exploit the possibilities
Showing 1 - 25 of 72 RSS Feed

Files

Apache Struts 2.5.12 XStream Remote Code Execution
Posted Sep 7, 2017
Authored by Warflop

Apache Struts versions 2.5 through 2.5.12 REST plugin XStream remote code execution exploit.

tags | exploit, remote, code execution
advisories | CVE-2017-9805
MD5 | ed713b2c9934090617c90e450993d42d

Related Files

Apache Struts 2 Namespace Redirect OGNL Injection
Posted Sep 7, 2018
Authored by wvu, Man Yue Mo, hook-s3c, asoto-r7 | Site metasploit.com

This Metasploit module exploits a remote code execution vulnerability in Apache Struts versions 2.3 through 2.3.4, and 2.5 through 2.5.16. Remote code execution can be performed via an endpoint that makes use of a redirect action. Native payloads will be converted to executables and dropped in the server's temp dir. If this fails, try a cmd/* payload, which won't have to write to the disk.

tags | exploit, remote, code execution
advisories | CVE-2018-11776
MD5 | a4e7f0e82c562b624ecf195e89e4fb88
Apache Struts 2.3 / 2.5 Remote Code Execution
Posted Aug 26, 2018
Authored by Mazin Ahmed

Apache versions 2.3 up to 2.3.34 and 2.5 up to 2.5.16 remote code execution exploit.

tags | exploit, remote, code execution
advisories | CVE-2018-11776
MD5 | d8cb5003787ffe5dff6acbd417ce2c59
Apache Struts 2.3 / 2.5 Remote Code Execution
Posted Aug 25, 2018
Authored by hook-s3c

Apache versions 2.3 up to 2.3.34 and 2.5 up to 2.5.16 remote code execution exploit.

tags | exploit, remote, code execution
advisories | CVE-2018-11776
MD5 | 986b43115c7195f3cd675987f7e99e5e
Apache Struts 2.x Remote Code Execution
Posted Aug 23, 2018
Authored by Man Yue Mo

Man Yue Mo from the Semmle Security Research team noticed that Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution vulnerabilities.

tags | advisory, remote, vulnerability, code execution
advisories | CVE-2018-11776
MD5 | 13ed154c6fefe1b2ae0599b839ed689d
Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution
Posted May 16, 2018
Authored by Nixawk, icez, xfer0 | Site metasploit.com

This Metasploit module exploits a remote code execution vulnerability in the Struts Showcase app in the Struts 1 plugin example in Struts 2.3.x series. Remote code execution can be performed via a malicious field value.

tags | exploit, remote, code execution
advisories | CVE-2017-9791
MD5 | 354fce33983d17e45d41971c85b42100
Apache Struts 2 REST Plugin XStream Remote Code Execution
Posted Sep 7, 2017
Authored by wvu, Man Yue Mo | Site metasploit.com

Apache Struts versions 2.5 through 2.5.12 using the REST plugin are vulnerable to a Java deserialization attack in the XStream library.

tags | exploit, java
advisories | CVE-2017-9805
MD5 | 6a456689db4d683f7253fa4ce925f95c
Apache Struts 2.3.x Showcase Remote Code Execution
Posted Jul 14, 2017
Authored by Vex Woo

Apache Struts 2.3.x Showcase remote code execution proof of concept exploit.

tags | exploit, remote, code execution, proof of concept
advisories | CVE-2017-9791
MD5 | b127e7bfe5e4cb4867bb2f3d6c8b1d64
HPE Security Bulletin HPESBGN03733 1
Posted Apr 7, 2017
Authored by Hewlett Packard Enterprise | Site hpe.com

HPE Security Bulletin HPESBGN03733 1 - A potential security vulnerability in Jakarta Multipart parser in Apache Struts has been addressed in HPE Universal CMDB. This vulnerability could be remotely exploited to allow code execution via mishandled file upload. Revision 1 of this advisory.

tags | advisory, code execution, file upload
advisories | CVE-2017-5638
MD5 | 77f2af54b71a701cb9a39d3cbac64dbd
Apache Struts Jakarta Multipart Parser OGNL Injection
Posted Mar 14, 2017
Authored by egypt, Nixawk, Nike.Zheng, Jeffrey Martin, Chorder | Site metasploit.com

This Metasploit module exploits a remote code execution vulnerability in Apache Struts version 2.3.5 - 2.3.31, and 2.5 - 2.5.10. Remote Code Execution can be performed via http Content-Type header. Native payloads will be converted to executables and dropped in the server's temp dir. If this fails, try a cmd/* payload, which won't have to write to the disk.

tags | exploit, remote, web, code execution
advisories | CVE-2017-5638
MD5 | 8637e8ffc6de9189c657a3e087a50331
Apache Struts 2 2.3.x / 2.5.x Remote Code Execution
Posted Mar 10, 2017
Authored by anarc0der

Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 remote code execution exploit that provides a reverse shell.

tags | exploit, remote, shell, code execution
advisories | CVE-2017-5638
MD5 | 1fe1221359b528e0a3f8439c385ef6e1
Struts2 S2-045 Remote Command Execution
Posted Mar 7, 2017
Authored by dsaw dash

Struts S2-045 remote command execution proof of concept exploit.

tags | exploit, remote, proof of concept
MD5 | de49204b909920bd9a5ae5c2b8b75d1e
Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution
Posted Jun 9, 2016
Authored by Nixawk | Site metasploit.com

This Metasploit module exploits a remote command execution vulnerability in Apache Struts version between 2.3.20 and 2.3.28 (except 2.3.20.2 and 2.3.24.2). Remote Code Execution can be performed when using REST Plugin with ! operator when Dynamic Method Invocation is enabled.

