CWE-611

{
  "affected": [],
  "aliases": [
    "CVE-2017-8040"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-09T01:29:00Z",
    "severity": "MODERATE"
  },
  "details": "In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system.",
  "id": "GHSA-fc7r-qxmj-ff6j",
  "modified": "2022-05-13T01:07:04Z",
  "published": "2022-05-13T01:07:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8040"
    },
    {
      "type": "WEB",
      "url": "https://pivotal.io/security/cve-2017-8040"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100617"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "ome:pom-bio-formats"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "8.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22186"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-08T17:33:26Z",
    "nvd_published_at": "2026-01-07T21:16:02Z",
    "severity": "MODERATE"
  },
  "details": "Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.",
  "id": "GHSA-fcqj-76g3-q7qm",
  "modified": "2026-03-19T21:06:48Z",
  "published": "2026-01-07T21:31:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ome/bioformats/security/advisories/GHSA-x9vc-qh97-8gjp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22186"
    },
    {
      "type": "WEB",
      "url": "https://docs.openmicroscopy.org/bio-formats"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ome/bioformats"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2026/Jan/6"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/bio-formats-xxe-in-leica-xlef-metadata-parser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Bio-Formats has an XML External Entity (XXE) vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.wutka:jox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-43142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-01T19:59:52Z",
    "nvd_published_at": "2022-03-30T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An XML External Entity (XXE) vulnerability exists in wutka jox 1.16 in the readObject method in JOXSAXBeanInput.",
  "id": "GHSA-fcrx-8829-jpqx",
  "modified": "2022-04-01T19:59:52Z",
  "published": "2022-04-01T00:00:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43142"
    },
    {
      "type": "WEB",
      "url": "https://novysodope.github.io/2021/10/29/64"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Improper Restriction of XML External Entity Reference in wutka jox"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-34823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-13T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server. This allows unauthenticated remote users to retrieve files accessible to the logged-on macOS user. When a remote user sends a crafted HTTP request to the server, it triggers a code path that will download a configuration file from a specified remote machine over HTTP. There is an XXE flaw in processing of this configuration file that allows reading local (to macOS) files and uploading them to remote machines.",
  "id": "GHSA-ff42-ccp4-hwcv",
  "modified": "2022-05-24T19:11:03Z",
  "published": "2022-05-24T19:11:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34823"
    },
    {
      "type": "WEB",
      "url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories"
    },
    {
      "type": "WEB",
      "url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29105"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-7307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-27T22:15:32Z",
    "severity": "HIGH"
  },
  "details": "Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity definitions, leading to potential disclosure of internal files, server-side request forgery (SSRF), or other impacts depending on parser behavior. The vulnerability is due to improper configuration of the XML parser, which allows resolution of external entities without restriction. This product is now\u00a0integrated into their IAM (Internet Access Management) platform and an affected version range is undefined.",
  "id": "GHSA-ffx8-q4qj-8vmr",
  "modified": "2025-08-28T21:31:25Z",
  "published": "2025-08-28T00:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7307"
    },
    {
      "type": "WEB",
      "url": "https://support.sangfor.com.cn/productDocument/read?product_id=22\u0026version_id=329\u0026category_id=261800"
    },
    {
      "type": "WEB",
      "url": "https://www.cnblogs.com/pursue-security/p/17666126.html"
    },
    {
      "type": "WEB",
      "url": "https://www.sangfor.com/blog/cybersecurity/launching-sangfor-iam-12-0-23-manage-risky-shadow-it-right-way"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/sangfor-behavior-management-system-xml-external-entity-injection"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-22380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-24T02:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.",
  "id": "GHSA-fg7j-3vp4-4qpg",
  "modified": "2025-06-05T18:30:33Z",
  "published": "2024-01-24T03:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22380"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN01434915"
    },
    {
      "type": "WEB",
      "url": "https://www.maff.go.jp/j/nousin/seko/nouhin_youryou/densi.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-45096"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-16T05:15:00Z",
    "severity": "MODERATE"
  },
  "details": "KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.",
  "id": "GHSA-fgh6-7vq6-4p7f",
  "modified": "2023-09-28T15:30:16Z",
  "published": "2021-12-17T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45096"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dawid-czarnecki/public-vulnerabilities"
    },
    {
      "type": "WEB",
      "url": "https://www.knime.com/changelog-v45"
    },
    {
      "type": "WEB",
      "url": "https://www.knime.com/whats-new-in-knime-45"
    },
    {
      "type": "WEB",
      "url": "https://zigrin.com/advisories/knime-analytics-platform-external-xml-entity-injection"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-7457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-14T14:59:00Z",
    "severity": "MODERATE"
  },
  "details": "XML External Entity via \".AOP\" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.",
  "id": "GHSA-fgq7-r9vw-5f86",
  "modified": "2025-04-20T03:36:08Z",
  "published": "2022-05-17T02:12:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7457"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/41852"
    },
    {
      "type": "WEB",
      "url": "http://hyp3rlinx.altervista.org/advisories/MOXA-MX-AOPC-SERVER-v1.5-XML-EXTERNAL-ENTITY.txt"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2017/Apr/51"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.bstek.ureport:ureport2-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-24187"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-14T21:56:11Z",
    "nvd_published_at": "2023-02-14T02:15:00Z",
    "severity": "HIGH"
  },
  "details": "An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.",
  "id": "GHSA-fhj6-gr87-g4cj",
  "modified": "2023-02-22T18:35:42Z",
  "published": "2023-02-14T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24187"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24187.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cgddgc/vulns/blob/main/ureport2-vuln-des.md"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/youseries/ureport"
    },
    {
      "type": "WEB",
      "url": "http://ureport.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XML External Entity Reference in ureport"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-10832"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-05-11T21:29:00Z",
    "severity": "MODERATE"
  },
  "details": "ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will return the contents of any local files to a remote attacker.",
  "id": "GHSA-fhqh-5c3v-xg77",
  "modified": "2022-05-14T03:19:04Z",
  "published": "2022-05-14T03:19:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10832"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/44607"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}