Donghyun

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions through 18.12.14 **Description** This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue. **Recommendations** Apache OFBiz versions through 18.12.14: Upgrade to version 18.12.15 to resolve the issue. As a temporary workaround, consider restricting access to unauthenticated endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Dext5 Upload versions 5.0.0.112 and earlier **Description** The issue allows remote files to be executed by setting the arguments to the ActiveX method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection. **Recommendations** For versions 5.0.0.112 and earlier, consider disabling the ActiveX control until a patch is available to prevent remote file execution. Restrict access to the dext5.ocx ActiveX Control to minimize the risk of exploitation. Avoid using the affected ActiveX method in web pages until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Zoneplayer versions 2.0.1.3 and prior versions Zoneplayer version 2.0.1.4 **Description** The issue allows an attacker to cause arbitrary code execution due to a file download vulnerability in the ZInsX.ocx ActiveX Control of Zoneplayer on Windows. **Recommendations** For Zoneplayer versions 2.0.1.3 and prior versions, update to a version later than 2.0.1.3 to resolve the issue. For Zoneplayer version 2.0.1.4, update to a version later than 2.0.1.4 to resolve the issue. As a temporary workaround, consider disabling the ZInsX.ocx ActiveX Control until a patch is available.