https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:37:42 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-06074 bdu:2022-06074 https://cve.radiocsirt.org/vuln/bdu:2022-06074 https://cve.radiocsirt.org/vuln/certa-2011-avi-011 certa-2011-avi-011 https://cve.radiocsirt.org/vuln/certa-2011-avi-011 https://cve.radiocsirt.org/vuln/euvd-2026-118698 EUVD-2026-118698 https://cve.radiocsirt.org/vuln/euvd-2026-118698 https://cve.radiocsirt.org/vuln/fkie_cve-2010-1870 <p>The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the &#34;#&#34; protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.</p> <p>The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the &#34;#&#34; protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2010-1870 https://cve.radiocsirt.org/vuln/ghsa-x5fc-pgpx-59j5 <p><strong>Affected:</strong> Maven: org.apache.struts:struts2-core</p> <p>OGNL provides, among other features, extensive expression evaluation capabilities. This vulnerability allows a malicious user to bypass the &#39;#&#39;-usage protection built into the ParametersInterceptor, thus being able to manipulate server side context objects. This behavior was already addressed in [S2-003](https://cwiki.apache.org/confluence/display/WW/S2-003), but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially.</p> <p><strong>Affected:</strong> Maven: org.apache.struts:struts2-core</p> <p>OGNL provides, among other features, extensive expression evaluation capabilities. This vulnerability allows a malicious user to bypass the &#39;#&#39;-usage protection built into the ParametersInterceptor, thus being able to manipulate server side context objects. This behavior was already addressed in [S2-003](https://cwiki.apache.org/confluence/display/WW/S2-003), but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially.</p> https://cve.radiocsirt.org/vuln/ghsa-x5fc-pgpx-59j5 https://cve.radiocsirt.org/vuln/gsd-2010-1870 gsd-2010-1870 https://cve.radiocsirt.org/vuln/gsd-2010-1870