Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 101

Export CSV
CVE-2016-3087

struts: Passing malicious expression can cause RCE when Dynamic Method Invocation is enabled and REST plugin is used

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

CVSS 3.0 · 9.8 Critical EPSS 81.9% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2016-3093

struts: OGNL cache poisoning can lead to DoS

Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

CVSS 3.0 · 5.3 Medium EPSS 8.4% KEV · Not listed
Vendors
Apache Ognl Project
Products
Struts Ognl
CVE-2016-4003

struts2: cross-site scripting vulnerability in the URLDecoder function

Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

CVSS 3.0 · 6.1 Medium EPSS 11.6% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2016-4430

struts: Bypassing token validation triggered by malicious expression

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 3.7% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2016-4431

struts: Possible manipulation of return result and bypassing validation

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

CVSS 3.0 · 7.5 High EPSS 9.8% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2016-4433

struts: Bypassing internal security mechanisms by crafted request

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

CVSS 3.0 · 7.5 High EPSS 9.8% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2016-4436

struts: Action name clean up is error prone

Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.

CVSS 3.0 · 9.8 Critical EPSS 6.6% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2016-4438

struts: Possible RCE via REST plugin

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

CVSS 3.0 · 9.8 Critical EPSS 16.7% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2016-4465

struts: Possible DoS attack when using URLValidator

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

CVSS 3.0 · 5.3 Medium EPSS 10.4% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2010-1870

Struts2/WebWorks/XWork: ParameterInterceptors bypass allows remote command execution

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.

CVSS 2.0 · 5.0 Medium EPSS 92.0% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2013-6348

Struts2: XSS via malicious action parameter

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.

CVSS 2.0 · 4.3 Medium EPSS 6.1% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2013-4310

struts: broken access control vulnerability

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.

CVSS 2.0 · 5.8 Medium EPSS 6.5% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2013-2248

Apache Struts 2 allows open redirects

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.

CVSS 2.0 · 5.8 Medium EPSS 94.7% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2013-2135

Apache Struts 2 arbitrary OGNL code execution via double evaluation

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

CVSS 2.0 · 9.3 Critical EPSS 13.8% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2013-2134

Apache Struts 2 arbitrary OGNL code execution via unsanitized wildcard matching

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.

CVSS 2.0 · 9.3 Critical EPSS 70.2% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2012-1007

struts: multiple XSS flaws

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.

CVSS 2.0 · 4.3 Medium EPSS 32.8% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2012-1006

struts2: multiple XSS flaws

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.

CVSS 2.0 · 4.3 Medium EPSS 56.6% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2012-0838

Struts2: Certain strings evaluated as OGNL expressions, leading to run-time data modification or arbitrary code execution

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

CVSS 2.0 · 10.0 Critical EPSS 13.7% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2012-0394

struts2: remote execution of arbitrary commands when developer mode is used

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

CVSS 2.0 · 6.8 Medium EPSS 72.9% KEV · Not listed
Vendors
Apache
Products
Struts