PT-2013-1359

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.14.2 Description The issue is related to incorrect code generation management when handling the includeParams attribute, allowing a remote attacker to execute arbitrary code by sending a specially crafted...

Apache Struts includeParams Remote Code Execution

This module exploits a remote command execution vulnerability in Apache Struts versions use exploit/multi/http/struts/includeparams msf undefinedincludeparams show actions ...actions... msf undefinedincludeparams set ACTION msf undefinedincludeparams show options ...show and set options... msf...

PT-2013-1357

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.15 Description The issue is related to the improper sanitization of input data in the DefaultActionMapper mechanism of Apache Struts. This allows a remote attacker to execute arbitrary OGNL expressions ...

PT-2013-1362

Name of the Vulnerable Software and Affected Versions Apache Struts Showcase App versions 2.0.0 through 2.3.13 Struts 2 versions prior to 2.3.14.3 Description The issue is related to improper handling of code generation, allowing remote attackers to execute arbitrary OGNL code via a crafted...

Apache-Struts IncludeParams < 2.3.14.1 RCE Linux

Apache-Struts2 / OpenSymphony-Xwork RCE Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

struts 2.3.14 includeParams 命令执行漏洞

Apache Struts框架是一个基于Java Servlets,JavaBeans和JavaServer PagesJSP的Web应用框架的开源项目,Struts基于Model-View-ControllerMVC的设计模式,可以用来构件复杂的Web应用.Apache Struts 2.3.14标签库中的url标签和a标签的includeParams这个属性，代表显示请求访问参数的含义，一旦它的值被赋予ALL或者GET或者POST，就会显示具体请求参数内容。可利用此进行命令执行攻击 struts 2.3.14...

PT-2013-1354

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions prior to 2.3.14.2 Description The issue is related to the incorrect handling of the includeParams attribute in the URL or A tag, allowing remote attackers to execute arbitrary OGNL code via a crafted request. This is d...

Struts 2.3.1 DebuggingInterceptor 命令执行漏洞

No description provided by source...

Struts 2.3.1.1 命令执行漏洞

No description provided by source...

Apache Struts ParametersInterceptor Remote Code Execution

This Metasploit module exploits a remote command execution vulnerability in Apache Struts versions 'Apache Struts ParametersInterceptor Remote Code Execution', 'Description' = %q This module exploits a remote command execution vulnerability in Apache Struts versions 2.3.1.2. This issue is caused...

Apache Struts ParametersInterceptor Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Apache Struts ParametersInterceptor...

Apache Struts - 'ParametersInterceptor' Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Apache Struts ParametersInterceptor...

The number of silver online the Struts command execution vulnerability, the total station the fall-vulnerability warning-the black bar safety net

Vulnerability Title: The number of silver online the Struts command execution vulnerability, the whole Station fall Vulnerability type: command execution Harm level: high Brief description: The number of silver online some address the presence of the Struts command execution vulnerability...

CVE-2012-4386

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks by setting the token name configuration parameter to a session attribute...

CVE-2012-4387

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service CPU consumption via a long parameter name, which is processed as an OGNL expression...

Code injection

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service CPU consumption via a long parameter name, which is processed as an OGNL expression...

Cross site request forgery (csrf)

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks by setting the token name configuration parameter to a session attribute...

CVE-2012-4386

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery CSRF attacks by setting the token name configuration parameter to a session attribute...

CVE-2012-4387

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service CPU consumption via a long parameter name, which is processed as an OGNL expression...

CVE-2012-4387

CVE-2012-4387 is an Apache Struts DoS vulnerability: remote attacker can cause CPU exhaustion by sending a long parameter name that is processed as an OGNL expression. The issue affects Struts 2.0.0–2.3.4. In the connected IBM advisories, remediation centers on upgrading IBM Sterling Order Manage...