CveMateVulnerability intelligence

Apache Ofbiz vulnerabilities, page 3

73 vulnerabilities

Known vulnerabilities in Apache Ofbiz, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2024-45507apache software foundationapache ofbiz+12y ago04-09-2024 08:08

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.CVE-2024-45195apache software foundationapache ofbiz+1KEV2y ago04-09-2024 08:08

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.CVE-2024-32113apache software foundationapache ofbiz+1KEV2y ago08-05-2024 14:50

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.CVE-2024-23946apache software foundationapache ofbiz+12y ago28-02-2024 15:44

Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.CVE-2019-0189apacheofbiz7y ago11-09-2019 20:29

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16 CVE-2019-0235apacheapache ofbiz+16y ago30-04-2020 19:22

Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.CVE-2019-10073apacheofbiz7y ago11-09-2019 20:34

The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616 CVE-2019-10074apacheofbiz7y ago11-09-2019 20:38

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533 CVE-2019-12425apacheapache ofbiz+16y ago30-04-2020 19:20

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host CVE-2019-12426apacheapache ofbiz+16y ago06-02-2020 16:47

an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06 CVE-2026-41919apache software foundationapache ofbiz+15mo ago19-05-2026 09:36

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-47342apache software foundationapache ofbiz+14mo ago10-06-2026 22:29

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.CVE-2026-31909apache software foundationapache ofbiz+15mo ago19-05-2026 09:32

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31906apache software foundationapache ofbiz+15mo ago19-05-2026 09:30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31379apache software foundationapache ofbiz+15mo ago19-05-2026 09:22

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31986apache software foundationapache ofbiz+15mo ago19-05-2026 09:34

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31910apache software foundationapache ofbiz+15mo ago19-05-2026 09:33

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31380apache software foundationapache ofbiz+15mo ago19-05-2026 09:24

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31388apache software foundationapache ofbiz+15mo ago19-05-2026 09:28

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31378apache software foundationapache ofbiz+15mo ago19-05-2026 09:21

Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.