CVE-2014-0114

Enforced Super POM for build stable artifacts

Super-POM 超级POM项目 用于在项目上定义约束，以满足项目稳定、安全构建投产。 背景使用Maven Enforcer Plugin提升构建稳定性。 基于Maven Enforcer Plugin构建的约束规则。 禁止引入冲突的依赖 约束多模块项目 其他经典约定：编码、运行时版本等 依赖管理最佳实践(可选) 重复类检测 禁止循环依

StrutsExample Block listed parameters: CVE-2006-1546 orgapachestrutstaglibhtmlCANCEL=true and orgapachestrutstaglibhtmlCANCELx -> If any of these parameters are present in request then we should need to log it and throw an exception CVE-2014-0114: If request parameter contains a reference to class as part of its name then log it and throw an exception B

Additional materials for RootedCON 2015 Apache Struts talk

CVE-2014-0094 / CVE -2014-0114 Struts Tester This PoC gives a list of payloads that can be used to modify data in the context of a Struts web application that is vulnerable to CVE-2014-0094 or CVE-2014-0114 The results depend on the container that executes the application Is a customized version for the PoC posted by "neobyte" at secbaiducom/indexphp?resea

Security patch for struts 1.3.8

struts-mini Security patch for struts 138 Struts 1 already stop official supporting for many years In these years, a few critical security vulnerabilities were found in struts 1 This project is a security patch for struts 138, below security vulnerabilities are solved: CVE-2016-1182 ActionServletjava in Apache Struts 1 1x through 1310 does not properly restrict the Va

struts1 CVE-2014-0114 classLoader manipulation vulnerability patch

struts1-patch Detailed description and usage, see: securitytencentcom/indexphp/blog/msg/50 struts1 CVE-2014-0114 classLoader manipulation vulnerability patch strutsjar

Automatically exported from code.google.com/p/jmap

JMap Automatically exported from codegooglecom/p/jmap, due to Google decided to close the codegooglecom I would take this as MIT license JMap is a Rails like Java web application framework started from 2008 Check the Wiki for simple user guide In a short, let's say, you have a URL is /jmap/main/login You don't have to plan a configuration file for URL mapping

CVE-2014-0114 - Sårbarhet i Struts 1 Parametrar i en POST- eller GET-request hanteras som egenskaper (properties) som ska sättas med formuläret som utgångspunkt Parametrar kan vara en sökväg till ett nästlat objekt Apache Struts 1x kan manipuleras att anropa getClass() på Form Beans Tex kan man direkt manipulera attribut på

A request parameter filter solution for Struts 1 CVE-2014-0114 based on the work of Alvaro Munoz and the HP Fortify team

struts1filter A request parameter filter solution for Apache Struts 1 CVE-2014-0114 based on the work of Alvaro Munoz and the HP Fortify team To use this filter, add the following filter declaration along with appropriate mapping to the webxml descriptor of the Apache Struts 1 application to protect: <filter> <filter-name>ParamWrapperFilter&