CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,275 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 5 of 26

CVE-2017-9458CRITICALCVSS 9.8EG 9.8
2017-09-07
XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to ob…
CVE-2018-0100MEDIUMCVSS 4.4EG 4.4
2018-01-18
A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to imp…
CVE-2018-0108MEDIUMCVSS 5.3EG 5.3
2018-01-18
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain informati…
CVE-2018-0207LOWCVSS 3.3EG 3.3
2018-03-08
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerabi…
CVE-2018-0218LOWCVSS 3.3EG 3.3
2018-03-08
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerabi…
CVE-2018-0414MEDIUMCVSS 5.7EG 5.7
2018-10-05
A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML …
CVE-2018-0765HIGHCVSS 7.5EG 7.5
2018-05-09
A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft…
CVE-2018-0878LOWCVSS 3.1EG 3.1
2018-03-14
Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709…
CVE-2018-1000008HIGHCVSS 8.8EG 8.8
2018-01-23
Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side reques…
CVE-2018-1000009HIGHCVSS 8.8EG 8.8
2018-01-23
Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side…
CVE-2018-1000010HIGHCVSS 8.8EG 8.8
2018-01-23
Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side reques…
CVE-2018-1000011HIGHCVSS 8.8EG 8.8
2018-01-23
Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side r…
CVE-2018-1000012HIGHCVSS 8.8EG 8.8
2018-01-23
Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side r…
CVE-2018-1000054HIGHCVSS 8.3EG 8.3
2018-02-09
Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request…
CVE-2018-1000055HIGHCVSS 8.3EG 8.3
2018-02-09
Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-sid…
CVE-2018-1000056HIGHCVSS 8.3EG 8.3
2018-02-09
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side requ…
CVE-2018-1000069MEDIUMCVSS 5.5EG 5.5
2018-03-13
FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially cr…
CVE-2018-1000090HIGHCVSS 7.5EG 7.5
2018-03-13
textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable vi…
CVE-2018-1000124CRITICALCVSS 10.0EG 10.0
2018-03-13
I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack…
CVE-2018-1000198MEDIUMCVSS 6.5EG 6.5
2018-06-05
A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XM…
CVE-2018-1000515HIGHCVSS 7.5EG 7.5
2018-06-26
ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that can result in Attacker can read any file in the server or use smbrelay attack to a…
CVE-2018-1000540HIGHCVSS 7.8EG 7.8
2018-06-26
LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when viewing the XML file in the browser that can result in disclosure of confidential data, denial of servi…
CVE-2018-1000542HIGHCVSS 7.8EG 7.8
2018-06-26
netbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible information disclosure, server-side request forgery, or remote code execution. This attack appear to be …
CVE-2018-1000546HIGHCVSS 7.8EG 7.8
2018-06-26
Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible information disclosure, server-side request forgery, or remote code execution. This attack appear to be …
CVE-2018-1000548HIGHCVSS 7.8EG 7.8
2018-06-26
Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially …
CVE-2018-1000614CRITICALCVSS 9.8EG 9.8
2018-07-09
ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary …
CVE-2018-1000616CRITICALCVSS 9.8EG 9.8
2018-07-09
ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can…
CVE-2018-1000639CRITICALCVSS 9.6EG 9.6
2018-08-20
LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable v…
CVE-2018-1000644CRITICALCVSS 10.0EG 10.0
2018-08-20
Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port…
CVE-2018-1000651CRITICALCVSS 10.0EG 10.0
2018-08-20
Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable …
CVE-2018-1000652CRITICALCVSS 10.0EG 10.0
2018-08-20
JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to …
CVE-2018-1000820CRITICALCVSS 10.0EG 10.0
2018-12-20
neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerabili…
CVE-2018-1000821CRITICALCVSS 10.0EG 10.0
2018-12-20
MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exp…
CVE-2018-1000822CRITICALCVSS 10.0EG 10.0
2018-12-20
codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be expl…
CVE-2018-1000823CRITICALCVSS 10.0EG 10.0
2018-12-20
exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
CVE-2018-1000825CRITICALCVSS 10.0EG 10.0
2018-12-20
FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploi…
CVE-2018-1000828CRITICALCVSS 9.0EG 9.0
2018-12-20
FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attac…
CVE-2018-1000829CRITICALCVSS 9.0EG 9.0
2018-12-20
Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability a…
CVE-2018-1000830CRITICALCVSS 10.0EG 10.0
2018-12-20
XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
CVE-2018-1000831CRITICALCVSS 10.0EG 10.0
2018-12-20
K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via mali…
CVE-2018-1000834CRITICALCVSS 9.0EG 9.0
2018-12-20
runelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
CVE-2018-1000835CRITICALCVSS 10.0EG 10.0
2018-12-20
KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
CVE-2018-1000836CRITICALCVSS 9.0EG 9.0
2018-12-20
bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attac…
CVE-2018-1000837CRITICALCVSS 10.0EG 10.0
2018-12-20
UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via…
CVE-2018-1000838CRITICALCVSS 10.0EG 10.0
2018-12-20
autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Spe…
CVE-2018-1000840MEDIUMCVSS 6.5EG 6.5
2018-12-20
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This…
CVE-2018-1000844CRITICALCVSS 9.1EG 9.1
2018-12-20
Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file syst…
CVE-2018-1000889HIGHCVSS 8.8EG 8.8
2018-12-28
Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java) that can result in information leak, possibl…
CVE-2018-10077MEDIUMCVSS 4.9EG 4.9
2018-04-20
XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data.
CVE-2018-10175MEDIUMCVSS 6.5EG 6.5
2018-04-20
Digital Guardian Management Console 7.1.2.0015 has an XXE issue.

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →