Known vulnerabilities in Apache Struts - page 2

Software: Apache Struts
Software CPE: cpe:2.3:a:apache_foundation:struts:*:*:*:*:*:apache_tomcat:*:*
Total vulnerabilities: 43
Public exploits: 18
Known exploited (KEV): 8
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Struts Apache Struts is affected by 43 known vulnerabilities: 2 critical, 17 high, 18 medium, 6 low Critical High Medium Low

Vulnerabilities (43)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU68588 - Permissions, Privileges, and Access Controls
CVE-2014-0112
CWE-264 High
Available
No
2.3.16.2 22.10.2022 SB2014042909
SB2023022233
SB20240417121
and 2 more
#VU46152 - Command injection
CVE-2016-3081
CWE-77 High
No
No
2.3.20.3, 2.3.24.3, 2.3.28.1 01.09.2020 SB2016042605
SB2024053143
SB2024053144
#VU46150 - Improper input validation
CVE-2016-4465
CWE-20 Medium
No
No
2.3.29, 2.5.13 01.09.2020 SB2016070508
#VU46149 - Improper input validation
CVE-2016-8738
CWE-20 Medium
No
No
2.5.13 01.09.2020 SB2017092025
#VU28582 - Improper input validation
CVE-2016-1181
CWE-20 High
No
No
2.0.0 04.06.2020 SB20200114164
SB20200114165
SB2020071619
and 11 more
#VU14487 - Improper input validation
CVE-2018-11776
CWE-20 High
Available
Exploited
2.3.35, 2.5.17 22.08.2018 SB2018082203
SB2020071640
SB2023022240
and 2 more
#VU12312 - Deserialization of Untrusted Data
CVE-2016-1000031
CWE-502 High
No
No
2.3.36 01.05.2018 SB2017111432
SB2018110601
SB2019051512
and 39 more
#VU11296 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2018-1327
CWE-611 Low
No
No
- 28.03.2018 SB2018032805
#VU9519 - Improper input validation
CVE-2017-15707
CWE-20 Medium
No
No
- 01.12.2017 SB2017120205
#VU9128 - Deserialization of Untrusted Data
CVE-2017-7525
CWE-502 High
Available
No
- 08.11.2017 SB2017110807
SB2017102005
SB2017120205
and 40 more
#VU8213 - Improper input validation
CVE-2017-12611
CWE-20 Medium
Available
No
- 11.09.2017 SB2017090806
SB20240417121
SB2024053144
#VU8114 - Improper input validation
CVE-2017-9804
CWE-20 Low
No
No
- 06.09.2017 SB2017082505
SB2017090801
#VU8112 - Improper input validation
CVE-2017-9793
CWE-20 Low
No
No
- 06.09.2017 SB2017090721
SB2017090801
#VU8111 - Deserialization of Untrusted Data
CVE-2017-9805
CWE-502 High
Available
Exploited
- 06.09.2017 SB2017090720
SB2017090801
#VU7893 - Improper input validation
CVE-2017-7672
CWE-20 Low
No
No
- 09.08.2017 SB2017080902
SB2024072154
#VU7391 - Improper input validation
CVE-2017-9791
CWE-20 High
Available
Exploited
- 10.07.2017 SB2017070704
#VU5930 - Improper Control of Generation of Code ('Code Injection')
CVE-2017-5638
CWE-94 Critical
Available
Exploited
- 09.03.2017 SB2017030610
SB2017040603
SB2023022303
and 2 more
#VU5234 - Permissions, Privileges, and Access Controls
CVE-2014-0094
CWE-264 Critical
Available
No
2.3.16.2 23.01.2017 SB2014030201
SB2023022233
SB2023071327
and 2 more
#VU1027 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2016-6795
CWE-22 High
No
No
- 18.10.2016 SB2017092010
#VU2803 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-1182
CWE-79 Low
No
No
1.3.10 30.11.-0001 SB2016040703
SB2023013040
SB2024042318
and 5 more


Showing elements 21 - 40 out of 43