Medium
- jenkins liquibase runner, jenkins project liquibase runner plugin +1 moreXXE vulnerability in Jenkins Liquibase Runner Plugin7.1 High
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity...7.5 High
- ozeki ng sms gatewayAn issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes...7.5 High
- gradle enterpriseAn issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. There is XXE with resultant SSRF...4.9 Medium
- dotplant dotplant2DotPlant2 Improper Restriction of XML External Entity Reference7.5 High
- yworks yedyWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document.9.8 Critical
- apache cocoonWhen using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML,...7.5 High
- hyland onbaseAn issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. It...9.8 Critical
- nec expresscluster, expresscluster x +1 moreThis vulnerability allows remote attackers to disclose sensitive information on affected...7.5 High
- yaws, canonical ubuntu linux, debian linux +2 moreWebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.9.8 Critical
- jenkins klocwork analysis, jenkins project klocwork analysis plugin +1 moreXXE vulnerability in Jenkins Klocwork Analysis Plugin6.5 Medium
- jenkins valgrind, jenkins project valgrind plugin +1 moreXXE vulnerability in Jenkins Valgrind Plugin7.1 High
- mpxj, oracle primavera unifier +1 moreImproper Restriction of XML External Entity Reference in MPXJ9.8 Critical
- openstack novaOpenStack Nova Live migration fails to update persistent domain XML8.3 High
- Show moreLoading…