Fallos del tipo CWE-611

647 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2025-7823MEDIUMJinher OA ProjectScheduleDelete.aspx xml external entity referenceEPSS 0.5%CVE-2024-36827HIGHAn XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensEPSS 0.5%CVE-2025-7824MEDIUMJinher OA XmlHttp.aspx xml external entity referenceEPSS 0.5%CVE-2024-40075MEDIUMLaravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.EPSS 0.5%CVE-2024-3969HIGH XML External Entity injection vulnerability in iManagerEPSS 0.5%CVE-2023-3113HIGHAn unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resulEPSS 0.5%CVE-2024-25606HIGHXXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before uEPSS 0.5%CVE-2026-12752HIGHMultiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026EPSS 0.5%CVE-2026-12756HIGHMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026EPSS 0.5%CVE-2026-40682CRITICALApache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistorEPSS 0.5%CVE-2025-0162HIGHIBM Aspera Shares XML external entity injectionEPSS 0.5%CVE-2025-61823MEDIUMColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2022-3338MEDIUMXXE in Trellix ePO serverEPSS 0.5%CVE-2025-53689HIGHApache Jackrabbit: XXE vulnerability in jackrabbit-spi-commonsEPSS 0.5%CVE-2024-7098CRITICALXML Injection in SFS Consulting's ww.WinsureEPSS 0.5%CVE-2024-10218CRITICALTIBCO Hawk Stored-XEE VulnerabilityEPSS 0.5%CVE-2025-36608MEDIUMDell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability.EPSS 0.5%CVE-2023-41369LOWExternal Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)EPSS 0.5%CVE-2023-26058MEDIUMAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a propeEPSS 0.5%CVE-2023-26057MEDIUMAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and aEPSS 0.5%