WaratekVRT Sign in
Reset
More filters (1)
Columns
Product: Struts✕
Overview 4 matches · 0 exploited · 0 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
4matches 0exploited0.0% 0CISA KEV0.0% 3public PoC75.0% 2EPSS ≥ 0.550.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 4 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 50.0% Proof of concept only 1 25.0% Forecast only 0 0.0% No public exploit 1 25.0%
split by peak 1 / year
Protected by Waratek: 4 Medium: 4 blocked by ARMR today: 4 No public exploit: 1Proof of concept only: 1Working exploit published: 2
20051 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20061 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20070 20080 20091 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20100 20110 20120 20130 20140 20150 20160 20170 20180 20190 20201 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1
20062008201020122014201620182020
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-26259 Medium 2020-12-16 Protected by Waratek Proof of concept only XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
CVE-2008-6505 Medium 2009-03-23 Protected by Waratek Working exploit published Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
CVE-2006-1548 Medium 2006-03-30 Protected by Waratek No public exploit Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
CVE-2005-3745 Medium 2005-11-22 Protected by Waratek Working exploit published Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.