Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

788 matches found

CVE
CVE•added 2019/09/11 8:34 p.m.•49 views

CVE-2019-10073

CVE-2019-10073 affects the Apache OFBiz template “ecommerce” in its Blog, Forum, and Contact Us screens. The issue is a Stored XSS weakness in these components. Root cause details are not elaborated in the provided documents beyond the XSS vulnerability claim. The recommended remediation is to up...

6.1CVSS5.9AI score0.05227EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist•added 2019/09/11 8:29 p.m.•37 views

CVE-2019-0189

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the...

9.7AI score0.2371EPSS
SaveExploits0References13
CVE
CVE•added 2019/09/11 8:29 p.m.•74 views

CVE-2019-0189

The CVE-2019-0189 issue affects Apache OFBiz via two dependencies (commons-beanutils and an outdated commons-fileupload). It uses Java deserialization in the HttpEngine: the request parameter serviceContext is passed to XmlSerializer.deserialize, enabling remote code execution through java.io.Obj...

9.8CVSS9.7AI score0.2371EPSS
SaveExploits0References13Affected Software1
Cvelist
Cvelist•added 2019/09/11 8:22 p.m.•31 views

CVE-2018-17200

The Apache OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the serviceContent parameter in the request and deserializes it using XStream. This XStream instance is slightly guard...

9.5AI score0.05027EPSS
SaveExploits0References5
CVE
CVE•added 2019/09/11 8:22 p.m.•53 views

CVE-2018-17200

The CVE-2018-17200 entry concerns the Apache OFBiz HTTP engine (HttpEngine.java) handling HTTP service requests via /webtools/control/httpService. The vulnerability arises from deserializing the serviceContent parameter with XStream; although the XStream instance is guarded by disabling ProcessBu...

9.8CVSS9.3AI score0.05027EPSS
SaveExploits0References5Affected Software1
CNVD
CNVD•added 2018/12/18 12:0 a.m.•20 views

Apache OFBiz Information Disclosure Vulnerability (CNVD-2018-25797)

Apache OFBiz also known as Apache Open For Business Project is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A security vulnerability exists in Apache OFBiz...

7.5CVSS6.7AI score0.25743EPSS
SaveExploits0References1
OSV
OSV•added 2018/12/13 2:29 p.m.•6 views

CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

7.5CVSS5.8AI score0.25743EPSS
SaveExploits0References1
Prion
Prion•added 2018/12/13 2:29 p.m.•24 views

Design/Logic Flaw

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

5CVSS7.4AI score0.25743EPSS
SaveExploits0References1Affected Software1
NVD
NVD•added 2018/12/13 2:29 p.m.•26 views

CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

7.5CVSS7.4AI score0.25743EPSS
SaveExploits0References1
Cvelist
Cvelist•added 2018/12/13 2:0 p.m.•28 views

CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

7.4AI score0.25743EPSS
SaveExploits0References1
CVE
CVE•added 2018/12/13 2:0 p.m.•85 views

CVE-2018-8033

CVE-2018-8033 affects Apache OFBiz 16.11.01–16.11.04. The vulnerability lies in the OFBiz HTTP engine at /webtools/control/httpService, where POST/GET requests may include serviceName, serviceMode, and serviceContext. Exploitation is achieved via DOCTYPEs referencing external entities, triggering...

7.5CVSS7.4AI score0.25743EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies•added 2018/12/13 12:0 a.m.•6 views

PT-2018-18396 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions 16.11.01 through 16.11.04 Description: The issue concerns the OFBiz HTTP engine, specifically the handling of requests for HTTP services via the "/webtools/control/httpService" endpoint. Both POST and GET requests to thi...

7.5CVSS7.6AI score0.25743EPSS
SaveExploits0References5
0day.today
0day.today•added 2018/12/12 12:0 a.m.•71 views

Apache OFBiz 16.11.05 - Cross-Site Scripting Vulnerability

Exploit for multiple platform in category web applications Exploit Title: Apache OFBiz v16.11.05 - Stored Cross-Site Scripting Vulnerability Exploit Author: DKM Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://www.apache.org/dyn/closer.lua/ofbiz/apache-ofbiz-16.11.05.zip Version:...

7.4AI score
SaveExploits0
Packet Storm
Packet Storm•added 2018/12/12 12:0 a.m.•51 views

Apache OFBiz 16.11.05 Cross Site Scripting

Exploit Title: Apache OFBiz v16.11.05 - Stored Cross-Site Scripting Vulnerability Google Dork: N/A Date: 09 - December - 2018 Exploit Author: DKM Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://www.apache.org/dyn/closer.lua/ofbiz/apache-ofbiz-16.11.05.zip Version: v16.11.05 Test...

7.4AI score
SaveExploits0
exploitpack
exploitpack•added 2018/12/11 12:0 a.m.•22 views

Apache OFBiz 16.11.05 - Cross-Site Scripting

Apache OFBiz 16.11.05 - Cross-Site Scripting Exploit Title: Apache OFBiz v16.11.05 - Stored Cross-Site Scripting Vulnerability Google Dork: N/A Date: 09 - December - 2018 Exploit Author: DKM Vendor Homepage: https://ofbiz.apache.org/ Software Link:...

6.8AI score
SaveExploits0
Exploit DB
Exploit DB•added 2018/12/11 12:0 a.m.•41 views

Apache OFBiz 16.11.05 - Cross-Site Scripting

Exploit Title: Apache OFBiz v16.11.05 - Stored Cross-Site Scripting Vulnerability Google Dork: N/A Date: 09 - December - 2018 Exploit Author: DKM Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://www.apache.org/dyn/closer.lua/ofbiz/apache-ofbiz-16.11.05.zip Version: v16.11.05 Test...

5.3AI score
SaveExploits0
CNVD
CNVD•added 2018/10/26 12:0 a.m.•1 views

Apache OFBiz XML External Entity Injection Vulnerability

Apache OFBiz is an e-commerce platform , is an open source project that provides the creation based on the latest J2EE/XML specifications and technical standards , to build medium-sized and large enterprise-class , cross-platform , cross-database , cross-application server multi-tier , distribute...

7AI score
SaveExploits0References1
0day.today
0day.today•added 2018/10/25 12:0 a.m.•46 views

Apache OFBiz 16.11.04 - XML External Entity Injection Exploit

Exploit for java platform in category web applications Exploit Title: Apache OFBiz 16.11.04 - XML External Entity Injection Exploit Author: Jamie Parfet Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://archive.apache.org/dist/ofbiz/ Version: xXx xXx """ if lensys.argv = 1: print'...

7.4AI score
SaveExploits0
Packet Storm
Packet Storm•added 2018/10/24 12:0 a.m.•23 views

Apache OFBiz 16.11.04 XML Injection

Exploit Title: Apache OFBiz 16.11.04 - XML External Entity Injection Date: 2018-10-15 Exploit Author: Jamie Parfet Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://archive.apache.org/dist/ofbiz/ Version: xXx xXx """ if lensys.argv = 1: print' Apache OFBiz 16.11.04 XXE' print' Use...

0.2AI score
SaveExploits0
Exploit DB
Exploit DB•added 2018/10/24 12:0 a.m.•26 views

Apache OFBiz 16.11.04 - XML External Entity Injection

Exploit Title: Apache OFBiz 16.11.04 - XML External Entity Injection Date: 2018-10-15 Exploit Author: Jamie Parfet Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://archive.apache.org/dist/ofbiz/ Version: xXx xXx """ if lensys.argv = 1: print' Apache OFBiz 16.11.04 XXE' print' Use...

5.3AI score
SaveExploits0
Rows per page
Query Builder