Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Apache OFBiz: Path traversal leading to RCE

Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz

Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

Pre-auth RCE in Apache Ofbiz 18.12.09

The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099

Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports

Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands

Apache OFBiz has unsafe deserialization prior to 17.12.07 version

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

Apache OFBiz has unsafe deserialization prior to 17.12.06

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field

The java.io.ObjectInputStream is known to cause Java serialisation issues

The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed

Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache…

Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14

Possible path traversal in Apache OFBiz allowing authentication bypass