CveMateVulnerability intelligence

Apache Software Foundation Apache Ofbiz vulnerabilities, page 2

51 vulnerabilities

Known vulnerabilities in Apache Software Foundation Apache Ofbiz, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2024-48962apache software foundationapache ofbiz+11y ago18-11-2024 08:41

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.CVE-2024-36104apache software foundationapache ofbiz+12y ago04-06-2024 07:25

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.CVE-2024-25065apache software foundationapache ofbiz+12y ago28-02-2024 15:42

Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.CVE-2024-38856apache software foundationapache ofbiz+1KEV2y ago05-08-2024 08:20

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).CVE-2024-45507apache software foundationapache ofbiz+12y ago04-09-2024 08:08

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.CVE-2024-45195apache software foundationapache ofbiz+1KEV2y ago04-09-2024 08:08

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.CVE-2024-32113apache software foundationapache ofbiz+1KEV2y ago08-05-2024 14:50

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.CVE-2024-23946apache software foundationapache ofbiz+12y ago28-02-2024 15:44

Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.CVE-2026-41919apache software foundationapache ofbiz+15mo ago19-05-2026 09:36

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-47342apache software foundationapache ofbiz+14mo ago10-06-2026 22:29

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.CVE-2026-31909apache software foundationapache ofbiz+15mo ago19-05-2026 09:32

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31906apache software foundationapache ofbiz+15mo ago19-05-2026 09:30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31379apache software foundationapache ofbiz+15mo ago19-05-2026 09:22

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31986apache software foundationapache ofbiz+15mo ago19-05-2026 09:34

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31910apache software foundationapache ofbiz+15mo ago19-05-2026 09:33

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31380apache software foundationapache ofbiz+15mo ago19-05-2026 09:24

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31388apache software foundationapache ofbiz+15mo ago19-05-2026 09:28

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31378apache software foundationapache ofbiz+15mo ago19-05-2026 09:21

Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-31387apache software foundationapache ofbiz+15mo ago19-05-2026 09:27

Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.CVE-2026-29220apache software foundationapache ofbiz+15mo ago19-05-2026 09:16

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.