apache ofbiz 16.11.01 vulnerabilities and exploits

(subscribe to this query)

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "__format=%27;alert(%27xss%27)" to the URL an alert window would exec...

Apache Ofbiz 16.11.01 Apache Ofbiz 16.11.02 Apache Ofbiz 16.11.03

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to...

Apache Ofbiz 11.04 Apache Ofbiz 11.04.01 Apache Ofbiz 11.04.02 Apache Ofbiz 11.04.03 Apache Ofbiz 11.04.04 Apache Ofbiz 11.04.05 Apache Ofbiz 11.04.06 Apache Ofbiz 12.04 Apache Ofbiz 12.04.01 Apache Ofbiz 12.04.02 Apache Ofbiz 12.04.03 Apache Ofbiz 12.04.04

The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article...

Apache Ofbiz 11.04 Apache Ofbiz 11.04.01 Apache Ofbiz 11.04.02 Apache Ofbiz 11.04.03 Apache Ofbiz 11.04.04 Apache Ofbiz 11.04.05 Apache Ofbiz 11.04.06 Apache Ofbiz 12.04 Apache Ofbiz 12.04.01 Apache Ofbiz 12.04.02 Apache Ofbiz 12.04.03 Apache Ofbiz 12.04.04

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.

an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: se...

3 Github repositories

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network...

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook