CWE-611

{
  "affected": [],
  "aliases": [
    "CVE-2021-36172"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-02T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.",
  "id": "GHSA-769g-xf8v-jx9v",
  "modified": "2022-05-24T19:19:25Z",
  "published": "2022-05-24T19:19:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36172"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/advisory/FG-IR-21-104"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-9044"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-29T08:15:05Z",
    "severity": "MODERATE"
  },
  "details": "A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.",
  "id": "GHSA-773m-x37x-96wr",
  "modified": "2024-11-29T12:31:49Z",
  "published": "2024-11-29T12:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9044"
    },
    {
      "type": "WEB",
      "url": "https://www.ag.ch/de/verwaltung/dfr/steuern/natuerliche-personen/steuererklaerung-easytax"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "be.e_contract.dssp:dssp-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-15011"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-12T23:42:07Z",
    "nvd_published_at": "2023-01-06T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function `checkSignResponse` of the file `dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 can address this issue. The name of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability.",
  "id": "GHSA-77cc-w3wm-6whp",
  "modified": "2023-01-12T23:42:07Z",
  "published": "2023-01-06T12:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-15011"
    },
    {
      "type": "WEB",
      "url": "https://github.com/e-Contract/dssp/commit/ec4238349691ec66dd30b416ec6eaab02d722302"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/e-Contract/dssp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/e-Contract/dssp/releases/tag/dssp-1.3.2"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.217549"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.217549"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "dssp vulnerable to Improper Restriction of XML External Entity Reference"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.codelibs.fess:fess"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-1000822"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:21:51Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.",
  "id": "GHSA-77hp-pfxw-4w63",
  "modified": "2022-09-14T22:20:53Z",
  "published": "2018-12-20T22:02:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000822"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codelibs/fess/issues/1851"
    },
    {
      "type": "WEB",
      "url": "https://0dd.zone/2018/10/27/fess-XXE"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-77hp-pfxw-4w63"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/codelibs/fess"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XML External Entity (XXE) vulnerability in codelibs fess"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cocoon:cocoon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49733"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-30T19:51:43Z",
    "nvd_published_at": "2023-11-30T12:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon. This issue affects Apache Cocoon: from 2.2.0 before 2.3.0.\n\nUsers are recommended to upgrade to version 2.3.0, which fixes the issue.",
  "id": "GHSA-77jg-cpw9-73vg",
  "modified": "2025-02-13T19:25:43Z",
  "published": "2023-11-30T12:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49733"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/cocoon"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/t87nntzt6dxw354zbqr9k7l7o1x8gq11"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/11/30/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-25955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-11T09:15:00Z",
    "severity": "MODERATE"
  },
  "details": "National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.",
  "id": "GHSA-77m5-rm2p-m2qh",
  "modified": "2024-04-04T03:23:52Z",
  "published": "2023-04-11T09:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25955"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN75742861"
    },
    {
      "type": "WEB",
      "url": "https://nlftp.mlit.go.jp/i_news.html#news4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-45192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-06T19:15:50Z",
    "severity": "HIGH"
  },
  "details": "IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  268758.",
  "id": "GHSA-78vm-22gj-q6cp",
  "modified": "2024-06-06T21:30:35Z",
  "published": "2024-06-06T21:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45192"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/268758"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7156492"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-26058"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-25T13:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.",
  "id": "GHSA-7946-5rp5-f5v2",
  "modified": "2024-04-04T03:40:30Z",
  "published": "2023-04-25T15:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26058"
    },
    {
      "type": "WEB",
      "url": "https://nokia.com"
    },
    {
      "type": "WEB",
      "url": "https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2022-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-1628"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-26T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Affected versions: Mule 4.x runtime released before February 2, 2021.",
  "id": "GHSA-79pr-23xj-fhhq",
  "modified": "2022-05-24T17:45:31Z",
  "published": "2022-05-24T17:45:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1628"
    },
    {
      "type": "WEB",
      "url": "https://help.salesforce.com/articleView?id=000357384\u0026type=1\u0026mode=1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.dataformat:jackson-dataformat-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.fasterxml.jackson.dataformat:jackson-dataformat-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-7051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:22:20Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of jackson-dataformat-xml) prior to 2.7.8 and prior to  2.8.4 allow remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.",
  "id": "GHSA-7c2r-3jqf-c9rw",
  "modified": "2022-09-14T00:19:56Z",
  "published": "2018-10-18T17:43:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7051"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FasterXML/jackson-dataformat-xml/issues/211"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1378673"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FasterXML/jackson-dataformat-xml"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-7c2r-3jqf-c9rw"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/97688"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "jackson-dataformat-xml vulnerable to server side request forgery (SSRF)"
}