Page 10 of 50 results (0.007 seconds)

CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0

CVE-2012-3506

https://notcve.org/view.php?id=CVE-2012-3506

Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors. Vulnerabilidad no especificada en Apache Open For Business Project (alias OFBiz) v10.04.x ??antes de v10.04.03 tiene un impacto y vectores de ataque desconocidos. • http://ofbiz.apache.org/download.html#vulnerabilities http://osvdb.org/86556 http://seclists.org/fulldisclosure/2012/Oct/156 http://www.securityfocus.com/bid/56171 https://exchange.xforce.ibmcloud.com/vulnerabilities/79540 •

CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 5

CVE-2010-0432 – Apache OFBiz - Admin Creator

https://notcve.org/view.php?id=CVE-2010-0432

Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Apache Open For Business Project (también conocido como OFBiz) v09.04 y anteriores, usado en Opentaps, Neogia, y Entente Oya, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de (1) el parámetro "productStoreId" a control/exportProductListing, (2) el parámetro "partyId" a partymgr/control/viewprofile (también conocido como partymgr/control/login), (3) el parámetro "start" a myportal/control/showPortalPage, (4) una URI no válida que comienza con /facility/control/ReceiveReturn (también conocido como /crmsfa/control/ReceiveReturn o /cms/control/ReceiveReturn), (5) el parámetro "contentId" (también conocido como variable entityName) a ecommerce/control/ViewBlogArticle, (6) el parámetro "entityName" a webtools/control/FindGeneric, o el (7) "subject" o (8) el parámetro "content" a un componente no especificado bajo ecommerce/control/contactus. Apache OFBiz suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/12264 https://www.exploit-db.com/exploits/12263 https://www.exploit-db.com/exploits/12330 http://svn.apache.org/viewvc?view=revision&revision=920369 http://svn.apache.org/viewvc?view=revision&revision=920370 http://svn.apache.org/viewvc?view=revision&revision=920371 http://svn.apache.org/viewvc?view=revision&revision=920372 http://svn.apache.org/viewvc? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 3

CVE-2006-6587

https://notcve.org/view.php?id=CVE-2006-6587

Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la implementación del forum en el componente ecommerce en el Apache Open For Business Project (OFBiz) permite a un atacante remoto inyectar secuencias de comandos web o HTML a través de añadir un mensaje. • http://archives.neohapsis.com/archives/fulldisclosure/2006-12/0177.html http://securitytracker.com/id?1017360 http://www.securityfocus.com/bid/21529 https://issues.apache.org/jira/browse/OFBIZ-178 https://issues.apache.org/jira/browse/OFBIZ-260 •

CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 2

CVE-2006-6589

https://notcve.org/view.php?id=CVE-2006-6589

Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCH_STRING parameter, a different issue than CVE-2006-6587. NOTE: some of these details are obtained from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en ecommerce/control/keywordsearch en Apache Open For Business Project (OFBiz) permite a un atacante remoto inyectar secuencias de comandos web o HTML a través del parámetro SEARCH_STRING, un problema distinto de CVE-2006-6587. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://jira.undersunconsulting.com/browse/OFBIZ-559 http://secunia.com/advisories/23457 http://www.securityfocus.com/bid/21702 https://issues.apache.org/jira/browse/OFBIZ-260 •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2006-6588

https://notcve.org/view.php?id=CVE-2006-6588

The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown impact. La implementación de forum en el componente ecommerce en Apache Open For Business Project (OFBiz) confia en ( 1) dataResourceTypeId, (2) contentTypeId,y otros campos de la forma, permite a atacantes remotos crear tipos de contenido no autorizados, modifcar contenido, o tener otro tipo de impactos. • https://issues.apache.org/jira/browse/OFBIZ-178 •