CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- ge toolboxstGE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference7.5 High
- predic8 soa modelImproper Restriction of XML External Entity Reference in soa-model9.8 Critical
- mcafee epolicy orchestrator, mcafee,llc mcafee epolicy orchestrator (epo) +1 moreePO XML extended entity vulnerability3.5 Low
- eyoucmsThe wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's...7.2 High
- jenkins semantic versioning, jenkins project semantic versioning plugin +1 moreAgent-to-controller security bypass in Jenkins Semantic Versioning Plugin6.5 Medium
- cvrf-csaf-converter project cvrf-csaf-converterXML External Entities Vulnerability in CVRF-CSAF-Converter6.1 Medium
- signiant, signiant manager\+agents +1 moreSigniant - Manager+Agents XML External Entity (XXE)6.8 Medium
- tryton proteus, trytond, debian linux +2 moreImproper Restriction of XML External Entity Reference in trytond and proteus6.5 Medium
- overit geocallAn issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the...6.5 Medium
- apache any23An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor9.1 Critical
- liquibase, liquibase liquibase/liquibase, oracle sqlcl +2 moreImproper Restriction of XML External Entity Reference in liquibase/liquibase7.3 High
- hazelcast, hazelcast hazelcast/hazelcast +1 moreImproper Restriction of XML External Entity Reference in hazelcast/hazelcast7.3 High
- monitorjbl excel-streaming-reader, excel streaming reader project streaming reader +1 moreImproper Restriction of XML External Entity Reference in Excel-Streaming-Reader9.8 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was...9.8 Critical
- rockwell automation factorytalk services platformIMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-6117.1 High
- jenkins chef sinatra, jenkins project chef sinatra plugin +1 moreImproper Restriction of XML External Entity Reference in Jenkins Chef Sinatra8.8 High
- magnolia-cms magnolia cmsImproper Restriction of XML External Entity Reference in Magnolia CMS7.8 High
- intel quartus primeImproper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before...7.8 High
- intel quartus primeImproper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R)...7.5 High
- signiant manager\+agentsSigniant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.9.8 Critical
- f5 big-ip advanced web application firewall, big-ip application security manager, big-ip fraud protection service +2 moreOn BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14...4.9 Medium
- ibm cognos controllerIBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity...7.1 High
- ibm cognos controllerIBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity...7.1 High
- jadx project jadx, skylot skylot/jadx +1 moreImproper Restriction of XML External Entity Reference in skylot/jadx5.5 Medium
- oracle graalvm, debian linux, netapp 7-mode transition tool +17 more +19 moreVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...5.3 Medium
- stanford corenlp, stanfordnlp stanfordnlp/corenlp +1 moreImproper Restriction of XML External Entity Reference in stanfordnlp/corenlp4.7 Medium
- prosodyprosody - security update7.5 High
- adobe experience manager, experience manager cloud service +1 moreAEM Forms Improper Restriction of XML External Entity Reference9.8 Critical
- stanford corenlp, stanfordnlp stanfordnlp/corenlp +1 moreImproper Restriction of XML External Entity Reference in stanfordnlp/corenlp6.1 Medium
- mitre calderaAn issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG"...8.8 High
- quest kace desktop authorityXXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file...5.5 Medium
- knime analytics platformKNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a...4.7 Medium
- dbeaver, dbeaver dbeaver/dbeaver +1 moreImproper Restriction of XML External Entity Reference in dbeaver/dbeaver9.8 Critical
- h2database h2XML External Entity (XXE) Injection8.1 High
- kb multinerNational Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is...9.1 Critical
- kb diggerNational Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected...9.1 Critical
- cloverdxCloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import.7.7 High
- claris filemaker pro, filemaker server +1 moreAn XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4...5.5 Medium
- jenkins owasp dependency-check, jenkins project owasp dependency-check plugin +1 moreXXE vulnerability in Jenkins OWASP Dependency-Check Plugin7.1 High
- jenkins pom2config, jenkins project pom2config plugin +1 moreXXE vulnerability in Jenkins pom2config Plugin6.5 Medium
- jenkins performance, jenkins project performance plugin +1 moreXXE vulnerability in Jenkins Performance Plugin6.5 Medium
- fortinet fortiportalAn improper restriction of XML external entity reference vulnerability in the parser of XML...4.3 Medium
- antenna house, inc. office server document converterOffice Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote...6.5 Medium
- antenna house, inc. office server document converterOffice Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote...7.5 High
- easyxml project easyxmlXML External Entity vulnerability in Easy-XML9.1 Critical
- getsymphony symphonyA XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement...9.1 Critical
- modx revolutionXML External Entity vulnerability in MODX CMS9.1 Critical
- stanford corenlp, stanfordnlp stanfordnlp/corenlp +1 moreImproper Restriction of XML External Entity Reference in stanfordnlp/corenlp8.6 High
- stanford corenlp, stanfordnlp stanfordnlp/corenlp +1 moreImproper Restriction of XML External Entity Reference in stanfordnlp/corenlp9.8 Critical
- s-cmsAn XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which...7.5 High
- Show moreLoading…