Apache OFBiz Code Injection Vulnerability (CNVD-2023-03918)

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz 18.12.05 and earlier versions, which stems from an error in Birt and can be exploited by attackers to remotely execute code...

Apache OFBiz 代码问题漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code issue vulnerability exists in Apache OFBiz Solr plugin 18.12.05 and earlier, which stems from the default configuration of automatically issuing RMI requests on port 1099 on localhost, which can be...

Apache OFBiz 跨站脚本漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation in the United States. The system provides a suite of Java-based web application components and tools. Apache OFBiz 18.12.05 and earlier versions contain a security vulnerability that can be exploited by...

Apache OFBiz Cross-Site Scripting Vulnerability (CNVD-2022-69474)

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation in the United States. The system provides a suite of Java-based web application components and tools. Apache OFBiz 18.12.05 and earlier versions contain a security vulnerability that can be exploited by...

PT-2022-17248 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.05 Description: The issue allows an unauthenticated malicious user to perform a stored XSS attack, enabling the injection of a malicious payload that can be executed. This is made possible by leveraging a...

PT-2022-17538 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions 18.12.05 and earlier Description: The issue allows an attacker, acting as an anonymous user of the ecommerce plugin, to insert malicious content in the "Subject" field of a message from the "Contact us" page. This can le...

Apache OFBiz has an unspecified vulnerability (CNVD-2023-03921)

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A security vulnerability exists in Apache OFBiz 18.12.05 and earlier, which can be exploited by attackers to conduct regular expression denial-of-service attacks...

Apache OFBiz 安全漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A security vulnerability exists in Apache OFBiz 18.12.05 and earlier, which can be exploited by attackers to conduct regular expression denial-of-service attacks...

Apache OFBiz Code Issue Vulnerability (CNVD-2023-03920)

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code issue vulnerability exists in Apache OFBiz Solr plugin 18.12.05 and earlier, which stems from the default configuration of automatically issuing RMI requests on port 1099 on localhost, which can be...

PT-2022-19419 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.06 Description: The issue arises from the way Apache OFBiz handles URLs provided by external, unauthenticated users, making it vulnerable to Regular Expression Denial of Service ReDoS. Recommendations: For...

Apache OFBiz 代码注入漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz versions 18.12.05 and earlier, which could be exploited to insert malicious content into the "Subject" field of the "Contact us" page. field of the "Contact...

PT-2022-19398 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.06 Description: The Solr plugin of Apache OFBiz is configured to automatically make a RMI request on localhost, port 1099 by default. In affected versions, an attacker may exploit this behavior by hosting ...

Apache OFBiz Code Injection Vulnerability (CNVD-2023-03919)

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz versions 18.12.05 and earlier, which could be exploited to insert malicious content into the "Subject" field of the "Contact us" page. field of the "Contact...

Apache OFBiz Log4Shell Direct Check (CVE-2021-44228)

Binary data apacheofbizlog4shell.nbin...

Log4Shell HTTP Scanner

Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will scan an HTTP end point for the Log4Shell vulnerability by injectin...

CVE-2021-25958

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception...

CVE-2021-25958

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception...

Code injection

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception...

CVE-2021-25958 Generation of Error Message Containing Sensitive Information in Apache OFBiz

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception...

CVE-2021-25958

Summary: CVE-2021-25958 affects Apache OFBiz (versions 17.12.01–17.12.07). The issue arises from a try/catch error handling path that leaks sensitive table information in error messages, aiding attacker reconnaissance. The vulnerability is triggered during normal login attempts after a user regis...