Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Jacques Le Roux
CVE-2025-61623: Apache OFBiz: Reflected Cross-site Scripting
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Tue, 11 Nov 2025 10:13:53 +0000 Severity: important Affected versions: - Apache OFBiz before 24.09.03 Description: Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.
CVE-2025-30676: Apache OFBiz: Stored XSS Vulnerability
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Tue, 01 Apr 2025 14:36:48 +0000 Severity: moderate Affected versions: - Apache OFBiz before 18.12.19 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue.
CVE-2025-26865: Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Fri, 07 Mar 2025 13:39:51 +0000 Severity: important Affected versions: - Apache OFBiz 18.12.17 before 18.12.18 Description: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18.
CVE-2024-48962: Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Sat, 16 Nov 2024 07:54:48 +0000 Affected versions: - Apache OFBiz before 18.12.17 Description: Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.
CVE-2024-45195: Apache OFBiz: Confused controller-view authorization logic (forced browsing)
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Tue, 03 Sep 2024 17:05:34 +0000 Severity: important Affected versions: - Apache OFBiz before 18.12.16 Description: Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
CVE-2024-38856: Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Sun, 04 Aug 2024 07:33:34 +0000 Severity: important Affected versions: - Apache OFBiz through 18.12.14 Description: Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue.
CVE-2024-36104: Apache OFBiz: Path traversal leading to a RCE
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Mon, 03 Jun 2024 06:55:25 +0000 Severity: important Affected versions: - Apache OFBiz before 18.12.14 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
CVE-2024-32113: Apache OFBiz: Path traversal leading to RCE
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Wed, 08 May 2024 14:39:03 +0000 Severity: important Affected versions: - Apache OFBiz before 18.12.13 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.
CVE-2024-25065: Apache OFBiz: Path traversal allowing authentication bypass.
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Wed, 28 Feb 2024 14:52:32 +0000 Severity: critical Affected versions: - Apache OFBiz before 18.12.12 Description: Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
CVE-2023-49070: Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Mon, 04 Dec 2023 21:04:50 +0000 Severity: moderate Affected versions: - Apache OFBiz before 18.12.10 Description: Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.
Miner hospitalised
Two serious crane incidents in two days Published by Shift Miner Shift Miner has been reporting on the Queensland resources sector for nearly 20 years. Based in Rockhampton, our reporters are contactable, accountable and your eyes and ears on the ground. More than 2000 people turn to us for their resource sector news each week. View all posts by Shift Miner
Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability
oss-sec mailing list archives From: Jacques Le Roux <jacques.le.roux () les7arts com> Date: Wed, 19 Apr 2023 08:25:36 +0200 Hi Seth, As I guess you know, the ASF has many (350+) projects: https://projects.apache.org/ OFBiz is only one of these projects. An "old" one, IIRW it was the 26th to get in. I say that because we have our own security team. Yet, all projects are overseen and especially helped by the ASF security team for security matter.
Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Tue, 18 Apr 2023 11:15:52 +0200 Hi Seth, I used to give more information. For this one, using our "new" internal process* (need an ASF credential) and following step 11 of**, notably <<Generally, reports should contain enough information to enable people to assess the risk the vulnerability poses for their own system, and no more.>> I restricted the information to a minimum.
CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Mon, 10 Apr 2023 09:21:11 +0000 Severity: important Description: Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz.This issue affects Apache OFBiz: before 18.12.07.
Apache OFBiz - Unauth Path Traversal with file corruption (CVE-2022-25371)
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Thu, 8 Sep 2022 15:53:26 +0200 Severity: High Vendor: The Apache Software Foundation Versions Affected: OFBiz versions prior to 18.12.06 Description: The Birt viewer version 4.5.0 has a security issue that allows this exploit.
Apache OFBiz - Unauth Stored XSS (CVE-2022-25370)
oss-sec mailing list archives From: Jacques Le Roux <jleroux () apache org> Date: Fri, 2 Sep 2022 08:28:34 +0200 Severity: High Vendor: The Apache Software Foundation Versions Affected: OFBiz versions prior to 18.12.06 Description: The Birt viewer version 4.5.0 has a security issue that allows this exploit.
[CVE-2021-26295] RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
oss-sec mailing list archives By Date By Thread [CVE-2021-26295] RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI From: Jacques Le Roux <jacques.le.roux () les7arts com> Date: Sun, 21 Mar 2021 14:01:37 +0100 Severity: High Vendor: The Apache Software Foundation Versions Affected: OFBiz versions prior to 17.12.06 Description: Apache OFBiz has unsafe deserialization prior to 17.12.06.
