CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2008-6682
https://notcve.org/view.php?id=CVE-2008-6682
09 Apr 2009 — Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Apache Struts v2.0.x anteriores a v2.0.11.1 y v2.1.x anteriores a v2.1.1 permi... • http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2007-6726
https://notcve.org/view.php?id=CVE-2007-6726
09 Apr 2009 — Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) Dojo v0.4.1 y v0.4.2, como el utilizado en Apache Struts y otros productos, permite a atacantes remotos inyectar web script o HTML de su elección a través de ve... • http://www.dojotoolkit.org/0-4-3-and-updated-0-4-1-0-4-2-builds • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 5%CPEs: 20EXPL: 4CVE-2008-6504 – XWork < 2.0.11.2 - 'ParameterInterceptor' Class OGNL Security Bypass
https://notcve.org/view.php?id=CVE-2008-6504
23 Mar 2009 — ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character. ParametersInterceptor en OpenSymphony XWork 2.0.x antes de 2.0.6 y 2.1.x antes de 2.1.2, tal como se uti... • https://www.exploit-db.com/exploits/32564 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 96%CPEs: 7EXPL: 1CVE-2008-6505 – Struts 2.0.11 - Multiple Directory Traversal Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-6505
23 Mar 2009 — Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x. Múltiples vulnerabilidades de salto de directorio en Apache Struts v2.0.x anteriores a v2.0.12 y v2.1.x anteriores a v2.1.3, permite a atacantes remotos leer ficheros de su elección a través de ..%25f (pun... • https://www.exploit-db.com/exploits/32565 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •