org.apache.struts:struts2-core
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Maven
- Vulnerability status
- affected by 23 advisory(ies)
Advisories (60)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-265r-pp83-gww7 Cross-site Scripting in Apache Struts | < 2.3.20 | Affected |
| GHSA-2j39-qcjm-428w Apache Struts vulnerable to path traversal | 2.0.0 – < 2.5.33 ; 6.0.0 – < 6.3.0.2 | Not affected |
| GHSA-2j4q-9fff-236j Apache Struts XSS Vulnerability | 2.0.0 – < 2.3.28 | Not affected |
| GHSA-2ppp-xj34-vvf7 Apache Struts's CookieInterceptor component does not use the parameter-name whitelist | < 2.2.3.1 | Affected |
| GHSA-2rvh-q539-q33v Cross-Site Request Forgery in Apache Struts | 2.0.0 – < 2.3.4.1 | Not affected |
| GHSA-383p-xqxx-rrmp Denial of service in Apache Struts | 2.0.0 – < 2.3.24.3 | Not affected |
| GHSA-3c5c-xrq4-qhr8 ClassLoader manipulation in Apache Struts | < 2.3.20 | Affected |
| GHSA-3g8j-jj54-3vjg Apache Struts is vulnerable to Cross-site Scripting | < 2.3.16 | Affected |
| GHSA-43mq-6xmg-29vm Apache Struts file upload logic is flawed | < 6.4.0 | Affected |
| GHSA-47qp-8v9g-39hp Code injection in Apache Struts | < 2.3.15.1 | Affected |
| GHSA-4g42-gqrg-4633 Apache Struts vulnerable to memory exhaustion | < 2.5.31 ; 6.0.0 – < 6.1.2.1 | Affected |
| GHSA-4prj-vw9j-v6pr Arbitrary code execution in Apache Struts 2 | 2.3.19 – < 2.3.29 | Not affected |
| GHSA-4qgj-9mvg-3929 Special top object can be used to access Struts' internals | < 2.3.24.1 | Affected |
| GHSA-4wrr-9h5r-m92w Apache Struts Remote Java Code Execution | < 2.2.3.1 | Affected |
| GHSA-56f8-g68r-j699 Cross-site Scripting in Apache Struts | < 2.2.3 | Affected |
| GHSA-729q-fcgp-r5xh Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability | 6.2.0 – < 6.3.0.1 ; 6.0.0 – < 6.1.2.2 ; < 2.5.32 | Affected |
| GHSA-737w-mh58-cxjp Arbitrary code execution in Apache Struts | 2.0.0 – < 2.3.14.2 | Not affected |
| GHSA-7ghm-rpc7-p7g5 Code injection in Apache Struts | 2.0.0 – < 2.3.14.2 | Not affected |
| GHSA-864w-r5qj-h6fj Apache Struts forced double OGNL evaluation | 2.0.0 – < 2.3.29 | Not affected |
| GHSA-86vq-8qhc-5rqw Apache Struts vulnerable to possible DoS attack when using URLValidator | 2.5.0 – < 2.5.13 | Not affected |
| GHSA-876p-4wgc-75rx Apache Struts RCE Vulnerability | 2.0.0 – < 2.3.20.3 ; 2.3.24 – < 2.3.24.3 | Not affected |
| GHSA-8c6j-ffmf-q6vm Apache Struts RCE Vulnerability | 2.3.19 – < 2.3.20.3 ; 2.3.21 – < 2.3.24.3 ; 2.3.25 – < 2.3.28.1 | Not affected |
| GHSA-8f6x-v685-g2xc Apache Struts vulnerable to memory exhaustion | < 2.5.31 ; 6.0.0 – < 6.1.2.1 | Affected |
| GHSA-8fx9-5hx8-crhm Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal | 2.0.1 – < 2.3.34 ; 2.5.0 – < 2.5.11 | Not affected |
| GHSA-8m5q-crqq-6pmf Unrestricted Upload of File with Dangerous Type in Apache Struts2 | 2.0 – < 2.5.22 | Not affected |
| GHSA-8mr5-h28g-36qx Spring AOP functionality (Struts) vulnerable to DoS attack | 2.3.7 – < 2.3.33 ; 2.5.0 – < 2.5.12 | Not affected |
| GHSA-9gp7-jvm2-r4mx Apache Struts Improper Input Validation vulnerability | 2.5.0 – < 2.5.12 | Not affected |
| GHSA-ccp5-gg58-pxfm Improper Preservation of Permissions in Apache Struts | 2.0.0 – < 2.5.22 | Not affected |
| GHSA-cr6j-3jp9-rw65 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation | 2.0.4 – < 2.3.35 ; 2.5 – < 2.5.17 | Not affected |
| GHSA-gqqm-564f-vvxq Arbitrary code execution in Apache Struts 2 | 2.0.0 – < 2.3.14.3 | Not affected |
