Weakness (CWE)
CWE-611: Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
How to prevent it (1 mitigation)
-
Implementation, System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
Source: MITRE CWE-611
131 results · Clear filters · Feed
-
Critical 9.8
ZendFramework vulnerable to XXE/XEE attacks
Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks: - XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities t…
-
Critical 9.8
Zendframework vulnerable to XXE/XEE attacks
Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks: - XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities t…
-
Critical 9.1
ebookmeta XML External Entity vulnerability
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
-
Critical 9.8
Symfony XML decoding attack vector through external entities
The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include a…
-
Critical 9.8
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that…
-
Critical 9.8
An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of …
-
Critical 9.8
Apache Cocoon's StreamGenerator is vulnerable to XXE injection
Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
-
Critical 9.8
OpenCRX allows a remote attacker to execute arbitrary code via a crafted request
An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.
-
Critical 9.1
Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.
-
Critical 9.9
IBM Aspera Faspex XML external entity injection
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.
-
Critical 9.8
An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a c…
-
Critical 10.0
IBM Tivoli Workload Scheduler XML external entity injection
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-For…
-
Critical 9.8
Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).
-
Critical 9.8
XML external entity vulnerability on agents in Jenkins MSTest Plugin
Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins …
-
Critical 9.8
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
XML Entity Expansion in Jenkins TestComplete support Plugin
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
Jenkins Plot Plugin XML External Entity Reference vulnerability
Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in So…
-
Critical 9.8
XXE vulnerability on agents in Jenkins OSF Builder Suite : : XML Linter Plugin
Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
XML External Entity Reference in Jenkins CCCC Plugin
Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
XXE vulnerability in Jenkins JAPEX Plugin
Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
XXE vulnerability on agents in Jenkins SourceMonitor Plugin
Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.1
"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing …
-
Critical 9.1CVE-2022-31678 Scanner template
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V de…
-
Critical 9.8
Jenkins RQM Plugin vulnerable to Improper Restriction of XML External Entity Reference
Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
Jenkins Compuware Common Configuration Plugin vulnerable to Improper Restriction of XML External Entity Reference
Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Critical 9.8
Apache Calcite: potential XEE attacks
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefo…
-
Critical 9.8
Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2
Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.
-
Critical 9.8
Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues
Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a do…
-
Critical 9.8
XML External Entity Reference in drools
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
-
Critical 9.8
Processing external DTDs
A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.
-
Critical 9.8
Improper Restriction of XML External Entity Reference in soa-model
An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
-
Critical 9.1
An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor
An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attack…
-
Critical 9.8
Improper Restriction of XML External Entity Reference in Excel-Streaming-Reader
Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.…
-
Critical 9.8
AEM Forms Improper Restriction of XML External Entity Reference
AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
-
Critical 9.8
Improper Restriction of XML External Entity Reference in dbeaver/dbeaver
dbeaver is vulnerable to Improper Restriction of XML External Entity Reference
-
Critical 9.1
XML External Entity vulnerability in Easy-XML
The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as i…
-
Critical 9.1
XML External Entity vulnerability in MODX CMS
A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).
-
Critical 9.8
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference