Apache OFBiz vulnerabilities

4 published CVEs name Apache OFBiz among the affected products.

Critical 3High 0Medium 1Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2019-10074
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the…
Apache · OFBiz
Critical9.8
CVE-2019-10073
The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade…
Apache · OFBiz
Medium6.1
CVE-2019-0189
The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java…
Apache · OFBiz
Critical9.8
CVE-2018-17200
The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService…
Apache · OFBiz
Critical9.8