Fallos del tipo CWE-611

697 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2022-1700HIGHImproper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), wEPSS 0.8%CVE-2024-55081CRITICALAn XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitraEPSS 0.8%CVE-2023-38693CRITICALRCE in Lucee REST endpointEPSS 0.8%CVE-2021-27604HIGHIn order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise ServiEPSS 0.8%CVE-2023-49110HIGHXML External Entity Injection in Kiuwan SASTEPSS 0.8%CVE-2017-20151MEDIUMiText RUPS XfaFile.java xml external entity referenceEPSS 0.8%CVE-2022-1331MEDIUMDelta Electronics DMARS Improper Restriction of XML External Entity ReferenceEPSS 0.8%CVE-2024-21082CRITICALVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.EPSS 0.8%CVE-2024-56324LOWGoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group adminsEPSS 0.8%CVE-2022-22977HIGHVMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administEPSS 0.8%CVE-2025-23195HIGHApache Ambari: XML External Entity (XXE) Vulnerability in Ambari/OozieEPSS 0.8%CVE-2016-15011MEDIUMe-Contract dssp SignResponseVerifier.java checkSignResponse xml external entity referenceEPSS 0.8%CVE-2022-4607MEDIUM3D City Database OGC Web Feature Service xml external entity referenceEPSS 0.8%CVE-2023-28151MEDIUMAn issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remoteEPSS 0.8%CVE-2022-43570HIGHXML External Entity Injection through a custom View in Splunk EnterpriseEPSS 0.8%CVE-2023-51605MEDIUMHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-51601MEDIUMHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-51602MEDIUMHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-51604MEDIUMHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-51600MEDIUMHoneywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.8%