Vulnerabilities > Apache > Ofbiz > High

DATE CVE VULNERABILITY TITLE RISK
2024-09-04 CVE-2024-45195 Unspecified vulnerability in Apache Ofbiz
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
network
low complexity
apache
7.5
2023-12-26 CVE-2023-50968 Server-Side Request Forgery (SSRF) vulnerability in Apache Ofbiz
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.
network
low complexity
apache CWE-918
7.5
2023-04-14 CVE-2022-47501 Unspecified vulnerability in Apache Ofbiz
Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin.
network
low complexity
apache
7.5
2022-09-02 CVE-2022-25813 Code Injection vulnerability in Apache Ofbiz
In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page.
network
low complexity
apache CWE-94
7.5
2022-09-02 CVE-2022-29158 Unspecified vulnerability in Apache Ofbiz
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users.
network
low complexity
apache
7.5
2021-08-30 CVE-2021-25958 Information Exposure Through an Error Message vulnerability in Apache Ofbiz
In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon.
network
low complexity
apache CWE-209
7.5
2020-04-30 CVE-2019-12425 Injection vulnerability in Apache Ofbiz 17.12.01
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host
network
low complexity
apache CWE-74
7.5
2020-04-30 CVE-2019-0235 Cross-Site Request Forgery (CSRF) vulnerability in Apache Ofbiz 17.12.01
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
network
low complexity
apache CWE-352
8.8
2019-11-26 CVE-2011-3600 XXE vulnerability in Apache Ofbiz
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem.
network
low complexity
apache CWE-611
7.5
2018-12-13 CVE-2018-8033 Information Exposure vulnerability in Apache Ofbiz
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint.
network
low complexity
apache CWE-200
7.5