CVSS: 9.8EPSS: 90%CPEs: 2EXPL: 2CVE-2011-3923 – Apache Struts - 'ParametersInterceptor' Remote Code Execution
https://notcve.org/view.php?id=CVE-2011-3923
01 Nov 2019 — Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. Apache Struts versiones anteriores a 2.3.1.2, permite a atacantes remotos omitir las protecciones de seguridad en la clase ParameterInterceptor y ejecutar comandos arbitrarios. • https://www.exploit-db.com/exploits/24874 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.3EPSS: 94%CPEs: 13EXPL: 24CVE-2018-11776 – Apache Struts Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-11776
22 Aug 2018 — Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. Apache Struts, desde la versión 2.3 hasta la ... • https://packetstorm.news/files/id/172830 •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2018-1327
https://notcve.org/view.php?id=CVE-2018-1327
27 Mar 2018 — The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16. El plugin REST en Apache Struts emplea una bibli... • http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html •
CVSS: 8.8EPSS: 1%CPEs: 59EXPL: 0CVE-2016-3090
https://notcve.org/view.php?id=CVE-2016-3090
30 Oct 2017 — The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling. El método TextParseUtil.translateVariables en las versiones 2.x anteriores a la 2.3.20 de Apache Struts permite que atacantes remotos ejecuten código arbitrario mediante una expresión OGNL manipulada con herramientas ANTLR. • http://www.securityfocus.com/bid/85131 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 0CVE-2016-4461
https://notcve.org/view.php?id=CVE-2016-4461
16 Oct 2017 — Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785. Apache Struts en versiones 2.x anteriores a la 2.3.29 permite que atacantes remotos ejecuten código arbitrario mediante una secuencia "%{}" en un atributo de etiqueta. Esto también se conoce como evaluación OGNL doble forzada. NOTA: Esta vulnerabilidad existe debido a una s... • http://www.securityfocus.com/bid/91277 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2015-5169
https://notcve.org/view.php?id=CVE-2015-5169
25 Sep 2017 — Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Apache Struts en versiones anteriores a 2.3.20. • http://jvn.jp/en/jp/JVN95989300/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 12%CPEs: 55EXPL: 0CVE-2017-9804
https://notcve.org/view.php?id=CVE-2017-9804
20 Sep 2017 — In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672. En Apache Struts desde la versión 2.3.7 hasta la 2.3.33 y desde la 2.5 hasta la 2.5.12, si una aplicación permite la introducción de una URL en u... • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 10%CPEs: 55EXPL: 0CVE-2017-9793
https://notcve.org/view.php?id=CVE-2017-9793
20 Sep 2017 — The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload. El Plugin REST en Apache Struts versiones 2.1.x, versiones 2.3.7 hasta 2.3.33 y versiones 2.5 hasta 2.5.12, está usando una biblioteca XStream obsoleta que es vulnerable y permite realizar un ataque de DoS usando una petición maliciosa con una carga útil XML especialmente diseñad... • http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2017-429.htm • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 94%CPEs: 90EXPL: 3CVE-2017-12611 – Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2017-12611
20 Sep 2017 — In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack. En Apache Struts versiones 2.0.0 hasta 2.3.33 y versiones 2.5 hasta 2.5.10.1, el uso de una expresión no intencional en una etiqueta Freemarker en lugar de literales de cadena podría conllevar a un ataque de tipo RCE. • https://www.exploit-db.com/exploits/44556 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 94%CPEs: 58EXPL: 19CVE-2017-9805 – Apache Struts Deserialization of Untrusted Data Vulnerability
https://notcve.org/view.php?id=CVE-2017-9805
07 Sep 2017 — The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. El Plugin REST en Apache Struts versiones 2.1.1 hasta 2.3.x anteriores a 2.3.34 y versiones 2.5.x anteriores a 2.5.13, usa una XStreamHandler con una instancia de XStream para deserialización sin ningún filtrado de tipos, lo que puede conllevar a un... • https://packetstorm.news/files/id/144034 • CWE-502: Deserialization of Untrusted Data •