[CVE-2020-13923] IDOR in Apache OFBiz
oss-sec mailing list archives By Date By Thread [CVE-2020-13923] IDOR in Apache OFBiz From: Jacques Le Roux <jacques.le.roux () les7arts com> Date: Wed, 15 Jul 2020 14:52:06 +0200 Severity: Important Vendor: The Apache Software Foundation Versions Affected: All versions < 17.12.04 Description: IDOR vulnerability in the order processing feature from ecommerce component.
[CVE-2019-0235 ] Apache OFBiz multiple CSRF vulnerabilities
oss-sec mailing list archives By Date By Thread [CVE-2019-0235 ] Apache OFBiz multiple CSRF vulnerabilities From: Jacques Le Roux <jacques.le.roux () les7arts com> Date: Thu, 30 Apr 2020 15:56:06 +0200 Severity: Important Vendor: The Apache Software Foundation Versions Affected: OFBiz 17.12.01 Description: Apache OFBiz is vulnerable to CSRF attacks Mitigation: Upgrade to 17.12.03 or manually apply the commits at OFBIZ-11470 ---- Credit: Initially known by the OFBiz security team...
[CVE-2019-12425] Apache OFBiz Host Header Injection
oss-sec mailing list archives By Date By Thread [CVE-2019-12425] Apache OFBiz Host Header Injection From: Jacques Le Roux <jacques.le.roux () les7arts com> Date: Thu, 30 Apr 2020 14:11:22 +0200 Severity: Important Vendor: The Apache Software Foundation Versions Affected: OFBiz 17.12.01 Description: Apache OFBiz is vulnerable to Host header injection by accepting arbitrary hosts Mitigation: Upgrade to 17.12.03 or manually apply the commit at OFBIZ-11583 ---- Credit: Pradeep Jairamani...
graphviz as a potential apache project
Le 04/06/2018 à 16:29, Bertrand Delacretaz a écrit : > On Mon, Jun 4, 2018 at 1:31 PM, Jacques Le Roux > wrote: >> ...Anyway a big +1 to invite Graphviz in the incubator. I may even help if >> necessary.... > Note that Stephen North who started this conversation with Sharan > hasn't been CCed in all messages so might have missed part of the > conversation.
[ANN] Please welcome Justin Mclean as the new Incubator PMC chair!
Le 04/06/2018 à 12:12, Bertrand Delacretaz a écrit : > Hi, > > John D. Ament recently announced his desire to step down from the > Incubator PMC chair role. Thank you so much John for your efficient > service here, "retiring" from that is certainly well deserved! > > The Incubator PMC had the difficult task of choosing between a handful > of excellent candidates and has selected Justin as our new chair. The > ASF's Board of Directors has ratified this choice at our May meeting.
[VOTE] Resolution to graduate Apache FreeMarker to TLP
+1 (binding) Le 19/02/2018 à 17:39, Jacopo Cappellato a écrit : > +1 (binding, mentor) > > Jacopo Cappellato > > On Mon, Feb 19, 2018 at 11:45 AM, Jacopo Cappellato > wrote: > >> Hi all, >> >> The FreeMarker community has discussed [1] and voted [2] positively on >> graduating to a top level project (TLP). The resolution for the graduation >> has been proposed and discussed in this list [3].
[VOTE] Retire Wave
+1 to retire (binding) Jacques Le 08/01/2018 à 19:56, John D. Ament a écrit : > All, > > This is a call to vote for the retirement of the Wave podling. > > The podling has positively voted to retire [1]. I now call upon the IPMC > to confirm this retirement. > > [ ] +1 to retire > [ ] +/- 0 to retire > [ ] -1 don't retire because... > > The podling is working on a migration plan, it seems they will move the > code to github somewhere, and will work on it as seen fit there.
Re: [DRAFT] Incubator PMC Board Report
Done, thanks Jacques Le 15/12/2017 à 03:53, John D. Ament a écrit : > Can you fix it? It's posted the same way as in the wiki. Probably just > best to leave it single line. > > On Thu, Dec 14, 2017 at 5:05 PM Jacques Le Roux jacques.le.roux@les7arts.com> wrote: > >> Hi John, >> >> Looks like my comment for Trafodion got badly formatted >> >> Thanks >> >> Jacques >> >> >> Le 14/12/2017 à 02:05, John D. Ament a écrit : >>> All, >>> >>> Below is the current draft.
Re: [DRAFT] Incubator PMC Board Report
Hi John, Looks like my comment for Trafodion got badly formatted Thanks Jacques Le 14/12/2017 à 02:05, John D. Ament a écrit : > All, > > Below is the current draft. Not much has changed since I sent last draft. > We're still missing sign off on 3 podling reports. Mentors for OpenWhisk, > Myriad and Spot please take a look at your podlings' reports and provide > input.
