CVE-2010-0432

Multiple cross-site scripting XSS vulnerabilities in the Apache Open For Business Project aka OFBiz 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via 1 the productStoreId parameter to control/exportProductListing, 2...

CVE-2012-1621

Multiple cross-site scripting XSS vulnerabilities in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via 1 a parameter array in freemarker templates, the 2 contentId or 3 mapKey parameter in a cms event request, whic...

PT-2014-2234

Name of the Vulnerable Software and Affected Versions Apache Open For Business Project aka OFBiz versions 10.04.x through 10.04.01 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

CVE-2012-1621: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via 1 a parameter array in freemarker templates, the 2 contentId or 3 mapKey parameter in a cms event request, whic...

CVE-2013-0177

Multiple cross-site scripting XSS vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the 1 Screenlet.title or 2...

PT-2014-2429

Name of the Vulnerable Software and Affected Versions Apache Open For Business Project aka OFBiz versions 10.04.x through 10.04.04 Apache Open For Business Project aka OFBiz version 11.04.01 Apache Open For Business Project aka OFBiz versions 09.04.x and earlier Description The issue concerns...

CVE-2013-0177: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the 1 Screenlet.title or 2...

CVE-2013-2137

Cross-site scripting XSS vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project aka OFBiz 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2250

Apache Open For Business Project aka OFBiz 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language UEL functions via JUEL metacharacters in unspecified parameters, related to nested expressions...

CVE-2013-2137

CVE-2013-2137 describes an XSS vulnerability in the Webtools "View Log" screen of Apache OFBiz. Affected: OFBiz Webtools View Log in versions 10.04.01–10.04.05, 11.04.01–11.04.02, and 12.04.01. Root cause: log HTML content not properly encoded. Impact: remote attackers can inject arbitrary script...

PT-2013-3556

Name of the Vulnerable Software and Affected Versions Apache Open For Business Project aka OFBiz versions 10.04.01 through 10.04.05 Apache Open For Business Project aka OFBiz versions 11.04.01 through 11.04.02 Apache Open For Business Project aka OFBiz version 12.04.01 Description A cross-site...

CVE-2013-2250: Improper Input Validation

Apache Open For Business Project aka OFBiz 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language UEL functions via JUEL metacharacters in unspecified parameters, related to nested expressions...

CVE-2013-2137: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project aka OFBiz 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-3624

Name of the Vulnerable Software and Affected Versions Apache Open For Business Project aka OFBiz versions 10.04.01 through 10.04.05 Apache Open For Business Project aka OFBiz versions 11.04.01 through 11.04.02 Apache Open For Business Project aka OFBiz version 12.04.01 Description The issue allow...

CVE-2012-3506

Unspecified vulnerability in the Apache Open For Business Project aka OFBiz 10.04.x before 10.04.03 has unknown impact and attack vectors...

CVE-2012-3506: Undefined Security Weakness

Unspecified vulnerability in the Apache Open For Business Project aka OFBiz 10.04.x before 10.04.03 has unknown impact and attack vectors...

PT-2012-4770

Name of the Vulnerable Software and Affected Versions Apache Open For Business Project aka OFBiz versions 10.04.x before 10.04.03 Description The issue concerns an unspecified vulnerability with unknown impact and attack vectors. Recommendations For Apache Open For Business Project aka OFBiz...

CVE-2010-0432

Multiple cross-site scripting XSS vulnerabilities in the Apache Open For Business Project aka OFBiz 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via 1 the productStoreId parameter to control/exportProductListing, 2...

CVE-2010-0432: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Apache Open For Business Project aka OFBiz 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via 1 the productStoreId parameter to control/exportProductListing, 2...

CVE-2006-6588

CVE-2006-6588 affects the Apache OFBiz OFBiz forum component, where the forum implementation trusts certain hidden form fields (dataResourceTypeId and contentTypeId) to process content. This trust allows remote attackers to create unauthorized content types, modify content, or cause other unknown...