Cross-site Scripting (XSS)

struts2-core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the improper handling of double quote characters in the href attribute of the s:a tag, as well as the parameters in the action attribute of the s:url tag, allowing XSS attacks...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (=2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (=2.0.0) +120 more potentially affected by CVE-2018-11776 via org.apache.struts:struts2-core (>=2.5 <=2.5.16)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.3-RELEASE, =2.5.0, =2.5.0, =2.5.2 - com.jgeppert.struts2.jquery:struts2-jquery-chart-plugin =4.0.3 - com.jgeppert.struts2.jquery:struts2-jquery-datatables-plugin =4.0.3 - com.jgeppert.struts2.jquery:struts2-jquery-grid-plugin =4.0.3 -...

be.objectify:objectify-struts2-tags (=1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0 <=2.0.8) +227 more potentially affected by CVE-2018-11776 via org.apache.struts:struts2-core (>=2.0.5 <=2.3.34)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =0.5.9, =1.2.0, =1.2.3 and more Source cves: CVE-2018-11776 Source advisory: OSV:GHSA-CR6J-3JP9-RW65...

cc.fozone.struts2:StreamResultX (=1.2), com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (>=1.5.3 <=2.4.0) +183 more potentially affected by CVE-2017-5638 via org.apache.struts:struts2-core (>=2.3.1 <=2.3.31)

org.apache.struts:struts2-core MAVEN version =2.3.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =0.5.9, =1.2.0, =1.0.0, =2.0, =1.2.2, =1.4.1, =1.5.5, =1.7.4 and more Source cves: CVE-2017-5638 Source advisory: OSV:GHSA-J77Q-2QQG-6989...

org.apache.struts:struts2-assembly (>=2.5.1 <=2.5.12), org.apache.struts:struts2-rest-showcase (>=2.5.1 <=2.5.12) potentially affected by CVE-2017-9793 +1 more via org.apache.struts:struts2-rest-plugin (>=2.5.1 <=2.5.12)

org.apache.struts:struts2-rest-plugin MAVEN version =2.5.1, =2.5.1, =2.5.1, =2.5.12 Source cves: CVE-2017-9793, CVE-2017-9805 Source advisory: OSV:GHSA-VWXJ-6M5M-RRVH...

Cisco Identity Services Engine Struts2 Namespace Vulnerability

According to its self-reported version, the Cisco Identity Services Engine Software is affected by a struts2 namespace vulnerability. Please see the included Cisco BID and the Cisco Security Advisory for more information. TRUSTED...

Exploit for CVE-2018-11776

Vulnerable docker container for CVE-2018-11776 docker...

Exploit for CVE-2018-11776

CVE-2018-11776-Python-PoC hook-s3c github.com/hook-s3c, @hoo...

Exploit for CVE-2018-11776

CVE-2018-11776 On August 23, 2018, Apache Struts2 released a...

Exploit for CVE-2018-11776

CVE-2018-11776 On August 23, 2018, Apache Struts2 released a...

Exploit for CVE-2018-11776

CVE-2018-11776 On August 23, 2018, Apache Struts2 released a...

Apache Struts2 S2-057 vulnerability analysis and early warning-vulnerability warning-the black bar safety net

It is possible to perform a RCE attack when the namespace value isn't set for a result defined in underlying xml configurations and in the same time, its upper actions configurations have no or wildcard namespace. The Same possibility when using the url tag which doesn't have value and action set...

Remote Code Execution (RCE)

struts2-core is vulnerable to remote code execution RCE attacks. These attacks are possible when using a namespace or url tag which doesn't have a value and action set and where its upper action configuration is using a wildcard namespace or has no namespace...

Apache Struts2 S2-057 Remote Code Execution Vulnerability

Struts2 is Apache Software Foundation is responsible for maintaining a MVC-based design pattern of the Web application framework for open source projects . Apache Struts2 S2-057 remote code execution vulnerability. Vulnerability triggering conditions : 1 , define the XML configuration when the...

Apache Struts2 high-risk vulnerabilities cause the Enterprise Server is the invasion mounted KoiMiner mining Trojan-vulnerability warning-the black bar safety net

0×1 Overview Many business websites use the Apache open source project to build a http server, which is most of the use of the Apache sub-project of Struts in. But since the Apache Struts2 Product code there are more risks, beginning in 2007, Struts2 will frequently broke multiple high-risk...

How to use Struts2 vulnerabilities to bypass firewall get Root permissions-bug warning-the black bar safety net

This article I want to share is about the Apache struts2 CVE-2013–2251 vulnerability, since the vulnerability can lead to remote code execution, had once been widely abused. The vulnerability principle is that, by manipulating the prefix“action:”/”redirect:”/”redirectAction:”parameter in the Stru...

Apache Struts2 Freemarker Remote Code Execution (CVE-2017-12611) - Ver2

A remote code execution vulnerability exists in Apache. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apache Struts2 REST Plugin XStream DoS (CVE-2017-9793) - Ver2

A vulnerability exists in Apache. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

Apache Struts Denial of Service Vulnerability (CNVD-2018-06540)

Struts2 is Apache Software Foundation is responsible for maintaining a MVC-based design pattern of the Web application framework for open source projects . A denial of service vulnerability exists in Apache Struts2. Due to the Apache Struts2 REST plug-in , the use of XStream component on the XML...

Apache Struts2 S2-056(CVE-2018-1327)

Summary A crafted XML request can be used to perform a DoS attack when using the Struts REST plugin | | | | :------------ | :------------ | | Who should read this | All Struts 2 developers and users which are using the REST plugin | | Impact of vulnerability | A DoS attack is possible when using...