Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Opensymphony Component: Xwork Clear all filters
TI-2011-01813 CVE-2011-2088 · GHSA-9ccm-g362-2r35

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork…

Priority LOW 32

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit el…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0614 Published 2011-05-13 Partial fix · 2.2.2 CWE-200
TI-2011-01551 CVE-2011-1772 · GHSA-56f8-g68r-j699

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before…

Priority LOW 38

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors in…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.33346 Published 2011-05-13 Partial fix · 2.2.3 CWE-79
TI-2008-06194 CVE-2008-6504 · GHSA-wxw2-2mx5-c5qf

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as…

Priority MEDIUM 50

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows re…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.38579 Published 2009-03-23 Fixed in 2.0.6, 2.1.2 CWE-20
TI-2007-04411 CVE-2007-4556 · GHSA-h7mf-qrm9-2848

Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in…

Priority MEDIUM 52

Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is en…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.25749 Published 2007-08-28 Fixed in 1.2.3, 2.0.4 CWE-20