2758 matches found
vulnerability_struts-2.3.31
vulnerabilitystruts-2.3.31 Соберите окружение struts-2.3.31 CVE-2017-5638. HTTPS-запрос возможен. Окружение Ubuntu 20.04 Docker 20.10.12 curl 7.68.0 Запуск сервера Мы будем использовать docker-образ tomcat:7.0-jre8. Распакуйте struts-2.3.31.zip в каталог по вашему выбору. cd struts-2.3.31 sudo...
Apache Struts2 S2-062 - Remote Code Execution
Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. id: CVE-2021-31805 info: name...
Apache S2-032 Struts - Remote Code Execution
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix related to chained expressions. id: CVE-2016-3081 info: name: Apache S2-032 Struts - Remote Code Execution...
Apache Struts2 S2-012 RCE
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect. id: CVE-2013-1965 info: name: Apache Struts2 S2-012 RCE author: pikpikcu...
Apache Struts 2.0.0-2.5.25 - Remote Code Execution
Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. id: CVE-2020-17530 info: name: Apache Struts 2.0.0-2.5.25 - Remote Code Execution author: pikpikcu severity: critical...
Apache Struts2 S2-053 - Remote Code Execution
Apache Struts 2.1.x and 2.3.x with the Struts 1 plugin might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. id: CVE-2017-9791 info: name: Apache Struts2 S2-053 - Remote Code Execution author: pikpikcu severity: critical description: | Apache...
Security Bulletin: Multiple Vulnerabilities in Apache Struts library affect IBM Tivoli Netcool/OMNIbus WebGUI (CVE-2026-73635, CVE-2026-73634)
Summary IBM Tivoli Netcool/OMNIbus WebGUI uses the Apache Struts framework to handle HTTP request processing and web application routing. Vulnerability Details CVEID:CVE-2026-73634 DESCRIPTION: Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoi...
CVE-2026-73635
A flaw was found in Apache Struts. An unauthenticated remote client can exploit a vulnerability where the framework's localized-text caches grow without bound. This occurs when no fixed locale is configured, and the locale for text lookups is derived from the incoming request. This can lead to th...
Exploit for Improper Handling of Exceptional Conditions in Apache Struts
Struts2 Vulnerability Detection and Exploitation Tool s2tool...
CVE-2019-20367
creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:45+00:00| seen| https://t.me/hackingAttack/49652 2026-09-01 20:01:51+00:00| seen| https://t.me/hackingAttack/45703 2026-09-02 01:01:58+00:00| seen| https://t.me/hackingAttack/49652 2026-09-02 01:02:04+00:00| seen|...
Security Bulletin: Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-64775)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Struts Vulnerability Details CVEID:CVE-2025-64775 DESCRIPTION: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issu...
Security Bulletin: Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-66675)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Struts Vulnerability Details CVEID:CVE-2025-66675 DESCRIPTION: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issu...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031329)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031329 advisory. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrar...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031330)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031330 advisory. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031328)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031328 advisory. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site...
Apache Struts 2 vulnerable to resource exhaustion
Overview Apache Struts 2 provided by The Apache Software Foundation contains the following vulnerability: Allocation of resources without limits or throttling CWE-770 - CVE-2026-73635 KuniyoshiNoguchi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...
Apache Struts 6.x < 6.11.0 / 7.x < 7.3.0 Multiple Vulnerabilities (S2-072) (S2-074)
The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by multiple denial of service vulnerabilities, as referenced in the S2-072 and S2-074 advisories: - When an application is configured to populate actions from a...
Apache Struts < 7.3.0 Multiple Vulnerabilities (S2-070) (S2-071)
The version of Apache Struts installed on the remote host is 7.2.1. It is, therefore, affected by multiple vulnerabilities in the JSON plugin, as referenced in the S2-070 and S2-071 advisories: - A component of the JSON plugin that holds per-request parsing state could be shared between concurren...
Apache Struts 6.0.0 <=> 6.10.0 / 7.0.0 <=> 7.2.1 Denial of Service (S2-073)
The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by a denial of service vulnerability as referenced in the S2-073 advisory. - Struts provides an optional facility for collecting Content Security Policy violatio...