Edit access to incubator wiki
Hi, Please add me in the contributors list Thanks Jacques --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org For additional commands, e-mail: general-help@incubator.apache.org
Edit access to incubator wiki
Oops sorry: JacquesLeRoux Thanks! Le 07/12/2017 à 16:11, John D. Ament a écrit : > What is your wiki username?
[VOTE] Graduate the Apache Trafodion Project from Incubator to a TLP
I'm ready for a +1 as soon as http://incubator.apache.org/projects/trafodion.html will be up to date. At least it misses my name as new mentor: https://whimsy4.apache.org/roster/ppmc/trafodion (I don't see other misses, please check) I'm not sure if we need to provide a "Charter" for Trafodion: https://incubator.apache.org/guides/graduation.html#the_graduation_process.
[VOTE] Graduate the Apache Trafodion Project from Incubator to a TLP
Then +1 from me (binding) Jacques Le 29/11/2017 à 15:41, John D. Ament a écrit : > On Wed, Nov 29, 2017 at 5:47 AM Jacques Le Roux jacques.le.roux@les7arts.com> wrote: > >> I'm ready for a +1 as soon as >> http://incubator.apache.org/projects/trafodion.html will be up to date. >> >> At least it misses my name as new mentor: >> https://whimsy4.apache.org/roster/ppmc/trafodion (I don't see other >> misses, please check) >> > If the only issue with the status page is roster, please ignore it.
[DISCUSS] Resolution to graduate the incubating Apache Trafodion Project
Assuming the mission statement is amended following Sebastian's suggestion (ditto not being very explicit, I guess KISS way is wanted): +1 (binding) Jacques Le 21/11/2017 à 02:20, sebb a écrit : > On 20 November 2017 at 21:32, Pierre Smits wrote: >> The community of the incubating Apache Trafodion Project has discussed and >> voted on graduating from incubating. Following instructions from the >> graduation guide, this thread is for discussion.
[VOTE] Apache Trafodion (incubating) release 2.2.0 RC 1
Hi, Since I got no time to go further since I tried 2 weeks ago, I'll simply repost what I send to the dev@trafodion.incubator.apache.org ML for the vote there. ------------------------------------------------------------------------------------------------------------------------------------------------------ I desperately tried to install Hadoop this morning (I'm not a Hadoop user) w/o success.
in need of one more mentor
You might prefer a more technical review: http://trafodion.apache.org/architecture-overview.html Jacques Le 06/11/2017 à 16:53, Jacques Le Roux a écrit : > Hi Pierre, > > I'd not have said it like that :) But it's true that the Trafodion project is an amazing one which badly lacks consideration > > Why it's amazing?
in need of one more mentor
Hi Pierre, I'd not have said it like that :) But it's true that the Trafodion project is an amazing one which badly lacks consideration Why it's amazing?
[VOTE] Release Apache FreeMarker 2.3.27 (incubating)
+1 (binding) Jacques Le 24/10/2017 à 16:00, Woonsan Ko a écrit : > Hi all, > > Apache FreeMarker (incubating) is a template engine, i.e. a generic > tool to generate text output based on templates. FreeMarker is > implemented in Java as a class library for programmers. > > The Apache FreeMarker community has voted on and approved a proposal > to release Apache FreeMarker 2.3.27-incubating.
[VOTE] Accept PageSpeed into the Apache Incubator
+1, Looking forward ! Jacques Le 27/09/2017 à 21:04, Otto van der Schaaf a écrit : > Hi All, > > I would like to start a VOTE to bring the PageSpeed project in as an Apache > incubator > podling. > > The ASF voting rules are described: > > https://www.apache.org/foundation/voting.html > > A vote for accepting a new Apache Incubator podling is a majority vote > for which only Incubator PMC member votes are binding. > > This vote will run for at least 72 hours.
New Mentor for the incubating Apache Trafodion project
Le 21/09/2017 à 08:56, Bertrand Delacretaz a écrit : > Hi, > > On Thu, Sep 21, 2017 at 8:42 AM, Pierre Smits wrote: >> ...It pleases me to inform you that ASF Member Jacques Le Roux has accepted >> the invitation to join and help the incubating Apache Trafodion project as >> a Mentor... > Great! > > Note that https://whimsy.apache.org/roster/committer/jleroux doesn't > list Jacques as an Incubator PMC member. As an ASF member he just > needs to ask on the Incubator private list to be added.
