CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2024-388569.8/CRITICALEPSS 99.4%CISA KEV

2024-08-05

Apache OFBiz Unauthenticated Remote Code Execution (RCE) and Authorization Bypass Advisory (CVE-2024-38856)

[Affected Scope] Apache OFBiz versions up to and including 18.12.14

[Impact] Unauthenticated remote attackers can execute arbitrary screen rendering code and system commands by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Apache OFBiz to the latest stable version 18.12.15 or higher

apache-ofbiz cve-2024-38856 cwe-863 rce broken-authorization

Full Advisory & Mitigation

CVE-2024-321139.8/CRITICALEPSS 99.9%CISA KEV

2024-05-08

Apache OFBiz Path Traversal and Remote Code Execution Vulnerability Advisory (CVE-2024-32113)

[Affected Scope] Apache OFBiz versions prior to 18.12.13

[Impact] Unauthenticated remote attackers can bypass security filters via path traversal, access internal APIs, and execute arbitrary system commands (RCE) on the target server.

[Mitigation] Immediately upgrade Apache OFBiz to the official patched version 18.12.13 or later.

apache-ofbiz path-traversal remote-code-execution cve-2024-32113 CWE-22

Full Advisory & Mitigation