OpenSymphony XWork vulnerable to improper input validation

XWork is an command-pattern framework that is used to power WebWork as well as other applications. Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language OGNL expression...

Denial Of Service (DoS)

OpenSymphony XWork is vulnerable to denial of service. Object-Graph Navigation Language OGNL expressions are recursively evaluated when altSyntax is enabled. A remote attacker is able to submit a crafted input to cause an infinite loop which results in a denial of service condition. This...

Unauthorized OGNL Execution

xwork is vulnerable to unauthorized OGNL execution attacks. The vulnerability exists due to the lack of sanitization of user input, allowing \u0023 to be used as interpreted as to allow OGNL statements to be executed...

Denial Of Service (DoS)

struts2-rest-plugin is vulnerable to denial of service DoS attacks. These attacks are possible because it is using a version of xwork-core that is vulnerable to CVE-2017-7957...

Regular Expression Denial Of Service (ReDoS)

struts2-core and xwork-core are vulnerable to regular expression denial of service ReDoS attacks. When the URLValidator is used it is possible to overload the server process through an attacker controlled URL. These attacks are as a result of an incomplete fix for CVE-2017-7672...

Denial Of Service (DoS)

xwork-core is vulnerable to denial of service DoS attacks. The library does not check if a authenticated user is allowed to access to edit the actions of a service, allowing a malicious user to block other users from accessing the service...

Jinnovision-JNDV Audio/Video Conference Converged Communication Platform s2-045 Remote Code Execution Vulnerability

JNDV audio/video conferencing converged communication platform is used to realize centralized monitoring, storage, data forwarding, management and control of all network video surveillance devices including network video servers and network cameras at the front end. Jinnovision-JNDV audio and vid...

Hikvision has s2-045 Remote Command Execution Vulnerability in Multiple Product Systems

Hikvision is a video-centric IoT solution and data operation service provider. Hikvision's multiple product systems use Apache Struts xwork as the website application framework. The file upload function of the Jakarta plug-in of this framework has a remote command execution vulnerability s2-045,...

s2-045 remote command execution vulnerability in KINGOSOFT University Teaching Network Management System of Hunan Qingguo Software Co.

Hunan Qingguo Software Co., Ltd KINGOSOFT college teaching network management system is a technical solution for the construction of digital campus for colleges and universities. Hunan Qingguo Software Co., Ltd. KINGOSOFT university teaching network management system uses Apache Struts xwork as t...

S2-045 Remote Command Execution Vulnerability in Soyo's CMS Website Management Platform

The Sawyer Technology CMS Website Management Platform is a content management system. The Apache Struts xwork is used as the web application framework, the file upload function of the Jakarta plug-in of the framework has a remote command execution vulnerability s2-045, which can be triggered by...

Nanjing Sudi Technology Webplus pro suffers from s2-045 remote command execution vulnerability

NJSU Webplus pro is a content management system. Webplus pro uses Apache Struts xwork as its application framework, and the file upload function of the Jakarta plug-in of this framework has a remote command execution vulnerability s2-045, which can be triggered by modifying the value of...

Mail.ru: Possible xWork classLoader RCE: shared.mail.ru

Ее похоже аффектит https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2014-05-21 classLoader пролетает, то есть фикса на уровне регулярок нет версия в уязвимом скоупе Я конечно попробую в выходные реально код исполнить, но по внешним признакам оно там есть Все версии меньше...

Atlassian Bamboo < 5.4.3 / 5.5.1 / 5.6.0 XWork Library ClassLoader Manipulation Remote Code Execution

According to its self-reported version number, the instance of Atlassian Bamboo running on the remote host is version 5.4.x prior to 5.4.3 or 5.5.x prior to 5.5.1. It is, therefore, affected by an unspecified flaw in the XWork library. An unauthenticated, remote attacker can exploit this, via...

Atlassian Confluence < 5.5.2 XWork Library ClassLoader Manipulation Remote Code Execution

According to its self-reported version number, the instance of Atlassian Confluence on the remote host is a version prior to 5.5.2. It is, therefore, affected by a flaw in the XWork library that allows a remote, unauthenticated user to alter the ClassLoader. This could allow an attacker to execut...

XWork 2.0.x 'ParameterInterceptor' Class OGNL Security Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/32101/info XWork is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input. Attackers can exploit this issue to manipulate server-side context objects with the privileges of the...

Patch for Security advisory 2014-05-21 doesn't work in Confluence 3.5.X

h3. Steps to reproduce: Confluence 3.5.13 Installed, booted up Postregres DB Shutdown, applied patch following advisory admin panel not accessible content appears to be missing see errors in the logs: code 2014-05-22 16:28:50,308 ERROR http-8080-1 Standalone.localhost./.action log Servlet.service...

Patch for Security advisory 2014-05-21 doesn't work in Confluence 3.5.X

h3. Steps to reproduce: Confluence 3.5.13 Installed, booted up Postregres DB Shutdown, applied patch following advisory admin panel not accessible content appears to be missing see errors in the logs: code 2014-05-22 16:28:50,308 ERROR http-8080-1 Standalone.localhost./.action log Servlet.service...

Upgrading to 5.5.1 from 5.4.3 didn't update xwork from 1.13 to 1.17

We recently upgraded our instance following your security advisory. It was discovered shortly after the upgrade that the xwork file that was vulnerable 1.13 was not upgraded to the safe version 1.17. This could have just been specific to our instance but you should check your upgrade process and...

Upgrading to 5.5.1 from 5.4.3 didn't update xwork from 1.13 to 1.17

We recently upgraded our instance following your security advisory. It was discovered shortly after the upgrade that the xwork file that was vulnerable 1.13 was not upgraded to the safe version 1.17. This could have just been specific to our instance but you should check your upgrade process and...

Upgrading to 5.5.1 from 5.4.3 didn't update xwork from 1.13 to 1.17

We recently upgraded our instance following your security advisory. It was discovered shortly after the upgrade that the xwork file that was vulnerable 1.13 was not upgraded to the safe version 1.17. This could have just been specific to our instance but you should check your upgrade process and...