CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1,250 vulnerabilities with CWE-611
CVE-2023-43624
MEDIUM
CX-Designer <= 3.740 - XML External Entity Injection via Project File
CVSS 5.5
CVE-2023-45727
HIGH
KEV
Proself Enterprise/Standard Edition <= 5.62, Gateway Edition <= 1.65, Mail Sanitize Edition <= 1.08 - XXE Injection
CVSS 7.5
CVE-2023-36419
HIGH
Azure HDInsight - XML External Entity Injection in Apache Oozie Workflow Scheduler
CVSS 8.8
CVE-2023-41365
MEDIUM
SAP Business One (B1i) -10.0 - Info Disclosure
CVSS 4.3
CVE-2023-45612
HIGH
JetBrains Ktor < 2.3.5 - XML External Entity Injection via Default ContentNegotiation
CVSS 8.6
CVE-2023-42445
MEDIUM
Gradle < 7.6.3 - XML External Entity Injection via Ivy XML and Maven POM Parsing
CVSS 6.8
CVE-2023-42132
MEDIUM
FD Application < 9.01 - XML External Entity Injection
CVSS 5.5
CVE-2023-38343
HIGH
Ivanti Endpoint Manager <2022 SU4 - XSS
CVSS 7.5
CVE-2023-3892
MEDIUM
MIM Assistant/C - XML External Entity Reference
CVSS 5.6
CVE-2023-41369
LOW
SAP S/4HANA 100-108 - XML External Entity Injection via Payment Attachment
CVSS 3.5
CVE-2023-41933
HIGH
Jenkins Job Configuration History Plugin < 1229.v3039470161a_d - XML External Entity Injection
CVSS 8.8
CVE-2023-41932
MEDIUM
Jenkins Job Configuration History Plugin < 1227.v7a_79fc4dc01f - Directory Deletion via Timestamp Query Parameter
CVSS 6.5
CVE-2023-35892
HIGH
IBM Financial Transaction Manager for SWIFT Services 3.2.4 - XXE
CVSS 7.1
CVE-2023-40239
HIGH
Lexmark Printers Firmware < LW80.*.P246 - XXE Injection
CVSS 7.5
CVE-2023-41034
MEDIUM
Eclipse Leshan < 1.5.0 - XML External Entity Injection via DDF File Parsing
CVSS 6.5
CVE-2023-24620
MEDIUM
Esoteric YamlBeans <1.15 - Info Disclosure
CVSS 5.5
CVE-2023-0871
MEDIUM
OpenNMS Horizon < 32.0.2 and Meridian < 2020.1.38 - XML External Entity Injection via /rtc/post/ Endpoint
CVSS 5.4
CVE-2023-3823
HIGH
PHP <8.0.30, 8.1.*<8.1.22, 8.2.*<8.2.8 - Info Disclosure
CVSS 8.6
CVE-2023-32567
CRITICAL
Ivanti Avalanche < 6.4.1 - XML External Entity Injection in decodeToMap
CVSS 9.8
CVE-2023-35389
MEDIUM
Microsoft Dynamics 365 9.0-9.0.47.08 - Remote Code Execution via XML External Entity Injection
CVSS 6.5
CVE-2023-37497
HIGH
HCL Unica < 11.1.0.6 - Authenticated XML External Entity Injection
CVSS 8.1
CVE-2023-30951
MEDIUM
Palantir Foundry Magritte REST Source - XML External Entity Injection
CVSS 6.3
CVE-2023-37364
CRITICAL
WS-Inc J WBEM Server 4.0.0-4.7.4 - XML External Entity Injection in CIM-XML Protocol Adapter
CVSS 9.1
CVE-2023-38490
MEDIUM
Kirby <3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6 - XXE
CVSS 6.8
CVE-2023-32639
MEDIUM
Applicant Programme <= 7.06 - XML External Entity Injection
CVSS 5.5
Details
Vulnerabilities
1,250