Apache OFBiz Code Injection Vulnerability

Apache OFBiz is an open source enterprise resource planning ERP system. A code injection vulnerability exists in the BIRT plugin in Apache OFBiz. The vulnerability arises because the plugin does not escape passed user input attributes. An attacker can perform code injection by passing via URL thi...

CVE-2017-15714

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...

Code injection

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...

CVE-2017-15714

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...

CVE-2017-15714

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...

CVE-2017-15714

The CVE-2017-15714 issue affects the BIRT plugin in Apache OFBiz versions 16.11.01 through 16.11.03. The root cause is that the plugin does not escape user input properties passed via the URL, enabling code injection when crafted input is supplied (e.g., a URL containing __format=%27;alert(%27xss...

CVE-2012-1622

Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors...

Code injection

Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-1622

Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-1622

CVE-2012-1622 affects Apache OFBiz 10.04.x before 10.04.02 and allows remote attackers to execute arbitrary code via unspecified vectors. The vulnerability is described as a remote code execution issue with high impact (network access, no auth required; exploits possible without user interaction)...

Apache OFBiz JavaScript Code Injection Vulnerability

Apache OFBiz is an enterprise resource planning system from the Apache Software Foundation in the United States. A security vulnerability in the Apache OFBiz processing form field allows remote attackers to exploit the vulnerability to submit a special request and execute arbitrary JavaScript cod...

Apache OFBiz Freemarker Instruction Code Execution Vulnerability

Apache OFBiz is an enterprise resource planning system from the Apache Software Foundation in the United States. Apache OFBiz has a security vulnerability in passing valid Freemarker commands to the Template Engine, allowing remote attackers to exploit the vulnerability to construct special...

Remote code execution

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...

CVE-2016-4462

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...

CVE-2016-6800

The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...

CVE-2016-6800

The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...

CVE-2016-4462

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...

Default configuration

The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not...

CVE-2016-6800

CVE-2016-6800 affects the Apache OFBiz blog feature: unsanitized input in the summary/article fields allows injection of arbitrary JavaScript, which is executed in users’ browsers visiting the article. Mitigation is to upgrade to Apache OFBiz 16.11.01. This vulnerability detail is supported by th...

CVE-2016-4462

CVE-2016-4462 concerns Apache OFBiz. A logged-in user can manipulate the externalLoginKey URL parameter to feed the Freemarker Template Engine with directives reflected on the page, enabling remote code execution via a specially crafted Freemarker template. Mitigation: upgrade to Apache OFBiz 16....