ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1182 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1182 Source advisory: OSV:GHSA-5GGR-MPGW-3MGX...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1182 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1182 Source advisory: GHSA-5GGR-MPGW-3MGX...

GHSA-7GHM-RPC7-P7G5 Code injection in Apache Struts

A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks. both the s:url and s:a tag provide an includeParams attribute. The main scope of that attribute is to understand whether includes...

Code injection in Apache Struts

A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks. both the s:url and s:a tag provide an includeParams attribute. The main scope of that attribute is to understand whether includes...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +178 more potentially affected by CVE-2013-2251 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.15)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.0, =1.0, =1.0, =1.0, =2.0.0, =1.2.0, =1.2.2 - com.github.downgoon:jresty-rest 0.0.1 - com.github.downgoon:jresty-rest-example 0.0.1 and more Source cves: CVE-2013-2251 Source advisory: GHSA-47QP-8V9G-39HP...

Code injection in Apache Struts

The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within...

GHSA-47QP-8V9G-39HP Code injection in Apache Struts

The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within...

org.acegisecurity:acegi-security (1.0.4), org.acegisecurity:acegi-security-adapters (1.0.4) +14 more potentially affected by CVE-2013-6429 via org.springframework:spring-web (2.0.4)

org.springframework:spring-web MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security 1.0.4 - org.acegisecurity:acegi-security-adapters 1.0.4 -...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2013-6429 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

org.springframework:spring-webmvc-portlet (2.5.3), org.springframework:spring-webmvc-struts (2.5.3) potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (2.5.3)

org.springframework:spring-webmvc MAVEN version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-webmvc-portlet 2.5.3 - org.springframework:spring-webmvc-struts...

Security Bulletin: IBM Sterling Order Management Apache Struts vulnerablity

Summary IBM Sterling Order Management Apache Struts vulnerablity Vulnerability Details CVEID:CVE-2019-0233 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by an access permission override when performing a file upload. By sending a specially crafted request, an attacker...

Security Bulletin: IBM Sterling Order Management Apache Struts vulnerablity

Summary IBM Sterling Order Management Apache Struts vulnerablity Vulnerability Details CVEID:CVE-2020-17530 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by a forced double OGNL evaluation on raw user input in tag attributes. By sending...

VulnCheck KEV: CVE-2014-0112

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for...

VulnCheck KEV: CVE-2014-0094

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method...

VulnCheck KEV: CVE-2021-31805

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. Using forced OGNL evaluation on untrusted user input can lead to a...

VulnCheck KEV: CVE-2014-0114

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrar...

VulnCheck KEV: CVE-2014-0113

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

org.acegisecurity:acegi-security (1.0.4), org.acegisecurity:acegi-security-adapters (1.0.4) +14 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.0.4)

org.springframework:spring-web MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security 1.0.4 - org.acegisecurity:acegi-security-adapters 1.0.4 -...

Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."...