CWE-611— Improper Restriction of XML External Entity Reference (XXE)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog
1,349 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-611page 24 of 27
- CVE-2023-43624MEDIUMCVSS 5.5EG 5.52023-10-23
CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensit…
- CVE-2022-32755MEDIUMCVSS 5.5EG 5.52023-10-14
IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. I…
- CVE-2023-42132MEDIUMCVSS 5.5EG 5.52023-10-02
FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- CVE-2023-24620MEDIUMCVSS 5.5EG 5.52023-08-25
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small Y…
- CVE-2023-32639MEDIUMCVSS 5.5EG 5.52023-07-25
Applicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- CVE-2023-32635MEDIUMCVSS 5.5EG 5.52023-07-19
XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker.
- CVE-2023-37200MEDIUMCVSS 5.5EG 5.52023-07-12
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacing a project file on the local filesystem and after manual restart of the server.
- CVE-2023-29498MEDIUMCVSS 5.5EG 5.52023-06-13
Improper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. If a user opens a specially crafted project file, sensitive information on the system where the affected product is…
- CVE-2023-2806MEDIUMCVSS 5.5EG 5.52023-05-19
A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated…
- CVE-2022-45876MEDIUMCVSS 5.5EG 5.52023-04-26
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
- CVE-2023-27652MEDIUMCVSS 5.5EG 5.52023-04-20
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _default_.xml file.
- CVE-2023-26264MEDIUMCVSS 5.5EG 5.52023-04-13
All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code.
- CVE-2023-26263MEDIUMCVSS 5.5EG 5.52023-04-13
All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server.
- CVE-2023-25955MEDIUMCVSS 5.5EG 5.52023-04-11
National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
- CVE-2022-46300MEDIUMCVSS 5.5EG 5.52023-03-21
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
- CVE-2022-46286MEDIUMCVSS 5.5EG 5.52023-03-21
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
- CVE-2022-45468MEDIUMCVSS 5.5EG 5.52023-03-21
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
- CVE-2022-45121MEDIUMCVSS 5.5EG 5.52023-03-21
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
- CVE-2022-43512MEDIUMCVSS 5.5EG 5.52023-03-21
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
- CVE-2022-41696MEDIUMCVSS 5.5EG 5.52023-03-21
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
- CVE-2014-125087MEDIUMCVSS 5.5EG 5.52023-02-19
A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to ad…
- CVE-2023-22322MEDIUMCVSS 5.5EG 5.52023-01-30
Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, sensitive information in the file syste…
- CVE-2015-10029MEDIUMCVSS 5.5EG 5.52023-01-07
A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to…
- CVE-2016-15011MEDIUMCVSS 5.5EG 5.52023-01-06
A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java.…
- CVE-2020-36641MEDIUMCVSS 5.5EG 5.52023-01-05
A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml exte…
- CVE-2020-36640MEDIUMCVSS 5.5EG 5.52023-01-05
A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/Secur…
- CVE-2022-4818MEDIUMCVSS 5.5EG 5.52022-12-28
A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java.…
- CVE-2022-37911MEDIUMCVSS 5.5EG 5.52022-12-12
Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the applicati…
- CVE-2022-45386MEDIUMCVSS 5.5EG 5.52022-11-15
Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- CVE-2022-1331MEDIUMCVSS 5.5EG 5.52022-05-03
In four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project files, which may allow unauthorized information disclosure.
- CVE-2022-0221MEDIUMCVSS 5.5EG 5.52022-04-13
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploi…
- CVE-2022-1018MEDIUMCVSS 5.5EG 5.52022-04-01
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from lo…
- CVE-2022-0219MEDIUMCVSS 5.5EG 5.52022-01-20
Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
- CVE-2021-44028MEDIUMCVSS 5.5EG 5.52021-12-22
XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.
- CVE-2021-3836MEDIUMCVSS 5.5EG 5.52021-12-14
dbeaver is vulnerable to Improper Restriction of XML External Entity Reference
- CVE-2021-44147MEDIUMCVSS 5.5EG 5.52021-11-22
An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks.
- CVE-2021-37178MEDIUMCVSS 5.5EG 5.52021-08-10
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the underlying XML parser could cause the affected application to disclose arbitrary files to remote att…
- CVE-2021-32972MEDIUMCVSS 5.5EG 5.52021-07-09
Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that…
- CVE-2021-27492MEDIUMCVSS 5.5EG 5.52021-05-27
When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary fi…
- CVE-2020-28387MEDIUMCVSS 5.5EG 5.52021-03-15
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote a…
- CVE-2020-26513MEDIUMCVSS 5.5EG 5.52020-12-07
An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML Ext…
- CVE-2020-13940MEDIUMCVSS 5.5EG 5.52020-10-01
In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the…
- CVE-2020-4510MEDIUMCVSS 5.5EG 5.52020-07-14
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Forc…
- CVE-2020-11541MEDIUMCVSS 5.5EG 5.52020-05-08
In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltrate data under the local Administrator account.
- CVE-2019-17554MEDIUMCVSS 5.5EG 5.52019-12-04
The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, ca…
- CVE-2019-12415MEDIUMCVSS 5.5EG 5.52019-10-23
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resource…
- CVE-2019-10976MEDIUMCVSS 5.5EG 5.52019-07-26
Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the…
- CVE-2018-8533MEDIUMCVSS 5.5EG 5.52018-10-10
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulne…
- CVE-2018-8532MEDIUMCVSS 5.5EG 5.52018-10-10
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulne…
- CVE-2018-8527MEDIUMCVSS 5.5EG 5.52018-10-10
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulner…
Map vulnerabilities like CWE-611 to your infrastructure
EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →