ST
Web Framework
Struts
On CISA KEVExploited in the wildRansomware-linked
99
CVEs
9
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 17High 32Medium 14Low 0
Watch
Add Struts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-11776 In wildKEV | 8.1 | Aug 22 | Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like… Affected: 2.3 to 2.3.34; 2.5 to 2.5.16 |
| CVE-2017-9805 In wildKEV | 8.1 | Sep 15 | The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type… Affected: Apache Struts before 2.3.34 and 2.5.x before 2.5.13 |
| CVE-2016-3081 In wildKEV | 8.1 | Apr 26 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method:… Affected: 2.3.20 before 2.3.20.3; 2.3.21 before 2.3.24.3; 2.3.25 before 2.3.28.1 |
| CVE-2006-1547 In wildKEV | 7.5 | Mar 30 | ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form… Affected: before 1.2.9 |
Showing 4