Weakness (CWE)
CWE-611: Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
How to prevent it (1 mitigation)
-
Implementation, System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
Source: MITRE CWE-611
342 results · Clear filters · Feed
-
Medium 6.3
IBM WebSphere Application Server XML external entity injection
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force I…
-
Medium 5.5
CVE-2022-45876
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 4.9
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, an…
-
Medium 6.5
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input v…
-
Medium 6.5
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. I…
-
Medium 5.5
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of ser…
-
Medium 5.5
All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks…
-
Medium 5.5
All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks…
-
Medium 5.9
A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Ent…
-
Medium 6.5
Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.
-
Medium 5.5
National land numerical information data conversion tool all versions improperly restricts XML external entity referenc…
-
Medium 6.0
Cisco Identity Services Engine XML External Entity Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an affected device, or neg…
-
Medium 5.8CVE-2022-43473 EPSS 20%
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12…
-
Medium 5.5CVE-2022-36969 EPSS 14%
This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 20…
-
Medium 5.3
An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) i…
-
Medium 5.3
An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injectio…
-
Medium 5.3
An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection…
-
Medium 6.5
Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks
Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Medium 5.5
CVE-2022-45468
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-45121
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-41696
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-43512
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 5.5
CVE-2022-46300
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
-
Medium 6.3
zwczou WeChat SDK Python to_xml xml external entity reference
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 …
-
Medium 6.8
XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)
SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files a…
-
Medium 6.8
ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability
An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.
-
Medium 6.5
XML External Entity (XXE) injection in GeoServer style upload functionality
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read.…
-
Medium 5.9
XML External Entity (XXE) vulnerability in apoc.import.graphml
### Impact A XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser…
-
Medium 5.5
UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference
A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086c…
-
Medium 6.5
php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XM…
-
Medium 5.3
3breadt dd-plist xml external entity reference
A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 …
-
Medium 5.5
java-xmlbuilder xml external entity reference
A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. Th…
-
Medium 6.9
An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC ver…
-
Medium 5.3CVE-2023-20052 Public exploit
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG f…
-
Medium 5.9
XML External Entity (XXE) vulnerability in apoc.import.graphml
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML Externa…
-
Medium 5.5
Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and e…
-
Medium 6.5
OpenStack Swift XML external entities (XXE) Injection
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read…
-
Medium 5.5
Talend Open Studio for MDM XML xml external entity reference
A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31d442b9fb1d518128fd18…
-
Medium 5.5
kelvinmo simplexrd simplexrd.class.php xml external entity reference
A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is ab…
-
Medium 5.5
e-Contract dssp SignResponseVerifier.java checkSignResponse xml external entity reference
A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java. The manipulation le…