CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- keysight ixia vision product familyKeysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference6.9 Medium
- ibm openpages with watsonIBM OpenPages XML external entity injection7.1 High
- ibm cognos controller, controller +1 moreIBM Cognos Controller XML external entity injection8.2 High
- rsa authentication managerRSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a...4.3 Medium
- r1bbit yimioaywoa WXCallBack Interface XMLParse.java extract xml external entity reference5.3 Medium
- ibm entirexIBM EntireX XML external entity injection7.1 High
- ibm cognos analyticsIBM Cognos Anaytics XML external entity injection7.1 High
- hl7 fhir-ig-publisherXXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`8.6 High
- hcl software bigfix patch management download plug-insHCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks2.5 Low
- apache ambariApache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie7.5 High
- google androidIn multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of...5.5 Medium
- google androidIn multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete...7.8 High
- schneider electric web designer for bmenoc0311(c), web designer for bmenoc0321(c), web designer for bmxnoe0110(h) +1 more +3 moreCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...8.4 High
- omron corporation programable terminals nb-designerVulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer5.5 Medium
- elspec-ltd g5dfr firmwareAn XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder...7.5 High
- elspec-ltd g5dfr firmwareAn issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML...7.5 High
- gocdGoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins2.1 Low
- gocdGoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality2.1 Low
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE...5.9 Medium
- opentext™ operations bridge managerImproper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations...5.3 Medium
- No product listedAn XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB...9.8 Critical
- fhir ucum-javaUcum-java has an XXE vulnerability in XML parsing8.6 High
- http4khttp4k has a potential XXE (XML External Entity Injection) vulnerability9.8 Critical
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAcrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)6.3 Medium
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Information Disclosure Vulnerability6.5 Medium
- siemens comos v10.3, comos v10.4.0, comos v10.4.1 +4 more +6 moreA vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 ...5.9 Medium
- siemens comos v10.3, comos v10.4.0, comos v10.4.1 +4 more +6 moreA vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 ...5.7 Medium
- sap se netweaver as javaXML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA5.3 Medium
unstructuredPyPI,github.com/Unstructured-IO/unstructuredGo,govulncheck-vulndbopenSUSE +2 moreunstructured XML External Entity (XXE)9.8 Critical- simplesamlphp saml2SimpleSAMLphp SAML2 has an XXE in parsing SAML messages8.3 High
- simplesamlphp xml-commonSimpleSAMLphp xml-common XXE vulnerability8.8 High
- verapdf verapdf-libraryPotential XXE (XML External Entity Injection) vulnerability in veraPDF CLI2.3 Low
- msg suisse ag easytaxXML External Entity (XXE) Vulnerability in EasyTax4.6 Medium
- hewlett packard enterprise (hpe) hpe insight remote support, hpe insight remote support +1 moreAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow...7.3 High
- hewlett packard enterprise (hpe) hpe insight remote support, hpe insight remote support +1 moreAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow...7.3 High
- hewlett packard enterprise (hpe) hpe insight remote support, hpe insight remote support +1 moreAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow...7.3 High
- microfocus imanagerPossible XML External Entity Injection in OpenText iManager7.5 High
- phpoffice phpspreadsheetXXE in PHPSpreadsheet's XLSX reader7.5 High
- phpoffice phpspreadsheetPhpSpreadsheet XmlScanner bypass leads to XXE7.5 High
- cisco catalyst sd-wan managerCisco SD-WAN vManage Software XML External Entity Vulnerability6.5 Medium
- rws worldserverAn XML External Entity (XXE) vulnerability in the Import object and Translation Memory import...6.5 Medium
- cisco catalyst sd-wan managerCisco SD-WAN vManage Software XML External Entity Vulnerability6.4 Medium
- ibm engineering insights, engineering lifecycle optimization - engineering insights +1 moreIBM Engineering Insights XML external entity injection8.2 High
- dompdf, dompdf dompdf/dompdf +1 moreImproper Restriction of XML External Entity Reference in dompdf/dompdf9.8 Critical
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability5.1 Medium
- tibco software inc hawk, operational intelligence +1 moreTIBCO Hawk Stored-XEE Vulnerability9.2 Critical
- hapifhir org.hl7.fhir.core, hl7 fhir core +1 moreXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`8.6 High
- manageengine sharepoint manager plus, zohocorp manageengine sharepoint manager plus +1 moreXML External Entity8.5 High
phpoffice/phpexcelPackagistPHPExcel XXE Vulnerability8.7 High- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine XML External Entity Injection Vulnerability5.5 Medium
- Show moreLoading…