Weakness (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

Base Draft

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it (1 mitigation)

Implementation, System Configuration

Many XML parsers and validators can be configured to disable external entity expansion.

Source: MITRE CWE-611

All Critical High Medium Low Exploited only Public exploit

941 results · Feed

Medium 5.8

CVE-2022-43473 EPSS 20%

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12…

ManageEngine OpManager

Mar 30, 2023
Medium 5.5

CVE-2022-36969 EPSS 14%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 20…

AVEVA Edge Browsers

Mar 29, 2023
Medium 5.3

CVE-2023-28151

An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) i…

Mar 24, 2023
Medium 5.3

CVE-2023-28152

An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injectio…

Mar 24, 2023
Medium 5.3

CVE-2023-28150

An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection…

Mar 24, 2023
Medium 6.5

CVE-2023-28684

Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks

Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins remote-jobs-view-plugin Plugin com.sap.jenkinsci:remote-jobs-view-plugin Web / CMS Maven

Mar 23, 2023
High 8.2

CVE-2023-28683

Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Phabricator Differential Plugin org.jenkins-ci.plugins:phabricator-plugin Web / CMS Maven

Mar 23, 2023
High 8.2

CVE-2023-28682

Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacks

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Performance Publisher Plugin org.jenkins-ci.plugins:perfpublisher Web / CMS Maven

Mar 23, 2023
High 8.2

CVE-2023-28681

Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks

Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Visual Studio Code Metrics Plugin org.jenkins-ci.plugins:vs-code-metrics Web / CMS Maven

Mar 23, 2023
High 7.5

CVE-2023-28680

Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacks

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Crap4J Plugin org.jenkins-ci.plugins:crap4j Web / CMS Maven

Mar 23, 2023
Medium 5.5

CVE-2022-45468

CVE-2022-45468

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

VISAM VBASE

Mar 21, 2023
Medium 5.5

CVE-2022-45121

CVE-2022-45121

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

VISAM VBASE

Mar 21, 2023
Medium 5.5

CVE-2022-41696

CVE-2022-41696

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

VISAM VBASE

Mar 21, 2023
Medium 5.5

CVE-2022-43512

CVE-2022-43512

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

VISAM VBASE

Mar 21, 2023
Medium 5.5

CVE-2022-46300

CVE-2022-46300

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

VISAM VBASE

Mar 21, 2023
Medium 6.3

CVE-2018-25082

zwczou WeChat SDK Python to_xml xml external entity reference

A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 …

zwczou WeChat SDK Python weixin-python PyPI

Mar 21, 2023
High 7.1

CVE-2023-28685

Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins AbsInt a³ Plugin org.jenkins-ci.plugins:absint-a3 Web / CMS Maven

Mar 21, 2023
Critical 9.9

CVE-2023-27874

IBM Aspera Faspex XML external entity injection

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.

IBM Aspera Faspex

Mar 21, 2023
Medium 6.8

CVE-2023-26461

XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)

SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files a…

SAP NetWeaver (SAP Enterprise Portal)

Mar 14, 2023
Medium 6.8

CVE-2023-1288

ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability

An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.

Dassault Systèmes ENOVIA Live Collaboration

Mar 9, 2023
High 8.2

CVE-2023-27476

XML External Entity (XXE) Injection in OWSLib

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and…

geopython OWSLib owslib owslib Debian Ubuntu PyPI

Mar 7, 2023
High 7.7

CVE-2023-27480

Data leak through a XAR import XXE attack in xwiki-platform-xar-model

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content…

xwiki xwiki-platform org.xwiki.platform:xwiki-platform-xar-model Maven

Mar 7, 2023
Medium 6.5

CVE-2023-26043

XML External Entity (XXE) injection in GeoServer style upload functionality

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read.…

GeoNode GeoNode geonode PyPI

Feb 27, 2023
Medium 5.9

GHSA-9vx8-f5c4-862x

XML External Entity (XXE) vulnerability in apoc.import.graphml

### Impact A XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser…

org.neo4j.procedure:apoc Maven

Feb 24, 2023
Critical 9.8

CVE-2023-24189

An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a c…

Feb 24, 2023
Medium 5.5

CVE-2015-10082

UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference

A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086c…

UIKit0 libplist

Feb 21, 2023
Medium 6.5

CVE-2023-26267

php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XM…

Feb 21, 2023
High 8.8

CVE-2023-20855

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administr…

Feb 21, 2023
Medium 5.3

CVE-2016-15026

3breadt dd-plist xml external entity reference

A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 …

3breadt dd-plist com.googlecode.plist:dd-plist Maven

Feb 20, 2023
Medium 5.5

CVE-2014-125087

java-xmlbuilder xml external entity reference

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. Th…

java-xmlbuilder com.jamesmurty.utils:java-xmlbuilder Ubuntu Maven

Feb 19, 2023
High 7.5

CVE-2021-33950

An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor functio…

Feb 17, 2023
Medium 6.9

CVE-2022-39954

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC ver…

Fortinet FortiNAC Network devices

Feb 16, 2023
Medium 5.3

CVE-2023-20052 Public exploit

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG f…

Cisco Cisco Secure Endpoint clamav clamav Network devices Debian Ubuntu Azure Linux Alpine

Feb 16, 2023
Medium 5.9

CVE-2023-23926

XML External Entity (XXE) vulnerability in apoc.import.graphml

APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML Externa…

neo4j apoc org.neo4j.procedure:apoc-core Maven

Feb 16, 2023
High 7.4

CVE-2023-22377

Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all…

Fujitsu tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools

Feb 15, 2023
High 7.8

CVE-2023-24187

XML External Entity Reference in ureport

An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.

com.bstek.ureport:ureport2-core Maven

Feb 14, 2023
High 7.5

CVE-2023-22832

Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type…

Apache Software Foundation Apache NiFi org.apache.nifi:nifi-ccda-processors Maven

Feb 10, 2023
High 8.8

CVE-2023-24323

Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.

Feb 9, 2023
High 7.8

CVE-2022-45588

All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) ty…

Feb 3, 2023
High 7.1

CVE-2022-38389

IBM Tivoli Workload Scheduler XML external entity injection

IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-For…

IBM Tivoli Workload Scheduler

Feb 2, 2023