CWE-112 Missing XML Validation
baseThe product accepts XML from an untrusted source but does not validate the XML against the proper schema.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-68493US | high8.1 | Exploit | ||
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users ar… | ||||
| CVE-2013-4002US | high7.1 | Exploit | ||
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1… | ||||
| CVE-2022-28213US | high8.1 | Exploit | ||
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an u… | ||||
| CVE-2013-2160US | medium5.0 | Exploit | ||
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumpt… | ||||
| CVE-2021-1359US | high8.8 | — | ||
A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection a… | ||||
| CVE-2022-22738US | high8.8 | — | ||
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability af… | ||||
| CVE-2020-1975US | high8.8 | — | ||
Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege… | ||||
| CVE-2023-40310US | high7.5 | — | ||
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file,… | ||||
| CVE-2013-7315US | medium6.8 | — | ||
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-depende… | ||||
| CVE-2021-27780US | medium5.3 | — | ||
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment. | ||||
| CVE-2014-0119US | medium4.3 | — | ||
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which a… | ||||
| CVE-2020-27282US | medium4.3 | — | ||
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the dev… | ||||
| CVE-2026-1190US | — | — | ||
A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the… | ||||
03
Angriffsmuster (2)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan