Cybersecurity information flow

S2-066 - File upload logic is flawed, and allows an attacker to enable paths with traversals

S2-065 - Excessive disk usage during file upload

S2-063 - DoS via OOM owing to not properly checking of list bounds.

S2-064 - DoS via OOM owing to no sanity limit on normal form fields in multipart forms.

S2-062 - Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to remote code execution - same as S2-061.

S2-061 - Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution - similar to S2-059.

S2-001 - Remote code exploit on form validation error

S2-002 - Cross site scripting (XSS) vulnerability on <s:url> and <s:a> tags

S2-003 - XWork ParameterInterceptors bypass allows OGNL statement execution

S2-004 - Directory traversal vulnerability while serving static content

S2-005 - XWork ParameterInterceptors bypass allows remote command execution

S2-006 - Multiple Cross-Site Scripting (XSS) in XWork generated error pages

S2-007 - User input is evaluated as an OGNL expression when there's a conversion error

S2-008 - Multiple critical vulnerabilities in Struts2

S2-009 - ParameterInterceptor vulnerability allows remote command execution

S2-010 - When using Struts 2 token mechanism for CSRF protection, token check may be bypassed by misusing known session attributes

S2-011 - Long request parameter names might significantly promote the effectiveness of DOS attacks

S2-012 - Showcase app vulnerability allows remote command execution

S2-013 - A vulnerability, present in the includeParams attribute of the URL and Anchor Tag, allows remote command execution

S2-014 - A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks

S2-015 - A vulnerability introduced by wildcard matching mechanism or double evaluation of OGNL Expression allows remote command execution.

S2-016 - A vulnerability introduced by manipulating parameters prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command execution

S2-017 - A vulnerability introduced by manipulating parameters prefixed with "redirect:"/"redirectAction:" allows for open redirects

S2-018 - Broken Access Control Vulnerability in Apache Struts2

S2-019 - Dynamic Method Invocation disabled by default

S2-020 - Upgrade Commons FileUpload to version 1.3.1 (avoids DoS attacks) and adds 'class' to exclude params in ParametersInterceptor (avoid ClassLoader manipulation)

S2-021 - Improves excluded params in ParametersInterceptor and CookieInterceptor to avoid ClassLoader manipulation

S2-022 - Extends excluded params in CookieInterceptor to avoid manipulation of Struts' internals

S2-023 - Generated value of token can be predictable

S2-024 - Wrong excludeParams overrides those defined in DefaultExcludedPatternsChecker