Fallos del tipo CWE-611

698 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2023-26461MEDIUMXML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)EPSS 0.5%CVE-2026-51080CRITICALlibpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.EPSS 0.5%CVE-2024-24743HIGHXXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)EPSS 0.5%CVE-2025-6985HIGHXXE Vulnerability in langchain-ai/langchainEPSS 0.5%CVE-2023-1288MEDIUMENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerabilityEPSS 0.5%CVE-2025-63551HIGHA Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content ManEPSS 0.5%CVE-2025-0162HIGHIBM Aspera Shares XML external entity injectionEPSS 0.5%CVE-2026-106616HIGHColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2024-40075MEDIUMLaravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.EPSS 0.5%CVE-2024-3969HIGH XML External Entity injection vulnerability in iManagerEPSS 0.5%CVE-2023-3113HIGHAn unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resulEPSS 0.5%CVE-2024-36827HIGHAn XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensEPSS 0.5%CVE-2024-25606HIGHXXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before uEPSS 0.5%CVE-2026-16884CRITICALMultiple Vulnerabilities in IBM API ConnectEPSS 0.5%CVE-2025-48882HIGHPHPOffice Math allows XXE when processing an XML file in the MathML formatEPSS 0.5%CVE-2026-12752HIGHMultiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026EPSS 0.5%CVE-2026-13285HIGHIBM MQ Managed File Transfer is vulnerable to XML external entity injectionEPSS 0.5%CVE-2026-12756HIGHMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026EPSS 0.5%CVE-2026-13287HIGHIBM MQ Managed File Transfer is vulnerable to XML external entity injectionEPSS 0.5%CVE-2021-22501MEDIUMImproper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation.  EPSS 0.5%