Sho Odagiri of GMO Cybersecurity by Ierae, Inc.

Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters

Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation

Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass

Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager

Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution

Apache OFBiz: Low-Privilege SSRF in Content Component

Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component

Apache Answer: Revision API Improper Access Control leads to Information Disclosure