Donghyun

This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue.

The issue allows remote files to be executed by setting the arguments to the ActiveX method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.

The issue allows an attacker to cause arbitrary code execution due to a file download vulnerability in the ZInsX.ocx ActiveX Control of Zoneplayer on Windows.