CWE-611

{
  "affected": [],
  "aliases": [
    "CVE-2017-12216"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-07T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files and execute remote code within the application. Cisco Bug IDs: CSCvf47946.",
  "id": "GHSA-8cxf-788q-xf3g",
  "modified": "2022-05-13T01:38:10Z",
  "published": "2022-05-13T01:38:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12216"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-socmin"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/100664"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1039274"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-40075"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-22T19:15:02Z",
    "severity": "MODERATE"
  },
  "details": "Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.",
  "id": "GHSA-8cxh-wxvq-9jgw",
  "modified": "2024-12-02T18:31:54Z",
  "published": "2024-07-22T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40075"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/Q16G/laravel_bug/blob/master/laravelBug.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-0100"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-01-18T06:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by injecting a crafted XML file with malicious entries, which could allow the attacker to read and write files. Cisco Bug IDs: CSCvg19341.",
  "id": "GHSA-8f5h-g89q-h3fx",
  "modified": "2022-05-13T01:35:49Z",
  "published": "2022-05-13T01:35:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0100"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-acpe"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102738"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1040246"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-1167"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-01T18:15:53Z",
    "severity": "MODERATE"
  },
  "details": "\nWhen SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur.\n\n",
  "id": "GHSA-8frx-325f-xvxg",
  "modified": "2024-02-01T18:31:08Z",
  "published": "2024-02-01T18:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1167"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-016-01"
    },
    {
      "type": "WEB",
      "url": "https://www.seweurodrive.com/contact_us/contact_us.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-8602"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-14T14:15:12Z",
    "severity": "MODERATE"
  },
  "details": "When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Open Worldwide Application Security Project (OWASP). An attacker could theoretically leverage this by delivering a manipulated PDF file to the target, and depending on the environment, various actions can be executed. These actions include:\n\n  *  Reading files from the operating system\n  *  Crashing the thread handling the parsing or causing it to enter an infinite loop\n  *  Executing HTTP requests\n  *  Loading additional DTDs or XML files\n  *  Under certain conditions, executing OS commands",
  "id": "GHSA-8g38-jgjc-p9jh",
  "modified": "2024-12-11T09:32:03Z",
  "published": "2024-10-14T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8602"
    },
    {
      "type": "WEB",
      "url": "https://esteuer.ewv-ete.ch/fileadmin/esta/2024-10-09-update/24_09_esta_newsletter_de.pdf"
    },
    {
      "type": "WEB",
      "url": "https://mkiesel.ch/posts/swiss-tax-adventures-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:L/U:Green",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.3.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "edu.stanford.nlp:stanford-corenlp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-3869"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-21T20:11:57Z",
    "nvd_published_at": "2021-10-19T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference",
  "id": "GHSA-8gf7-w3cp-gfh3",
  "modified": "2022-06-21T20:11:57Z",
  "published": "2022-05-24T19:18:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3869"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stanfordnlp/CoreNLP"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/2f8baf6c-14b3-420d-8ede-9805797cd324"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Restriction of XML External Entity Reference in Stanford CoreNLP"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-34436"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-02T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.",
  "id": "GHSA-8gpx-73gc-wq7c",
  "modified": "2022-05-24T22:01:46Z",
  "published": "2022-05-24T22:01:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34436"
    },
    {
      "type": "WEB",
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=563174"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/theia-ide/theia-xml-extension"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-17411"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-26T22:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.",
  "id": "GHSA-8h4f-p5hq-w6gc",
  "modified": "2022-05-14T01:48:26Z",
  "published": "2022-05-14T01:48:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17411"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MrR3boot/CVE-Hunting/blob/master/iWay%20DQS%20XXE.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "OWSLib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.28.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-27476"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-07T20:41:36Z",
    "nvd_published_at": "2023-03-08T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nOWSLib\u0027s XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution for `lxml`, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.\n\n### Patches\n\n- Use only lxml for XML handling, adding `resolve_entities=False` to `lxml`\u0027s parser: https://github.com/geopython/OWSLib/pull/863\n\n### Workarounds\n\n```python\npatch_well_known_namespaces(etree)\netree.set_default_parser(\n    parser=etree.XMLParser(resolve_entities=False)\n)\n```\n\n### References\n\n- [`GHSL-2022-131`](https://securitylab.github.com/advisories/GHSL-2022-131_OWSLib/)\n",
  "id": "GHSA-8h9c-r582-mggc",
  "modified": "2024-10-07T21:17:55Z",
  "published": "2023-03-07T20:41:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27476"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geopython/OWSLib/pull/863"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geopython/OWSLib"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geopython/OWSLib/releases/tag/0.28.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/owslib/PYSEC-2023-86.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00032.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2022-131_owslib"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5426"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OWSLib vulnerable to XML External Entity (XXE) Injection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-1000069"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-13T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim\u0027s machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.",
  "id": "GHSA-8hf8-chvw-73m9",
  "modified": "2022-05-14T01:20:28Z",
  "published": "2022-05-14T01:20:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000069"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00019.html"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4175"
    },
    {
      "type": "WEB",
      "url": "https://www.freeplane.org/wiki/index.php/XML_External_Entity_vulnerability_in_map_parser"
    },
    {
      "type": "WEB",
      "url": "https://www.youtube.com/watch?v=7IXtiTNilAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}