Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
struts vulnerabilities and exploits
(subscribe to this query)
6.8
CVSSv2
CVE-2012-0392
The CookieInterceptor component in Apache Struts prior to 2.3.1.1 does not use the parameter-name whitelist, which allows remote malicious users to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Apache Struts
1 EDB exploit
6.8
CVSSv2
CVE-2009-1275
Apache Tiles 2.1 prior to 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote malicious users to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspe...
Apache Tiles 2.1.1
Apache Tiles 2.1.0
6.8
CVSSv2
CVE-2007-4556
Struts support in OpenSymphony XWork prior to 1.2.3, and 2.x prior to 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote malicious users to cause a de...
Opensymphony Xwork
6.5
CVSSv2
CVE-2012-1592
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
Apache Struts 2.0.0
1 EDB exploit
6.5
CVSSv2
CVE-2016-3090
The TextParseUtil.translateVariables method in Apache Struts 2.x prior to 2.3.20 allows remote malicious users to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
Apache Struts 2.0.1
Apache Struts 2.0.2
Apache Struts 2.0.9
Apache Struts 2.0.10
Apache Struts 2.1.0
Apache Struts 2.1.1
Apache Struts 2.1.8.1
Apache Struts 2.2.1
Apache Struts 2.3.3
Apache Struts 2.3.4
Apache Struts 2.3.10
Apache Struts 2.3.11
Apache Struts 2.3.15.1
Apache Struts 2.3.15.2
Apache Struts 2.3.19
Apache Struts 2.0.3
Apache Struts 2.0.4
Apache Struts 2.0.11
Apache Struts 2.0.11.1
Apache Struts 2.1.2
Apache Struts 2.1.3
Apache Struts 2.2.1.1
6.4
CVSSv2
CVE-2016-1182
ActionServlet.java in Apache Struts 1 1.x up to and including 1.3.10 does not properly restrict the Validator configuration, which allows remote malicious users to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-20...
Apache Struts 1.0
Apache Struts 1.1
Apache Struts 1.2.5
Apache Struts 1.2.6
Apache Struts 1.3.9
Apache Struts 1.3.10
Apache Struts 1.0.2
Apache Struts 1.2.1
Apache Struts 1.2.2
Apache Struts 1.2.9
Apache Struts 1.3.5
Apache Struts 1.2.3
Apache Struts 1.2.4
Apache Struts 1.3.7
Apache Struts 1.3.8
Apache Struts 1.3.6
Apache Struts 1.0.1
Apache Struts 1.2.0
Apache Struts 1.2.7
Apache Struts 1.2.8
1 Github repository
6.4
CVSSv2
CVE-2012-0393
The ParameterInterceptor component in Apache Struts prior to 2.3.1.1 does not prevent access to public constructors, which allows remote malicious users to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
Apache Struts
1 EDB exploit
5.8
CVSSv2
CVE-2014-0116
CookieInterceptor in Apache Struts 2.x prior to 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote malicious users to "manipulate" the ClassLoader and modify session state via a crafted reques...
Apache Struts 2.0.1
Apache Struts 2.0.10
Apache Struts 2.0.2
Apache Struts 2.0.3
Apache Struts 2.1.0
Apache Struts 2.1.1
Apache Struts 2.2.1
Apache Struts 2.2.1.1
Apache Struts 2.3.14
Apache Struts 2.3.14.1
Apache Struts 2.3.16
Apache Struts 2.3.16.1
Apache Struts 2.3.16.2
Apache Struts 2.0.11.2
Apache Struts 2.0.12
Apache Struts 2.0.6
Apache Struts 2.0.7
Apache Struts 2.1.5
Apache Struts 2.1.6
Apache Struts 2.3.1
Apache Struts 2.3.1.1
Apache Struts 2.3.15
5.8
CVSSv2
CVE-2013-4310
Apache Struts 2.0.0 up to and including 2.3.15.1 allows remote malicious users to bypass access controls via a crafted action: prefix.
Apache Struts 2.3.15
Apache Struts 2.3.14.3
Apache Struts 2.3.1
Apache Struts 2.2.3.1
Apache Struts 2.1.4
Apache Struts 2.1.3
Apache Struts 2.0.6
Apache Struts 2.0.5
Apache Struts 2.0.11.2
Apache Struts 2.0.11.1
Apache Struts 2.3.4
Apache Struts 2.3.3
Apache Struts 2.3.1.2
Apache Struts 2.3.1.1
Apache Struts 2.1.6
Apache Struts 2.1.5
Apache Struts 2.0.8
Apache Struts 2.0.7
Apache Struts 2.0.13
Apache Struts 2.0.12
Apache Struts 2.3.8
Apache Struts 2.3.14.2
5.8
CVSSv2
CVE-2013-2248
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 up to and including 2.3.15 allow remote malicious users to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
Apache Struts 2.0.11.2
Apache Struts 2.0.11.1
Apache Struts 2.3.14.3
Apache Struts 2.1.4
Apache Struts 2.2.1
Apache Struts 2.1.1
Apache Struts 2.1.0
Apache Struts 2.3.1.1
Apache Struts 2.0.0
Apache Struts 2.3.8
Apache Struts 2.0.11
Apache Struts 2.0.9
Apache Struts 2.0.6
Apache Struts 2.1.5
Apache Struts 2.0.12
Apache Struts 2.1.6
Apache Struts 2.0.4
Apache Struts 2.0.7
Apache Struts 2.0.10
Apache Struts 2.0.5
Apache Struts 2.3.4.1
Apache Struts 2.3.7
1 EDB exploit
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27977
IMAP
local users
CVE-2024-32038
CVE-2023-49963
CVE-2023-22869
CVE-2024-31497
local
CVE-2024-2961
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
10
NEXT »