CVSS: 5.3EPSS: 65%CPEs: 20EXPL: 4CVE-2008-6504 – XWork < 2.0.11.2 - 'ParameterInterceptor' Class OGNL Security Bypass
https://notcve.org/view.php?id=CVE-2008-6504
23 Mar 2009 — ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character. ParametersInterceptor en OpenSymphony XWork 2.0.x antes de 2.0.6 y 2.1.x antes de 2.1.2, tal como se uti... • https://www.exploit-db.com/exploits/32564 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 81%CPEs: 7EXPL: 1CVE-2008-6505 – Struts 2.0.11 - Multiple Directory Traversal Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-6505
23 Mar 2009 — Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x. Múltiples vulnerabilidades de salto de directorio en Apache Struts v2.0.x anteriores a v2.0.12 y v2.1.x anteriores a v2.1.3, permite a atacantes remotos leer ficheros de su elección a través de ..%25f (pun... • https://www.exploit-db.com/exploits/32565 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2006-1546 – struts bypass validation
https://notcve.org/view.php?id=CVE-2006-1546
30 Mar 2006 — Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check. • http://issues.apache.org/bugzilla/show_bug.cgi?id=38374 •
CVSS: 7.8EPSS: 9%CPEs: 2EXPL: 1CVE-2006-1547 – Apache Struts 1 ActionForm Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2006-1547
30 Mar 2006 — ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils. ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS). • http://issues.apache.org/bugzilla/show_bug.cgi?id=38534 • CWE-749: Exposed Dangerous Method or Function •
CVSS: 4.3EPSS: 5%CPEs: 1EXPL: 0CVE-2006-1548 – struts LookupDispatchAction XSS
https://notcve.org/view.php?id=CVE-2006-1548
30 Mar 2006 — Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message. • http://issues.apache.org/bugzilla/show_bug.cgi?id=38749 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 36%CPEs: 1EXPL: 3CVE-2005-3745 – Apache Struts 1.2.7 - Error Response Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2005-3745
22 Nov 2005 — Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Apache Struts 1.2.7, y posiblemente otras versiones, permite a atacantes remotos inyectar 'script' web o HTML de su elección mediante la cadena de consulta, que no es entr... • https://www.exploit-db.com/exploits/26542 •