xxe
Safeguard articles tagged "xxe" — guides, analysis, and best practices for software supply chain and application security.
18 articles
The Java ecosystem's recurring vulnerability classes: deserialization, XXE, and JNDI injection
Log4Shell scored a 10.0 CVSS and Spring4Shell followed five months later — both traced back to two patterns Java has repeated for a decade.
Finding and fixing XXE vulnerabilities across common XML parsers
XXE is tracked as CWE-611 and lives in OWASP's misconfiguration category — because most XML parsers ship unsafe by default.
OWASP A05: Security Misconfiguration — A Deep-Dive Guide
Security Misconfiguration ranks #5 in the OWASP Top 10 (2021) and absorbed XXE. A deep dive into defaults, exposed services, real CVEs, and how to fix them.
What Is XXE (XML External Entity Injection)?
XXE abuses an XML parser's ability to load external entities to read local files, reach internal services, or knock a server offline. Here is how to stop it.
XML Parsing Security: XXE, Billion Laughs, and Beyond
XML's feature richness is its security weakness. XXE, entity expansion, and XSLT injection continue to plague applications that process XML.
Apache Solr XXE remote code execution (CVE-2017-12629)
CVE-2017-12629 chains XXE and Solr's RunExecutableListener into unauthenticated RCE. Affected versions, timeline, and concrete remediation steps.
Blind and Out-of-Band XXE: How XXE Injection Really Works
A defensive guide to XXE injection, including the blind and out-of-band variants that leak data with no visible response, plus how to detect and shut them down.
WWW XXE: Understanding and Preventing XML External Entity Attacks
XXE lets a crafted XML document read files, reach internal services, and exhaust resources. Here is how the attack works and how to shut it down.
Python pptx: Using python-pptx Securely to Build Presentations
python pptx usually means the python-pptx library for reading and writing PowerPoint files. Here is how it works and the security pitfalls of processing untrusted decks.
The Most Common Java Security Flaws and How to Fix Them
A practitioner's tour of the Java security flaws that actually break production systems — deserialization, injection, XXE, and the dependency risks that scanners miss.
XXE Attack Example: How XML External Entity Injection Works and How to Stop It
A defensive XXE attack example that explains how XML External Entity injection abuses parsers, what it can expose, and the parser settings that shut it down.
XXE Attack Walkthroughs: What a Good Demo Actually Shows
Most XXE video walkthroughs stop at proof-of-concept file reads — here's what a genuinely useful one covers, plus the Java fix that actually closes the hole.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.