https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 21:28:06 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-92887 <p>Incorrect default value in the REST API framework&#39;s .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.</p> <p>Users are recommended to upgrade to version 24.09.08, which fixes this issue.</p> <p>Incorrect default value in the REST API framework&#39;s .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.</p> <p>Users are recommended to upgrade to version 24.09.08, which fixes this issue.</p> https://db.gcve.eu/vuln/fkie_cve-2026-92887 https://db.gcve.eu/vuln/ghsa-8p9x-6h8h-hghw <p>Incorrect default value in the REST API framework&#39;s .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.</p> <p>Users are recommended to upgrade to version 24.09.08, which fixes this issue.</p> <p>Incorrect default value in the REST API framework&#39;s .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.</p> <p>Users are recommended to upgrade to version 24.09.08, which fixes this issue.</p> https://db.gcve.eu/vuln/ghsa-8p9x-6h8h-hghw https://db.gcve.eu/vuln/wid-sec-w-2026-4357 <p>Ein Angreifer kann mehrere Schwachstellen in Apache OFBiz ausnutzen, um Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen, Bestell- und Zahlungsdaten zu manipulieren oder einen DoS auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache OFBiz ausnutzen, um Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen, Bestell- und Zahlungsdaten zu manipulieren oder einen DoS auszulösen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4357