CVE-2016-1182
High · 8.2CVSS
8.2
EPSS
25.7%
Published
Jul 4, 2016
CISA due date
—
The record
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.struts:struts-core | 0 | No fix |
| Maven | struts:struts | 0 | No fix |
| Mageia:5 | struts | 0 | 1.3.10-8.2.mga5 |
Related vulnerabilities
- CVE-2016-1181 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access… Also affects org.apache.struts:struts-core
- CVE-2015-0899 The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote… Also affects org.apache.struts:struts-core
- CVE-2012-1007 Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote… Also affects org.apache.struts:struts-core
- CVE-2005-3745 Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other… Also affects org.apache.struts:struts-core
- CVE-2006-1547 ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7… Also affects struts:struts
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20