Apache Struts vulnerable to cross-site scripting

Overview Apache Struts provided by the Apache Software Foundation is a software framework for creating web applications in Java. Apache Struts is vulnerable to cross-site scripting when JSP files can be accessed directly. Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. reported this...

[SECURITY] Fedora 22 Update: struts-1.3.10-14.fc22

Welcome to the Struts Framework! The goal of this project is to provide an open source framework useful in building web applications with Java Servlet and JavaServer Pages JSP technology. Struts encourages application architectures based on the Model-View-Controller MVC design paradigm,...

JVN#88408929: Apache Struts vulnerable to cross-site scripting

Apache Struts provided by the Apache Software Foundation is a software framework for creating web applications in Java. Apache Struts is vulnerable to cross-site scripting when JSP files can be accessed directly. Impact An arbitrary script may be executed on the user's Internet Explorer when the...

JVN#95989300: Apache Struts vulnerable to cross-site scripting

Apache Struts provided by the Apache Software Foundation is a software framework for creating Java web applications. Apache Struts contains a cross-site scripting vulnerability when devMode is left turned on. Impact An arbitrary script may be executed on the user's web browser. Solution Update th...

Fedora Update for struts FEDORA-2015-14237

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 22 : struts-1.3.10-14.fc22 (2015-14237)

fix CVE-2015-0899 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Networ...

Struts2 Remote Command Execution Vulnerability in Palm Ticket Issuance System

Pocket Airline Ticket Issuance System is a ticket issuance system of Beijing Aihong Technology Co. A Struts2 remote command execution vulnerability exists in the Pocket Ticket Issuance System. This vulnerability allows an attacker to remotely execute commands to gain server privileges...

Debian DLA-292-1 : libstruts1.2-java security update

The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. When the Apache Struts 1 Validator is used, the web...

DLA-292-1 libstruts1.2-java - security update

Bulletin has no description...

PT-2015-3440

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.20 Description The issue is related to a cross-site scripting XSS vulnerability. It is associated with the debug mode devMode of the Apache Struts platform, where the structure of web pages is not properly...

PT-2015-3441

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.20 Description The issue is related to a cross-site scripting XSS vulnerability in the implementation of the debug mode devMode in Apache Struts. This vulnerability can be exploited by a remote attacker to...

SOL17126 - Apache Struts vulnerability CVE-2014-7809

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL995...

CVE-2015-1831

The default exclude patterns excludeParams in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors...

CVE-2015-1831

The default exclude patterns excludeParams in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors...

Default credentials

The default exclude patterns excludeParams in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors...

CVE-2015-1831

CVE-2015-1831 concerns Apache Struts 2.3.20, where misleading default excludeParams could let an attacker alter an application’s internal state. IBM advisories list affected IBM storage platforms (FlashSystem 900/ V840/ V9000 and Storwize families) with fixes in specific code levels (e.g., FlashS...

CVE-2015-1831

The default exclude patterns excludeParams in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors...

CVE-2015-1831: Undefined Security Weakness

The default exclude patterns excludeParams in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors...

PT-2015-5461

Name of the Vulnerable Software and Affected Versions Apache Struts version 2.3.20 Description The default exclude patterns in Apache Struts allow remote attackers to compromise the internal state of an application via unspecified vectors. Recommendations For Apache Struts version 2.3.20, conside...

SOL16827 - Apache Struts vulnerability CVE-2015-1831

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL995...