CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,345 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 4 of 27

CVE-2018-11788CRITICALCVSS 9.8EG 9.8
2019-01-07
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn'…
CVE-2019-5312CRITICALCVSS 9.8EG 9.8
2019-01-04
An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318.
CVE-2018-20664CRITICALCVSS 9.8EG 9.8
2019-01-03
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.
CVE-2018-14720CRITICALCVSS 9.8EG 9.8
2019-01-02
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVE-2018-20433CRITICALCVSS 9.8EG 9.8
2018-12-24
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
CVE-2018-20318CRITICALCVSS 9.8EG 9.8
2018-12-21
An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.
CVE-2018-20059CRITICALCVSS 9.8EG 9.8
2018-12-11
jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
CVE-2018-12544CRITICALCVSS 9.8EG 9.8
2018-10-10
In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenA…
CVE-2018-17411CRITICALCVSS 9.8EG 9.8
2018-09-26
An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.
CVE-2018-15531CRITICALCVSS 9.8EG 9.8
2018-09-26
JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
CVE-2018-16521CRITICALCVSS 9.8EG 9.8
2018-09-05
An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0.
CVE-2018-13417CRITICALCVSS 9.8EG 9.8
2018-08-13
In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary fi…
CVE-2018-13415CRITICALCVSS 9.8EG 9.8
2018-08-13
In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary fil…
CVE-2018-13416CRITICALCVSS 9.8EG 9.8
2018-08-03
In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrar…
CVE-2018-8027CRITICALCVSS 9.8EG 9.8
2018-07-31
Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
CVE-2018-10600CRITICALCVSS 9.8EG 9.8
2018-07-24
SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms…
CVE-2018-14065CRITICALCVSS 9.8EG 9.8
2018-07-15
XMLReader.php in PHPOffice Common before 0.2.9 allows XXE.
CVE-2018-12463CRITICALCVSS 9.8EG 9.8
2018-07-12
An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted …
CVE-2018-1000616CRITICALCVSS 9.8EG 9.8
2018-07-09
ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in onos\drivers\utilities\src\main\java\org\onosproject\drivers\utilities\XmlConfigParser.java loadxml() that can result in An adversary can…
CVE-2018-1000614CRITICALCVSS 9.8EG 9.8
2018-07-09
ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary …
CVE-2017-3208CRITICALCVSS 9.8EG 9.8
2018-06-11
The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly…
CVE-2017-3206CRITICALCVSS 9.8EG 9.8
2018-06-11
The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it…
CVE-2018-11586CRITICALCVSS 9.8EG 9.8
2018-06-05
XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
CVE-2018-10653CRITICALCVSS 9.8EG 9.8
2018-05-23
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-1309CRITICALCVSS 9.8EG 9.8
2018-05-23
Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applie…
CVE-2018-1183CRITICALCVSS 9.8EG 9.8
2018-04-30
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS version…
CVE-2014-3990CRITICALCVSS 9.8EG 9.8
2018-03-20
The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitra…
CVE-2017-18197CRITICALCVSS 9.8EG 9.8
2018-02-24
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.
CVE-2018-6489CRITICALCVSS 9.8EG 9.8
2018-02-22
XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML External Entity (XXE)
CVE-2017-7375CRITICALCVSS 9.8EG 9.8
2018-02-19
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, t…
CVE-2014-3244CRITICALCVSS 9.8EG 9.8
2018-02-01
XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
CVE-2014-3005CRITICALCVSS 9.8EG 9.8
2018-02-01
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a cra…
CVE-2017-1000497CRITICALCVSS 9.8EG 9.8
2018-01-03
Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution
CVE-2014-3630CRITICALCVSS 9.8EG 9.8
2017-12-29
XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact …
CVE-2017-14101CRITICALCVSS 9.8EG 9.8
2017-12-15
A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical Imaging Company, which is now a Change Healthcare company. An unauthenticated us…
CVE-2014-3600CRITICALCVSS 9.8EG 9.8
2017-10-27
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
CVE-2014-3579CRITICALCVSS 9.8EG 9.8
2017-10-27
XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
CVE-2014-9487CRITICALCVSS 9.8EG 9.8
2017-10-17
The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to…
CVE-2017-12629CRITICALCVSS 9.8EG 9.8
2017-10-14
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses L…
CVE-2014-0030CRITICALCVSS 9.8EG 9.8
2017-10-10
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
CVE-2017-14759CRITICALCVSS 9.8EG 9.8
2017-10-03
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11E…
CVE-2017-12620CRITICALCVSS 9.8EG 9.8
2017-10-03
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to …
CVE-2017-12621CRITICALCVSS 9.8EG 9.8
2017-09-28
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to conn…
CVE-2017-9458CRITICALCVSS 9.8EG 9.8
2017-09-07
XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to ob…
CVE-2015-7241CRITICALCVSS 9.8EG 9.8
2017-09-06
XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
CVE-2016-6798CRITICALCVSS 9.8EG 9.8
2017-07-19
In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input…
CVE-2017-10670CRITICALCVSS 9.8EG 9.8
2017-06-30
An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conforming OSCI message from within the infrast…
CVE-2015-7326CRITICALCVSS 9.8EG 9.8
2017-06-07
XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
CVE-2017-7503CRITICALCVSS 9.8EG 9.8
2017-05-18
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
CVE-2015-7273CRITICALCVSS 9.8EG 9.8
2017-04-10
Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →