CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Struts 2 Dynamic Method Invocation (DMI) Remote Code Execution (CVE-2016-3081, S2-032)
[Affected Scope] Apache Struts versions 2.3.19 through 2.3.28 with Dynamic Method Invocation (DMI) enabled.
[Impact] Remote attackers can execute arbitrary code (RCE) with server privileges via specially crafted HTTP requests, leading to full system compromise.
[Mitigation] Immediately upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 and set 'struts.enable.DynamicMethodInvocation' to 'false'.
IBM Products Apache Commons Collections Deserialization Remote Code Execution (RCE) (CVE-2015-7450)
[Affected Scope] IBM WebSphere Application Server and associated business, analytics, and mobile solutions utilizing vulnerable Apache Commons Collections library versions
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges by sending crafted serialized Java objects to exposed interfaces
[Mitigation] Apply official IBM security patches (Interim Fixes) immediately, or implement JVM-level deserialization filters to block the InvokerTransformer class
Apache Struts 2 Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2013-2251, S2-016)
[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15
[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise
[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes
Apache Struts 2 ExceptionDelegator OGNL Injection Remote Code Execution (CVE-2012-0391, S2-008)
[Affected Scope] Apache Struts versions prior to 2.2.3.1
[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.
[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.
Apache Struts 1.x Remote Denial of Service Vulnerability Analysis and Mitigation (CVE-2006-1547)
[Affected Scope] Apache Struts versions prior to 1.2.9 deployed with Commons BeanUtils 1.7
[Impact] Remote attackers can trigger a Denial of Service (DoS) state by exhausting server resources via specially crafted multipart/form-data requests
[Mitigation] Upgrade Apache Struts to version 1.2.9 or higher, or implement input validation filters to block malicious parameter names