Fallos del tipo CWE-611

698 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2026-14905HIGHIBM DataPower Gateway XXEEPSS 0.3%CVE-2026-19596MEDIUMOpenNMS XML collector XXE allows arbitrary file read from the OpenNMS hostEPSS 0.3%CVE-2020-14478HIGHIMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611EPSS 0.3%CVE-2026-3511HIGHImproper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticEPSS 0.3%CVE-2025-15251MEDIUMbeecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity referenceEPSS 0.3%CVE-2026-36765HIGHAn XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execEPSS 0.3%CVE-2026-88794HIGHXML External Entity injection in Sparx Enterprise ArchitectEPSS 0.3%CVE-2026-102155HIGHSecurity Advisory 0190EPSS 0.3%CVE-2026-2536MEDIUMopencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity referenceEPSS 0.3%CVE-2026-77090HIGHCVFS Information DisclosureEPSS 0.3%CVE-2026-93891HIGHSecurity Vulnerability identified in IBM TRIRIGA - XXEEPSS 0.3%CVE-2026-21569HIGHThis High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. ThEPSS 0.3%CVE-2025-46425MEDIUMDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabEPSS 0.3%CVE-2026-41066HIGHlxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local filesEPSS 0.3%CVE-2026-70448HIGHJenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing IvyEPSS 0.3%CVE-2026-13275HIGHIBM MQ Managed File Transfer is vulnerable to XML external entity injectionEPSS 0.3%CVE-2025-26484MEDIUMDell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privilegEPSS 0.3%CVE-2026-18172HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2025-35112MEDIUMAgiloft XML external entity local path traversalEPSS 0.3%CVE-2025-26400MEDIUMSolarWinds Web Help Desk XML External Entity Injection (XXE) VulnerabilityEPSS 0.3%