WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Vendor opensymphony✕
Overview 5 matches · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
5matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 3public PoC60.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 60.0% No exploit published 2 40.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 1 20.0% High 0 0.0% Medium 3 60.0% Low 1 20.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 60.0% Proof of concept only 1 20.0% Forecast only 0 0.0% No public exploit 1 20.0%
split by peak 2 / year
No exploit published: 2Mitigation candidate: 3 Low: 1Medium: 3Critical: 1 not blocked: 5 No public exploit: 1Proof of concept only: 1Working exploit published: 3
20071 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20080 20091 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20100 20112 Mitigation candidate1 No exploit published1 Medium1 Low1 not blocked2 Working exploit published1 No public exploit1 20120 20130 20140 20150 20160 20170 20180 20190 20200 20210 20220 20231 No exploit published1 Critical1 not blocked1 Proof of concept only1
200720092011201320152017201920212023
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-39022 Critical 2023-07-28 No exploit published Proof of concept only oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument.
CVE-2011-2088 Medium 2011-05-13 No exploit published No public exploit XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
CVE-2011-1772 Low 2011-05-13 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
CVE-2008-6504 Medium 2009-03-23 Mitigation candidate Working exploit published ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
CVE-2007-4556 Medium 2007-08-28 Mitigation candidate Working exploit published Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.