CVE-2019-0235

Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...

CVE-2019-0235

CVE-2019-0235 affects Apache OFBiz. Connected sources detail a Cross-Site Request Forgery vulnerability in OFBiz 17.12.01 (and related 17.12.x releases) where forged requests can perform unauthorized actions (e.g., via endpoints like updateEmailAddress). The core issue is CSRF protection weakness...

CVE-2019-12425

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...

CVE-2019-12425

CVE-2019-12425 affects Apache OFBiz 17.12.01 and is described as a Host header injection vulnerability caused by accepting arbitrary Host headers. This is documented across multiple sources (e.g., NVD entry and Red Hat, CNVD, OSV, CVE lists) with the consistent description that OFBiz 17.12.01 is ...

Apache OFBiz Insecure Deserialization (CVE-2019-0189)

An insecure deserialization vulnerability exists in Apache OFBiz. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2020-1943

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07...

CVE-2020-1943

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07...

Code injection

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07...

CVE-2020-1943

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07...

CVE-2020-1943

CVE-2020-1943 affects Apache OFBiz 16.11.01–16.11.07. The vulnerability is a cross-site scripting flaw caused by unsanitized data sent with the contentId parameter to the /control/stream endpoint. Impact, as reported, is execution of malicious scripts in the victim’s browser (potential session-re...

PT-2020-15180 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions 16.11.01 through 16.11.07 Description: The issue allows for XSS attacks due to unsanitized data sent with the contentId to the "/control/stream" API endpoint. Recommendations: For Apache OFBiz versions 16.11.01 through...

Apache OFBiz Unauthorized Access Vulnerability

Apache OFBiz is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a complete set of Java-based Web application components and tools. An unauthorized access vulnerability exists in Apache OFBiz, which could be exploited by ...

CVE-2019-12426

an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06...

CVE-2019-12426

an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06...

Information disclosure

an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06...

CVE-2019-12426

CVE-2019-12426 affects Apache OFBiz versions 16.11.01 through 16.11.06. An unauthenticated actor could access information on certain backend screens by invoking setSessionLocale, leading to information disclosure. The available connected sources corroborate unauthenticated information exposure in...

CVE-2019-12426

an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06...

The vulnerability of the “org.apache.ofbiz.service.engine.HttpEngine.java” component of the Apache OFBiz resource planning software allows a hacker to execute arbitrary code.

The vulnerability of the “org.apache.ofbiz.service.engine.HttpEngine.java” component of the Apache OFBiz resource planning software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted...

CVE-2011-3600

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...

CVE-2011-3600

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...