Fallos del tipo CWE-611

649 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2026-41936HIGHVvveb < 1.0.8.2 XML External Entity Injection via ImportEPSS 0.3%CVE-2022-45386MEDIUMJenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.3%CVE-2026-18061MEDIUMImproper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePluginEPSS 0.3%CVE-2025-26400MEDIUMSolarWinds Web Help Desk XML External Entity Injection (XXE) VulnerabilityEPSS 0.3%CVE-2026-91197HIGHFlowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactoryEPSS 0.3%CVE-2026-41895HIGHchangedetection.io: XXE vulnerability in the changedetection.io projectEPSS 0.3%CVE-2026-2252HIGHXML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)EPSS 0.3%CVE-2026-12666HIGHIBM MQ Java messaging is vulnerable to XML external entity injectionEPSS 0.3%CVE-2026-1218MEDIUMBjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity referenceEPSS 0.3%CVE-2026-40882HIGHOpenRemote has XXE in Velbus Asset ImportEPSS 0.3%CVE-2022-45121MEDIUMCVE-2022-45121EPSS 0.3%CVE-2022-41696MEDIUMCVE-2022-41696EPSS 0.3%CVE-2022-43512MEDIUMCVE-2022-43512EPSS 0.3%CVE-2023-5136MEDIUMIncorrect Permission Assignment in the TopoGrafix DataPlugin for GPXEPSS 0.3%CVE-2026-13275HIGHIBM MQ Managed File Transfer is vulnerable to XML external entity injectionEPSS 0.3%CVE-2026-18715MEDIUMIBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server LibertyEPSS 0.2%CVE-2026-71375HIGHXXE Vulnerability in Cosminexus Component ContainerEPSS 0.2%CVE-2025-36374MEDIUMIBM DataPower Gateway affected by XML external entity injectionEPSS 0.2%CVE-2023-3892MEDIUMUnsafe XML parsing of 3rd party DICOM private tags may lead to XXEEPSS 0.2%CVE-2022-21220HIGHImproper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user toEPSS 0.2%