Known vulnerabilities in Apache OFBiz - page 3

Vendor: Apache Foundation
Software: Apache OFBiz
Software CPE: cpe:2.3:a:apache_foundation:ofbiz:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 63
Public exploits: 11
Known exploited (KEV): 5
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache OFBiz Apache OFBiz is affected by 63 known vulnerabilities: 3 critical, 25 high, 15 medium, 20 low Critical High Medium Low

Vulnerabilities (63)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU58816 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-44228		 CWE-94 Critical
Available
Exploited
 18.12.03 10.12.2021 SB2021121003
SB2021121101
SB2021121201
and 338 more
#VU52705 - Deserialization of Untrusted Data
CVE-2021-29200		 CWE-502 High
Available
No
 17.12.07 28.04.2021 SB2021042814
#VU52704 - Deserialization of Untrusted Data
CVE-2021-30128		 CWE-502 High
Available
No
 17.12.07 28.04.2021 SB2021042814
#VU51585 - Deserialization of Untrusted Data
CVE-2021-26295		 CWE-502 High
Available
No
 17.12.06 21.03.2021 SB2021032101
#VU34152 - Improper input validation
CVE-2020-13923		 CWE-20 Medium
No
No
 17.12.04 15.07.2020 SB2020071539
#VU34153 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-9496		 CWE-79 Low
Available
No
 - 15.07.2020 SB2020071543
#VU27486 - Cross-Site Request Forgery (CSRF)
CVE-2019-0235		 CWE-352 Medium
Available
No
 17.12.03 04.05.2020 SB2020050405
#VU27485 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2019-12425		 CWE-93 Medium
No
No
 17.12.03 04.05.2020 SB2020050405
#VU25815 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-1943		 CWE-79 Low
No
No
 17.12.01 08.03.2020 SB2020030804
#VU25113 - Exposure of sensitive information to an unauthorized actor
CVE-2019-12426		 CWE-200 Medium
No
No
 16.11.07 10.02.2020 SB2020021013
#VU30762 - Deserialization of Untrusted Data
CVE-2019-0189		 CWE-502 High
No
No
 16.11.06 11.09.2019 SB2019091150
#VU37707 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-15714		 CWE-79 Low
No
No
 - 04.01.2018 SB2018010436
#VU38011 - Improper input validation
CVE-2012-1622		 CWE-20 High
No
No
 - 26.10.2017 SB2017102615
#VU38375 - Improper input validation
CVE-2016-4462		 CWE-20 High
No
No
 - 30.08.2017 SB2017083013
#VU38376 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-6800		 CWE-79 Low
No
No
 - 30.08.2017 SB2017083013
#VU40388 - Improper input validation
CVE-2016-2170		 CWE-20 High
No
No
 - 12.04.2016 SB2016041222
#VU40392 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-3268		 CWE-79 Low
No
No
 - 12.04.2016 SB2016041222
#VU41388 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-0232		 CWE-79 Low
No
No
 - 22.08.2014 SB2014082207
#VU41541 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-1621		 CWE-79 Low
No
No
 - 19.06.2014 SB2014061903
#VU42096 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2013-0177		 CWE-79 Low
Available
No
 - 30.01.2014 SB2014013001


Showing elements 41 - 60 out of 63