struts vulnerabilities and exploits

(subscribe to this query)

5

CVSSv2

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method....

Apache Struts

6.5

CVSSv2

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files....

Apache Struts1 EDB exploit available

6.8

CVSSv2

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors....

Apache Struts

7.5

CVSSv2

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE:...

Apache Struts1 EDB exploit available2 Github repositories available

5.8

CVSSv2

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix....

Apache Struts1 Article available

4.3

CVSSv2

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display....

Apache Struts

9.3

CVSSv2

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method....

Apache Struts1 EDB exploit available

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message....

Apache Struts1 EDB exploit available

7.5

CVSSv2

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an...

Apache Struts2 EDB exploits available1 Metasploit module available3 Github repositories available1 Article available

9.3

CVSSv2

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix....

Apache Struts1 EDB exploit available1 Metasploit module available31 Github repositories available1 Article available

« PREV 1 2 3 4 5 6 7 NEXT »