CVE-2012-0838

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field...

CVE-2012-0838

CVE-2012-0838 affects Apache Struts 2 before 2.2.3.1, where an OGNL expression is evaluated during a conversion error, enabling a remote attacker to modify run-time data values and potentially execute arbitrary code. IBM security bulletins for Order Management (and related advisories) confirm the...

Apache Struts 2 vulnerable to an arbitrary Java method execution

Overview Apache Struts 2 contains an arbitrary Java method execution vulnerability. Apache Struts 2 is a framework to create Java web applications. Apache Struts 2 contains an arbitrary Java method execution vulnerability due to improper conversion in OGNL expression if a non-string property is...

JVN#79099262: Apache Struts 2 vulnerable to an arbitrary Java method execution

Apache Struts 2 is a framework to create Java web applications. Apache Struts 2 contains an arbitrary Java method execution vulnerability due to improper conversion in OGNL expression if a non-string property is contained in action. Impact If a remote attacker sends a malformed request parameter ...

Apache Struts多个HTML代码注入漏洞

BUGTRAQ ID: 51902 CVE ID: CVE-2012-1006 Apache Struts是一款开发Java web应用程序的开源Web应用框架。 Apache Struts在实现上存在多个HTML注入漏洞，攻击者可利用这些漏洞在受影响浏览器中运行HTML和脚本代码，窃取Cookie身份验证凭证或控制站点外观。 0 Apache Group Struts 2.2.3 Apache Group Struts 2.0.14 厂商补丁： Apache Group ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版...

Apache Struts <= 1.3.10 CookBook/Examples Multiple XSS Vulnerabilities

Apache Struts is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Struts < 2.3.3 Showcase Multiple Persistent XSS Vulnerabilities

Apache Struts Showcase is prone to multiple persistent cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

Apache Struts Showcase Multiple Persistence Cross-Site Scripting Vulnerabilities

This host is running Apache Struts Showcase and is prone to multiple persistence cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbapachestrutsshowcasemultiplexssvuln.nasl 5841 2017-04-03 12:46:41Z cfi $ Apache Struts Showcase Multiple Persistence Cross-Site Scripting...

Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities

This host is running Apache Struts and is prone to multiple Cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbapachestrutscookbooknexmpmulxssvuln.nasl 5841 2017-04-03 12:46:41Z cfi $ Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities Authors: Antu...

CVE-2012-1007

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via 1 the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to 2 struts-cookbook/processSimple.do or 3...

CVE-2012-1006

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 lastName parameter to struts2-showcase/person/editPerson.action, or the 3 clientName parameter to struts2-rest-showcase/orders...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 lastName parameter to struts2-showcase/person/editPerson.action, or the 3 clientName parameter to struts2-rest-showcase/orders...

CVE-2012-1006

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 lastName parameter to struts2-showcase/person/editPerson.action, or the 3 clientName parameter to struts2-rest-showcase/orders...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via 1 the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to 2 struts-cookbook/processSimple.do or 3...

CVE-2012-1007

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via 1 the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to 2 struts-cookbook/processSimple.do or 3...

CVE-2012-1007

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via 1 the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to 2 struts-cookbook/processSimple.do or 3...

CVE-2012-1006

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 lastName parameter to struts2-showcase/person/editPerson.action, or the 3 clientName parameter to struts2-rest-showcase/orders...

CVE-2012-1006

CVE-2012-1006 refers to multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3. The flaws allow remote attackers to inject arbitrary web script or HTML via parameters in the Struts2 showcase applications: (1) name, (2) lastName to struts2-showcase/person/editPerson....

CVE-2012-1007

CVE-2012-1007 is an XSS vulnerability in Apache Struts 1.3.10. The issue allows remote attackers to inject arbitrary scripts via (1) name in struts-examples/upload/upload-submit.do, or (2) message in struts-cookbook/processSimple.do, or (3) struts-cookbook/processDyna.do. The IBM/OSS sources iden...

Apache Struts 2 ParameterInterceptor Class OGNL Expression Parsing Remote Command Execution

The remote web application appears to use Apache Struts 2, a web framework that uses XWork. Due to a flaw in the ParameterInterceptor class, user input is not properly sanitized, which allows a remote attacker to run arbitrary Java code on the remote host by sending a specially crafted HTTP...