CWE-611

Improper Restriction of XML External Entity Reference

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1,250 vulnerabilities with CWE-611
CVE-2022-28890 CRITICAL
Apache Jena <4.4.0 - Info Disclosure
CVSS 9.8
CVE-2022-29943 MEDIUM
Talend Administration Center - Authenticated XML External Entity Injection
CVSS 6.5
CVE-2022-20780 CRITICAL
Cisco Enterprise NFV Infrastructure Software < 4.7.1 - Unauthenticated Command Injection and Data Leak
CVSS 9.9
CVE-2022-1331 MEDIUM
DMARS < 2.1.10.24 - XML External Entity Injection in Project File Processing
CVSS 5.5
CVE-2022-21949 HIGH
SUSE Open Build Service <2.10.13 - Info Disclosure
CVSS 8.8
CVE-2022-29265 HIGH
Apache NiFi 0.0.1-1.16.0 - XML External Entity Injection in Standard Content Viewer and Processors
CVSS 7.5
CVE-2022-24449 CRITICAL
Solar appScreener <= 3.10.4 - XML External Entity Injection and Server-Side Request Forgery via Crafted XML Document
CVSS 9.8
CVE-2022-24898 MEDIUM
XWiki Commons 2.7-12.10.9, 13.0-13.4.3, 13.5-13.7.9 - XML External Entity Injection via XML Script Service
CVSS 4.9
CVE-2022-0272 CRITICAL
detekt < 1.20.0 - XML External Entity Injection
CVSS 9.8
CVE-2022-0221 MEDIUM
SCADAPack Workbench <6.6.8a - Info Disclosure
CVSS 5.5
CVE-2022-28219 CRITICAL
ManageEngine ADAudit Plus CVE-2022-28219
CVSS 9.8
CVE-2022-1018 MEDIUM
Rockwell Automation Connected Components Workbench < 12.0 - XML External Entity Injection via Malicious Solution File
CVSS 5.5
CVE-2022-28155 HIGH
Jenkins Pipeline: Phoenix AutoTest Plugin < 1.3 - XML External Entity Injection
CVSS 8.1
CVE-2022-28154 HIGH
Jenkins Coverage/Complexity Scatter Plot Plugin < 1.1.1 - XML External Entity Injection
CVSS 8.1
CVE-2022-28140 HIGH
Jenkins Flaky Test Handler Plugin < 1.2.1 - XML External Entity Injection
CVSS 8.1
CVE-2022-0861 LOW
McAfee ePolicy Orchestrator < 5.10.0 - Authenticated XML External Entity Injection via Extension Import
CVSS 3.5
CVE-2022-27193 MEDIUM
CVRF-CSAF-Converter < 1.0.0-rc2 - XML External Entity Injection
CVSS 6.1
CVE-2022-26661 MEDIUM
Tryton Application Platform <6.2.5-6.2.1 - XXE
CVSS 6.5
CVE-2022-22835 MEDIUM
OverIT Geocall < 8.0 - Authenticated XML External Entity Injection via Test Trasformazione XSL
CVSS 6.5
CVE-2022-22795 MEDIUM
Signiant Manager+Agents - XML External Entity Injection
CVSS 6.8
CVE-2022-25312 CRITICAL
Apache Any23 < 2.7 - XML External Entity Injection in RDFa XSLTStylesheet Extractor
CVSS 9.1
CVE-2022-0839 CRITICAL
liquibase < 4.8.0 - XML External Entity Injection
CVSS 9.8
CVE-2022-0265 CRITICAL
GitHub hazelcast/hazelcast <5.1-BETA-1 - SSRF
CVSS 9.8
CVE-2022-23640 CRITICAL
excel_streaming_reader < 2.1.0 - XML External Entity Injection
CVSS 9.8
CVE-2022-24340 CRITICAL
JetBrains TeamCity <2021.2.1 - Info Disclosure
CVSS 9.8
Details
Vulnerabilities 1,250
Links
MITRE CWE Entry Search this CWE With Exploits