EUVD-2019-2132

Malware in sbrugna...

CVE-2019-10074: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never...

PT-2019-11418

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 16.11.06 Description: A remote code execution RCE issue is possible when Freemarker markup is entered in a textarea field of an Apache OFBiz Form Widget, specifically when encoding has been disabled on such a...

Apache Struts2 S2-053 Remote Code Execution Vulnerability

Struts2 is the Apache Software Foundation is responsible for maintaining a MVC-based design pattern of the Web application framework for open source projects . Apache Struts2 suffers from a S2-053 remote code execution vulnerability that causes an attacker to remotely execute a code attack when a...