CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- eclipse jetty, the eclipse foundation eclipse jetty, debian linux +6 more +8 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations5.3 Medium
- silverstripeSilverStripe XXE Vulnerability in CSSContentParser4.8 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack...8.2 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack...7.1 High
- luxion keyshot, datakit crosscadware, siemens solid edge se2020 firmware +1 more +3 moreWhen opening a specially crafted 3DXML file, the application containing Datakit Software...5.5 Medium
- ibm websphere application serverIBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML...6.5 Medium
- jenkins urltrigger, jenkins project urltrigger plugin +1 moreXXE vulnerability in Jenkins URLTrigger Plugin8.1 High
- jenkins nuget, jenkins project nuget plugin +1 moreXML external entity vulnerability in Jenkins Nuget Plugin9.1 Critical
- jenkins filesystem trigger, jenkins project filesystem trigger plugin +1 moreXXE vulnerability in Jenkins Filesystem Trigger Plugin8.8 High
- chamiloadmin/user_import.php in Chamilo 1.11.14 reads XML data without disabling the ability to load...6.5 Medium
- elastic app searchElastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity...7.5 High
- jenkins xcode integration, jenkins project xcode integration plugin +1 moreXML external entity (XXE) attacks in Jenkins Xcode integration Plugin7.1 High
- jetbrains intellij ideaIn IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.7.5 High
- paxtechnology paxstorePax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE)...6.5 Medium
- cisco broadworks messaging server, broadworks +1 moreCisco BroadWorks Messaging Server XML External Entity Injection Vulnerability5.4 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when...7.1 High
- cisco firepower device manager, firepower threat defense software +1 moreCisco Firepower Device Manager On-Box Software XML External Entity Vulnerability5.4 Medium
- arubanetworks clearpass, hewlett packard enterprise (hpe) aruba clearpass policy manager +1 moreA remote XML external entity (XXE) vulnerability was discovered in Aruba ClearPass Policy Manager...8.2 High
- arubanetworks airwaveA remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform...8.1 High
- avaya meetings server, equinox conferencing +1 moreAvaya Equinox Conferencing XXE vulnerability8.1 High
- arubanetworks airwaveA remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform...8.1 High
- arubanetworks airwaveA remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform...6.5 Medium
- avaya callback assistXXE in Avaya Callback Assist Administration8.1 High
- avaya aura orchestration designerXXE in Avaya Aura Orchestration Designer8.1 High
- fusionauth saml v2FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or...6.5 Medium
- jenkins config file provider, jenkins project config file provider plugin +1 moreXML External Entity Reference vulnerability in Jenkins Config File Provider Plugin8.1 High
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity...8.2 High
- ibm websphere application serverIBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity...8.2 High
- wordpress, debian linux, wordpress wordpress-develop +2 moreWordPress Authenticated XXE attack when installation is running PHP 87.1 High
- sap netweaver process integration, sap se process integration (enterprise service repository java mappings) +1 moreIn order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP...7.7 High
- perforce helix almThe XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build...4.9 Medium
- windriver vxworksXML External Entity Resolution (XXE) in Helix ALM. The XML Import functionality of the...5.3 Medium
- ruby-lang rexml, ruby, fedoraproject fedora +2 moreREXML round-trip instability7.5 High
- forcepoint web security content gateway, data loss prevention, email security +2 moreForcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input,...7.5 High
- proofpoint insider threat managementThe Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML...7.2 High
- eclipse jetty, the eclipse foundation eclipse jetty, jenkins +19 more +21 moreJetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources7.5 High
- pikepdf project pikepdf, fedoraproject fedora +1 moreImproper Restriction of XML External Entity Reference in pikepdf7.5 High
- ibm engineering lifecycle optimization, engineering workflow management, engineering insights +4 more +6 moreIBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when...7.1 High
- ibm cloud pak for automationIBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity...7.1 High
- salesforce mule, salesforce, inc. mulesoft +1 moreMuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a...9.8 Critical
- compassplus tranzware e-commerce payment gateway/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in...7.5 High
- siemens solid edge se2020, solid edge se2021, solid edge +2 moreA vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge...5.5 Medium
- arubanetworks airwaveA remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in...6.5 Medium
- lumis experience platformLumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API...9.1 Critical
- eprintsEPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via...9.8 Critical
- dell srs policy manager, emc srs policy manager +1 moreSRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to...7.2 High
- micro focus solutions business managerXML External Entity processing6.1 Medium
- pelco digital sentry serverPelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable...7.5 High
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity...8.2 High
- openhab, openhab openhab-addons +1 moreXXE vulnerability in OpenHAB6.4 Medium
- Show moreLoading…