CWE-611

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.restlet.jse:org.restlet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-14949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:32:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.",
  "id": "GHSA-cvj4-g3gx-8vqq",
  "modified": "2022-04-26T21:37:05Z",
  "published": "2018-10-17T00:04:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/restlet/restlet-framework-java/commit/fe75aff3af23b879b984db7a2b6824cee0ef0fc5"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-cvj4-g3gx-8vqq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/restlet/restlet-framework-java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements"
    },
    {
      "type": "WEB",
      "url": "https://lgtm.com/blog/restlet_CVE-2017-14949"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-0950"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-20T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, and (4) ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1.3 allow remote attackers to cause a denial of service or access other servers via crafted XML data. IBM X-Force ID: 92623.",
  "id": "GHSA-cvv6-8h36-ppcg",
  "modified": "2022-05-14T03:21:14Z",
  "published": "2022-05-14T03:21:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0950"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92623"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675164"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-29436"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-17T02:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.",
  "id": "GHSA-cvwh-p6q5-8546",
  "modified": "2022-05-24T17:36:45Z",
  "published": "2022-05-24T17:36:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29436"
    },
    {
      "type": "WEB",
      "url": "https://support.sonatype.com/hc/en-us/articles/1500000415082-CVE-2020-29436-Nexus-Repository-Manager-3-XML-External-Entities-injection-2020-12-15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-40239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-01T11:15:42Z",
    "severity": "HIGH"
  },
  "details": "Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., \u0027*\u0027 indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability.",
  "id": "GHSA-cwqw-75wv-wxpm",
  "modified": "2024-04-04T07:21:27Z",
  "published": "2023-09-01T12:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40239"
    },
    {
      "type": "WEB",
      "url": "https://publications.lexmark.com/publications/security-alerts/CVE-2023-40239.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2012-1102"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-09T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.",
  "id": "GHSA-cwv6-3m5x-7f9p",
  "modified": "2022-04-23T00:40:50Z",
  "published": "2022-04-23T00:40:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1102"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/MIYAGAWA/XML-Atom-0.39/source/Changes"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/oss-sec/2012/q1/549"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-11677"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-02T14:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.",
  "id": "GHSA-cww6-6g24-2wx4",
  "modified": "2024-04-04T00:26:13Z",
  "published": "2022-05-24T16:45:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11677"
    },
    {
      "type": "WEB",
      "url": "https://www.manageengine.com/products/firewall/release-notes.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-23525"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-18T00:15:38Z",
    "severity": "MODERATE"
  },
  "details": "The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig.",
  "id": "GHSA-cxjh-j6f8-vrmf",
  "modified": "2024-05-05T15:30:28Z",
  "published": "2024-01-18T00:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23525"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MichaelDaum/spreadsheet-parsexlsx/issues/10"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/phvietan/d1c95a88ab6e17047b0248d6bf9eac4a"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00018.html"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/NUDDLEGG/Spreadsheet-ParseXLSX-0.30/changes"
    },
    {
      "type": "WEB",
      "url": "https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/01/18/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-22354"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-17T01:15:06Z",
    "severity": "HIGH"
  },
  "details": "\nIBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401.\n\n",
  "id": "GHSA-cxq5-8mc6-xprf",
  "modified": "2024-04-17T03:30:37Z",
  "published": "2024-04-17T03:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22354"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/280401"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7148426"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-28684"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-21T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the network (via an XXE attack).",
  "id": "GHSA-f243-hqpc-893w",
  "modified": "2022-05-24T19:05:45Z",
  "published": "2022-05-24T19:05:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28684"
    },
    {
      "type": "WEB",
      "url": "https://peterka.tech/blog/posts/cve-2021-28684"
    },
    {
      "type": "WEB",
      "url": "https://www.powerarchiver.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-20029"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-07T17:16:03Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the licensing features of\u0026nbsp;Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information.\u0026nbsp;\n\nThis vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC. An attacker could exploit this vulnerability by uploading a malicious file to the application. A successful exploit could allow the attacker to read arbitrary files from the underlying operating system that could include sensitive data that should otherwise be inaccessible even to administrators. To exploit this vulnerability, the attacker must have valid administrative credentials.",
  "id": "GHSA-f26c-v5jj-mj89",
  "modified": "2026-01-07T18:30:26Z",
  "published": "2026-01-07T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20029"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxe-jWSbSDKt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}