Skip to content
OpenAdvisories

Archive

January 2012

Vulnerabilities first published in this month (UTC), newest first.

← December 2011 2012 / January February 2012 →
  1. 1 
  2. 24
  3. 37
  4. 410
  5. 53
  6. 611
  7. 73
  8. 818
  9. 9 
  10. 1014
  11. 11 
  12. 123
  13. 1314
  14. 147
  15. 157
  16. 16 
  17. 172
  18. 1880
  19. 1916
  20. 2014
  21. 21 
  22. 22 
  23. 231
  24. 2423
  25. 2523
  26. 264
  27. 2720
  28. 285
  29. 2920
  30. 305
  31. 31 
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium —
    CVE-2012-0394 Public exploit EPSS 73%

    Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itsel…

    org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0392 Public exploit EPSS 98%

    Apache Struts's CookieInterceptor component does not use the parameter-name whitelist

    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0393 Public exploit EPSS 36%

    Apache Struts's ParameterInterceptor component does not prevent access to public constructors

    The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2011-4858 Public exploit EPSS 80%

    Improper Input Validation in Apache Tomcat

    Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption)…

    org.apache.tomcat:tomcat Maven