Fallos del tipo CWE-611

649 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2022-41221HIGHThe client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center AdmEPSS 0.3%CVE-2026-38429CRITICALOpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplieEPSS 0.3%CVE-2024-34711CRITICALGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)EPSS 0.3%CVE-2025-26484MEDIUMDell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privilegEPSS 0.3%CVE-2026-33913HIGHOpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server FilesEPSS 0.3%CVE-2026-17443MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.3%CVE-2026-17444MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.3%CVE-2025-13209MEDIUMbestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity referenceEPSS 0.3%CVE-2026-54366HIGHCentreStack < 17.4 XXE via SharePoint Storage ConfigurationEPSS 0.3%CVE-2026-58248MEDIUMXML External Entity Injection in SAP BusinessObjects Business IntelligenceEPSS 0.3%CVE-2026-28809MEDIUMXXE in esaml SAML library allows local file read and potential SSRFEPSS 0.3%CVE-2024-45745MEDIUMTopQuadrant TopBraid EDG JavaScript console XXEEPSS 0.3%CVE-2024-12476HIGHCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstaEPSS 0.3%CVE-2026-2074MEDIUMO2OA HTTP POST Request check xml external entity referenceEPSS 0.3%CVE-2026-70423MEDIUMDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low EPSS 0.3%CVE-2026-81832HIGHIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.3%CVE-2025-22478HIGHDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabEPSS 0.3%CVE-2025-36589HIGHDell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low prEPSS 0.3%CVE-2024-8010LOWXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary FilesEPSS 0.3%CVE-2026-84941MEDIUMOmada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File ReadEPSS 0.3%