CWE-611— Improper Restriction of XML External Entity Reference (XXE)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog
1,447 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-611page 22 of 29
- CVE-2023-51604MEDIUMCVSS 6.5EG 6.52024-05-03
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…
- CVE-2023-51602MEDIUMCVSS 6.5EG 6.52024-05-03
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…
- CVE-2023-51601MEDIUMCVSS 6.5EG 6.52024-05-03
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…
- CVE-2023-51600MEDIUMCVSS 6.5EG 6.52024-05-03
Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Su…
- CVE-2023-42035MEDIUMCVSS 6.5EG 6.52024-05-03
Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnectio…
- CVE-2023-39472MEDIUMCVSS 6.5EG 6.52024-05-03
Inductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Inductive Automati…
- CVE-2023-50380MEDIUMCVSS 6.5EG 6.52024-02-27
XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file rea…
- CVE-2023-52239MEDIUMCVSS 6.5EG 6.52024-02-06
The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.
- CVE-2024-23525MEDIUMCVSS 6.5EG 6.52024-01-18
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig.
- CVE-2023-6149MEDIUMCVSS 6.5EG 6.52024-01-09
Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any us…
- CVE-2023-6147MEDIUMCVSS 6.5EG 6.52024-01-09
Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This al…
- CVE-2022-34832MEDIUMCVSS 6.5EG 6.52023-10-27
An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component.
- CVE-2023-43067MEDIUMCVSS 6.5EG 6.52023-10-23
Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local files in the file system.
- CVE-2023-41932MEDIUMCVSS 6.5EG 6.52023-09-06
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file …
- CVE-2023-35389MEDIUMCVSS 6.5EG 6.52023-08-08
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2023-37942MEDIUMCVSS 6.5EG 6.52023-07-12
Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- CVE-2023-28009MEDIUMCVSS 6.5EG 6.52023-04-26
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2023-26058MEDIUMCVSS 6.5EG 6.52023-04-25
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit t…
- CVE-2023-26057MEDIUMCVSS 6.5EG 6.52023-04-25
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exp…
- CVE-2023-28340MEDIUMCVSS 6.5EG 6.52023-04-11
Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.
- CVE-2023-26043MEDIUMCVSS 6.5EG 6.52023-02-27
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to …
- CVE-2023-26267MEDIUMCVSS 6.5EG 6.52023-02-21
php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.
- CVE-2022-47950MEDIUMCVSS 6.5EG 6.52023-01-18
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting …
- CVE-2022-2330MEDIUMCVSS 6.5EG 6.52022-08-30
Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to v…
- CVE-2022-34001MEDIUMCVSS 6.5EG 6.52022-07-19
Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.
- CVE-2022-29943MEDIUMCVSS 6.5EG 6.52022-05-04
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, vers…
- CVE-2022-26661MEDIUMCVSS 6.5EG 6.52022-03-10
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through …
- CVE-2022-22835MEDIUMCVSS 6.5EG 6.52022-03-10
An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE vulnerability to read arbitrary files from the filesystem.
- CVE-2021-43576MEDIUMCVSS 6.5EG 6.52021-11-12
Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses ext…
- CVE-2021-21701MEDIUMCVSS 6.5EG 6.52021-11-12
Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- CVE-2021-20839MEDIUMCVSS 6.5EG 6.52021-11-01
Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by proce…
- CVE-2021-20801MEDIUMCVSS 6.5EG 6.52021-10-13
Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the information stored in the product via unspecified vectors. This issue occurs only when using Mozilla Fi…
- CVE-2021-3312MEDIUMCVSS 6.5EG 6.52021-10-08
An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
- CVE-2021-40439MEDIUMCVSS 6.5EG 6.52021-10-07
Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML f…
- CVE-2021-35201MEDIUMCVSS 6.5EG 6.52021-09-30
NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.
- CVE-2021-3055MEDIUMCVSS 6.5EG 6.52021-09-08
An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically craf…
- CVE-2020-26564MEDIUMCVSS 6.5EG 6.52021-07-31
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the surve…
- CVE-2021-27635MEDIUMCVSS 6.5EG 6.52021-06-09
SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the application because of missing XML Validation…
- CVE-2021-32925MEDIUMCVSS 6.5EG 6.52021-05-13
admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.
- CVE-2020-36124MEDIUMCVSS 6.5EG 6.52021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access t…
- CVE-2021-25164MEDIUMCVSS 6.5EG 6.52021-04-28
A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
- CVE-2021-27736MEDIUMCVSS 6.5EG 6.52021-04-22
FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.
- CVE-2021-27604MEDIUMCVSS 6.5EG 6.52021-04-14
In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refe…
- CVE-2021-26969MEDIUMCVSS 6.5EG 6.52021-03-05
A remote authenticated authenticated xml external entity (xxe) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Due to improper restrictions on XML entities a vulnerability exists in the web-…
- CVE-2020-26981MEDIUMCVSS 6.5EG 6.52021-01-12
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This i…
- CVE-2020-35123MEDIUMCVSS 6.5EG 6.52020-12-17
In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer store extension, which is vulnerable to XXE attacks. This has been fixed in Zimbra Collaboration Suit…
- CVE-2020-29436MEDIUMCVSS 6.5EG 6.52020-12-17
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.
- CVE-2020-7032MEDIUMCVSS 6.5EG 6.52020-11-13
An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Av…
- CVE-2020-2315MEDIUMCVSS 6.5EG 6.52020-11-04
Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- CVE-2020-2305MEDIUMCVSS 6.5EG 6.52020-11-04
Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Map vulnerabilities like CWE-611 to your infrastructure
EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →