824 matches found
CVE-2022-25371 Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz
Apache OFBiz uses the Birt project plugin https://eclipse.github.io/birt-website/ to create data visualizations and reports. By leveraging a bug in Birt https://bugs.eclipse.org/bugs/showbug.cgi?id=538142 it is possible to perform a remote code execution RCE attack in Apache OFBiz, release 18.12....
CVE-2022-25371 Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz
Apache OFBiz uses the Birt project plugin https://eclipse.github.io/birt-website/ to create data visualizations and reports. By leveraging a bug in Birt https://bugs.eclipse.org/bugs/showbug.cgi?id=538142 it is possible to perform a remote code execution RCE attack in Apache OFBiz, release 18.12....
CVE-2022-25370
Summary: CVE-2022-25370 affects Apache OFBiz versions 18.12.05 and earlier, due to a vulnerability in the Birt plugin (Birt issue 538142) that enables an unauthenticated stored XSS attack. The attack can inject and execute a payload via the stored XSS vector. Affected software/component: Apache O...
CVE-2022-25370 Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz
Apache OFBiz uses the Birt plugin https://eclipse.github.io/birt-website/ to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt https://bugs.eclipse.org/bugs/showbug.cgi?id=538142, an unauthenticated malicious user...
Apache OFBiz Cross-Site Scripting Vulnerability (CNVD-2022-69474)
Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation in the United States. The system provides a suite of Java-based web application components and tools. Apache OFBiz 18.12.05 and earlier versions contain a security vulnerability that can be exploited by...
PT-2022-17248 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.05 Description: The issue allows an unauthenticated malicious user to perform a stored XSS attack, enabling the injection of a malicious payload that can be executed. This is made possible by leveraging a...
Apache OFBiz 路径遍历漏洞
Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz 18.12.05 and earlier versions, which stems from an error in Birt and can be exploited by attackers to remotely execute code...
Apache OFBiz 代码问题漏洞
Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code issue vulnerability exists in Apache OFBiz Solr plugin 18.12.05 and earlier, which stems from the default configuration of automatically issuing RMI requests on port 1099 on localhost, which can be...
PT-2022-17538 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions 18.12.05 and earlier Description: The issue allows an attacker, acting as an anonymous user of the ecommerce plugin, to insert malicious content in the "Subject" field of a message from the "Contact us" page. This can le...
Apache OFBiz Code Issue Vulnerability (CNVD-2023-03920)
Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code issue vulnerability exists in Apache OFBiz Solr plugin 18.12.05 and earlier, which stems from the default configuration of automatically issuing RMI requests on port 1099 on localhost, which can be...
CVE-2022-29063: Deserialization of Untrusted Data
The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run...
Apache OFBiz 安全漏洞
Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A security vulnerability exists in Apache OFBiz 18.12.05 and earlier, which can be exploited by attackers to conduct regular expression denial-of-service attacks...
PT-2022-19419 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.06 Description: The issue arises from the way Apache OFBiz handles URLs provided by external, unauthenticated users, making it vulnerable to Regular Expression Denial of Service ReDoS. Recommendations: For...
CVE-2022-29158: Inefficient Regular Expression Complexity
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service ReDoS in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599...
Apache OFBiz 代码注入漏洞
Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz versions 18.12.05 and earlier, which could be exploited to insert malicious content into the "Subject" field of the "Contact us" page. field of the "Contact...
PT-2022-19398 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.06 Description: The Solr plugin of Apache OFBiz is configured to automatically make a RMI request on localhost, port 1099 by default. In affected versions, an attacker may exploit this behavior by hosting ...
CVE-2022-25370: Improper Neutralization of Input During Web Page Generation
Apache OFBiz uses the Birt plugin https://eclipse.github.io/birt-website/ to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt https://bugs.eclipse.org/bugs/showbug.cgi?id=538142, an unauthenticated malicious user...
CVE-2022-25371: Improper Limitation of a Pathname to a Restricted Directory
Apache OFBiz uses the Birt project plugin https://eclipse.github.io/birt-website/ to create data visualizations and reports. By leveraging a bug in Birt https://bugs.eclipse.org/bugs/showbug.cgi?id=538142 it is possible to perform a remote code execution RCE attack in Apache OFBiz, release 18.12....
Apache OFBiz Code Injection Vulnerability (CNVD-2023-03919)
Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz versions 18.12.05 and earlier, which could be exploited to insert malicious content into the "Subject" field of the "Contact us" page. field of the "Contact...
CVE-2022-25813: Improper Neutralization of Special Elements Used in a Template Engine
In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SST...