Re: Security Related Issues in OFBiz

2017-12-19 Thread Jacopo Cappellato
Hi Vivek, the best way to go is to use a release that is part of a release branch that is still actively maintained: https://ofbiz.apache.org/download.html Security vulnerabilities on active branches should be reported to the OFBiz security list: secur...@ofbiz.apache.org Thank you, Jacopo

Security Related Issues in OFBiz

2017-12-18 Thread vivek.mi
Hello All, A few issues were reported while testing my application using IBM AppScan tool, built upon OFBiz framework for Blackbox testing. Issues are listed as below: 1. Unsafe third-party link (target="_blank") in screens and forms. 2. Query Parameter in SSL Request while sending hidden