← Back

Struts

struts

Vendor: Apache • 99 CVEs

CVEs (99)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-7672
1Apache
1Struts
May 13, 2026
Jul 13, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Soluti...Show more
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.Show less
CVE-2017-9791
1Apache
1Struts
Apr 21, 2026
Jul 10, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
CVE-2017-5638
7Apache
ArubanetworksHp+4 more
9Clearpass Policy Manager
Oncommand BalanceServer Automation+6 more
Apr 21, 2026
Mar 11, 2017
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to ex...Show more
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.Show less
CVE-2016-4436
1Apache
1Struts
May 6, 2026
Oct 3, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
CVE-2016-4465
1Apache
1Struts
May 6, 2026
Jul 4, 2016
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
CVE-2016-4438
1Apache
1Struts
May 6, 2026
Jul 4, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
CVE-2016-4433
1Apache
1Struts
May 6, 2026
Jul 4, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
CVE-2016-4431
1Apache
1Struts
May 6, 2026
Jul 4, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
CVE-2016-4430
1Apache
1Struts
May 6, 2026
Jul 4, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
CVE-2016-1182
1Apache
1Struts
Oct 15, 2026
Jul 4, 2016
N/A· v4
8.2 HIGH· v3
6.4 MEDIUM· v2
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service vi...Show more
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.Show less
CVE-2016-1181
2Apache
Oracle
3Banking Platform
PortalStruts
Oct 15, 2026
Jul 4, 2016
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory...Show more
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.Show less
CVE-2015-0899
1Apache
1Struts
May 6, 2026
Jul 4, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
CVE-2016-3093
2Apache
Ognl Project
2Ognl
Struts
May 6, 2026
Jun 7, 2016
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified ve...Show more
Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.Show less
CVE-2016-3087
1Apache
1Struts
May 6, 2026
Jun 7, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) opera...Show more
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.Show less
CVE-2016-3082
1Apache
1Struts
May 6, 2026
Apr 26, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
CVE-2016-3081
3Apache
HuaweiOracle
20Agile Controller Campus Firmware
AnyofficeFirehunter6000 Firmware+17 more
Oct 9, 2026
Apr 26, 2016
N/A· v4
8.1 HIGH· v3
9.3 HIGH· v2
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2016-4003
1Apache
1Struts
May 6, 2026
Apr 12, 2016
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web s...Show more
Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.Show less
CVE-2016-2162
1Apache
1Struts
May 6, 2026
Apr 12, 2016
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involvi...Show more
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.Show less
CVE-2016-0785
1Apache
1Struts
May 6, 2026
Apr 12, 2016
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
CVE-2015-1831
1Apache
1Struts
May 6, 2026
Jul 16, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.