| GHSA-h4v9-jf2r-9h6m Cross-Site Request Forgery in Apache Struts | < 2.3.20 | Affected |
| GHSA-hmhq-382q-mp56 ClassLoader manipulation in Apache Struts | < 2.3.20 | Affected |
| GHSA-hxqq-w4mr-mc62 Apache Struts's ParameterInterceptor component does not prevent access to public constructors | < 2.3.1.1 | Affected |
| GHSA-j68f-8h6p-9h5q Struts ParameterInterceptor vulnerability allows remote command execution | 2.0.0 – < 2.3.1.2 | Not affected |
| GHSA-j77q-2qqg-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation | 2.3.0 – < 2.3.32 ; 2.5.0 – < 2.5.10.1 | Not affected |
| GHSA-j7h6-xr7g-m2c5 Code injection in Apache Struts | 2.0.0 – < 2.3.15.2 | Not affected |
| GHSA-jc35-q369-45pv Remote code execution in Apache Struts | 2.0.0 – < 2.5.26 | Not affected |
| GHSA-jgcr-9c2q-rvp8 Apache Struts is vulnerable to Cross-site Scripting | 2.0.0 – < 2.0.11.1 ; 2.1.0 – < 2.1.1 | Not affected |
| GHSA-m3x6-9v6h-4g28 Cross-site Scripting in Apache Struts | 2.0.0 – < 2.3.28 | Not affected |
| GHSA-mmj6-cjj4-hpr5 Apache Struts vulnerable to arbitrary remote code execution due to improper input validation | 2.3.19 – < 2.3.20.3 ; 2.3.21 – < 2.3.24.3 ; 2.3.25 – < 2.3.28.1 | Not affected |
| GHSA-mwrx-hx6x-3hhv Apache Struts Code injection due to conversion error | < 2.2.3.1 | Affected |
| GHSA-prjv-jj26-wf8h ClassLoader manipulation in Apache Struts | < 2.3.20 | Affected |
| GHSA-pvm9-288c-v5wq Remote Code Execution in Apache Struts | < 2.3.20.3 ; 2.3.24 – < 2.3.24.3 ; 2.3.28 – < 2.3.28.1 | Affected |
| GHSA-pw8r-x2qm-3h5m Arbitrary code execution in Apache Struts 2 | 2.0.0 – < 2.3.14.3 | Not affected |
| GHSA-q2cg-xf9p-h457 Incomplete exclude pattern in Apache Struts | 2.0.0 – < 2.3.20.1 | Not affected |
| GHSA-q5q8-jghf-3pm3 Apache Struts2 Broken Access Control Vulnerability | < 2.3.15.3 | Affected |
| GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation | 2.0.0 – 2.3.37 ; 2.5.0 – 2.5.33 ; 6.0.0 – < 6.1.1 | Not affected |
| GHSA-rg58-xhh7-mqjw Apache Struts has a Denial of Service vulnerability | 2.0.0 – < 6.8.0 ; 7.0.0 – < 7.1.1 | Not affected |
| GHSA-rpj9-r897-wc6q Open redirect in Apache Struts | < 2.3.15.1 | Affected |
| GHSA-v8j6-6c2r-r27c Expression Language Injection in Apache Struts | 2.0.0 – < 2.5.30 | Not affected |
| GHSA-vrwc-qjmw-5rjm ClassLoader manipulation in Apache Struts | 2.0.0 – < 2.3.16.2 | Not affected |
| GHSA-vwhv-j36g-5rm8 Cross-site Scripting in Apache Struts | < 2.3.20 | Affected |
| GHSA-whmq-v94q-34p9 Improper Control of Generation of Code in Apache Struts | < 2.3.14.3 | Affected |
| GHSA-wp4h-pvgw-5727 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts | 2.0.0 – < 2.5.22 | Not affected |
| GHSA-wv7g-xhvw-8hcp Apache Struts directory traversal vulnerability | 2.0.0 – < 2.0.12 ; 2.1.0 – < 2.1.3 | Not affected |
| GHSA-x5fc-pgpx-59j5 Server side object manipulation in Apache Struts | < 2.2.1 | Affected |
| GHSA-x5x7-3v85-wpc4 Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used | 2.3.7 – < 2.3.34 ; 2.5.0 – < 2.5.13 | Not affected |
| GHSA-xg75-68x3-7p3q Apache Struts vulnerable to possible DoS attack when using URLValidator | 2.3.20 – < 2.3.29 ; 2.5.0 – < 2.5.13 | Not affected |
| GHSA-xm92-v2mq-842q Apache Struts improper action name cleanup | 2.0.0 – < 2.3.29 ; 2.5-BETA1 – < 2.5.1 | Not affected |
| GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak | 6.0.0 – < 6.8.0 ; 7.0.0 – < 7.1.1 ; 2.0.0 – 2.3.37 ; … | Not affected |
Sources
| Source | Licence |
|---|