Apache Struts struts-examples upload-submit.do 'theText' Parameter XSS

The remote web server hosts struts-examples, a demonstration application for the Struts framework. Input passed via the 'theText' POST parameter to the 'upload-submit.do' page is not properly sanitized before using it to generate dynamic HTML. By tricking a user into clicking on a specially craft...

CVE-2012-1007

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via 1 the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to 2 struts-cookbook/processSimple.do or 3...

CVE-2012-1007: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via 1 the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to 2 struts-cookbook/processSimple.do or 3...

PT-2012-3010

Name of the Vulnerable Software and Affected Versions Apache Struts version 1.3.10 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters to certain API endpoints. The vulnerable parameters include the name parameter to...