GCVE - cpe:2.3:a:apache:ofbiz:10.04.02:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:ofbiz:10.04.02:*:*:*:*:*:*:*

part: a version: 10.04.02 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Ofbiz (`3603fcf6-7ff0-5cae-b097-d1fba79a6c6e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/ofbiz`	purl2cpe	2026-06-01 10:14:26.493141
`pkg:github/apache/ofbiz`	purl2cpe	2026-06-01 10:14:26.493142

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-2250`	vulnerable	2026-06-08 05:04:23.924802	Details available Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions. Published: 2013-08-15T16:00:00.000Z Updated: 2024-08-06T15:27:41.176Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/61369 http://ofbiz.apache.org/download.html#vulnerabilities http://secunia.com/advisories/53910 http://osvdb.org/95522 https://exchange.xforce.ibmcloud.com/vulnerabilities/85875	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2137`	vulnerable	2026-06-08 05:03:58.561400	Details available Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2013-08-15T16:00:00.000Z Updated: 2024-08-06T15:27:40.897Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/85874 http://ofbiz.apache.org/download.html#vulnerabilities http://secunia.com/advisories/53910 http://www.securityfocus.com/bid/61370 http://archives.neohapsis.com/archives/bugtraq/2013-07/0144.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0177`	vulnerable	2026-06-08 05:03:45.666201	Details available Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages. Published: 2014-01-30T15:00:00.000Z Updated: 2024-08-06T14:18:09.106Z Open on db.gcve.eu Reference links http://osvdb.org/89453 http://ofbiz.apache.org/download.html#vulnerabilities http://seclists.org/fulldisclosure/2013/Jan/148 http://osvdb.org/89452 http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3506`	vulnerable	2026-06-08 05:02:10.260976	Details available Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors. Published: 2012-10-25T10:00:00.000Z Updated: 2024-08-06T20:05:12.776Z Open on db.gcve.eu Reference links http://ofbiz.apache.org/download.html#vulnerabilities http://seclists.org/fulldisclosure/2012/Oct/156 http://www.securityfocus.com/bid/56171 https://exchange.xforce.ibmcloud.com/vulnerabilities/79540 http://osvdb.org/86556	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.