Apache Struts 2 Core 7.4.0 OGNL Code Execution

Apache Struts 2 Core version 7.4.0 and below contain an OGNL security-bypass issue that can allow nested reflective calls to execute arbitrary code where attacker-controlled input is evaluated as OGNL. Description Apache Struts2 Core version 7.4.0 and below attempt to prevent arbitrary code...

Apache Struts2 Core 7.4.0 Timing Side Channel

Apache Struts2 Core version 7.4.0 and below contains a timing side-channel vulnerability in TokenHelper token comparisons that may allow attackers to infer valid session token values...

Apache Struts2 Core 7.4.0 Integer Overflow

Apache Struts2 Core version 7.4.0 and below contains an integer-overflow validation bypass where locale grouping separators can allow out-of-range numeric input to be narrowed and wrapped during action-property conversion. The supplied proof of concept demonstrates an Integer value wrapping to a...

com.google.code.struts2webflow:struts2webflow-parent (1.0.4), com.google.code.struts2webflow:struts2webflow-plugin (1.0.4) +19 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.0.6)

org.apache.struts:struts2-core MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - com.google.code.struts2webflow:struts2webflow-parent 1.0.4 -...

org.apache.struts:struts2-apps (2.3.33), org.apache.struts:struts2-assembly (2.3.33) +39 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.3.33)

org.apache.struts:struts2-core MAVEN version 2.3.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.3.33 - org.apache.struts:struts2-assembly 2.3.33 -...

ca.stellardrift.guice-backport.extensions:guice-struts2 (5.0.1), com.google.inject.extensions:guice-struts2 (>=3.0-rc2, <=5.0.1) +47 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.2.1)

org.apache.struts:struts2-core MAVEN version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - ca.stellardrift.guice-backport.extensions:guice-struts2 5.0.1 -...

Security Bulletin: CVE-2020-17530 may affect Apache struts2-core used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Summary Vulnerability found in Apache struts2-core-2.5.22 used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections Vulnerability Details CVEID: CVE-2020-17530 DESCRIPTION: Apache Struts could allo...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +77 more potentially affected by CVE-2011-1772 via org.apache.struts:struts2-core (>=2.0.5, <=2.2.1.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =1.2.1, =0.6, =3.0-rc2, =2.4.0, =2.1.0, =3.0.2 and more Source cves: CVE-2011-1772 Source advisory: GHSA-56F8-G68R-J699...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +239 more potentially affected by CVE-2016-4461 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.28.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2016-4461 Source advisory: OSV:GHSA-864W-R5QJ-H6FJ...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +224 more potentially affected by CVE-2014-0116 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.16.3)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.0, =1.0, =1.0, =1.0, =2.0.0, =0.5.9, =0.5.10.2 and more Source cves: CVE-2014-0116 Source advisory: GHSA-HMHQ-382Q-MP56...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +81 more potentially affected by CVE-2012-0392 via org.apache.struts:struts2-core (>=2.0.5, <=2.2.3)

org.apache.struts:struts2-core MAVEN version =2.0.5, =1.2.1, =0.6, =3.0-rc2, =2.4.0, =2.1.0, =3.1.1 and more Source cves: CVE-2012-0392 Source advisory: OSV:GHSA-2PPP-XJ34-VVF7...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +299 more potentially affected by CVE-2019-0233 via org.apache.struts:struts2-core (>=2.0.5, <=2.5.20)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.2, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2019-0233 Source advisory: MEND:CVE-2019-0233...