Search for packages
| purl | pkg:maven/org.apache.struts.xwork/xwork-core@2.3.14.3 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-kdsa-599r-eud7
Aliases: CVE-2014-0094 GHSA-vrwc-qjmw-5rjm |
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. |
Affected by 3 other vulnerabilities. |
|
VCID-p9xh-frm5-8ucp
Aliases: CVE-2015-1831 GHSA-q2cg-xf9p-h457 |
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. |
Affected by 3 other vulnerabilities. |
|
VCID-tgd1-s1yg-9fdt
Aliases: CVE-2025-68493 GHSA-qcfc-hmrc-59x7 |
Apache Struts 2 is Missing XML Validation Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue. | There are no reported fixed by versions. |
|
VCID-ufcq-57q9-53c7
Aliases: CVE-2012-0394 GHSA-hmvj-gc9q-mg9p |
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself. |
Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-6241-shkt-s7ew | Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135. |
CVE-2013-2134
GHSA-gqqm-564f-vvxq |
| VCID-vnkw-9fa2-zqcm | Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice. |
CVE-2013-2135
GHSA-pw8r-x2qm-3h5m |