858 matches found
Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)
Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery Account Takeover Exploit Author: Faiz Ahmed Zaidi Vendor Homepage: https://ofbiz.apache.org/security.html Software Link: https://ofbiz.apache.org/download.htmlsecurity Version: Before 17.12.03 Tested on: Linux and Windows CVE :...
Apache OFBiz 17.12.03 Cross Site Request Forgery
Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery Account Takeover Exploit Author: Faiz Ahmed Zaidi Vendor Homepage: https://ofbiz.apache.org/security.html Software Link: https://ofbiz.apache.org/download.htmlsecurity Version: Before 17.12.03 Tested on: Linux and Windows CVE :...
CVE-2019-12425
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...
CVE-2019-0235
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...
CVE-2019-0235
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...
Cross site request forgery (csrf)
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...
Design/Logic Flaw
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...
CVE-2019-0235
CVE-2019-0235 affects Apache OFBiz. Connected sources detail a Cross-Site Request Forgery vulnerability in OFBiz 17.12.01 (and related 17.12.x releases) where forged requests can perform unauthorized actions (e.g., via endpoints like updateEmailAddress). The core issue is CSRF protection weakness...
CVE-2019-0235
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...
CVE-2019-12425
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...
CVE-2019-12425
CVE-2019-12425 affects Apache OFBiz 17.12.01 and is described as a Host header injection vulnerability caused by accepting arbitrary Host headers. This is documented across multiple sources (e.g., NVD entry and Red Hat, CNVD, OSV, CVE lists) with the consistent description that OFBiz 17.12.01 is ...
Apache OFBiz Insecure Deserialization (CVE-2019-0189)
An insecure deserialization vulnerability exists in Apache OFBiz. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
CVE-2020-1943
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07...
CVE-2020-1943
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07...
Code injection
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07...
CVE-2020-1943
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07...
CVE-2020-1943
CVE-2020-1943 affects Apache OFBiz 16.11.01–16.11.07. The vulnerability is a cross-site scripting flaw caused by unsanitized data sent with the contentId parameter to the /control/stream endpoint. Impact, as reported, is execution of malicious scripts in the victim’s browser (potential session-re...
PT-2020-15180 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions 16.11.01 through 16.11.07 Description: The issue allows for XSS attacks due to unsanitized data sent with the contentId to the "/control/stream" API endpoint. Recommendations: For Apache OFBiz versions 16.11.01 through...
Apache OFBiz Unauthorized Access Vulnerability
Apache OFBiz is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a complete set of Java-based Web application components and tools. An unauthorized access vulnerability exists in Apache OFBiz, which could be exploited by ...