com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (2.3.4), com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (2.3.4) +108 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.3.16.3)

org.apache.struts:struts2-core MAVEN version 2.3.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - com.amashchenko.struts2.actionflow:struts2-actionflow-plugin 2.3.4 -...

org.apache.struts:struts2-apps (2.0.11), org.apache.struts:struts2-assembly (2.0.11) +18 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.0.11)

org.apache.struts:struts2-core MAVEN version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.0.11 - org.apache.struts:struts2-assembly 2.0.11 -...

org.anyline:anyline-struts (>=8.3.7, <=8.3.8), org.apache.struts:struts2-apps (2.3.35) +40 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.3.35)

org.apache.struts:struts2-core MAVEN version 2.3.35 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.anyline:anyline-struts =8.3.7, =8.3.8 - org.apache.struts:struts2-apps 2.3.35 -...

org.apache.struts:struts2-apps (2.5-beta1), org.apache.struts:struts2-assembly (2.5-beta1) +33 more potentially affected by CVE-2024-53677 via org.apache.struts:struts2-core (2.5-beta1)

org.apache.struts:struts2-core MAVEN version 2.5-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.5-beta1 - org.apache.struts:struts2-assembly 2.5-beta1 -...

Denial Of Service (DoS)

Struts 2 Core is vulnerable to Denial Of Service DoS. The vulnerability exists due to improper list bound checks during a multipart request with non-file form fields. An attacker can submit a crafted request, resulting in an out of memory error if the struts.multipart.maxSize is a value greater o...

org.apache.struts:struts2-apps (2.3.28), org.apache.struts:struts2-assembly (2.3.28) +39 more potentially affected by CVE-2016-3082 via org.apache.struts:struts2-core (2.3.28)

org.apache.struts:struts2-core MAVEN version 2.3.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-core and may be impacted: - org.apache.struts:struts2-apps 2.3.28 - org.apache.struts:struts2-assembly 2.3.28 -...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +38 more potentially affected by CVE-2016-4436 via org.apache.struts:struts2-core (>=2.5-beta1, <=2.5)

org.apache.struts:struts2-core MAVEN version =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5-beta1, =2.5 and more Source cves: CVE-2016-4436 Source advisory: OSV:GHSA-XM92-V2MQ-842Q...

Class Loader Manipulation With CookieInterceptor

Struts 2 Core is vulnerable to class loader manipulation vulnerability. The vulnerability exists because the getClass method does not properly restrict access to cookies as it accepts all cookie names when "\" is used to configure cookiesName parameter which allows remote attackers to manipulate...