tags | exploit, remote, code execution
advisories | CVE-2016-3087
MD5 | a500c7d4893ccc30f624a84876393fb9
Apache Struts 2.3.28 Dynamic Method Invocation Remote Code Execution
Posted Apr 30, 2016
Authored by Nixawk | Site metasploit.com

This Metasploit module exploits a remote command execution vulnerability in Apache Struts version between 2.3.20 and 2.3.28 (except 2.3.20.2 and 2.3.24.2). Remote Code Execution can be performed via method: prefix when Dynamic Method Invocation is enabled.

tags | exploit, remote, code execution
advisories | CVE-2016-3081
MD5 | bb77e1c207231c0a1ce3a4a82373b2c0
Debian Security Advisory 3536-1
Posted Mar 31, 2016
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3536-1 - It was discovered that libstruts1.2-java, a Java framework for MVC applications, contains a bug in its multi-page validation code. This allows input validation to be bypassed, even if MPV is not used directly.

tags | advisory, java
systems | linux, debian
advisories | CVE-2015-0899
MD5 | e1ae343a7d28ca21618e50508f60f7ac
Apache Struts 2.3.20 Security Fixes
Posted Dec 8, 2014
Authored by Lukasz Lenart | Site struts.apache.org

Apache has released Struts version 2.3.20 which merges various security fixes and extends an existing security mechanism to block access to given Java packages and Classes.

tags | advisory, java
MD5 | 731c184c594e7079c4d5e8d8e95cd386
HP Security Bulletin HPSBST03160
Posted Oct 28, 2014
Authored by HP | Site hp.com

HP Security Bulletin HPSBST03160 - A potential security vulnerability has been identified with HP XP Command View Advanced Edition running Apache Struts. Revision 1 of this advisory.

tags | advisory
advisories | CVE-2014-0114
MD5 | 9b395dbdfb2853bc1226c83291fe27ca
Debian Security Advisory 2940-1
Posted Aug 21, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2940-1 - It was discovered that missing access checks in the Struts ActionForm object could result in the execution of arbitrary code.

tags | advisory, arbitrary
systems | linux, debian
advisories | CVE-2014-0114
MD5 | 39cdf20b0014b76773979dfc0b02fa5e
Cisco Security Advisory 20140709-struts2
Posted Jul 9, 2014
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - Multiple Cisco products include an implementation of the Apache Struts 2 component that is affected by a remote command execution vulnerability identified by Apache with Common Vulnerabilities and Exposures ID CVE-2010-1870. The vulnerability is due to insufficient sanitization on user-supplied input in the XWorks component of the affected software. The component uses the ParameterInterceptors directive to parse the Object-Graph Navigation Language (OGNL) expressions that are implemented via a whitelist feature. An attacker could exploit this vulnerability by sending crafted requests that contain OGNL expressions to an affected system. An exploit could allow the attacker to execute arbitrary code on the targeted system. Cisco has released free software updates that address this vulnerability for all the affected products except Cisco Business Edition 3000 Series. Customers using Cisco Business Edition 3000 Series should contact their Cisco representative for available options.

tags | advisory, remote, arbitrary, vulnerability
systems | cisco
advisories | CVE-2010-1870
MD5 | f99f63988930581031d2a4c54c4246de
VMware Security Advisory 2014-0007
Posted Jun 25, 2014
Authored by VMware | Site vmware.com

VMware Security Advisory 2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library.

tags | advisory, vulnerability
advisories | CVE-2014-0050, CVE-2014-0094, CVE-2014-0112
MD5 | 3595a99c468e3b216b6df603faaa858e
HP Security Bulletin HPSBGN03041
Posted May 27, 2014
Authored by HP | Site hp.com

HP Security Bulletin HPSBGN03041 - A potential security vulnerability has been identified with HP IceWall Configuration Manager running Apache Struts. The vulnerability could be exploited remotely resulting in execution of arbitrary code. Revision 1 of this advisory.

tags | advisory, arbitrary
advisories | CVE-2014-0114
MD5 | fb4150bd6e2c01119b9f0f2ebe49e6a0
Mandriva Linux Security Advisory 2014-095
Posted May 19, 2014
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-095 - It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions.

tags | advisory, remote, code execution
systems | linux, mandriva
advisories | CVE-2014-0114
MD5 | 4205d082436cdc97e0ada92408be1dfb
Red Hat Security Advisory 2014-0511-01
Posted May 15, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0511-01 - Red Hat JBoss Operations Network is a middleware management solution that provides a single point of control to deploy, manage, and monitor JBoss Enterprise Middleware, applications, and services. Apache Struts is a framework for building web applications with Java. It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions.

tags | advisory, java, remote, web, code execution
systems | linux, redhat
advisories | CVE-2013-4286, CVE-2014-0114
MD5 | 0d3db40019777908c611112e3561a69a
Red Hat Security Advisory 2014-0500-01
Posted May 14, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0500-01 - Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. Apache Struts is a framework for building web applications with Java. It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions.

tags | advisory, java, remote, web, code execution
systems | linux, redhat
advisories | CVE-2014-0114
MD5 | 046d6be5d5ced0953d815ee6eefa443e
Red Hat Security Advisory 2014-0498-01
Posted May 14, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0498-01 - Fuse ESB Enterprise is an integration platform based on Apache ServiceMix. It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions.

tags | advisory, remote, code execution
systems | linux, redhat
advisories | CVE-2014-0114
MD5 | 88dc2f3e41de030610a87c412e2602c9
Red Hat Security Advisory 2014-0497-01
Posted May 14, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0497-01 - Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions.

tags | advisory, remote, code execution
systems | linux, redhat
advisories | CVE-2014-0114
MD5 | ab022dff15de3cf47d3c6e94c3aaa24b
Page 1 of 3
Back123Next

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    0 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close