WaratekVRT Sign in
Reset
More filters (1)
Columns
Vendor struts✕
Overview 7 matches · 1 exploited · 1 CISA KEV · 0 public PoC · 1 EPSS ≥ 0.5
7matches 1exploited14.3% 1CISA KEV14.3% 0public PoC0.0% 1EPSS ≥ 0.514.3%
Protected by Waratek 7 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 6 85.7% Medium 1 14.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 7 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 85.7%
split by peak 3 / year
Protected by Waratek: 7 Medium: 1High: 6 blocked by ARMR today: 7 No public exploit: 6Exploited: 1
20063 Protected by Waratek3 High2 Medium1 blocked by ARMR today3 Exploited1 No public exploit2 20070 20080 20090 20100 20110 20120 20130 20140 20150 20163 Protected by Waratek3 High3 blocked by ARMR today3 No public exploit3 20170 20180 20190 20200 20210 20220 20231 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
200720092011201320152017201920212023
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-49735 High 2023-11-30 Protected by Waratek No public exploit ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2016-1182 High 2016-07-04 Protected by Waratek No public exploit ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
CVE-2016-1181 High 2016-07-04 Protected by Waratek No public exploit ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
CVE-2015-0899 High 2016-07-04 Protected by Waratek No public exploit The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
CVE-2006-1548 Medium 2006-03-30 Protected by Waratek No public exploit Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
CVE-2006-1547 High 2006-03-30 Protected by Waratek Exploited ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
CVE-2006-1546 High 2006-03-30 Protected by Waratek No public exploit Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.