[VOTE] Do not accept software grants with conditionals or exclusions
+1 (not binding, not part of IPMC) Jacques Le 07/09/2017 à 10:07, Bertrand Delacretaz a écrit : > Hi Incubator PMC. > > We recently received a software grant pointing to an archive file for > the code donation, but mentioning that some material contained in that > archive might not be donated.
New Incubator Logo Selection Results
I agree it's weird esthetically, but have your other concerns? Jacques Le 18/03/2017 à 06:59, Niclas Hedhman a écrit : > I don't think the ASF and the incubator logo should be placed side-by-side > like that (2) > > http://incubator.staging.apache.org/ > > > On Sat, Mar 18, 2017 at 8:53 AM, John D. Ament > wrote: > >> Yeah, sorry about that. Was going to send out more direct links when I had >> the website updates almost ready. Anyways here they are. >> >> 1.
[VOTE] Release Apache FreeMarker 2.3.25 (incubating)
+1 (not binding) Jacques Le 22/06/2016 à 19:47, ddekany@apache.org a écrit : > Hi all, > > The Apache FreeMarker community has voted on and approved a proposal > to release Apache FreeMarker 2.3.25-incubating.
[VOTE] Accept Pony Mail into the Apache Incubator
+1 (not binding) Jacques Le 24/05/2016 à 07:56, Daniel Gruno a écrit : > Since it seems the discussion has died down, I am now calling a vote on > accepting Pony Mail into the Incubator. Sorry in advance for potato. > > This vote will run for the usual 72 hours. > > ################### PROPOSAL BELOW ################### > > Abstract > > Pony Mail is a mail-archiving, archive viewing, and interaction service, > that can be integrated with many email platforms.
[VOTE] Release Apache FreeMarker 2.3.24-rc01 (incubating)
Maybe it's too late or has been already reported but at 1st glance it was not obvious to me that, after downloading/installing Ant and Ivy, I should have copied ivy.jar in ant/lib to be able to build. Else you get this error: <> So for noobies like me, I would recommend a sentence like <> after <> Note: I'm on Win7 but I don't think it has an impact on this. All the rest (MD5, DISCLAIMER, LICENSE, NOTICE, README) is OK with me.
[VOTE] Accept Fineract into Apache Incubator
+1 (not binding) Jacques Le 10/12/2015 10:21, Ross Gardler a écrit : > I would like to call a vote on accepting the Fineract project into the Apache Incubator.
[VOTE] Graduate Groovy from the Incubator
+1 (not binding) Jacques Le 28/10/2015 21:26, Konstantin Boudnik a écrit : > Following discussions [1] about its current status, the Groovy community > has voted [2] to graduate from the Incubator.
[DISCUSSION] Graduate Ignite from the Apache Incubator
Le 23/07/2015 21:19, Ted Dunning a écrit : > On Thu, Jul 23, 2015 at 11:54 AM, Konstantin Boudnik wrote: > >> On Thu, Jul 23, 2015 at 09:29AM, Ted Dunning wrote: >>> On Wed, Jul 22, 2015 at 11:20 PM, Konstantin Boudnik >> wrote: >>>> Looks like now we can put "git branch deletion data loss" fiction to >> rest. >>> I think that I am willing to say that the entirely reasonable git branch >>> detail loss QUESTION has been answered.
[VOTE] Accept Freemarker into Apache Incubator
+1 (non-binding) Jacques Le 19/06/2015 09:15, Jacopo Cappellato a écrit : > Following the discussion in the thread [1], I would like to call a VOTE to accept Freemarker as a new Apache Incubator project. > > The proposal is available on the wiki at [2] and is also attached to this mail. > > The VOTE is open for at least the next 72 hours: > > [ ] +1 accept Freemarker into the Apache Incubator > [ ] ±0 Abstain > [ ] -1 because... > > Thank you, > > Jacopo Cappellato > > 1.
[DISCUSS] Freemarker Incubation proposal
Le 21/05/2015 16:29, John D. Ament a écrit : > On Thu, May 21, 2015 at 10:11 AM Bertrand Delacretaz > wrote: > >> Hi, >> >> On Thu, May 21, 2015 at 3:38 PM, Sergio Fernández >> wrote: >>> ...If you'd need any other mentor, I'm happy to help there (I'm >> Incubator PMC >>> and ASF Member)...
[VOTE] Accept Groovy into the Apache Incubator
+1 (non-binding) Le 19/03/2015 07:55, Roman Shaposhnik a écrit : > Following the discussion earlier in the thread: > http://s.apache.org/KWE > > I would like to call a VOTE for accepting Groovy > as a new incubator project. > > The proposal is available at: > https://wiki.apache.org/incubator/GroovyProposal > and is also included at the bottom of this email.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jacques
Contact Jacques, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack