Apache OFBiz: renderLink compiles link parameters as FreeMarker source

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Apache OFBiz: Unsandboxed Groovy compiled from a service parameter

Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Apache OFBiz: webtools xmldsdump exports any entity to any path

Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE

Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval(), whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Apache OFBiz: Content Manager VIEW-only RCE in updateLayout

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login

Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostname mapped to a different tenant: ContextFilter resolves the tenant from the hostname via TenantDomainName, but LoginWorker gives priority to the conflicting userTenantId request parameter and authenticates against the attacker's own tenant, so a subsequent ordinary request to the same hostname combines the hostname-mapped tenant's Entity Engine delegator with the attacker's tenant's session dispatcher, security object, and identity, letting the permission check run against the attacker's own tenant while the resulting read or write is performed against the hostname-mapped tenant's data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Argument Injection with Privilege Escalation in Dell OpenManage Enterprise

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Apache OFBiz: Authenticated Code Execution Vulnerability

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no permission check, to retype an attacker-created DataResource as an FTL template evaluating its own primary key, then using the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Improper Restriction of Authentication Attempts Enabling Phishing in Dell OpenManage Enterprise

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Launch of phishing attacks.

Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service

Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass

External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

Windows Update Stack Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Windows Imaging Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

Windows Imaging Component Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network.