Fallos del tipo CWE-611

698 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2026-40882HIGHOpenRemote has XXE in Velbus Asset ImportEPSS 0.3%CVE-2026-123857MEDIUMIn JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetectionEPSS 0.3%CVE-2022-41696MEDIUMCVE-2022-41696EPSS 0.3%CVE-2022-45121MEDIUMCVE-2022-45121EPSS 0.3%CVE-2022-43512MEDIUMCVE-2022-43512EPSS 0.3%CVE-2025-52162MEDIUMagorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. EPSS 0.3%CVE-2023-5136MEDIUMIncorrect Permission Assignment in the TopoGrafix DataPlugin for GPXEPSS 0.3%CVE-2026-33371MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra ExchangEPSS 0.2%CVE-2026-4980MEDIUMImproper Restriction of XML External Entity Reference in InkscapeEPSS 0.2%CVE-2023-3892MEDIUMUnsafe XML parsing of 3rd party DICOM private tags may lead to XXEEPSS 0.2%CVE-2024-56356MEDIUMIn JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attackEPSS 0.2%CVE-2025-4338MEDIUMLantronix Device Installer Improper Restriction of XML External Entity ReferenceEPSS 0.2%CVE-2026-4374HIGHImproper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) allows Serialized Data External Linking, Data Serializat...EPSS 0.2%CVE-2022-21220HIGHImproper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user toEPSS 0.2%CVE-2026-8045HIGHCWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side fiEPSS 0.2%CVE-2024-21765MEDIUMElectronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, ElectronEPSS 0.2%CVE-2026-6501MEDIUMImproper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External EntEPSS 0.2%CVE-2023-42346HIGHAlkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.EPSS 0.2%CVE-2026-13271HIGHIBM MQ Managed File Transfer is affected by a denial of service vulnerabilityEPSS 0.2%CVE-2026-14304MEDIUMIn Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based applicatEPSS 0.2%