CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- itext rupsiText RUPS XfaFile.java xml external entity reference5.5 Medium
- healthit code-validator-apiONC code-validator-api XML CodeValidatorApiConfiguration.java vocabularyValidationConfigurations xml external entity reference5.5 Medium
- talend open studio for mdmTalend Open Studio for MDM SystemStorageWrapper.java xml external entity reference5.5 Medium
- dragonflyoss dragonflyImproper Restriction of XML External Entity Reference in Dragonfly7.0 High
- xml-rpc.net project xml-rpc.netAn XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote...8.8 High
- 3d city database ogc web feature service3D City Database OGC Web Feature Service xml external entity reference5.5 Medium
- broadcom symantec identity governance and administrationAn authenticated user can perform XML eXternal Entity injection in Management Console in Symantec...8.8 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom...3.9 Low
- jenkins plot, jenkins project plot plugin +1 moreJenkins Plot Plugin XML External Entity Reference vulnerability9.8 Critical
- kwoksys information serverAn XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2...4.9 Medium
- zohocorp manageengine servicedesk plus, manageengine assetexplorer, manageengine servicedesk plus msp +1 more +3 moreZoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External...4.9 Medium
- sophos mobile, mobile managed on-premises +1 moreAn XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and...9.8 Critical
- jenkins japex, jenkins project japex plugin +1 moreXXE vulnerability in Jenkins JAPEX Plugin9.8 Critical
- jenkins project osf builder suite : : xml linter plugin, jenkins osf builder suite \ +1 moreXXE vulnerability on agents in Jenkins OSF Builder Suite : : XML Linter Plugin9.8 Critical
- jenkins sourcemonitor, jenkins project sourcemonitor plugin +1 moreXXE vulnerability on agents in Jenkins SourceMonitor Plugin9.8 Critical
- jenkins cccc, jenkins project cccc plugin +1 moreXML External Entity Reference in Jenkins CCCC Plugin9.8 Critical
- jenkins violations, jenkins project violations plugin +1 moreXML External Entity Reference in Jenkins Violations Plugin5.5 Medium
- concretecms concrete cmsConcrete CMS vulnerable to XML External Entity5.3 Medium
- bruhn-newtech cbrn-analysisCBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash...3.8 Low
- cisco firepower management center, secure firewall management center +1 moreA vulnerability in the module import function of the administrative interface of Cisco Firepower...4.3 Medium
- splunk, splunk enterprise, cloud platform +2 moreXML External Entity Injection through a custom View in Splunk Enterprise8.8 High
- trellix ips manager, intrusion prevention system manager +1 moreTrellix IPS Manager vulnerable to XXE5.9 Medium
- arubanetworks arubaos, sd-wan, hewlett packard enterprise aruba mobility conductor (formerly mobility master); aruba mobility controllers; wlan gateways and sd-wan gateways managed by aruba central +2 moreDue to improper restrictions on XML entities multiple vulnerabilities exist in the command line...3.8 Low
- auieosoftware candidatsCandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This...7.5 High
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE)...9.1 Critical
- vmware cloud foundation, nsx data center +1 moreVMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x...9.1 Critical
- xmlsoft libxml2, apple ipados, iphone os +17 more +19 moreAn issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can...7.8 High
- jenkins compuware topaz for total test, jenkins project compuware topaz for total test plugin +1 moreXXE vulnerability in Jenkins Compuware Topaz for Total Test Plugin7.5 High
- jenkins repo, jenkins project repo plugin +1 moreXXE vulnerability in Jenkins REPO Plugin7.5 High
- mcafee epolicy orchestrator, trellix epolicy orchestrator (epo) +1 moreXXE in Trellix ePO server5.4 Medium
- adobe coldfusionAdobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read7.5 High
- adobe coldfusionAdobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read7.5 High
- veritas netbackupAn issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The...5.4 Medium
- veritas netbackupAn issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The...5.3 Medium
- ibm partner engagement manager, sterling partner engagement manager +1 moreIBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection ...7.1 High
- apache soapApache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP7.5 High
- jenkins rqm, jenkins project rqm plugin +1 moreJenkins RQM Plugin vulnerable to Improper Restriction of XML External Entity Reference9.1 Critical
- jenkins compuware common configuration, jenkins project compuware common configuration plugin +1 moreJenkins Compuware Common Configuration Plugin vulnerable to Improper Restriction of XML External Entity Reference9.8 Critical
- safe fme serverSafe Software FME Server v2022.0.1.1 and below was discovered to contain a XML External Entity ...8.5 High
- forcepoint cloud security gateway, data loss prevention (dlp), data loss prevention +5 more +7 moreImproper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine...7.5 High
- apache calciteApache Calcite: potential XEE attacks9.8 Critical
- ddmal mei2volpianoMEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)7.5 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection...7.1 High
- delta electronics robot automation studio (dras), deltaww delta robot automation studio +1 moreDelta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by...5.5 Medium
- trellix dlp endpoint for windows, mcafee data loss prevention endpoint +1 moreXXE vulnerability in DLP Endpoint for Windows6.5 Medium
- ibm mqIBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity...8.2 High
- red hat amq, redhat jboss a-mq +1 moreA flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's...5.6 Medium
- eclipse sphinx, the eclipse foundation eclipse sphinx +1 moreIn Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling...5.3 Medium
- zohocorp manageengine analytics plusOut-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus...7.5 High
mofhPyPImofh Vulnerable to Improper Restriction of XML External Entity ReferenceNo score- Show moreLoading…