Apache : Security Vulnerabilities, CVEs, Published In July 2017 (Code Execution)
CVE-2017-9791
Known exploited
Public exploit
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Max CVSS
9.8
EPSS Score
97.45%
Published
2017-07-10
Updated
2020-05-28
CISA KEV Added
2022-02-10
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.
Max CVSS
9.1
EPSS Score
2.11%
Published
2017-07-17
Updated
2019-05-06
2 vulnerabilities found