Fallos del tipo CWE-611

698 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2024-8602MEDIUMXML Eternal Entity Attack in the Software Library taxstatement.jarEPSS 0.4%CVE-2026-88789HIGHApache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardeningEPSS 0.4%CVE-2025-44044HIGHKeyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into paEPSS 0.4%CVE-2026-82578HIGHNextGen Healthcare Mirth Connect Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2024-6961MEDIUMXXE in Guardrails AI when consuming RAIL documentsEPSS 0.4%CVE-2026-13449HIGHXXE attack in IBM Business Automation Manager Open EditionsEPSS 0.4%CVE-2026-71375HIGHXXE Vulnerability in Cosminexus Component ContainerEPSS 0.4%CVE-2024-4690MEDIUMInsecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation ToolsEPSS 0.4%CVE-2026-17443MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.4%CVE-2026-17444MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.4%CVE-2026-85957HIGHImproper XML external entity restriction in Progress MarkLogic Server SAML processingEPSS 0.4%CVE-2026-12788MEDIUMzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity referenceEPSS 0.4%CVE-2026-42212HIGHSolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parserEPSS 0.4%CVE-2025-31487HIGHThe XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA serverEPSS 0.4%CVE-2026-3404LOWthinkgem JeeSite Endpoint CasOutHandler.java xml external entity referenceEPSS 0.4%CVE-2026-123029HIGHWowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges EPSS 0.4%CVE-2026-54082MEDIUMveraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFsEPSS 0.4%CVE-2025-64518HIGHCycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injectionEPSS 0.4%CVE-2025-1781HIGHThere is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce serEPSS 0.4%CVE-2026-19614MEDIUMXML External Entity (XXE) Injection in CyberELF NanoXMLEPSS 0.4%