Search for packages
| purl | pkg:maven/org.apache.struts.xwork/xwork-core@2.0.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6241-shkt-s7ew
Aliases: CVE-2013-2134 GHSA-gqqm-564f-vvxq |
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135. |
Affected by 4 other vulnerabilities. |
|
VCID-hkjh-35ye-1ugj
Aliases: CVE-2013-2115 GHSA-7ghm-rpc7-p7g5 |
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966. |
Affected by 6 other vulnerabilities. |
|
VCID-kdsa-599r-eud7
Aliases: CVE-2014-0094 GHSA-vrwc-qjmw-5rjm |
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. |
Affected by 3 other vulnerabilities. |
|
VCID-p9xh-frm5-8ucp
Aliases: CVE-2015-1831 GHSA-q2cg-xf9p-h457 |
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. |
Affected by 3 other vulnerabilities. |
|
VCID-q96z-v3bs-k3dg
Aliases: CVE-2012-4387 GHSA-hrgc-54mv-58gv |
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression. |
Affected by 8 other vulnerabilities. |
|
VCID-vkb9-11h4-dugp
Aliases: CVE-2013-1966 GHSA-737w-mh58-cxjp |
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. |
Affected by 6 other vulnerabilities. |
|
VCID-vnkw-9fa2-zqcm
Aliases: CVE-2013-2135 GHSA-pw8r-x2qm-3h5m |
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice. |
Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||