WaratekVRT Sign in
Reset
More filters (3)
Columns
Published from 2016-01-01✕Published to 2016-12-31✕Vendor org.apache.struts✕
Overview 14 matches · 4 protected · 1 exploited · 1 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
14matches 4protected28.6% 1exploited7.1% 1CISA KEV7.1% 2public PoC14.3% 2EPSS ≥ 0.514.3%
Protected by Waratek 4 28.6% Rule in development 0 0.0% Mitigation candidate 1 7.1% No exploit published 9 64.3%
Critical 4 28.6% High 6 42.9% Medium 4 28.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 28.6% partly blocked 0 0.0% not blocked 10 71.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 7.1% Working exploit published 1 7.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 12 85.7%
split by peak 6 / month
No exploit published: 9Mitigation candidate: 1Protected by Waratek: 4 Medium: 4High: 6Critical: 4 not blocked: 10blocked by ARMR today: 4 No public exploit: 12Working exploit published: 1Exploited: 1
Apr 165 Protected by Waratek1 No exploit published4 Critical1 High2 Medium2 blocked by ARMR today1 not blocked4 Exploited1 No public exploit4 May 160 Jun 162 Mitigation candidate1 No exploit published1 Critical1 Medium1 not blocked2 Working exploit published1 No public exploit1 Jul 166 Protected by Waratek3 No exploit published3 Critical1 High4 Medium1 blocked by ARMR today3 not blocked3 No public exploit6 Aug 160 Sep 160 Oct 161 No exploit published1 Critical1 not blocked1 No public exploit1
Apr 16May 16Jun 16Jul 16Aug 16Sep 16Oct 16
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2016-4436 Critical 2016-10-03 No exploit published No public exploit Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
CVE-2016-4465 Medium 2016-07-04 No exploit published No public exploit The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
CVE-2016-4438 Critical 2016-07-04 No exploit published No public exploit The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
CVE-2016-4431 High 2016-07-04 No exploit published No public exploit Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
CVE-2016-1182 High 2016-07-04 Protected by Waratek No public exploit ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
CVE-2016-1181 High 2016-07-04 Protected by Waratek No public exploit ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
CVE-2015-0899 High 2016-07-04 Protected by Waratek No public exploit The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
CVE-2016-3093 Medium 2016-06-07 No exploit published No public exploit Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
CVE-2016-3087 Critical 2016-06-07 Mitigation candidate Working exploit published Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
CVE-2016-3082 Critical 2016-04-26 No exploit published No public exploit XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
CVE-2016-3081 High 2016-04-26 Protected by Waratek Exploited Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2016-4003 Medium 2016-04-12 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.
CVE-2016-2162 Medium 2016-04-12 No exploit published No public exploit Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.
CVE-2016-0785 High 2016-04-12 No exploit published No public exploit Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.