CVEs published July 4, 2016
12 CVEs were published on July 4, 2016: 0 critical, 1 high.
- Published
- 12
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- org.apache.struts:struts-core · struts:struts
- 3
- org.apache.struts.xwork:xwork-core
- 2
- commons-fileupload:commons-fileupload
- 1
- org.apache.struts:struts-parent
- 1
- org.apache.struts:struts2-core
- 1
- org.apache.struts:struts2-core · org.apache.struts:struts2-…
- 1
High 1
Medium, low and unrated 11
- CVE-2015-0899The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions vorg.apache.struts:struts-core · struts:struts
- CVE-2016-1181ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attaorg.apache.struts:struts-core · struts:struts
- CVE-2016-1182ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackeorg.apache.struts:struts-core · struts:struts
- CVE-2016-4430Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSorg.apache.struts.xwork:xwork-core
- CVE-2016-4431Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leorg.apache.struts:struts-parent
- CVE-2016-4433Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via aorg.apache.struts.xwork:xwork-core
- CVE-2016-4438The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.org.apache.struts:struts2-core · org.apache.struts:struts2-…
- CVE-2016-4465The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of servicorg.apache.struts:struts2-core
- CVE-2016-0899EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential i
- CVE-2016-5848Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate p
- CVE-2016-5849Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage.