CWE-611

{
  "affected": [],
  "aliases": [
    "CVE-2024-22380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-24T02:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.",
  "id": "GHSA-fg7j-3vp4-4qpg",
  "modified": "2025-06-05T18:30:33Z",
  "published": "2024-01-24T03:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22380"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN01434915"
    },
    {
      "type": "WEB",
      "url": "https://www.maff.go.jp/j/nousin/seko/nouhin_youryou/densi.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-45096"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-16T05:15:00Z",
    "severity": "MODERATE"
  },
  "details": "KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.",
  "id": "GHSA-fgh6-7vq6-4p7f",
  "modified": "2023-09-28T15:30:16Z",
  "published": "2021-12-17T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45096"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dawid-czarnecki/public-vulnerabilities"
    },
    {
      "type": "WEB",
      "url": "https://www.knime.com/changelog-v45"
    },
    {
      "type": "WEB",
      "url": "https://www.knime.com/whats-new-in-knime-45"
    },
    {
      "type": "WEB",
      "url": "https://zigrin.com/advisories/knime-analytics-platform-external-xml-entity-injection"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-7457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-14T14:59:00Z",
    "severity": "MODERATE"
  },
  "details": "XML External Entity via \".AOP\" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.",
  "id": "GHSA-fgq7-r9vw-5f86",
  "modified": "2025-04-20T03:36:08Z",
  "published": "2022-05-17T02:12:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7457"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/41852"
    },
    {
      "type": "WEB",
      "url": "http://hyp3rlinx.altervista.org/advisories/MOXA-MX-AOPC-SERVER-v1.5-XML-EXTERNAL-ENTITY.txt"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2017/Apr/51"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.bstek.ureport:ureport2-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-24187"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-14T21:56:11Z",
    "nvd_published_at": "2023-02-14T02:15:00Z",
    "severity": "HIGH"
  },
  "details": "An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.",
  "id": "GHSA-fhj6-gr87-g4cj",
  "modified": "2023-02-22T18:35:42Z",
  "published": "2023-02-14T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24187"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24187.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cgddgc/vulns/blob/main/ureport2-vuln-des.md"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/youseries/ureport"
    },
    {
      "type": "WEB",
      "url": "http://ureport.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XML External Entity Reference in ureport"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-10832"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-05-11T21:29:00Z",
    "severity": "MODERATE"
  },
  "details": "ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will return the contents of any local files to a remote attacker.",
  "id": "GHSA-fhqh-5c3v-xg77",
  "modified": "2022-05-14T03:19:04Z",
  "published": "2022-05-14T03:19:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10832"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/44607"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.calcite:calcite-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.32.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-39135"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-15T03:28:19Z",
    "nvd_published_at": "2022-09-11T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Apache Calcite prior to version 1.32.0 the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, which makes them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.",
  "id": "GHSA-fj2m-w3wv-x9pr",
  "modified": "2022-09-16T22:02:34Z",
  "published": "2022-09-12T00:00:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39135"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/11/21/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.web:gs-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.26.0"
            },
            {
              "fixed": "2.26.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver:gs-wms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.26.0"
            },
            {
              "fixed": "2.26.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver.web:gs-web-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.25.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geoserver:gs-wms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.25.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-58360"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-25T19:07:05Z",
    "nvd_published_at": "2025-11-25T21:15:56Z",
    "severity": "HIGH"
  },
  "details": "## Description\n\nAn XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint ``/geoserver/wms`` operation ``GetMap``. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.\n\nAn XML External Entity attack is a type of attack that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.\n\nBy exploiting this vulnerability, an attacker can:\n- Read arbitrary files from the server\u0027s file system.\n- Conduct Server-Side Request Forgery (SSRF) to interact with internal systems.\n- Execute Denial of Service (DoS) attacks by exhausting resources.\n\n## Resolution\n\nUpdate to GeoServer 2.25.6, GeoServer 2.26.3, or GeoServer 2.27.0.\n\n## Impact\n\nThe XXE vulnerability can be used to retrieve arbitrary files from the server\u0027s file system.\n\n## Reference\n\n* https://osgeo-org.atlassian.net/browse/GEOS-11682\n* XBOW-024-081\n\n## Disclaimer\n\nThis vulnerability was detected using **[XBOW](https://xbow.com/)**, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.",
  "id": "GHSA-fjf5-xgmq-5525",
  "modified": "2025-12-11T21:55:34Z",
  "published": "2025-11-25T19:07:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58360"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geoserver/geoserver"
    },
    {
      "type": "WEB",
      "url": "https://osgeo-org.atlassian.net/browse/GEOS-11682"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58360"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature"
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-6059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-02-01T20:59:00Z",
    "severity": "HIGH"
  },
  "details": "IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.",
  "id": "GHSA-fjjf-46hr-qcp6",
  "modified": "2022-05-17T03:01:05Z",
  "published": "2022-05-17T03:01:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6059"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21991683"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94032"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-44147"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-22T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks.",
  "id": "GHSA-fjxg-q4vx-2g4h",
  "modified": "2024-02-28T00:02:08Z",
  "published": "2021-11-23T00:00:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44147"
    },
    {
      "type": "WEB",
      "url": "https://davidhamann.de/2021/11/18/filemaker-xxe-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://support.claris.com/s/answerview?anum=000035751"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-40503"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:15:24Z",
    "severity": "HIGH"
  },
  "details": "LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the saveXmlFile method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-19952.",
  "id": "GHSA-fmx6-75w7-fmgw",
  "modified": "2024-05-03T03:30:59Z",
  "published": "2024-05-03T03:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40503"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1207"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}