CVE-2016-4430

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery CSRF attacks via unspecified vectors...

CVE-2016-1181

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service unexpected memory access via a multipart request, a related issue to CVE-2015-0899...

CVE-2016-1181

CVE-2016-1181 affects Apache Struts 1.x (1.1–1.3.10) where ActionServlet.java mishandles multithreaded access to an ActionForm, allowing a remote attacker to execute arbitrary code or cause a denial of service via a multipart request (related to CVE-2015-0899). The NVD description explicitly ties...

CVE-2016-4433

CVE-2016-4433 affects Apache Struts 2.2.3.20–2.3.28.1, where a crafted request can bypass access restrictions and trigger redirection attacks. Multiple connected sources (NVD description; IBM advisories for Struts-related products) confirm the same affected range and attack pattern. The provided ...

PT-2016-2304

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions 2.3.20 through 2.3.28.1 Description The issue exists due to insufficient input validation in the Apache Struts platform. This allows a remote attacker to bypass existing access restrictions by utilizing a default metho...

CVE-2016-4431: Improper Input Validation

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method...

PT-2016-2324

Name of the Vulnerable Software and Affected Versions Apache Struts versions 1.x through 1.3.10 Description The issue is related to insufficient input validation in the ActionServlet.java file of Apache Struts, allowing remote attackers to conduct cross-site scripting XSS attacks or cause a denia...

CVE-2016-1182: Improper Input Validation

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

CVE-2016-1181: Undefined Security Weakness

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service unexpected memory access via a multipart request, a related issue to CVE-2015-0899...

CVE-2015-0899: Improper Input Validation

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter...

PT-2016-2325

Name of the Vulnerable Software and Affected Versions Apache Struts versions 1.x through 1.3.10 Description The issue is related to errors in the code of the Apache Struts platform, specifically in the ActionServlet.java file, which mishandles multithreaded access to an ActionForm instance. This...

CVE-2016-4465: Improper Input Validation

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field...

PT-2016-2303

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions 2.3.20 through 2.3.28.1 Description The issue allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request. This is due to insufficient input validation in the...

PT-2016-2300

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.20 through 2.3.28.1 Apache Struts versions 2.5.x before 2.5.13 Description The issue exists due to insufficient input validation in the URLValidator class of Apache Struts. This allows a remote attacker to cause a...

PT-2016-5955

Name of the Vulnerable Software and Affected Versions Apache Struts 2 versions 2.3.20 through 2.3.28.1 Description The issue is related to token validation mishandling, which allows remote attackers to conduct cross-site request forgery CSRF attacks. This is due to incorrect token validation in...

CVE-2016-4433: Improper Input Validation

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request...

CVE-2016-4438: Improper Input Validation

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression...

CVE-2016-4430: Cross-Site Request Forgery (CSRF)

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery CSRF attacks via unspecified vectors...

PT-2016-2302

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.19 through 2.3.28.1 Description The issue exists due to insufficient input validation in the REST plugin of the Apache Struts platform. This allows a remote attacker to execute arbitrary code using a specially crafte...

Fedora Update for struts FEDORA-2016-21bd6a33af

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...