Struts

struts

Vendor: Apache • 99 CVEs

CVEs (99)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-17530 2Apache Oracle 8Business Intelligence Communications Diameter Intelligence HubCommunications Policy Management+5 more Jun 17, 2026 Dec 11, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CVE-2019-0233 2Apache Oracle 5Communications Policy Management Financial Services Data Integration HubFinancial Services Market Risk Measurement And Management+2 more Jun 17, 2026 Sep 14, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
CVE-2019-0230 2Apache Oracle 5Communications Policy Management Financial Services Data Integration HubFinancial Services Market Risk Measurement And Management+2 more Jun 17, 2026 Sep 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVE-2015-2992 1Apache 1Struts Nov 21, 2024 Feb 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
CVE-2012-1592 1Apache 1Struts Nov 21, 2024 Dec 5, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
CVE-2011-3923 2Apache Redhat 2Jboss Enterprise Web Server Struts Nov 21, 2024 Nov 1, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2018-11776 3Apache NetappOracle 8Active Iq Unified Manager Communications Policy ManagementEnterprise Manager Base Platform+5 more Oct 27, 2025 Aug 22, 2018 N/A· v4 8.1 HIGH· v3 9.3 HIGH· v2 Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with...Show more Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.Show less
CVE-2018-1327 1Apache 1Struts Nov 21, 2024 Mar 27, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and...Show more The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.Show less
CVE-2017-15707 3Apache NetappOracle 12Agile Plm Framework Enterprise Manager For VirtualizationFinancial Services Hedge Management And Ifrs Valuations+9 more May 13, 2026 Dec 1, 2017 N/A· v4 6.2 MEDIUM· v3 5.0 MEDIUM· v2 In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
CVE-2016-3090 1Apache 1Struts May 13, 2026 Oct 30, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
CVE-2016-4461 2Apache Netapp 2Oncommand Balance Struts May 13, 2026 Oct 16, 2017 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix...Show more Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.Show less
CVE-2015-5169 1Apache 1Struts May 13, 2026 Sep 25, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
CVE-2017-9804 1Apache 1Struts May 13, 2026 Sep 20, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overl...Show more In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.Show less
CVE-2017-9793 1Apache 1Struts May 13, 2026 Sep 20, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted X...Show more The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.Show less
CVE-2017-12611 1Apache 1Struts May 13, 2026 Sep 20, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
CVE-2016-8738 1Apache 1Struts May 13, 2026 Sep 20, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process whe...Show more In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.Show less
CVE-2016-6795 1Apache 1Struts May 13, 2026 Sep 20, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
CVE-2017-9805 3Apache CiscoNetapp 7Digital Media Manager Hosted Collaboration SolutionMedia Experience Engine+4 more Apr 21, 2026 Sep 15, 2017 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code...Show more The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.Show less
CVE-2015-5209 1Apache 1Struts May 13, 2026 Aug 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
CVE-2017-9787 1Apache 1Struts May 13, 2026 Jul 13, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.

Previous 123 4 5 Next