CVE-2016-3082

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter...

Design/Logic Flaw

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions...

CVE-2016-3081

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions...

CVE-2016-3081

Apache Struts 2.x is affected by CVE-2016-3081 where Dynamic Method Invocation (DMI) enabled leads to remote code execution via a method: prefix, tied to chained expressions. The affected ranges listed are 2.3.19–2.3.20.2, 2.3.21–2.3.24.1, and 2.3.25–2.3.28. Public exploit evidence exists (Exploi...

CVE-2016-3082

CVE-2016-3082 affects Apache Struts 2.x; using XSLTResult, remote code execution is possible via the stylesheet location parameter. Affected: 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1. Impact: arbitrary code execution on the server. Remediation: upgrade to patche...

CVE-2016-3082

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter...

CVE-2016-3082

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter...

CVE-2016-3081

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions...

CVE-2016-3081

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions...

CVE-2016-3082: Improper Input Validation

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter...

PT-2016-1804

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.x before 2.3.20.2 Apache Struts versions 2.3.24.x before 2.3.24.2 Apache Struts versions 2.3.28.x before 2.3.28.1 Description The issue is related to the XSLTResult class in Apache Struts, which is vulnerable due to...

CVE-2016-3081: Improper Neutralization of Special Elements used in a Command

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions...

The vulnerability of the Apache Struts software platform, which allows a hacker to execute arbitrary code

The vulnerability of the Apache Struts software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the sequence of characters "%" in the tag attribute...

SOL17588029 - Apache Struts vulnerabilities CVE-2016-0785, CVE-2016-2162, CVE-2016-3081, CVE-2016-3082, and CVE-2016-4003

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

The vulnerability of the Apache Struts software platform, which allows attackers to carry out XSS attacks

The vulnerability of the Apache Struts software platform exists due to the lack of text validation in the Locale object, which is constructed using I18NInterceptor. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

PT-2016-3436

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.19 through 2.3.20.2 Apache Struts versions 2.3.21 through 2.3.24.1 Apache Struts versions 2.3.25 through 2.3.28 Description The issue is related to the implementation of the Dynamic Method Invocation DMI mechanism in...

Apache Struts Oracle JRE Cross-Site Scripting Vulnerability

Apache Struts is the United States an open source framework for creating enterprise Java Web applications.Oracle JRE is a set of environments for running Java applications. A cross-site scripting vulnerability exists in the 'URLDecoder' function of the Oracle JRE used by Apache Struts, which allo...

CVE-2016-4003

Cross-site scripting XSS vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter...

CVE-2016-4003

Cross-site scripting XSS vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter...

CVE-2016-2162

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...