2967 matches found
PT-2016-1804
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.x before 2.3.20.2 Apache Struts versions 2.3.24.x before 2.3.24.2 Apache Struts versions 2.3.28.x before 2.3.28.1 Description The issue is related to the XSLTResult class in Apache Struts, which is vulnerable due to...
CVE-2016-3082: Improper Input Validation
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter...
CVE-2016-3081: Improper Neutralization of Special Elements used in a Command
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions...
The vulnerability of the Apache Struts software platform, which allows a hacker to execute arbitrary code
The vulnerability of the Apache Struts software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the sequence of characters "%" in the tag attribute...
The vulnerability of the Apache Struts software platform, which allows attackers to carry out XSS attacks
The vulnerability of the Apache Struts software platform exists due to the lack of text validation in the Locale object, which is constructed using I18NInterceptor. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...
SOL17588029 - Apache Struts vulnerabilities CVE-2016-0785, CVE-2016-2162, CVE-2016-3081, CVE-2016-3082, and CVE-2016-4003
Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...
Apache Struts2 Remote Code Execution Vulnerability (CNVD-2016-02506 )
Apache Struts is an open source framework for creating enterprise Java Web applications. A remote code execution vulnerability exists in Struts2, which can be exploited by an attacker to execute arbitrary code on the server side of a server that initiates a dynamic method call...
PT-2016-3436
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.19 through 2.3.20.2 Apache Struts versions 2.3.21 through 2.3.24.1 Apache Struts versions 2.3.25 through 2.3.28 Description The issue is related to the implementation of the Dynamic Method Invocation DMI mechanism in...
Struts2 Remote Command Execution Vulnerability in Investment Project Audit Management System
The Investment Project Audit Management System IPAMS is an audit management system. The product suffers from a Struts2 remote command execution vulnerability, which can be exploited by an attacker to remotely execute commands and thus gain server privileges...
Apache Struts Oracle JRE Cross-Site Scripting Vulnerability
Apache Struts is the United States an open source framework for creating enterprise Java Web applications.Oracle JRE is a set of environments for running Java applications. A cross-site scripting vulnerability exists in the 'URLDecoder' function of the Oracle JRE used by Apache Struts, which allo...
CVE-2016-4003
Cross-site scripting XSS vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter...
CVE-2016-4003
Cross-site scripting XSS vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter...
CVE-2016-2162
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...
CVE-2016-2162
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...
CVE-2016-4003
Cross-site scripting XSS vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter...
Cross site scripting
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...
CVE-2016-0785
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%" sequence in a tag attribute, aka forced double OGNL evaluation...
Cross site scripting
Cross-site scripting XSS vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter...
CVE-2016-2162
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...