Apache Ofbiz

Vulnerabilities related to Apache Ofbiz 49

• Unrated Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an... CVE-2026-100228 Nov 5, 22:43
• Unrated Missing check for  ACCOUNTING_UPDATE /  ACCOUNTING_CREATE in accounting in allows user with only... CVE-2026-105325 Nov 5, 22:40
• Unrated Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24... CVE-2026-105330 Nov 5, 22:40
• Unrated Missing check for  ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to... CVE-2026-105461 Nov 5, 22:39
• Unrated Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz... CVE-2026-109129 Nov 5, 22:38
• Unrated Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24... CVE-2026-109837 Nov 5, 22:38
• Unrated Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24... CVE-2026-109856 Nov 5, 22:37
• Unrated Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT... CVE-2026-109928 Nov 5, 22:36
• Unrated Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the... CVE-2026-114229 Nov 5, 22:36
• Unrated Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all... CVE-2026-114233 Nov 5, 22:35
• Unrated Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08... CVE-2026-114235 Nov 5, 22:35
• Unrated Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24... CVE-2026-114271 Nov 5, 22:34
• Unrated Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz... CVE-2026-114272 Nov 5, 22:34
• Unrated Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's... CVE-2026-114277 Nov 5, 22:33
• Unrated An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor,... CVE-2026-68524 Nov 5, 01:55
• Medium 6.5 Authenticated Path Traversal in Catalog Image Management allows writing image files outside the... CVE-2026-66903 Nov 5, 01:55
• Critical 9.8 Authentication Bypass in Apache Ofbiz CVE-2026-45434 May 19, 19:16
• Medium 6.5 Code Injection in Apache Ofbiz CVE-2026-35086 May 19, 19:16
• Critical 9.1 Apache OFBizのパス・トラバーサルの脆弱性により遠隔からプログラムを実行されるおそれ 2024年6月に公表されたApache OFBizの脆弱性です。パス・トラバーサルの不備から遠隔からプログラムを実行されるおそれがあり、CVSSは9.1と深刻度は重大です。18.12.14より前の版が対象で、18.12.14への更新が修正版です。公表から時間がたっているため、未対応の環境は早めに更新を確認してください。 CVE-2024-36104 Jun 4, 2024