CVE-2013-0177

Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.

• CWE-79

• http://ofbiz.apache.org/download.html#vulnerabilitiesVendor Advisory
• http://osvdb.org/89452Broken Link
• http://osvdb.org/89453Broken Link
• http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2013/Jan/148Mailing List, Third Party Advisory
• http://secunia.com/advisories/51812Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81398Third Party Advisory, VDB Entry
• https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395Broken Link
• https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850Broken Link
• http://ofbiz.apache.org/download.html#vulnerabilitiesVendor Advisory
• http://osvdb.org/89452Broken Link
• http://osvdb.org/89453Broken Link
• http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2013/Jan/148Mailing List, Third Party Advisory
• http://secunia.com/advisories/51812Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81398Third Party Advisory, VDB Entry
• https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395Broken Link
• https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850Broken Link

Published

Jan 30, 2014

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-0171Foreman before 1.1 allows remote attackers to execute arbitr…
• CVE-2013-0172Samba 4.0.x before 4.0.1, in certain Active Directory domain…
• CVE-2013-0173Foreman before 1.1 uses a salt of "foreman" to hash root pas…
• CVE-2013-0174The external node classifier (ENC) API in Foreman before 1.1…
• CVE-2013-0175multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 …
• CVE-2013-0176The publickey_from_privatekey function in libssh before 0.5.…
• CVE-2013-0178Insecure temporary file vulnerability in Redis before 2.6 re…5.5
• CVE-2013-0179The process_bin_delete function in memcached.c in memcached …
• CVE-2013-0180Insecure temporary file vulnerability in Redis 2.6 related t…5.5
• CVE-2013-0181Cross-site scripting (XSS) vulnerability in Views in the Sea…
• CVE-2013-0182The Payment module 7.x-1.x before 7.x-1.3 for Drupal does no…
• CVE-2013-0183multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x bef…