https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:17:31 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-06000 bdu:2022-06000 https://cve.radiocsirt.org/vuln/bdu:2022-06000 https://cve.radiocsirt.org/vuln/certa-2013-avi-596 certa-2013-avi-596 https://cve.radiocsirt.org/vuln/certa-2013-avi-596 https://cve.radiocsirt.org/vuln/euvd-2026-107338 EUVD-2026-107338 https://cve.radiocsirt.org/vuln/euvd-2026-107338 https://cve.radiocsirt.org/vuln/fkie_cve-2013-4310 <p>Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.</p> <p>Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2013-4310 https://cve.radiocsirt.org/vuln/ghsa-q5q8-jghf-3pm3 <p><strong>Affected:</strong> Maven: org.apache.struts:struts2-core</p> <p>The Struts 2 action mapping mechanism supports the special parameter prefix action: which is intended to help with attaching navigational information to buttons within forms, under certain conditions this can be used to bypass security constraints.</p> <p>In Struts 2.3.15.3 the action mapping mechanism was changed to avoid circumventing security constraints. Two additional constants were introduced to steer behaviour of DefaultActionMapper:</p> <p>- struts.mapper.action.prefix.enabled - when set to false support for &#34;action:&#34; prefix is disabled, set to false by default - struts.mapper.action.prefix.crossNamespaces - when set to false, actions defined with &#34;action:&#34; prefix must be in the same namespace as current action</p> <p><strong>Affected:</strong> Maven: org.apache.struts:struts2-core</p> <p>The Struts 2 action mapping mechanism supports the special parameter prefix action: which is intended to help with attaching navigational information to buttons within forms, under certain conditions this can be used to bypass security constraints.</p> <p>In Struts 2.3.15.3 the action mapping mechanism was changed to avoid circumventing security constraints. Two additional constants were introduced to steer behaviour of DefaultActionMapper:</p> <p>- struts.mapper.action.prefix.enabled - when set to false support for &#34;action:&#34; prefix is disabled, set to false by default - struts.mapper.action.prefix.crossNamespaces - when set to false, actions defined with &#34;action:&#34; prefix must be in the same namespace as current action</p> https://cve.radiocsirt.org/vuln/ghsa-q5q8-jghf-3pm3 https://cve.radiocsirt.org/vuln/gsd-2013-4310 gsd-2013-4310 https://cve.radiocsirt.org/vuln/gsd-2013-4310