CWE-611

Improper Restriction of XML External Entity Reference

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1,228 vulnerabilities with CWE-611
CVE-2024-20531 MEDIUM
Cisco ISE - SSRF
CVSS 5.5
CVE-2024-51132 CRITICAL
Ca.uhn.hapi.fhir Org.hl7.fhir.convertors < 6.4.0 - XXE
CVSS 9.8
CVE-2024-45086 MEDIUM
IBM WebSphere App Server <9.0 - XXE
CVSS 5.5
CVE-2024-51136 CRITICAL
Openimaj - XXE
CVSS 9.8
CVE-2024-50442 MEDIUM
Royal-elementor-addons Royal Elementor Addons < 1.3.981 - XXE
CVSS 6.5
CVE-2024-4690 HIGH
Microfocus Application Automation Tools < 24.1.0 - XXE
CVSS 8.0
CVE-2024-4189 HIGH
Microfocus Application Automation Tools < 24.1.0 - XXE
CVSS 8.0
CVE-2024-4184 HIGH
Microfocus Application Automation Tools < 24.1.0 - XXE
CVSS 8.0
CVE-2024-45072 MEDIUM
IBM WebSphere App Server 8.5-9.0 - XXE
CVSS 5.5
CVE-2024-21255 HIGH
Oracle Peoplesoft Enterprise Peopletools - XXE
CVSS 8.8
CVE-2024-8602 MEDIUM
XML - XXE
CVE-2024-28168 HIGH
Apache Formatting Objects Processor < 2.10 - XXE
CVSS 7.5
CVE-2024-39586 LOW
Dell Emc Appsync < 4.6.0.3 - XXE
CVSS 2.9
CVE-2024-45293 HIGH
PHPSpreadsheet - XSS
CVSS 7.5
CVE-2024-45745 MEDIUM
Topquadrant Topbraid Edg < 8.0.1 - XXE
CVSS 5.0
CVE-2024-46985 HIGH
Dataease < 2.10.1 - XXE
CVSS 7.5
CVE-2024-46984 HIGH
Gematik Reference Validator < 2.5.1 - XXE
CVSS 8.6
CVE-2024-7098 CRITICAL
SFS Winsure < 4.6.2 - XXE
CVSS 9.8
CVE-2024-37397 HIGH
Ivanti Endpoint Manager < 2022 - XXE
CVSS 8.2
CVE-2024-45294 HIGH
HL7 FHIR Core <6.3.23 - XML External Entity Injection
CVSS 8.6
CVE-2024-45490 HIGH
libexpat <2.6.3 - Info Disclosure
CVSS 7.5
CVE-2024-45048 HIGH
PHPSpreadsheet <2.2.1 - XSS
CVSS 8.8
CVE-2024-22218 HIGH
Terminalfour 8.0.0001-8.3.18 & XML JDBC 1.0.4 - RCE
CVSS 8.8
CVE-2024-38653 HIGH
Ivanti Avalanche 6.3.1 - Info Disclosure
CVSS 7.5
CVE-2024-6893 HIGH
Journyx soap_cgi.pyc - XML External Entity Reference
CVSS 7.5
Details
Vulnerabilities 1,228
Links
MITRE CWE Entry Search this CWE With Exploits