Denial Of Service (DoS)

xwork-core is vulnerable to denial of service DoS attacks. The library does not check if a authenticated user is allowed to access to edit the actions of a service, allowing a malicious user to block other users from accessing the service...

Jinnovision-JNDV Audio/Video Conference Converged Communication Platform s2-045 Remote Code Execution Vulnerability

JNDV audio/video conferencing converged communication platform is used to realize centralized monitoring, storage, data forwarding, management and control of all network video surveillance devices including network video servers and network cameras at the front end. Jinnovision-JNDV audio and vid...

Hikvision has s2-045 Remote Command Execution Vulnerability in Multiple Product Systems

Hikvision is a video-centric IoT solution and data operation service provider. Hikvision's multiple product systems use Apache Struts xwork as the website application framework. The file upload function of the Jakarta plug-in of this framework has a remote command execution vulnerability s2-045,...

s2-045 remote command execution vulnerability in KINGOSOFT University Teaching Network Management System of Hunan Qingguo Software Co.

Hunan Qingguo Software Co., Ltd KINGOSOFT college teaching network management system is a technical solution for the construction of digital campus for colleges and universities. Hunan Qingguo Software Co., Ltd. KINGOSOFT university teaching network management system uses Apache Struts xwork as t...

S2-045 Remote Command Execution Vulnerability in Soyo's CMS Website Management Platform

The Sawyer Technology CMS Website Management Platform is a content management system. The Apache Struts xwork is used as the web application framework, the file upload function of the Jakarta plug-in of the framework has a remote command execution vulnerability s2-045, which can be triggered by...

Nanjing Sudi Technology Webplus pro suffers from s2-045 remote command execution vulnerability

NJSU Webplus pro is a content management system. Webplus pro uses Apache Struts xwork as its application framework, and the file upload function of the Jakarta plug-in of this framework has a remote command execution vulnerability s2-045, which can be triggered by modifying the value of...

Mail.ru: Possible xWork classLoader RCE: shared.mail.ru

Ее похоже аффектит https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2014-05-21 classLoader пролетает, то есть фикса на уровне регулярок нет версия в уязвимом скоупе Я конечно попробую в выходные реально код исполнить, но по внешним признакам оно там есть Все версии меньше...

Atlassian Bamboo < 5.4.3 / 5.5.1 / 5.6.0 XWork Library ClassLoader Manipulation Remote Code Execution

According to its self-reported version number, the instance of Atlassian Bamboo running on the remote host is version 5.4.x prior to 5.4.3 or 5.5.x prior to 5.5.1. It is, therefore, affected by an unspecified flaw in the XWork library. An unauthenticated, remote attacker can exploit this, via...

Atlassian Confluence < 5.5.2 XWork Library ClassLoader Manipulation Remote Code Execution

According to its self-reported version number, the instance of Atlassian Confluence on the remote host is a version prior to 5.5.2. It is, therefore, affected by a flaw in the XWork library that allows a remote, unauthenticated user to alter the ClassLoader. This could allow an attacker to execut...

XWork 2.0.x 'ParameterInterceptor' Class OGNL Security Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/32101/info XWork is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input. Attackers can exploit this issue to manipulate server-side context objects with the privileges of the...

Patch for Security advisory 2014-05-21 doesn't work in Confluence 3.5.X

h3. Steps to reproduce: Confluence 3.5.13 Installed, booted up Postregres DB Shutdown, applied patch following advisory admin panel not accessible content appears to be missing see errors in the logs: code 2014-05-22 16:28:50,308 ERROR http-8080-1 Standalone.localhost./.action log Servlet.service...

Patch for Security advisory 2014-05-21 doesn't work in Confluence 3.5.X

h3. Steps to reproduce: Confluence 3.5.13 Installed, booted up Postregres DB Shutdown, applied patch following advisory admin panel not accessible content appears to be missing see errors in the logs: code 2014-05-22 16:28:50,308 ERROR http-8080-1 Standalone.localhost./.action log Servlet.service...

Upgrading to 5.5.1 from 5.4.3 didn't update xwork from 1.13 to 1.17

We recently upgraded our instance following your security advisory. It was discovered shortly after the upgrade that the xwork file that was vulnerable 1.13 was not upgraded to the safe version 1.17. This could have just been specific to our instance but you should check your upgrade process and...

Upgrading to 5.5.1 from 5.4.3 didn't update xwork from 1.13 to 1.17

We recently upgraded our instance following your security advisory. It was discovered shortly after the upgrade that the xwork file that was vulnerable 1.13 was not upgraded to the safe version 1.17. This could have just been specific to our instance but you should check your upgrade process and...

Upgrading to 5.5.1 from 5.4.3 didn't update xwork from 1.13 to 1.17

We recently upgraded our instance following your security advisory. It was discovered shortly after the upgrade that the xwork file that was vulnerable 1.13 was not upgraded to the safe version 1.17. This could have just been specific to our instance but you should check your upgrade process and...

Apache Struts XWork Error Page Multiple Cross-Site Scripting (CVE-2011-1772)

A Cross-Site Scripting vulnerability has been reported in Apache Struts. The vulnerabilities are due to unsanitized parameters in various automatically generated error pages. A remote attacker can exploit these vulnerabilities by enticing a victim to follow a specially crafted link. Successful...

OGNL double evaluation in atlassian-xwork

We have fixed a vulnerability in our version of Xwork. In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. The attacker needs to be able to access the Confluence web interface. A valid user account is not...

OGNL double evaluation in atlassian-xwork

We have fixed a vulnerability in our version of Xwork. In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. The attacker needs to be able to access the Confluence web interface. A valid user account is not...

OGNL double evaluation in atlassian-xwork

We have fixed a vulnerability in our version of Xwork. In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. The attacker needs to be able to access the Confluence web interface. A valid user account is not...

Apache Struts 2 ParameterInterceptor Class OGNL Expression Parsing Remote Command Execution

The remote web application appears to use Apache Struts 2, a web framework that uses XWork. Due to a flaw in the ParameterInterceptor class, user input is not properly sanitized, which allows a remote attacker to run arbitrary Java code on the remote host by sending a specially crafted HTTP...