WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2014-12-31✕Vendor org.apache.struts.xwork✕
Overview 5 matches · 0 protected · 1 exploited · 0 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
5matches 0protected0.0% 1exploited20.0% 0CISA KEV0.0% 3public PoC60.0% 3EPSS ≥ 0.560.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 60.0% No exploit published 2 40.0%
Critical 0 0.0% High 5 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 20.0% Working exploit published 2 40.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 40.0%
split by peak 4 / month
No exploit published: 2Mitigation candidate: 3 High: 5 not blocked: 5 No public exploit: 2Working exploit published: 2Exploited: 1
Mar 121 No exploit published1 High1 not blocked1 No public exploit1 Apr 120 May 120 Jun 120 Jul 120 Aug 120 Sep 120 Oct 120 Nov 120 Dec 120 Jan 130 Feb 130 Mar 130 Apr 130 May 130 Jun 130 Jul 134 Mitigation candidate3 No exploit published1 High4 not blocked4 Exploited1 Working exploit published2 No public exploit1
Mar 12May 12Jul 12Sep 12Nov 12Jan 13Mar 13May 13Jul 13
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2013-2135 High 2013-07-16 No exploit published No public exploit Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
CVE-2013-2134 High 2013-07-16 Mitigation candidate Exploited Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
CVE-2013-2115 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
CVE-2013-1966 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
CVE-2012-0838 High 2012-03-02 No exploit published No public exploit Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.