CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Information Disclosure Vulnerability6.5 Medium
- cyclonedx cyclonedx-javascript-library@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability8.1 High
- honeywell saia pg5 controls suiteHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability5.5 Medium
- honeywell saia pg5 controls suiteHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability5.5 Medium
- honeywell saia pg5 controls suiteHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability5.5 Medium
- honeywell saia pg5 controls suiteHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability5.5 Medium
- honeywell saia pg5 controls suiteHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability5.5 Medium
- voltronic power viewpower pro, voltronicpower viewpower +1 moreVoltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability6.5 Medium
- d-link d-view, dlink d-view 8 +1 moreD-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability8.2 High
- visualware myconnection serverVisualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability6.5 Medium
- lg simple editorLG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability7.5 High
- lg simple editorLG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability7.5 High
- lg simple editorLG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability7.5 High
- inductive automation ignitionInductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability6.5 Medium
- sonicwall gms, global management system +1 moreThe XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE)...7.1 High
- ibm websphere application server, websphere application server liberty +1 moreIBM WebSphere Application Server XML external entity injection7.0 High
- oracle bi publisher, oracle corporation bi publisher (formerly xml publisher) +1 moreVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). ...9.8 Critical
- oracle web applications desktop integratorVulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business...4.3 Medium
- apache zeppelin, apache software foundation zeppelin sap +1 moreApache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE5.3 Medium
- No product listedAn XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an...6.3 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection...5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector5.9 Medium
- lakernote easyadminlakernote EasyAdmin saveReportFile xml external entity reference6.3 Medium
- fitnesseImproper restriction of XML external entity references vulnerability exists in FitNesse all...5.8 Medium
- ibm maximo application suite, maximo asset management +1 moreIBM Maximo Application Suite XML external entity injection8.2 High
- pega platform, pegasystems pega platform +1 morePega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.7.7 High
- frentix openolatXML external entity (XXE) injection in OpenOLAT4.6 Medium
- ibm security guardium key lifecycle managerIBM Security Guardium Key Lifecycle Manager XML external entity injection5.5 Medium
- apache ambariApache Ambari: authenticated users could perform XXE to read arbitrary files on the server6.5 Medium
- github codeql cli, codeql-cli-binaries +1 moreLimited data exfiltration in CodeQL CLI2.7 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has an XXE vulnerability in Java2WsddTask._format8.0 High
- ivanti connect secure, policy secure, ivant ics +2 more +4 moreAn XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x,...8.3 High
- sap se netweaver as java (guided procedures), sap netweaver application server java +1 moreXXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)8.6 High
- magicsoftware magic xpi integration platformThe XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.6.5 Medium
- ibm security verify access appliance, security verify access docker, security verify access +2 moreIBM Security Access Manager Container XML external entity injection7.1 High
- sew-eurodrive movitools motionstudioSEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity Reference5.5 Medium
- opentext appbuilderXML External Entity (XXE) Processing4.9 Medium
- dfeg electronic deliverables creation support tool, ministry of defense electronic deliverables creation support tool (construction edition), electronic deliverables creation support tool (design & survey edition) +2 moreElectronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and...5.5 Medium
- maff electronic delivery check system, ministry of agriculture, forestry and fisheries electronic delivery check system (ministry of agriculture, forestry and fisheries the agriculture and rural development project version) march, heisei 31 era edition +1 moreElectronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture...5.5 Medium
- cals-ed electronic delivery check system, electronic delivery item inspection support system, ministry of land, infrastructure, transport and tourism, japan electronic delivery check system (dentsu) +2 more +4 moreElectronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check...5.5 Medium
- tozt spreadsheet\The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to...6.5 Medium
- fonttoolsfonttools XML External Entity Injection (XXE) Vulnerability7.5 High
- qualys web application screening, qualys,inc. web app scanning connector jenkins plugin +1 morePossible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security5.7 Medium
- qualys policy compliance, qualys,inc. policy compliance connector jenkins plugin +1 morePossible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance5.7 Medium
- netscout ngeniusoneAn issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code...9.8 Critical
- unifiedremote unified remoteUnified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a...9.8 Critical
- ivanti avalancheAn unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or...6.5 Medium
- 52north wpsXML External Entity Reference on 52North WPS7.2 High
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 products vulnerable to XML External Entity attack4.6 Medium
- europeana repoxImproper Restriction of XML External Entity Reference in Repox8.3 High
- Show moreLoading…