CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2023-34396 – Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
https://notcve.org/view.php?id=CVE-2023-34396
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater • http://www.openwall.com/lists/oss-security/2023/06/14/3 https://cwiki.apache.org/confluence/display/WW/S2-064 https://security.netapp.com/advisory/ntap-20230706-0005 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2023-34149 – Apache Struts: DoS via OOM owing to not properly checking of list bounds
https://notcve.org/view.php?id=CVE-2023-34149
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater. • http://www.openwall.com/lists/oss-security/2023/06/14/2 https://cwiki.apache.org/confluence/display/WW/S2-063 https://security.netapp.com/advisory/ntap-20230706-0005 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.2EPSS: 42%CPEs: 28EXPL: 0CVE-2016-1182
https://notcve.org/view.php?id=CVE-2016-1182
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899. ActionServlet.java en Apache Struts 1 1.x hasta la versión 1.3.10 no restringe adecuadamente la configuración Validator, lo que permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) o provocar una denegación de servicio a través de una entrada manipulada, un problema relacionado con CVE-2015-0899. • http://jvn.jp/en/jp/JVN65044642/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2016-000097 http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/security- • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 2%CPEs: 33EXPL: 0CVE-2016-1181
https://notcve.org/view.php?id=CVE-2016-1181
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899. ActionServlet.java en Apache Struts 1 1.x hasta la versión 1.3.10 no maneja adecuadamente accesos multihilo para una instancia ActionForm, lo que permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (acceso inesperado a memoria) a través de una solicitud multiparte, un problema relacionado con CVE-2015-0899. • http://jvn.jp/en/jp/JVN03188560/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2016-000096 http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security- •
CVSS: 7.5EPSS: 93%CPEs: 17EXPL: 0CVE-2015-0899
https://notcve.org/view.php?id=CVE-2015-0899
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter. La implementación MultiPageValidator en Apache Struts 1 1.1 hasta la versión 1.3.10 permite a atacantes remotos eludir las restricciones destinadas al acceso a través de un parámetro page modificado. • http://jvn.jp/en/jp/JVN86448949/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000042 http://www.debian.org/security/2016/dsa-3536 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.securityfocus.com/bid/74423 https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN https://security.netapp.com/advisory/ntap-20180629-0006 • CWE-20: Improper Input Validation •