CVE-2013-2137

Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

• CWE-79

• http://archives.neohapsis.com/archives/bugtraq/2013-07/0144.htmlBroken Link
• http://ofbiz.apache.org/download.html#vulnerabilitiesPatch, Vendor Advisory
• http://osvdb.org/95523Broken Link
• http://secunia.com/advisories/53910Third Party Advisory
• http://www.securityfocus.com/bid/61370Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85874Third Party Advisory, VDB Entry
• http://archives.neohapsis.com/archives/bugtraq/2013-07/0144.htmlBroken Link
• http://ofbiz.apache.org/download.html#vulnerabilitiesPatch, Vendor Advisory
• http://osvdb.org/95523Broken Link
• http://secunia.com/advisories/53910Third Party Advisory
• http://www.securityfocus.com/bid/61370Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85874Third Party Advisory, VDB Entry

Published

Aug 15, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-2131Format string vulnerability in the rrdtool module 1.4.7 for …
• CVE-2013-2132bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo…
• CVE-2013-2133The EJB invocation handler implementation in Red Hat JBossWS…
• CVE-2013-2134Apache Struts 2 before 2.3.14.3 allows remote attackers to e…
• CVE-2013-2135Apache Struts 2 before 2.3.14.3 allows remote attackers to e…
• CVE-2013-2136Multiple cross-site scripting (XSS) vulnerabilities in Apach…
• CVE-2013-2138The (1) uploadify and (2) flowplayer SWF files in Gallery 3 …
• CVE-2013-2139Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earli…
• CVE-2013-2140The dispatch_discard_io function in drivers/block/xen-blkbac…
• CVE-2013-2141The do_tkill function in kernel/signal.c in the Linux kernel…
• CVE-2013-2142userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CO…
• CVE-2013-2143The users controller in Katello 1.5.0-14 and earlier, and Re…