CVE-2012-1592

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files...

CVE-2012-1592

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files...

CVE-2012-1592

Apache Struts2 is affected by a local code execution vulnerability involving processing malformed XSLT files. The issue affects Struts2 versions prior to 2.5.22 and can allow a malicious user to upload and execute arbitrary files on the server. A fix exists with Struts 2.5.22 or later; advisory e...

CVE-2012-1592: Unrestricted Upload of File with Dangerous Type

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +125 more potentially affected by CVE-2011-3923 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.1.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.2.0, =1.0.3, =0.6, =3.0-rc2, =5.0.1 - com.google.inject.extensions:guice-struts2-plugin 2.0 - com.google.inject.integration:guice-struts2-plugin 1.0 - com.googlecode.rapid-framework:rapid-core 4.0 and more Source cves:...

UPDATE: Infection Monkey 1.6.1

PenTestIT RSS Feed I'm sure you must have read my previous post title the List of Adversary Emulation Tools. In that post, I briefly mentioned about the Guardicore Infection Monkey. Good news now is that it has been updated! We now have Infection Monkey 1.6.1. An important change about this versi...

Directory Traversal

struts2-core is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of sanitization in file path, allowing ..%252f to be used in the file path to perform directory traversal attacks...

Cross-site Scripting (XSS)

struts2-core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the improper handling of double quote characters in the href attribute of the s:a tag, as well as the parameters in the action attribute of the s:url tag, allowing XSS attacks...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +243 more potentially affected by CVE-2018-11776 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.34)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2018-11776 Source advisory: GHSA-CR6J-3JP9-RW65...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +243 more potentially affected by CVE-2018-11776 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.34)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2018-11776 Source advisory: OSV:GHSA-CR6J-3JP9-RW65...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +127 more potentially affected by CVE-2018-11776 via org.apache.struts:struts2-core (>=2.5, <=2.5.16)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.3 - com.jgeppert.struts2.jquery:struts2-jquery-integration-tests 4.0.3 and more Source cves: CVE-2018-11776 Source advisory: GHSA-CR6J-3JP9-RW65...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +127 more potentially affected by CVE-2018-11776 via org.apache.struts:struts2-core (>=2.5, <=2.5.16)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.3 - com.jgeppert.struts2.jquery:struts2-jquery-integration-tests 4.0.3 and more Source cves: CVE-2018-11776 Source advisory: OSV:GHSA-CR6J-3JP9-RW65...

cc.fozone.struts2:streamresultx (1.2), com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (>=1.5.3, <=2.4.0) +199 more potentially affected by CVE-2017-5638 via org.apache.struts:struts2-core (>=2.3.1, <=2.3.31)

org.apache.struts:struts2-core MAVEN version =2.3.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =2.0.0, =0.5.9, =0.5.10.2 and more Source cves: CVE-2017-5638 Source advisory: GHSA-J77Q-2QQG-6989...

cc.fozone.struts2:streamresultx (1.2), com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (>=1.5.3, <=2.4.0) +199 more potentially affected by CVE-2017-5638 via org.apache.struts:struts2-core (>=2.3.1, <=2.3.31)

org.apache.struts:struts2-core MAVEN version =2.3.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =2.0.0, =0.5.9, =0.5.10.2 and more Source cves: CVE-2017-5638 Source advisory: OSV:GHSA-J77Q-2QQG-6989...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +58 more potentially affected by CVE-2017-5638 via org.apache.struts:struts2-core (>=2.5, <=2.5.10)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.2 and more Source cves: CVE-2017-5638 Source advisory: OSV:GHSA-J77Q-2QQG-6989ht...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +58 more potentially affected by CVE-2017-5638 via org.apache.struts:struts2-core (>=2.5, <=2.5.10)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.2 and more Source cves: CVE-2017-5638 Source advisory: GHSA-J77Q-2QQG-6989https:...

org.apache.struts:struts2-portlet (>=2.1.2, <=2.1.6), org.apache.struts:struts2-showcase (>=2.1.2, <=2.1.6) +18 more potentially affected by CVE-2015-3192 via org.springframework:spring-web (2.5.3)

org.springframework:spring-web MAVEN version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.apache.struts:struts2-portlet =2.1.2, =2.1.2, =2.1.2, =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1,...

com.moomanow.web:moomanowwebapp (>=0.0.1, <=0.0.10), com.moomanow:moomanow-struts2-core (>=0.0.4, <=0.1.0) +2 more potentially affected by CVE-2017-9805 via org.apache.struts:struts2-rest-plugin (>=2.5, <=2.5.12)

org.apache.struts:struts2-rest-plugin MAVEN version =2.5, =0.0.1, =0.0.4, =2.5, =2.5, =2.5.12 Source cves: CVE-2017-9805 Source advisory: OSV:GHSA-GG9M-FJ3V-R58C...

org.apache.struts:struts2-assembly (>=2.2.1, <=2.3.33), org.apache.struts:struts2-rest-showcase (>=2.1.2, <=2.3.33) +5 more potentially affected by CVE-2017-9805 via org.apache.struts:struts2-rest-plugin (>=2.1.2, <=2.3.33)

org.apache.struts:struts2-rest-plugin MAVEN version =2.1.2, =2.2.1, =2.1.2, =2.0-rc2.3, =1.0, =1.0.1 - org.meruvian.yama:yama-struts-core 1.0.1 Source cves: CVE-2017-9805 Source advisory: GHSA-GG9M-FJ3V-R58C...

org.apache.struts:struts2-assembly (>=2.2.1, <=2.3.33), org.apache.struts:struts2-rest-showcase (>=2.1.2, <=2.3.33) +5 more potentially affected by CVE-2017-9805 via org.apache.struts:struts2-rest-plugin (>=2.1.2, <=2.3.33)

org.apache.struts:struts2-rest-plugin MAVEN version =2.1.2, =2.2.1, =2.1.2, =2.0-rc2.3, =1.0, =1.0.1 - org.meruvian.yama:yama-struts-core 1.0.1 Source cves: CVE-2017-9805 Source advisory: OSV:GHSA-GG9M-FJ3V-R58C...