- Struts2, Java web framework, is vulnerable to remote commands execution due to a vulnerability in XWork's ParametersInterceptor, which is enabled by default in Struts2 and WebWork applications. The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 220.127.116.11, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables.
- Upgrade to Struts version 2.2.
- WordPress Plugin Shortcodes Ultimate Remote Code Execution (5.0.0)
- Drupal Core 8.5.x Remote Code Execution (8.5.0 - 8.5.10)
- WordPress Plugin Peter's Math Anti-Spam Audio CAPTCHA Security Bypass (0.1.6)
- WordPress Plugin Jetpack by WordPress.com Multiple Vulnerabilities (4.0.3)
- WordPress Plugin Essential Content Types Security Bypass (1.4)