CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- eclipse memory analyzer, eclipse foundation memory analyzer (tools.mat) +1 moreIn Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered...2.8 Low
- apache cocoonApache Cocoon's StreamGenerator is vulnerable to XXE injection9.8 Critical
- jenkins matlab, jenkins project matlab plugin +1 moreJenkins MATLAB Plugin XML External Entity vulnerability9.8 Critical
- adobe robohelp, robohelp server +1 moreZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability7.5 High
- siemens opc ua modelling editor (siome), opc ua modeling editor +1 moreA vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2...7.5 High
- eclipse ide, org.eclipse.core.runtime, pde +1 more +3 moreXXE in eclipse.platform / Eclipse IDE5.0 Medium
- ni topografix dataplugin for gpx, diadem, flexlogger +2 more +4 moreIncorrect Permission Assignment in the TopoGrafix DataPlugin for GPX5.5 Medium
- national tax agency e-tax software, nta e-tax +1 moree-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE...5.5 Medium
- opencrxOpenCRX allows a remote attacker to execute arbitrary code via a crafted request9.8 Critical
- vermeg agile reporterAn issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the...6.5 Medium
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack...4.9 Medium
- omrom cx-designerCX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper...5.5 Medium
- fnando svg optimizersvg_optimizer rubygem external XML entity (XXE) vulnerability5.9 Medium
- north grid proself, north grid corporation proself enterprise/standard edition, proself gateway edition +1 more +3 moreProself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and...7.5 High
- ibm security directory server, security directory suite, security verify directory +2 moreIBM Security Directory Server external entity injection5.5 Medium
- nettyNetty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled8.3 High
- microsoft azure hdinsightAzure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability8.8 High
- sap business one, sap se business one (b1i) +1 moreInformation Disclosure vulnerability in SAP Business One (B1i)4.3 Medium
- jetbrains ktorIn JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was...8.6 High
- gradlePossible local file exfiltration by XML External entity injection6.8 Medium
- mhlw fd applicationFD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external...5.5 Medium
- codehaus-plexus plexus-utils, red hat a-mq clients 2, a-mq online +28 more +30 moreCodehaus-plexus: xml external entity (xxe) injection4.3 Medium
- ivanti endpoint managerAn XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti...7.5 High
- mim software assistant, client +1 moreUnsafe XML parsing of 3rd party DICOM private tags may lead to XXE5.6 Medium
- sap se s/4hana (create single payment application), sap s\/4 hana +1 moreExternal Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)3.5 Low
- jenkins job configuration history, jenkins project job configuration history plugin +1 moreJob Configuration History Plugin's path traversal allows exploiting XXE vulnerability8.8 High
- jenkins job configuration history, jenkins project job configuration history plugin +1 morePath traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin6.5 Medium
- ibm financial transaction manager for swift services, financial transaction manager +1 moreIBM Financial Transaction Manager for SWIFT Services XML external entity injection7.1 High
- lexmark cs310, c2132 firmware, cs310 firmware +80 more +82 moreCertain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to...7.5 High
- eclipse leshanDDFFileParser in eclipse leshan is vulnerable to XXE Attacks6.5 Medium
- esotericsoftware yamlbeansEsoteric YamlBeans XML Entity Expansion vulnerability5.5 Medium
- python, debian linux +1 moreAn XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no...9.8 Critical
- apache ivyApache Ivy: XML External Entity vulnerability in Apache Ivy8.2 High
- opennms horizon, meridian +1 moreAn XML External Entity injection vulnerability5.4 Medium
- php, debian linux, fedoraproject fedora +2 moreSecurity issue with external entity loading in XML without enabling it8.6 High
- ivanti avalanche, wavelink +1 moreIvanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.6.5 Medium
- microsoft dynamics 365, dynamics 365 (on-premises) version 9.0 +1 moreMicrosoft Dynamics 365 On-Premises Remote Code Execution Vulnerability6.5 Medium
- cisco sd-wan vmanage, catalyst sd-wan manager +1 moreA vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated,...6.5 Medium
- hcl software unica platform, hcltech unica +1 moreAn XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform8.1 High
- palantir com.palantir.magritte:magritte-rest-source-bundle, magritte-rest-source-bundle +1 moreCVE-2023-309516.3 Medium
- ws-inc j wbemIn WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity...9.1 Critical
- getkirby kirbyKirby XML External Entity (XXE) vulnerability in the XML data handler6.8 Medium
- moj applicant programmeApplicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE...5.5 Medium
- edinet-fsa xbrl data create, financial services agency xbrl data create application +1 moreXBRL data create application version 7.0 and earlier improperly restricts XML external entity...5.5 Medium
- jenkins external monitor job type, jenkins project external monitor job type plugin +1 moreJenkins External Monitor Job Type Plugin XML external entity vulnerability6.5 Medium
- schneider electric ecostruxure opc ua server expertA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...5.5 Medium
- eclipse jettyMadeYouReset HTTP/2 vulnerability7.7 High
- eclipse jettyEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations3.7 Low
- eclipse jetty, netapp active iq unified manager, bootstrap os +2 moreJetty DOS vulnerability on DosFilter5.3 Medium
- eclipse jettyJetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks5.9 Medium
- Show moreLoading…