Public signup for this instance is disabled. Go to our Self serve sign up page to request an account. Report potential security issues privately

  1. Sub-task OFBIZ-13162
    [SECURITY] (CVE-2024-48962) Enhance Parameter Encoding in MacroMenuRenderer
  2. Sub-task OFBIZ-13158
    [SECURITY] (CVE-2024-47208) Update method to check if the string starts with component:// instead of merely containing it
  3. Sub-task OFBIZ-13132
    [CVE-2024-45507] Add validation to screen/script URI to block URL patterns
  4. Sub-task OFBIZ-13130
    [CVE-2024-45195] Add permission check for view-maps and change defaults for request-maps
  5. Sub-task OFBIZ-13128
    [CVE-2024-38856] Add permission check for ProgramExport and EntitySQLProcessor
  6. Sub-task OFBIZ-13124
    CVE-2024-34750 Apache Tomcat - Denial of Service
  7. Sub-task OFBIZ-13092
    [SECURITY] (CVE-2024-36104) Path traversal leading to RCE
  8. Sub-task OFBIZ-13006
    [SECURITY] (CVE-2024-32113) Path traversal leading to RCE
  9. Sub-task OFBIZ-12942
    [SECURITY] Several CVEs in Apache Tomcat
  10. Sub-task OFBIZ-12898
    [SECURITY] In Solr fixe NPE in FieldLengthFeature with non-stored/missing fields.
  11. Sub-task OFBIZ-12887
    [SECURITY] (CVE-2024-25065) Normalize contextPath in hasBasePermission
  12. Sub-task OFBIZ-12884
    [SECURITY] (CVE-2024-23946) Don't need to show files names in UI messages
  13. Sub-task OFBIZ-12875
    [SECURITY: CVE-2023-50968] Use screen engine for the request getJSONuilabels
  14. Sub-task OFBIZ-12873
    [SECURITY: CVE-2023-51467] Replaced direct null checks on username, password, and token with UtilValidate.isEmpty() method calls for consistency.
  15. Sub-task OFBIZ-12866
    [SECURITY] Upgrade Apache Shiro to 1.13.0 to fix CVE-2023-46750
  16. Sub-task OFBIZ-12860
    [SECURITY] Several CVEs in Apache Tomcat
  17. Sub-task OFBIZ-12857
    Execution of queries without authentication
  18. Sub-task OFBIZ-12854
    Improve use of RandomStringUtils where it's potentially used in an insecure way
  19. Sub-task OFBIZ-12839
    [CVE-2023-34478] Apache Shiro, before 1.12.0, is susceptible to a path traversal attack
  20. Sub-task OFBIZ-12831
    [SECURITY] CVE-2023-34981 Apache Tomcat
  21. Sub-task OFBIZ-12824
    Disable the Birt component in all branches (including trunk) because of CVE-2022-25371
  22. Sub-task OFBIZ-12812
    [SECURITY] Remove deprecated Apache XML-RPC related code (CVE-2023-49070)
  23. Sub-task OFBIZ-12794
    Disallow string concatenation in uploaded files
  24. Sub-task OFBIZ-12792
    [CVE-2022-47501] Arbitrary file reading vulnerability in Solr
  25. Sub-task OFBIZ-12782
    [SECURITY] CVE-2023-28708 Apache Tomcat - Information Disclosure
  26. Sub-task OFBIZ-12766
    CVE-2023-24998 Apache Commons FileUpload and Tomcat - DoS with excessive parts
  27. Sub-task OFBIZ-12737
    CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection
  28. Sub-task OFBIZ-12713
    Update Apache Shiro to 1.10.1
  29. Sub-task OFBIZ-12708
    Update Tomcat to 9.0.68 due to a low security issue
  30. Sub-task OFBIZ-12696
    Upgrade Tomcat from 9.0.60 to 9.0.65
  31. Sub-task OFBIZ-12657
    [SECURITY] Upgrade Tika to 1.28.4
  32. Sub-task OFBIZ-12656
    Update Solr and Lucene from 8.11.1 to 8.11.2 for security reason
  33. Sub-task OFBIZ-12646
    Java Deserialization vulnerability in Apache OfBiz (CVE-2022-29063)
  34. Sub-task OFBIZ-12634
    Regular expression denial of service in jquery-validation
  35. Sub-task OFBIZ-12626
    [SECURITY] Upgrade Tika to 1.28.3
  36. Sub-task OFBIZ-12599
    In UtilHttp, for regex processing of urls, replace Java regexp with RE2J
  37. Sub-task OFBIZ-12594
    Prevent Freemarker interpolation in fields
  38. Sub-task OFBIZ-12592
    Prevent possible DOS attack done using Java deserialisation
  39. Sub-task OFBIZ-12584
    Stored XSS in webappPath parameter from content/control/EditWebSite
  40. Sub-task OFBIZ-12582
    Prevent post-Auth vulnerability: FreeMarker Bypass
  41. Sub-task OFBIZ-12573
    CLONE - [SECURITY] Upgrade Tika to 1.28.1
  42. Sub-task OFBIZ-12572
    [SECURITY] Upgrade Tika to 2.3.0 or more
  43. Sub-task OFBIZ-12558
    Possible authenticated attack related to Tomcat CVE-2020-1938
  44. Sub-task OFBIZ-12549
    [SECURITY] CVE-2022-23437: Infinite loop within Apache XercesJ xml parser
  45. Sub-task OFBIZ-12539
    Upgrade Tomcat from 9.0.54 to 9.0.58
  46. Sub-task OFBIZ-12475
    [SECURITY] CVE-2021-44832: Apache Log4j2
  47. Sub-task OFBIZ-12474
    [SECURITY] Update TIka because of Apache Log4j2 vulnerability
  48. Sub-task OFBIZ-12470
    [SECURITY] CVE-2021-45105: Apache Log4j2
  49. Sub-task OFBIZ-12464
    Update Solr and Lucene to address several CVEs (including Log4j)
  50. Sub-task OFBIZ-12449
    [SECURITY] CVE-2021-44228: Apache Log4j2
Refresh results