CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- eclipse jettyJetty PushSessionCacheFilter can cause remote DoS attacks3.1 Low
- eclipse jetty, debian linux, eclipse jetty.project +2 more +4 moreJetty connection leaking on idle timeout when TCP congested7.5 High
- eclipse jettyEclipse Jetty GZIP buffer release7.2 High
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 High
- eclipse jetty, debian linux, eclipse jetty.project +2 moreJetty's OpenId Revoked authentication allows one request3.5 Low
- eclipse jetty, debian linux, eclipse jetty.project +2 moreJetty accepts "+" prefixed value in Content-Length5.3 Medium
- eclipse jetty, debian linux, eclipse jetty.project +2 moreJetty vulnerable to errant command quoting in CGI Servlet3.5 Low
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view...4.9 Medium
- google androidIn getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of...9.8 Critical
- easy-parse project easy-parseeasy-parse XML External Entity Injection vulnerability7.5 High
- py-xml project py-xmlpy-xml XML External Entity Injection vulnerability7.5 High
- requests-xml project requests-xmlrequests-xml XML External Entity Injection vulnerability7.5 High
- lenovo xclarity administratorAn unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common...8.2 High
- dromara hutoolDromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference5.5 Medium
- fuji electric co., ltd. frenic rhc loaderImproper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC...5.5 Medium
- microfocus arcsight loggerPotential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.9.1 Critical
- xml library project libraryxml-rs vulnerable to denial of service via invalid token in XML document7.5 High
- splunk, splunk enterprise, cloud platform +2 moreDenial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication7.7 High
- opentext archive center administrationThe client in OpenText Archive Center Administration through 21.2 allows XXE attacks....7.1 High
- weaver e-cologyWeaver e-cology API RequestInfoByXml xml external entity reference5.5 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine XML External Entity Injection Vulnerabilities4.9 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine XML External Entity Injection Vulnerabilities4.9 Medium
- schneider electric opc factory server (ofs), schneider-electric opc factory server +1 moreA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...5.0 Medium
- ibm websphere application serverIBM WebSphere Application Server XML external entity injection6.3 Medium
- the ministry of justice shinseiyo sogo softShinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE)....7.5 High
- visam vbaseCVE-2022-458765.5 Medium
- hcl software workload automationHCL Workload Automation is vulnerable to XML External Entity (XXE) Injection6.5 Medium
- hcl software workload automationHCL Workload Automation is vulnerable to XML External Entity (XXE) Injection7.1 High
- zohocorp manageengine servicedesk plus, manageengine assetexplorer, manageengine servicedesk plus msp +1 more +3 moreZoho ManageEngine ServiceDesk Plus through 14104 allows admin users to conduct an XXE attack.4.9 Medium
- nokia netactAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance...6.5 Medium
- nokia netactAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the...6.5 Medium
- egostudiogroup super cleanAn issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges...5.5 Medium
- eclipse jetty, debian linux, eclipse jetty.project +4 more +6 moreCookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty2.4 Low
- eclipse jetty, jetty.project +1 moreOutOfMemoryError for large multipart without filename in Eclipse Jetty5.3 Medium
- guralp man-eam-0003cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE)...7.5 High
- talend data catalogAll versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML...5.5 Medium
- talend data catalogAll versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML...5.5 Medium
- siemens polarion almA vulnerability has been identified in Polarion ALM (All versions < V2304.0). The application...5.9 Medium
- zohocorp manageengine applications managerZoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.6.5 Medium
- ministry of land, infrastructure, transport and tourism, japan national land numerical information data conversion toolNational land numerical information data conversion tool all versions improperly restricts XML...5.5 Medium
- ibm tririga application platformIBM TRIRIGA Application Platform XML external entity injection7.1 High
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine XML External Entity Injection Vulnerability6.0 Medium
- hitachi vantara pentaho business analytics server, hitachi vantara pentaho business analytics server +1 moreHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference7.1 High
- manageengine opmanager, zohocorp manageengine opmanager, manageengine opmanager msp +1 more +3 moreA blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of...5.8 Medium
- aveva edgeThis vulnerability allows remote attackers to disclose sensitive information on affected...5.5 Medium
- independentsoft jwordAn issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external...5.3 Medium
- independentsoft jspreadsheetAn issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML...5.3 Medium
- independentsoft jodfAn issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external...5.3 Medium
- jenkins remote-jobs-view, jenkins project remote-jobs-view-plugin plugin +1 moreJenkins remote-jobs-view-plugin vulnerable to XML external entity attacks6.5 Medium
- jenkins phabricator differential, jenkins project phabricator differential plugin +1 moreJenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks8.2 High
- Show moreLoading…