WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2012-06-01✕Vendor org.apache.struts.xwork✕
Overview 4 matches · 0 protected · 2 exploited · 0 CISA KEV
4matches 0protected0.0% 2exploited50.0% 0CISA KEV0.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 4 100.0% No exploit published 0 0.0%
Critical 0 0.0% High 3 75.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 50.0% Working exploit published 2 50.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / month
Mitigation candidate: 4 Medium: 1High: 3 not blocked: 4 Working exploit published: 2Exploited: 2
Jul 133 Mitigation candidate3 High3 not blocked3 Exploited1 Working exploit published2 Aug 130 Sep 130 Oct 130 Nov 130 Dec 130 Jan 140 Feb 140 Mar 141 Mitigation candidate1 Medium1 not blocked1 Exploited1
Jul 13Aug 13Sep 13Oct 13Nov 13Dec 13Jan 14Feb 14Mar 14
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2014-0094 Medium 2014-03-11 Mitigation candidate Exploited The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
CVE-2013-2134 High 2013-07-16 Mitigation candidate Exploited Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
CVE-2013-2115 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
CVE-2013-1966 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.