CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- redhat process automation managerXML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with...8.2 High
- inductive automation ignitionInductive Automation Ignition7.6 High
- ibm datapower gatewayIBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4...5.5 Medium
- dogtagpkiAccess to external entities when parsing XML documents can lead to XML external entity (XXE)...7.5 High
- autodesk fusion 360An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a...7.8 High
- visam vbase pro-rt/ server-rt (web remote), vbase web-remote +1 moreVISAM VBASE Editor Improper Restriction of XML5.9 Medium
- christian stefanescu untangleuntangle vulnerable to Improper Restriction of XML External Entity Reference7.5 High
- openkm, openkm document management community +1 moreOpenKM XXE Injection8.5 High
- data systems consulting co., ltd. bpm, digiwin business process management +1 moreData Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection7.5 High
- ibm partner engagement manager, sterling partner engagement manager, partner engagement manager on cloud\/saas +1 more +3 moreIBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML...7.1 High
- unit4 enterprise resource planningUnit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.6.5 Medium
- apache cloudstackApache CloudStack SAML Single Sign-On XXE9.8 Critical
- eclipse hudsonHudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.29.8 Critical
- sap business oneDue to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker...7.5 High
- eclipse lyo, the eclipse foundation eclipse lyo +1 moreXML External Entity Reference in Eclipse Lyo5.3 Medium
- apache jetspeed, portals jetspeed, apache software foundation portals +2 moreApache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues9.8 Critical
- jenkins recipe, jenkins project recipe plugin +1 moreXML External Entity Reference in Jenkins Recipe Plugin8.8 High
- sysaid okta sso, - okta sso integration +1 moreSysAid - Okta SSO integration5.9 Medium
- obdasystems mastroXML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system...7.5 High
- rocketsoftware ags-zenaASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4...9.8 Critical
- redhat droolsXML External Entity Reference in drools9.8 Critical
- mendix saml, siemens mendix saml module (mendix 7 compatible), mendix saml module (mendix 8 compatible) +1 more +3 moreA vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions <...7.5 High
- magicpinAn XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access...7.5 High
- netscout ngeniusoneNetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.9.8 Critical
- vmware tools, tools for windows +1 moreVMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE)...7.1 High
- morpheusdata morpheusAn XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful...7.5 High
- jenkins storable configs, jenkins project storable configs plugin +1 moreXML External Entity Reference in Jenkins Storable Configs Plugin8.8 High
- hcl software unicaHCL Unica Platform is vulnerable to XML External Entity (XXE) injection7.5 High
- wso2 api manager, identity server, identity server as key manager +2 moreXML External Entity (XXE) vulnerability in the file based service provider creation feature of...9.1 Critical
- tibco managed file transfer command center, managed file transfer internet server +1 moreTIBCO Managed File Transfer Command Center XXE Vulnerability8.6 High
- siemens teamcenter, teamcenter v12.4, teamcenter v13.0 +2 moreA vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter...7.5 High
- twelvemonkeys project twelvemonkeysXML External Entity (XXE) Injection7.3 High
- apache jenaProcessing external DTDs9.8 Critical
- talend administration centerTalend Administration Center has a vulnerability that allows an authenticated user to use XML...6.5 Medium
- cisco enterprise nfv infrastructure softwareCisco Enterprise NFV Infrastructure Software Vulnerabilities9.9 Critical
- delta electronics dmarsDelta Electronics DMARS Improper Restriction of XML External Entity Reference5.5 Medium
- opensuse open build serviceMultiple XXE vulnerabilities in OBS8.8 High
- apache nifiImproper Restriction of XML External Entity References in Multiple Components7.5 High
- rt-solar solar appscreenerSolar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF...9.8 Critical
- xwiki commons, xwiki-commons +1 moreArbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml4.9 Medium
- detekt, detekt detekt/detekt +1 moreImproper Restriction of XML External Entity Reference in detekt/detekt7.3 High
- fanuc roboguideICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform6.1 Medium
- zohocorp manageengine adaudit plusZoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that...9.8 Critical
- rockwell automation isagraf, connected component workbench, safety instrumented systems workstation +1 more +3 moreICSA-22-088-01 Rockwell Automation ISaGRAF5.5 Medium
- softwareag mashzone nextgenThe "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA...7.2 High
- jox project joxImproper Restriction of XML External Entity Reference in wutka jox9.8 Critical
- jenkins project pipeline: phoenix autotest plugin, jenkins pipeline\ +1 moreXML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin8.1 High
- jenkins project coverage/complexity scatter plot plugin, jenkins coverage\/complexity scatter plot +1 moreenkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability8.1 High
- jenkins flaky test handler, jenkins project flaky test handler plugin +1 moreXXE vulnerability in Jenkins Flaky Test Handler Plugin8.1 High
- schneider electric scadapack workbenchA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...5.5 Medium
- Show moreLoading…