CVE-2022-25370

Summary: CVE-2022-25370 affects Apache OFBiz versions 18.12.05 and earlier, due to a vulnerability in the Birt plugin (Birt issue 538142) that enables an unauthenticated stored XSS attack. The attack can inject and execute a payload via the stored XSS vector. Affected software/component: Apache O...

CVE-2022-25370 Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz

Apache OFBiz uses the Birt plugin https://eclipse.github.io/birt-website/ to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt https://bugs.eclipse.org/bugs/showbug.cgi?id=538142, an unauthenticated malicious user...

Apache OFBiz 路径遍历漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz 18.12.05 and earlier versions, which stems from an error in Birt and can be exploited by attackers to remotely execute code...

Apache OFBiz Code Issue Vulnerability (CNVD-2023-03920)

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code issue vulnerability exists in Apache OFBiz Solr plugin 18.12.05 and earlier, which stems from the default configuration of automatically issuing RMI requests on port 1099 on localhost, which can be...

Apache OFBiz 代码问题漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code issue vulnerability exists in Apache OFBiz Solr plugin 18.12.05 and earlier, which stems from the default configuration of automatically issuing RMI requests on port 1099 on localhost, which can be...

PT-2022-17538 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions 18.12.05 and earlier Description: The issue allows an attacker, acting as an anonymous user of the ecommerce plugin, to insert malicious content in the "Subject" field of a message from the "Contact us" page. This can le...

Apache OFBiz Cross-Site Scripting Vulnerability (CNVD-2022-69474)

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation in the United States. The system provides a suite of Java-based web application components and tools. Apache OFBiz 18.12.05 and earlier versions contain a security vulnerability that can be exploited by...

Apache OFBiz 代码注入漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz versions 18.12.05 and earlier, which could be exploited to insert malicious content into the "Subject" field of the "Contact us" page. field of the "Contact...

PT-2022-19419 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.06 Description: The issue arises from the way Apache OFBiz handles URLs provided by external, unauthenticated users, making it vulnerable to Regular Expression Denial of Service ReDoS. Recommendations: For...

PT-2022-19398 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.06 Description: The Solr plugin of Apache OFBiz is configured to automatically make a RMI request on localhost, port 1099 by default. In affected versions, an attacker may exploit this behavior by hosting ...

PT-2022-17248 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.05 Description: The issue allows an unauthenticated malicious user to perform a stored XSS attack, enabling the injection of a malicious payload that can be executed. This is made possible by leveraging a...

Apache OFBiz Code Injection Vulnerability (CNVD-2023-03919)

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz versions 18.12.05 and earlier, which could be exploited to insert malicious content into the "Subject" field of the "Contact us" page. field of the "Contact...

Apache OFBiz 安全漏洞

Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A security vulnerability exists in Apache OFBiz 18.12.05 and earlier, which can be exploited by attackers to conduct regular expression denial-of-service attacks...

Apache OFBiz Log4Shell Direct Check (CVE-2021-44228)

Binary data apacheofbizlog4shell.nbin...

Log4Shell HTTP Scanner

Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will scan an HTTP end point for the Log4Shell vulnerability by injectin...

CVE-2021-25958

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception...

CVE-2021-25958

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception...

CVE-2021-25958 Generation of Error Message Containing Sensitive Information in Apache OFBiz

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception...

CVE-2021-25958

Summary: CVE-2021-25958 affects Apache OFBiz (versions 17.12.01–17.12.07). The issue arises from a try/catch error handling path that leaks sensitive table information in error messages, aiding attacker reconnaissance. The vulnerability is triggered during normal login attempts after a user regis...

Apache OFBiz安全漏洞

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a suite of Java-based web application components and tools. A security vulnerability exists in Apache Ofbiz versions 17.12.01 through 17.12.07, which stems from the...