CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- cybozu, inc. cybozu remote service, cybozu remote service manager +1 moreCybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML...6.5 Medium
- tibco jasperreports server, tibco software inc. jasperreports server - community edition, jasperreports server - developer edition +3 more +5 moreTIBCO JasperReports XML Eternal Entity (XXE) vulnerability7.5 High
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (crystal reports) +1 moreSAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows...7.5 High
- alkacon opencmsXML External Entity Reference in org.opencms:opencms-core6.5 Medium
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.9.8 Critical
- apache openofficeBillion Laughs6.5 Medium
- pingidentity pingfederatePing Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE...7.5 High
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine XML External Entity Injection Vulnerability6.4 Medium
- netscout ngeniusoneNEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.6.5 Medium
- nokogiriImproper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby7.5 High
- ibm jazz for service management, tivoli netcool\/omnibus gui +1 moreIBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an...7.1 High
- mcafee endpoint security, mcafee,llc mcafee endpoint security (ens) for windows +1 moreXML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior...5.0 Medium
- apache jenaXML External Entity (XXE) vulnerability7.5 High
- axiossystems assystAssyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application...7.7 High
- siemens teamcenter v12.4, teamcenter v13.0, teamcenter v13.1 +2 more +4 moreA vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter...7.5 High
- apache any23An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java9.1 Critical
- palo alto networks pan-osPAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface6.5 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote...9.8 Critical
- jenkins nested view, jenkins project nested view plugin +1 moreXXE vulnerability in Jenkins Nested View Plugin7.1 High
- osgeo owslib, pywps, debian linux +2 moreXML External Entity Injection in PyWPS7.5 High
- quokka project quokkaImproper Restriction of XML External Entity Reference in Quokka9.8 Critical
- quokka project quokkaImproper Restriction of XML External Entity Reference in Quokka9.8 Critical
- on24 screenshareThe ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file...9.1 Critical
com.epam.reportportal:service-apiMavenXML External Entity Reference7.5 High- craftcms commerce, hcltechsw hcl commerce +1 more" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE)...9.1 Critical
- cpanelThe WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).7.2 High
- altova mobiletogether serverAltova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes...9.1 Critical
- siemens solid edge se2021, solid edge se2021 firmware +1 moreA vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML...5.5 Medium
- salesforce mule, salesforce, inc. mulesoft +1 moreXML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component...7.5 High
- objectplanet opinioObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <...6.5 Medium
- glances project glancesXML External Entity (XXE) Injection6.3 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External...7.1 High
- microfocus verastream host integratorXML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7...7.6 High
- oracle bi publisher, oracle corporation bi publisher (formerly xml publisher) +1 moreVulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E...5.3 Medium
- dell openmanage enterprise, emc openmanage enterprise, emc openmanage enterprise-modular +2 moreDell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME...5.4 Medium
- dell avamar, emc avamar server, emc integrated data protection appliance +2 moreDell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data...8.2 High
- mitsubishi ae-200a firmware, ae-200e firmware, ae-50a firmware +16 more +18 moreImproper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air...8.2 High
- flowdroid project flowdroidImproper Restriction of XML External Entity Reference in de.tud.sse5.3 Medium
- kaseya vsaUnauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.67.5 High
- panasonic fpwin proPanasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file...5.5 Medium
- jenkins selenium html report, jenkins project selenium html report plugin +1 moreXXE vulnerability in Jenkins Selenium HTML report Plugin4.3 Medium
- xml2dict project xml2dictXML2Dict XML Entity Expansion Vulnerability7.5 High
- huawei ecns280 firmwareThere is an XXE injection vulnerability in eCNS280 V100R005C00 and V100R005C10. A module does not...5.3 Medium
- reportportal service-api, reportportal +1 moreXXE vulnerability on Launch import with externally-defined DTD file7.5 High
- connectwise automateAn XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.9.8 Critical
- powerarchiverThe XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external...4.3 Medium
- jenkins generic webhook trigger, jenkins project generic webhook trigger plugin +1 moreXXE vulnerability in Jenkins Generic Webhook Trigger Plugin9.8 Critical
- jdom, apache solr, tika +3 more +5 moreXML External Entity (XXE) Injection in JDOM7.5 High
- ibm financial transaction managerIBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE)...6.5 Medium
- sap se netweaver as for java, sap netweaver application server for java +1 moreSAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker...9.0 Critical
- Show moreLoading…