CWE-611

Improper Restriction of XML External Entity Reference

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1,253 vulnerabilities with CWE-611
CVE-2018-1424 HIGH
IBM Marketing Platform 9.1.0, 9.1.2, and 10.1 - XML External Entity Injection
CVSS 7.1
CVE-2018-15362 CRITICAL
GE Proficy Cimplicity GDS <10.0 - SSRF
CVSS 9.1
CVE-2018-16792 CRITICAL
SolarWinds SFTP/SCP <2018-09-10 - Info Disclosure
CVSS 9.1
CVE-2018-1730 HIGH
IBM QRadar SIEM 7.2-7.3 - XML External Entity Injection
CVSS 7.1
CVE-2018-1905 HIGH
IBM WebSphere Application Server <9.0.0.10 - XXE
CVSS 7.1
CVE-2018-19244 HIGH
Charles 4.2.7 - XML External Entity Injection via Import/Export Setup
CVSS 8.6
CVE-2018-15444 MEDIUM
Cisco Energy Management Suite Software - Authenticated XML External Entity Injection via XML File Import
CVSS 6.3
CVE-2018-17186 HIGH
Apache Syncope - XML External Entity Injection
CVSS 7.2
CVE-2018-18980 HIGH
ManageEngine Network Configuration Manager & OpManager < 12.3.214 - XXE via RequestXML
CVSS 7.5
CVE-2018-1846 HIGH
IBM Rational Engineering Lifecycle Manager 5.0-5.0.2 and 6.0-6.0.6 - XML External Entity Injection
CVSS 7.1
CVE-2018-1835 HIGH
IBM Daeja ViewONE Professional, Standard & Virtual 5 - XML External Entity Injection
CVSS 7.1
CVE-2018-17912 HIGH
CASE Suite < 3.10 - XML External Entity Injection via Parameter Entity Processing
CVSS 7.5
CVE-2018-18737 HIGH
Douchat 4.0.4 - XML External Entity Injection via Data/notify.php
CVSS 7.5
CVE-2018-18659 HIGH
Arcserve UDP - Unauthenticated XML External Entity Injection via /management/UdpHttpService
CVSS 7.5
CVE-2018-1747 HIGH
IBM Security Key Lifecycle Manager 2.5-2.5.0.9 - XML External Entity Injection
CVSS 7.1
CVE-2018-1844 HIGH
IBM FileNet Content Manager 5.2.1 and 5.5.0 - XML External Entity Injection
CVSS 7.1
CVE-2018-12544 CRITICAL
Eclipse Vert.x 3.5.Beta1-3.5.3 - XML External Entity Injection via OpenAPI XML Type Validator
CVSS 9.8
CVE-2018-8533 MEDIUM
Microsoft SQL Server Management Studio <18 - Info Disclosure
CVSS 5.5
CVE-2018-8532 MEDIUM
Microsoft SQL Server Management Studio <18.0 - Info Disclosure
CVSS 5.5
CVE-2018-8527 MEDIUM
Microsoft SQL Server Management Studio <18.0 - Info Disclosure
CVSS 5.5
CVE-2018-8494 HIGH
Microsoft XML Core Services MSXML Parser - Remote Code Execution
CVSS 8.8
CVE-2018-11796 HIGH
Apache Tika 0.1-1.19 - XML External Entity Injection via SAXParser Reset
CVSS 7.5
CVE-2018-10614 HIGH
LeviStudioU 1.8.29 and 1.8.44 - XML External Entity Injection via Project XML File Processing
CVSS 8.8
CVE-2018-17889 MEDIUM
WECON PI Studio < 4.2.34 and PI Studio HMI < 4.1.9 - XML External Entity Injection in Project File Parser
CVSS 5.3
CVE-2018-0414 MEDIUM
Cisco Secure Access Control Server < 5.8 - Authenticated XML External Entity Injection via XML File Import
CVSS 5.7
Details
Vulnerabilities 1,253
Links
MITRE CWE Entry Search this CWE With Exploits