strutt-cve-2014-0114

CVE-2014-0114 - Schwachstelle in Struts 1 Parameter in einer POST- oder GET-Request werden als Eigenschaften Properties behandelt, die ausgehend vom Formular gesetzt werden sollen. Parameter können ein Pfad zu einem verschachtelten Objekt sein. Apache Struts 1.x kann manipuliert werden, um getCla...

CVE-2014-0094-test-program-for-struts1

Über die Unterstützung von CVE-2014-0094 für Struts 1 Einleitung Dies fasst die Auswirkungen von CVE-2014-0094 auf Struts 1 zusammen. Sofern nicht anders angegeben, wurden alle Tests mit Java 1.7.002, Struts 1.3.10, Apache-Tomcat-6.0.39 und FreeBSD 8.2 durchgeführt. Es wird keinerlei Gewähr für d...

st2-048

ثغرة تنفيذ الأوامر عن بُعد St2-048 إمكانية تنفيذ RCE في Apache Struts 2 في تطبيق Struts Showcase في مثال المكوّن الإضافي Struts 1 في سلسلة Struts 2.3.x http://struts.apache.org/docs/s2-048.html https://cwiki.apache.org/confluence/display/WW/S2-048 الاستخدام: root@kitploit: python St2-048.py set u...

struts1filter

struts1filter Una soluzione di filtro per i parametri delle richieste per Apache Struts 1 CVE-2014-0114 basata sul lavoro di Alvaro Munoz e il team HP Fortify. Per utilizzare questo filtro, aggiungi la seguente dichiarazione del filtro insieme al mapping appropriato nel descrittore web.xml...

Ubuntu 16.04 ESM / 18.04 ESM : Apache Commons BeanUtils vulnerabilities (USN-4766-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4766-1 advisory. It was discovered that Apache Commons BeanUtils improperly handled certain input. An attacker could possibly use this vulnerability to cause ...

Debian: Security Advisory (DLA-292-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

K40444230: Apache Struts 1 vulnerability CVE-2016-1181

Security Advisory Description ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service unexpected memory access via a multipart request, a related issue ...

K04403302: Apache Struts 1 vulnerability CVE-2016-1182

Security Advisory Description ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

Improper Input Validation in Apache Struts

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

Mageia: Security Advisory (MGASA-2016-0244)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Struts 1 ActionForm Denial-of-Service Vulnerability

ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service DoS...

Arbitrary code execution in Apache Commons BeanUtils

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrar...

Security Bulletin: Vulnerability in Apache Commons BeanUtils Affects IBM Sterling B2B Integrator (CVE-2014-0114)

Summary Apache Commons BeanUtils with Struts 1 does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts could allow a remote attacke...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0114)

Summary Apache Struts 1.X could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability by using the class parameter of an ActionForm object to manipulate the ClassLoade...

Security Bulletin: Class loader manipulation vulnerability in IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2014-0114)

Summary A class loader manipulation vulnerability exists in the Apache Struts 1, which is used by IBM WebSphere Application Server and is provided with WebSphere Enterprise Service Bus Registry Edition Vulnerability Details This security vulnerability is fixed with available interim fixes and are...

Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2014-0114)

Summary There is a classloader manipulation vulnerability in the Apache Struts 1 that is used by IBM WebSphere Application Server shipped with IBM WebSphere Service Registry and Repository v6.2, v6.3, v7.0 and v7.5. Vulnerability Details This vulnerability is fixed within WebSphere Application...

Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution', 'Description' = %q This module exploits a remote code execution vulnerability in t...

Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution', 'Description' = %q This module exploits a remote code execution vulnerability in t...

Oracle WebCenter Portal Multiple Vulnerabilities (January 2018 CPU)

Binary data oraclewebcenterportalcpujan2018.nbin...

Apache Struts 2 Struts 1 Plugin ActionMessage < 2.3.32 RCE

Remote command execution vulnerability in Apache Struts 2 Struts 1 plugin ActionMessage class error message input handling Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...