Skip to content

Apache Ofbiz vulnerabilities

apache ofbizApache OFBiz 17.12.01 is vulnerable to some CSRF attacks.CVE-2019-0235Public exploitEPSS 32.7%8.8 HighApril 30, 2020
apache ofbizApache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary hostCVE-2019-124257.5 HighApril 30, 2020
apache ofbizData sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache...CVE-2020-1943EPSS 97.2%6.1 MediumApril 1, 2020
apache ofbizan unauthenticated user could get access to information of some backend screens by invoking...CVE-2019-124265.3 MediumFebruary 6, 2020
apache ofbizThe /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External...CVE-2011-3600EPSS 15.9%7.5 HighNovember 26, 2019
apache ofbizAn RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field...CVE-2019-100749.8 CriticalSeptember 11, 2019
apache ofbizThe "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in...CVE-2019-100736.1 MediumSeptember 11, 2019
apache ofbizThe java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is...CVE-2019-0189EPSS 23.7%9.8 CriticalSeptember 11, 2019
apache ofbizThe Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests...CVE-2018-172009.8 CriticalSeptember 11, 2019
apache ofbizIn Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine...CVE-2018-8033Public exploitEPSS 25.7%7.5 HighDecember 13, 2018
apache ofbizThe BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed....CVE-2017-157149.8 CriticalJanuary 4, 2018
apache ofbizApache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via...CVE-2012-16229.8 CriticalOctober 26, 2017
apache ofbizThe default configuration of the Apache OFBiz framework offers a blog functionality. Different...CVE-2016-68006.1 MediumAugust 30, 2017
apache ofbizBy manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid...CVE-2016-44628.8 HighAugust 30, 2017
apache ofbizApache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to...CVE-2016-2170EPSS 12.7%9.8 CriticalApril 12, 2016
apache ofbizCross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in...CVE-2015-32686.1 MediumApril 12, 2016
apache ofbizMultiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes...CVE-2014-02324.3 MediumAugust 22, 2014
apache ofbizMultiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka...CVE-2012-16214.3 MediumJune 19, 2014
apache ofbizMultiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in...CVE-2013-0177Public exploitEPSS 21.2%3.5 LowJanuary 30, 2014
apache ofbizApache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02...CVE-2013-2250EPSS 12.4%10.0 HighAugust 15, 2013
apache ofbizCross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in...CVE-2013-21374.3 MediumAugust 15, 2013
apache ofbizUnspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10...CVE-2012-350610.0 HighOctober 25, 2012
apache ofbizMultiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka...CVE-2010-0432Public exploitEPSS 22.9%4.3 MediumApril 15, 2010
apache ofbiz, opentaps +1 moreCross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open...CVE-2006-65896.8 MediumDecember 15, 2006
apache ofbizThe forum implementation in the ecommerce component in the Apache Open For Business Project ...CVE-2006-65887.5 HighDecember 15, 2006
apache ofbizCross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component...CVE-2006-65876.8 MediumDecember 15, 2006