CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- rti connext professionalImproper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.8.8 High
- lobster gmbh pro, lobster-world lobster pro +1 moreArbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro7.7 High
- 4d serverArbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP8.7 High
- No product listedAn XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4...8.8 High
- nsa grassmarlinNSA GRASSMARLIN Improper Restriction of XML External Entity Reference5.5 Medium
- oracle graalvm, graalvm for jdk, jdk +33 more +35 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...7.5 High
- lxmllxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files7.5 High
- wso2 api managerXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files3.5 Low
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreXML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service7.5 High
- openremoteOpenRemote has XXE in Velbus Asset Import7.6 High
- microsoft .net, powershell 7.6, microsoft .net 10.0 +11 more +13 more.NET Denial of Service Vulnerability7.5 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has an XML External Entity (XXE) Injection5.3 Medium
- rti connext professionalImproper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) all…8.8 High
- microsoft xml notepad, xmlnotepad +1 moreXML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading6.5 Medium
- getgrav gravGrav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload...7.6 High
- inkscapeImproper Restriction of XML External Entity Reference in Inkscape6.3 Medium
- open-emr openemrOpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files7.7 High
- arekinath esamlXXE in esaml SAML library allows local file read and potential SSRF6.3 Medium
- synacor zimbra collaboration suiteAn issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE)...4.3 Medium
- slovensko.digital autogramImproper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko...8.6 High
- tolgee, tolgee tolgee-platform +1 moreTolgee has an XXE Injection in Translation Import9.3 Critical
- ibm infosphere information serverIBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability7.1 High
- jeesitethinkgem JeeSite Endpoint CasOutHandler.java xml external entity reference2.3 Low
- xerox freeflow coreXML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)7.5 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 XML External Entity Reference7.1 High
- opencc jflowopencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity reference5.3 Medium
- top password software msn password recoveryMSN Password Recovery 1.30 - XML External Entity Injection6.7 Medium
- schneider eelctric ecostruxure building operation workstation, schneider electric ecostruxure building operation webstation +1 moreCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...7.0 High
- zoneland o2oaO2OA HTTP POST Request check xml external entity reference5.3 Medium
- asterisk, sangoma certified asterisk +1 moreAsterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection2.0 Low
- apache syncopeApache Syncope: Console XXE on Keymaster parameters4.9 Medium
- atlassian crowd, crowd data center +1 moreThis High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7...7.9 High
- assertjAssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion8.2 High
- bjskzy zhiyou erpBjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity reference5.3 Medium
- opensagres xdocreportXDocReport affected by an XML External Entity (XXE) vulnerability9.8 Critical
- kraft plugins demo importer plusDemo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload7.5 High
- geonetworkGeonetwork 4.2.0 - XML External Entity (XXE)8.7 High
- apache struts, red hat enterprise linux 8, fuse 7 +2 more +4 moreApache Struts, Apache Struts: XXE vulnerability in outdated XWork component8.1 High
- open microscopy environment bio-formatsBio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser4.6 Medium
- cisco identity services engine softwareCisco Identity Services Engine XML External Entity Processing Information Disclosure Vulnerability4.9 Medium
- dell unisphere for powermax, unisphere for powermax virtual appliance +1 moreDell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML...7.6 High
- apache software foundation sis, apache spatial information system +1 moreApache SIS: XML External Entity (XXE) vulnerability6.5 Medium
- beecue fastbeebeecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference6.3 Medium
- kyocera net adminKYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection7.1 High
- novarad corporation novapacs diagnostics viewerNovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection7.1 High
- jcthiele openxrechnungtoolboxOpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow...5.0 Medium
- biopythonBiopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez4.9 Medium
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)7.4 High
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)6.8 Medium
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)6.2 Medium
- Show moreLoading…