ST
Web Framework
Struts
On CISA KEVExploited in the wildRansomware-linked
99
CVEs
9
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 17High 32Medium 14Low 0
Watch
Add Struts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-17530 In wildKEV | 9.8 | Dec 11 | Apache Struts Remote Code Execution Vulnerability Affected: Struts 2.0.0 - Struts 2.5.25 |
| CVE-2017-9791 In wildKEV | 9.8 | Jul 10 | The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage Affected: 2.1.x series; 2.3.x series |
| CVE-2017-5638 RansomwareIn wildKEV | 9.8 | Mar 11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload… Affected: 2.3.x before 2.3.32; 2.5.x before 2.5.10.1 |
| CVE-2013-2251 In wildKEV | 9.8 | Jul 18 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:… Affected: 2.0.0 through 2.3.15 |
| CVE-2012-0391 In wildKEV | 9.8 | Jan 8 | The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of… Affected: before 2.2.3.1 |
| CVE-2018-11776 In wildKEV | 8.1 | Aug 22 | Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like… Affected: 2.3 to 2.3.34; 2.5 to 2.5.16 |
| CVE-2017-9805 In wildKEV | 8.1 | Sep 15 | The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type… Affected: Apache Struts before 2.3.34 and 2.5.x before 2.5.13 |
| CVE-2016-3081 In wildKEV | 8.1 | Apr 26 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method:… Affected: 2.3.20 before 2.3.20.3; 2.3.21 before 2.3.24.3; 2.3.25 before 2.3.28.1 |
| CVE-2006-1547 In wildKEV | 7.5 | Mar 30 | ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form… Affected: before 1.2.9 |
Showing 9