VulnCheck KEV: CVE-2024-45507

Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue...

Exploit for Incorrect Authorization in Apache Ofbiz

cveCVE-2024-38856-poc CVE-2024-38856 is a serious vulnerabil...

Apache OFBiz code issue vulnerability (CNVD-2024-46271)

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A security vulnerability exists in Apache OFBiz that stems from the product's failure to properly validate...

The vulnerability of the Apache OFBiz resource planning software lies in improper code generation management, which allows attackers to execute SSRF attacks.

The vulnerability of Apache OFBiz’s resource planning software lies in improper code generation management. Exploiting this vulnerability allows a remote attacker to execute an SSRF attack...

The vulnerability of the Apache OFBiz resource planning software lies in the insufficient validation of requests on the server side, allowing attackers to execute SSRF attacks.

The vulnerability of Apache OFBiz’s resource planning software lies in insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...

CVE-2024-48962

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

CVE-2024-48962

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

CVE-2024-47208 Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue...

CVE-2024-47208 Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue...

CVE-2024-47208

CVE-2024-47208 affects Apache OFBiz prior to 18.12.17. The issue is a Server-Side Request Forgery (SSRF) with improper control of code generation (code injection) that could enable an attacker to access intranet resources. Affected component/flow details are not explicitly enumerated beyond the v...

CVE-2024-47208 Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue...

CVE-2024-48962

CVE-2024-48962 affects Apache OFBiz versions before 18.12.17. The issue combines improper generation of code (code injection) with CSRF, arising from improper neutralization of certain template elements. This can enable unauthorized actions or code execution within vulnerable OFBiz deployments. T...

CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

Apache OFBiz 安全漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation in the United States. The system provides a suite of Java-based web application components and tools. A security vulnerability exists in Apache OFBiz versions prior to 18.12.17 that stems from improper...

Apache OFBiz 代码问题漏洞

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A security vulnerability exists in Apache OFBiz that stems from the product's failure to properly validate...

PT-2024-8600 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to Server-Side Request Forgery SSRF and Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This vulnerability may allow a remote...

PT-2024-8602 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery CSRF and improper neutralization of special elements...

Apache OFBiz < 18.12.16 Remote Code Execution

Apache OFBiz versions prior to 18.12.16 suffers from a vulnerability allowing a remote and unauthenticated attacker to arbitrary write file to the target instance and Remote Code Execution RCE on the vulnerable system. Note that this plugin requires the 'File Upload' assessment option enabled in...