In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.
Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.