CVE-2016-1182

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

CVE-2016-4431

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method...

CVE-2016-4438

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression...

CVE-2016-4430

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery CSRF attacks via unspecified vectors...

CVE-2016-1181

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service unexpected memory access via a multipart request, a related issue to CVE-2015-0899...

CVE-2016-4430: Cross-Site Request Forgery (CSRF)

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery CSRF attacks via unspecified vectors...

CVE-2016-4433: Improper Input Validation

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request...

CVE-2016-4438: Improper Input Validation

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression...

CVE-2016-4465: Improper Input Validation

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field...

CVE-2016-1181: Undefined Security Weakness

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service unexpected memory access via a multipart request, a related issue to CVE-2015-0899...

PT-2016-2324

Name of the Vulnerable Software and Affected Versions Apache Struts versions 1.x through 1.3.10 Description The issue is related to insufficient input validation in the ActionServlet.java file of Apache Struts, allowing remote attackers to conduct cross-site scripting XSS attacks or cause a denia...

PT-2016-2303

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions 2.3.20 through 2.3.28.1 Description The issue allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request. This is due to insufficient input validation in the...

PT-2016-2304

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions 2.3.20 through 2.3.28.1 Description The issue exists due to insufficient input validation in the Apache Struts platform. This allows a remote attacker to bypass existing access restrictions by utilizing a default metho...

PT-2016-2302

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.19 through 2.3.28.1 Description The issue exists due to insufficient input validation in the REST plugin of the Apache Struts platform. This allows a remote attacker to execute arbitrary code using a specially crafte...

PT-2016-5955

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions 2.3.20 through 2.3.28.1 Description The issue is related to token validation mishandling, which allows remote attackers to conduct cross-site request forgery CSRF attacks. This is due to incorrect token validation in...

PT-2016-2325

Name of the Vulnerable Software and Affected Versions Apache Struts versions 1.x through 1.3.10 Description The issue is related to errors in the code of the Apache Struts platform, specifically in the ActionServlet.java file, which mishandles multithreaded access to an ActionForm instance. This...

CVE-2016-4431: Improper Input Validation

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method...

PT-2016-2300

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.20 through 2.3.28.1 Apache Struts versions 2.5.x before 2.5.13 Description The issue exists due to insufficient input validation in the URLValidator class of Apache Struts. This allows a remote attacker to cause a...

CVE-2016-1182: Improper Input Validation

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

CVE-2015-0899: Improper Input Validation

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter...