Fallos del tipo CWE-611

697 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2026-10025HIGHIBM QRadar SIEM has an XML External Entity (XXE) injection vulnerabilityEPSS 0.6%CVE-2020-26229LOWXML External Entity in Dashboard WidgetEPSS 0.6%CVE-2021-32754MEDIUMImproper Restriction of XML External Entity Reference in de.tud.sseEPSS 0.6%CVE-2022-20938MEDIUMA vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could alloEPSS 0.6%CVE-2024-46984HIGHXML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidatorEPSS 0.6%CVE-2023-6280HIGHXML External Entity Reference on 52North WPSEPSS 0.6%CVE-2024-2826MEDIUMlakernote EasyAdmin saveReportFile xml external entity referenceEPSS 0.6%CVE-2026-108358HIGHPhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServiceEPSS 0.6%CVE-2025-11140MEDIUMBjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity referenceEPSS 0.6%CVE-2024-29010HIGHThe XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the diEPSS 0.6%CVE-2023-50304HIGHIBM Engineering Requirements Management DOORS XML external entity injectionEPSS 0.6%CVE-2019-18943MEDIUMXML External Entity processingEPSS 0.6%CVE-2024-45048HIGHXML External Entity Reference (XXE) in PHPSpreadsheetEPSS 0.6%CVE-2023-6721HIGHImproper Restriction of XML External Entity Reference in RepoxEPSS 0.6%CVE-2023-32706HIGHDenial Of Service due to Untrusted XML Tag in XML Parser within SAML AuthenticationEPSS 0.6%CVE-2023-28685HIGHJenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.6%CVE-2026-44020HIGHDocling: Unsafe XML Entity Expansion in USPTO Patent BackendEPSS 0.6%CVE-2026-82880HIGHYaCy Search Server through 1.941 XML External Entity Injection via ParsersEPSS 0.6%CVE-2026-90885HIGHApache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was ResolvedEPSS 0.6%CVE-2020-26066MEDIUMCisco SD-WAN vManage Software XML External Entity VulnerabilityEPSS 0.6%