Fallos del tipo CWE-611

698 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2026-44018MEDIUMDocling: Unsafe Archive Extraction and XML Parsing in METS-GBS BackendEPSS 0.2%CVE-2024-54005MEDIUMA vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions),EPSS 0.2%CVE-2026-48981MEDIUMpam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.cEPSS 0.2%CVE-2026-101893MEDIUMNewell Brands DYMO ID document parsing failing file type extension authentication checkEPSS 0.2%CVE-2026-75055MEDIUMIn JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXEEPSS 0.2%CVE-2026-75058MEDIUMIn JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importersEPSS 0.2%CVE-2025-4044HIGHXML External Entity Injection vulnerability in various Lexmark Universal DriversEPSS 0.2%CVE-2026-67268MEDIUMDell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low prEPSS 0.1%CVE-2025-2070MEDIUMAn improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url EPSS 0.1%CVE-2025-66372LOWMustang before 2.16.3 allows exfiltrating files via XXE attacks.EPSS 0.1%CVE-2026-104679MEDIUMVOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project filEPSS 0.1%CVE-2024-42185LOWHCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacksEPSS 0.1%CVE-2026-1227HIGHCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files,EPSS 0.1%CVE-2025-36603MEDIUMDell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attackerEPSS 0.1%CVE-2026-73235MEDIUMFreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parserEPSS 0.1%CVE-2026-19721LOWXXE in TÜBİTAK BİLGEM's İmzagerEPSS 0.1%CVE-2026-49383LOWIn JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possibleEPSS 0.1%CVE-2026-80435MEDIUMDataStage on Cloud Pak for Data has several vulnerabilitiesEPSS —