CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1,255 vulnerabilities with CWE-611
CVE-2014-3990
CRITICAL
OpenCart < 1.5.6.4 - Server-Side Request Forgery and XML External Entity Injection via Cart Update
CVSS 9.8
CVE-2014-3244
CRITICAL
SugarCRM < 6.5.16 - XML External Entity Injection via RSSDashlet
CVSS 9.8
CVE-2014-3005
CRITICAL
Zabbix 1.8.x-1.8.20 2.0.x-2.0.12 2.2.x-2.2.4 2.3.x-2.3.1 - XML External Entity Injection via DTD in XML Request
CVSS 9.8
CVE-2014-3630
CRITICAL
Play Framework < 2.2.6 and 2.3.x < 2.3.5 - XML External Entity Injection
CVSS 9.8
CVE-2014-3600
CRITICAL
Apache ActiveMQ 5.x < 5.10.1 - XML External Entity Injection via XPath Selector
CVSS 9.8
CVE-2014-3579
CRITICAL
Apache ActiveMQ Apollo 1.0.0-1.7.0 - XML External Entity Injection via XPath Selector
CVSS 9.8
CVE-2014-9487
CRITICAL
MediaWiki <1.24.1, 1.23.8, 1.22.15, 1.19.23 - Info Disclosure
CVSS 9.8
CVE-2014-0030
CRITICAL
Apache Roller - XML External Entity Injection
CVSS 9.8
CVE-2014-0225
HIGH
Spring Framework 3.0.0-3.2.8 and 4.0.0-4.0.4 - XML External Entity Injection
CVSS 8.8
CVE-2014-3004
Castor < 1.3.3 - XML External Entity Injection via Default Xerces SAX Parser Configuration
CVE-2013-4334
CRITICAL
opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0 - XML External Entity Injection
CVSS 9.8
CVE-2013-4333
CRITICAL
OpenPNE 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 - XML External Entity Injection
CVSS 9.1
CVE-2013-6429
Spring Framework < 3.2.5 - XML External Entity Injection and Cross-Site Request Forgery via Unsafe XML Parsing
CVE-2013-0340
libexpat < 2.4.0 - XML External Entity Injection
CVE-2013-1824
Redhat Enterprise Linux < 10.8.5 - XXE
CVE-2013-1915
ModSecurity < 2.7.3 - XML External Entity Injection
CVE-2012-1102
HIGH
XML::Atom < 0.39 - XML External Entity Injection
CVSS 7.5
CVE-2012-2656
HIGH
Restlet 1.1.10 - XML External Entity Injection via XML Transport Endpoint
CVSS 7.5
CVE-2012-3363
CRITICAL
Zend Framework 1.x < 1.11.12 and 1.12.x < 1.12.0 - XML External Entity Injection via XML-RPC Request
CVSS 9.1
CVE-2012-5656
MEDIUM
Inkscape < 0.48.4 - XML External Entity Injection via SVG File Processing
CVSS 5.5
CVE-2012-2239
CRITICAL
Mahara 1.4.0-1.4.3 and 1.5.0-1.5.2 - XML External Entity Injection
CVSS 9.1
CVE-2012-4399
HIGH
CakePHP 2.1.0-2.1.4 and 2.1.0-alpha-2.1.4 - XML External Entity Injection
CVSS 7.5
CVE-2012-3489
MEDIUM
PostgreSQL 8.3.0-8.3.19, 8.4.0-8.4.12, 9.0.0-9.0.8, 9.1.0-9.1.4 - XXE Injection via xml_parse
CVSS 6.5
CVE-2012-0037
MEDIUM
Redland Raptor < 2.0.7 - XML External Entity Injection via RDF Document
CVSS 6.5
CVE-2011-3600
HIGH
Apache OFBiz 16.11.01-16.11.04 - XML External Entity Injection via XML-RPC Endpoint
CVSS 7.5
Details
Vulnerabilities
1,255