CVE-2024-25065 Apache OFBiz: Path traversal allowing authentication bypass.

Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue...

CVE-2024-25065 Apache OFBiz: Path traversal allowing authentication bypass.

Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue...

CVE-2024-25065

Apache OFBiz, an enterprise resource planning (ERP) system, contains a path traversal vulnerability in versions prior to 18.12.12 . The root cause is identified as incorrect restrictions on the path to the restricted-access catalog, which allows a remote attacker to bypass the authentication proc...

PT-2024-2299 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.12 Description: The issue is related to a possible path traversal in Apache OFBiz, allowing authentication bypass. This can be exploited by a remote attacker to bypass the authentication process...

CVE-2024-23946: Improper Limitation of a Pathname to a Restricted Directory

Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue...

CVE-2024-25065: Improper Limitation of a Pathname to a Restricted Directory

Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue...

The vulnerability of the createRegister method implementation in Apache OFBiz’s enterprise resource planning software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the createRegister method in Apache OFBiz’s enterprise resource planning software lies in the leakage of information in error messages. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Apache OFBiz createRegister Error Message Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apache OFBiz. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createRegister method. The issue results from outputting an error message that...

The vulnerability of the Solr software solution for enterprise resource planning by Apache OFBiz, which allows attackers to modify protected information

The vulnerability of the Solr software for enterprise resource planning software Apache OFBiz lies in the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker to remotely modify protected information...

VulnCheck KEV: CVE-2023-50968

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes th...

Exploit for Code Injection in Apache Ofbiz

Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-20...

Exploit for Server-Side Request Forgery in Apache Ofbiz

BadBizness Automatic exploitation scrip...

Exploit for Server-Side Request Forgery in Apache Ofbiz

BadBizness Automatic exploitation scrip...

New PoC Exploit for Apache OfBiz Vulnerability Poses Risk to ERP Systems

Cybersecurity researchers have developed a proof-of-concept PoC code that exploits a recently disclosed critical flaw in the Apache OfBiz open-source Enterprise Resource Planning ERP system to execute a memory-resident payload. The vulnerability in question is CVE-2023-51467 CVSS score: 9.8, a...

Exploit for Server-Side Request Forgery in Apache Ofbiz

Go-Exploit for CVE-2023-51467 This repository contains a go-e...

Exploit for Code Injection in Apache Ofbiz

Exploit CVE-2023-49070 and CVE-2023-51467 Apache OFBiz 18.12...

Exploit for Server-Side Request Forgery in Apache Ofbiz

CVE-2023-51467 Graphical Apache Ofbiz: CVE-2023-51467 – Remo...

Attacks, Vulnerabilities and Actors 25 December to 31 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, four instances of adversary activity, and five exploited...

Zero-Day Authentication Bypass Exploit in Apache OFBiz

Summary: CVE-2023-51467 is a critical authentication bypass vulnerability in Apache OFBiz. Exploitation of this vulnerability could result in bypass authentication to achieve a simple Server-Side Request Forgery SSRF or arbitrary code execution. Users are advised to update to Apache OFBiz version...

Apache OFBiz Remote Code Execution

Apache OFBiz versions before 18.12.10 suffer from an authentication bypass vulnerability and a deserialization vulnerability on the /webtools/control/xmlrpc endpoint. By crafting a malicious serialized Java Object, a remote and unauthenticated attacker could achieve a remote code execution on the...