Known vulnerabilities in Library Support for Struts

Known vulnerabilities in Library Support for Struts

Vendor: IBM Corporation

Software: Library Support for Struts

Software CPE: cpe:2.3:a:ibm_corporation:library_support_for_struts:*:*:*:*:*:*:*:*

Website: https://www.ibm.com/us-en

Total vulnerabilities: 19

Public exploits: 6

Known exploited (KEV): 2

Breakdown by Severity Chart

Vulnerabilities (19)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU121148 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2025-68493	CWE-611	Medium	Available	No	-	12.01.2026	SB2026011214 SB2026021948 SB20260428178
#VU119841 - Resource exhaustion CVE-2025-66675	CWE-400	Medium	No	No	-	11.12.2025	SB2025120157 SB2026021868 SB2026021948
#VU118877 - Resource exhaustion CVE-2025-64775	CWE-400	Medium	No	No	-	01.12.2025	SB2025120157 SB2026012180 SB2026021948 and 4 more
#VU111165 - Improper Access Control CVE-2025-48734	CWE-284	Medium	No	No	-	16.06.2025	SB2025061643 SB2025061644 SB2025061645 and 141 more
#VU111162 - Resource exhaustion CVE-2025-48976	CWE-400	Medium	Available	No	-	16.06.2025	SB2025061634 SB2025061635 SB2025061927 and 157 more
#VU101653 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2024-53677	CWE-22	High	Available	No	2.5.37	11.12.2024	SB2024121136 SB2025012198 SB2025041017 and 2 more
#VU98025 - Resource exhaustion CVE-2024-47554	CWE-400	Medium	No	No	-	03.10.2024	SB2024100352 SB2024100421 SB2024101007 and 133 more
#VU88924 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2008-2025	CWE-79	Medium	No	No	-	23.04.2024	SB2024042318 SB2024042504 SB2026101926
#VU88923 - Security Features CVE-2006-1546	CWE-254	Medium	No	No	-	23.04.2024	SB2024042318 SB2026101926
#VU88920 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2006-1548	CWE-79	Medium	No	No	-	23.04.2024	SB2024042318 SB2026101926
#VU88919 - Resource exhaustion CVE-2006-1547	CWE-400	High	No	Exploited	-	23.04.2024	SB2024042318 SB2026101926
#VU88918 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2005-3745	CWE-79	Medium	Available	No	-	23.04.2024	SB2024042318 SB2026101926
#VU72427 - Allocation of Resources Without Limits or Throttling CVE-2023-24998	CWE-770	Medium	Available	No	-	20.02.2023	SB2023022046 SB2023022047 SB2023030917 and 203 more
#VU65653 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') CVE-2014-0114	CWE-470	Medium	Available	Exploited	-	21.07.2022	SB2022072128 SB2022090131 SB2022120629 and 16 more
#VU52252 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2021-29425	CWE-22	Low	No	No	-	15.04.2021	SB2021041510 SB2021081922 SB2021093016 and 122 more
#VU28582 - Improper input validation CVE-2016-1181	CWE-20	High	No	No	-	04.06.2020	SB20200114164 SB20200114165 SB2020071619 and 12 more
#VU20844 - Protection Mechanism Failure CVE-2019-10086	CWE-693	Low	No	No	-	04.09.2019	SB2019090405 SB2019090406 SB2019121902 and 114 more
#VU9754 - Improper input validation CVE-2015-0899	CWE-20	Low	No	No	-	26.12.2017	SB2016033101 SB2023013025 SB2024042318 and 5 more
#VU2803 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2016-1182	CWE-79	Low	No	No	-	30.11.-0001	SB2016040703 SB2023013040 SB2024042318 and 6 more