CVE-2008-6504

CVE-2008-6504 affects OpenSymphony XWork (ParameterInterceptor) used in Apache Struts: OGNL refs to # context objects are not properly restricted, enabling remote OGNL evaluation and modification of server-side objects. Affected: XWork 2.0.x prior to 2.0.6 and 2.1.x prior to 2.1.2; vulnerability ...

CVE-2008-2025

CVE-2008-2025 is an XSS vulnerability in Apache Struts (prior to 1.2.9-162.31.1 on SUSE SLE 11, prior to 1.2.9-108.2 on SUSE openSUSE 10.3, prior to 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1) caused by insufficient quoting of parameters. Remote attackers ...

CVE-2008-6682

Apache Struts is affected by multiple cross-site scripting (XSS) vulnerabilities in 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1. The issue arises from improper handling of (1) double-quote characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag, ...

CVE-2008-6505

CVE-2008-6505 affects Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3. The vulnerability is a directory traversal issue triggered by a encoded dot-dot-slash sequence in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x. Explo...

CVE-2007-6726

CVE-2007-6726 refers to multiple XSS vulnerabilities in Dojo 0.4.1 and 0.4.2 as used in Apache Struts and other products. The issues allow remote injection of arbitrary script/HTML via vectors involving xip_client.html and xip_server.html in src/io/. The NVD entry lists a MEDIUM severity (CVSSv2:...