824 matches found
CVE-2020-13923
IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04...
CVE-2020-9496: Improper Neutralization of Input During Web Page Generation
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03...
CVE-2020-13923: Authorization Bypass Through User-Controlled Key
IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04...
Apache OFBiz XML-RPC Java Deserialization
This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.01 using the ROME gadget chain. Versions up to 18.12.11 are exploitable utilizing an auth bypass CVE-2023-51467 and use the...
Apache OFBiz Cross-Site Request Forgery Vulnerability
Apache OFBiz is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a complete set of Java-based Web application components and tools. A cross-site request forgery vulnerability exists in Apache OFBiz version 17.12.01 that...
Apache OFBiz Injection Vulnerability
Apache OFBiz is the United States Apache Apache Software Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. An injection vulnerability exists in Apache OFBiz version 17.12.01. An attacker can exploit this...
Apache OFBiz 17.12.03 Cross Site Request Forgery Vulnerability
Exploit for multiple platform in category web applications Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery Account Takeover Exploit Author: Faiz Ahmed Zaidi Vendor Homepage: https://ofbiz.apache.org/security.html Software Link: https://ofbiz.apache.org/download.htmlsecurity...
Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)
Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery Account Takeover Exploit Author: Faiz Ahmed Zaidi Vendor Homepage: https://ofbiz.apache.org/security.html Software Link: https://ofbiz.apache.org/download.htmlsecurity Version: Before 17.12.03 Tested on: Linux and Windows CVE :...
Apache OFBiz 17.12.03 Cross Site Request Forgery
Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery Account Takeover Exploit Author: Faiz Ahmed Zaidi Vendor Homepage: https://ofbiz.apache.org/security.html Software Link: https://ofbiz.apache.org/download.htmlsecurity Version: Before 17.12.03 Tested on: Linux and Windows CVE :...
CVE-2019-0235
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...
CVE-2019-0235
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...
Cross site request forgery (csrf)
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...
Design/Logic Flaw
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...
CVE-2019-0235
CVE-2019-0235 affects Apache OFBiz. Connected sources detail a Cross-Site Request Forgery vulnerability in OFBiz 17.12.01 (and related 17.12.x releases) where forged requests can perform unauthorized actions (e.g., via endpoints like updateEmailAddress). The core issue is CSRF protection weakness...
CVE-2019-0235
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks...
CVE-2019-12425
CVE-2019-12425 affects Apache OFBiz 17.12.01 and is described as a Host header injection vulnerability caused by accepting arbitrary Host headers. This is documented across multiple sources (e.g., NVD entry and Red Hat, CNVD, OSV, CVE lists) with the consistent description that OFBiz 17.12.01 is ...
CVE-2019-12425
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...
CVE-2019-12425: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host...