Show filters
14 Total Results
Displaying 1-10 of 14
Sort by:
Attacker Value
Unknown
CVE-2016-6795
Disclosure Date: September 20, 2017 (last updated November 26, 2024)
In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
0
Attacker Value
Unknown
CVE-2017-9787
Disclosure Date: July 13, 2017 (last updated November 08, 2023)
When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
0
Attacker Value
Unknown
CVE-2017-9791
Disclosure Date: July 10, 2017 (last updated November 26, 2024)
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
0
Attacker Value
Unknown
CVE-2016-4436
Disclosure Date: October 03, 2016 (last updated November 25, 2024)
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
0
Attacker Value
Unknown
CVE-2016-4430
Disclosure Date: July 04, 2016 (last updated November 25, 2024)
Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
0
Attacker Value
Unknown
CVE-2016-4431
Disclosure Date: July 04, 2016 (last updated November 25, 2024)
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
0
Attacker Value
Unknown
CVE-2016-4438
Disclosure Date: July 04, 2016 (last updated November 25, 2024)
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
0
Attacker Value
Unknown
CVE-2016-4433
Disclosure Date: July 04, 2016 (last updated November 25, 2024)
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
0
Attacker Value
Unknown
CVE-2016-4465
Disclosure Date: July 04, 2016 (last updated November 25, 2024)
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
0
Attacker Value
Unknown
CVE-2016-3087
Disclosure Date: June 07, 2016 (last updated November 25, 2024)
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
0
