Apache Software Foundation Apache OFBiz
51 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-47342 | < 24.09.07 | Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass | HIGH 8.8 | 0.4 % | ||
| CVE-2026-50223 | < 24.09.07 | Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution | HIGH 8.8 | 0.7 % | ||
| CVE-2026-46586 | < 24.09.06 | Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution | HIGH 8.8 | 0.7 % | ||
| CVE-2026-45434 | < 24.09.06 | Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE | CRITICAL 9.8 | 21 % | ||
| CVE-2026-45187 | < 24.09.06 | Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-41919 | < 24.09.06 | Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-35086 | < 24.09.06 | Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-31986 | < 24.09.06 | Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-31910 | < 24.09.06 | Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access | HIGH 7.5 | 0.5 % | ||
| CVE-2026-31909 | < 24.09.06 | Apache OFBiz: Unauthenticated Shipment Label Image Disclosure | HIGH 7.5 | 0.5 % | ||
| CVE-2026-31906 | < 24.09.06 | Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-31388 | < 24.09.06 | Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-31387 | < 24.09.06 | Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-31380 | < 24.09.06 | Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-31379 | < 24.09.06 | Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager | MEDIUM 6.1 | 0.6 % | ||
| CVE-2026-31378 | < 24.09.06 | Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-29226 | < 24.09.06 | Apache OFBiz: Low-Privilege SSRF in Content Component | HIGH 7.3 | 0.5 % | ||
| CVE-2026-29207 | < 24.09.06 | Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-29220 | < 24.09.06 | Apache OFBiz: Low-Privilege LFI in Content Component | MEDIUM 6.5 | 0.7 % | ||
| CVE-2025-61623 | < 24.09.03 | Apache OFBiz: Reflected Cross-site Scripting | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-59118 | < 24.09.03 | Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload | HIGH 7.3 | 1.7 % | ||
| CVE-2025-54466 | < 24.09.02 | Apache OFBiz: RCE Vulnerability in scrum plugin | CRITICAL 9.8 | 27 % | ||
| CVE-2025-30676 | < 18.12.19 | Apache OFBiz: Stored XSS Vulnerability | MEDIUM 6.1 | 68 % | ||
| CVE-2025-26865 | 18.12.17 – < 18.12.18 | Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE | LOW 3.5 | 0.7 % | ||
| CVE-2024-47208 | < 18.12.17 | Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE | CRITICAL 9.8 | 1.6 % | ||
| CVE-2024-48962 | < 18.12.17 | Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE) | HIGH 8.9 | 0.6 % | ||
| CVE-2024-45195 | < 18.12.16 | Apache OFBiz: Confused controller-view authorization logic (forced browsing) | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2024-45507 | < 18.12.16 | Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE | CRITICAL 9.8 | 96 % | ||
| CVE-2024-38856 | ≤ 18.12.14 | Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code | CRITICAL 9.8 | 99 % | KEV | |
| CVE-2024-36104 | < 18.12.14 | Apache OFBiz: Path traversal leading to a RCE | CRITICAL 9.1 | 88 % | ||
| CVE-2024-32113 | < 18.12.13 | Apache OFBiz: Path traversal leading to RCE | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2024-23946 | < 18.12.12 | Apache OFBiz: Path traversal or file inclusion | MEDIUM 5.3 | 3.1 % | ||
| CVE-2024-25065 | < 18.12.12 | Apache OFBiz: Path traversal allowing authentication bypass. | CRITICAL 9.1 | 48 % | ||
| CVE-2023-51467 | < 18.12.11 | Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability | CRITICAL 9.8 | 96 % | ||
| CVE-2023-50968 | ≤ 18.12.10 | Apache OFBiz: Arbitrary file properties reading and SSRF attack | HIGH 7.5 | 63 % | ||
| CVE-2023-49070 | < 18.12.10 | Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present | CRITICAL 9.8 | 95 % | ||
| CVE-2023-46819 | < 18.12.09 | Apache OFBiz: Execution of Solr plugin queries without authentication | MEDIUM 5.3 | 1.8 % | ||
| CVE-2022-47501 | 18.12.06 – < 18.12.07 | Apache OFBiz: Arbitrary file reading vulnerability | HIGH 7.5 | 10 % | ||
| CVE-2022-29158 | Apache OFBiz – 18.12.05 | Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz | HIGH 7.5 | 2.2 % | ||
| CVE-2022-29063 | Apache OFBiz – 18.12.05 | Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz | CRITICAL 9.8 | 5.1 % | ||
| CVE-2022-25813 | Apache OFBiz – 18.12.05 | Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz | HIGH 7.5 | 67 % | ||
| CVE-2022-25371 | Apache OFBiz – 18.12.05 | Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz | CRITICAL 9.8 | 5.4 % | ||
| CVE-2022-25370 | Apache OFBiz – 18.12.05 | Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz | MEDIUM 5.4 | 2.8 % | ||
| CVE-2021-37608 | unspecified – 17.12.07 | Arbitrary file upload vulnerability in OFBiz | CRITICAL 9.8 | 6.0 % | ||
| CVE-2021-30128 | Apache OFBiz – < 17.12.07 | Unsafe deserialization in Apache OFBiz | CRITICAL 9.8 | 81 % | ||
| CVE-2021-29200 | Apache OFBiz – < 17.12.07 | RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI | CRITICAL 9.8 | 55 % | ||
| CVE-2021-26295 | Apache OFBiz 17.12.01 to 17.12.05 | RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI | CRITICAL 9.8 | 98 % | ||
| CVE-2018-8033 | Apache OFBiz 16.11.01 to 16.11.04 | In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP serv | HIGH 7.5 | 26 % | ||
| CVE-2017-15714 | 16.11.01 to 16.11.03 | The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing t | CRITICAL 9.8 | 3.3 % | ||
| CVE-2016-6800 | 13.07.* ; 12.04.* ; 11.04.* | The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are rel | MEDIUM 6.1 | 3.5 % | ||
| CVE-2016-4462 | 13.07.* ; 12.04.* ; 11.04.* | By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engin | HIGH 8.8 | 3.8 % |