SUSE CVE-2016-4430

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery CSRF attacks via unspecified vectors...

SUSE CVE-2017-12611

In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack...

SUSE CVE-2018-1327

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here...

SUSE CVE-2018-11776

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true either by user or a plugin like Convention Plugin and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace...

SUSE CVE-2019-0230

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution...

Apache Struts 1.x < 1.2.9 Denial of Service (CVE-2006-1547)

The version of Apache Struts running on the remote host is 1.x prior to 1.2.9. It is, therefore, affected by a denial of service vulnerability in the ActionForm class. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C...

Security Bulletin: Vulnerabilities in Apache Struts affect IBM Tivoli Application Dependency Discovery Manager. (CVE-2021-31805)

Summary Vulnerabilities in Apache Struts affect IBM Tivoli Application Dependency Discovery Manager CVE-2021-31805 Vulnerability Details CVEID:CVE-2021-31805 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by a double evaluation of tag...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2021-31805 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by a double evaluation of tag attributes. By forcing OGNL evaluation of...

Security Bulletin: Netcool Operations Insight v1.6.6 contains fixes for multiple security vulnerabilities.

Summary Netcool Operations Insight v1.6.6 contains fixes for multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2021-23450 DESCRIPTION: Dojo could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in the...

The vulnerability of the Apache Struts software platform, related to deficiencies in access control, allows attackers to modify any arbitrary files.

The vulnerability of the Apache Struts software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to modify arbitrary files remotely...

The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform allows a hacker to execute arbitrary code.

The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary code using a specially created HTTP cookie header...

The vulnerability of the Apache Struts Showcase application on the Apache Struts software platform allows a attacker to execute arbitrary OGNL code.

The vulnerability of the Apache Struts Showcase application on the Apache Struts software platform is related to improper code generation. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary OGNL code using a specially created parameter name...

The vulnerability of the ParametersInterceptor class implementation in the Apache Struts software platform allows attackers to compromise the integrity of the protected information.

The vulnerability of the ParametersInterceptor class implementation in the Apache Struts software platform is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to manipulate the integrity of protected information by using a class parameter passed t...

The vulnerability of the Apache Struts software platform, related to deficiencies in access control, allows attackers to trigger a service failure.

The vulnerability of the Apache Struts software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to trigger service failures through specially crafted requests with very long parameter names...

The vulnerability of the Apache Struts software platform, related to insufficient validation of input data, allows attackers to execute arbitrary code.

The vulnerability of the Apache Struts software platform is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Dynamic Method Invocation (DMI) mechanism implemented in the Apache Struts software framework allows attackers to execute arbitrary code.

The vulnerability of the Dynamic Method Invocation DMI mechanism in the Apache Struts software framework is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the implementation of the action name cleaning method in the Apache Struts software framework allows a hacker to execute arbitrary code.

The vulnerability of the action name cleaning method in the Apache Struts software framework is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

Exploit for Deserialization of Untrusted Data in Apache Struts

CVE-2017-9805 CVE-2017-9805 POC The issue comes fro...

The vulnerability of the Apache Struts software platform, related to improper code generation management, allows attackers to execute arbitrary code.

The vulnerability of the Apache Struts software framework is related to improper code generation during the processing of the includeParams attribute. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted request...

The vulnerability of the Dynamic Method Invocation (DMI) mechanism implemented in the Apache Struts software framework allows attackers to execute arbitrary code.

The vulnerability of the Dynamic Method Invocation DMI mechanism in the Apache Struts software framework lies in the lack of measures taken to sanitize input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...