2.3.20

DATE	CVE	VULNERABILITY TITLE	RISK
2016-04-12	CVE-2016-4003	Cross-site Scripting vulnerability in Apache Struts Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter. network apache CWE-79	4.3
2016-04-12	CVE-2016-2162	Cross-site Scripting vulnerability in Apache Struts Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display. network apache CWE-79	4.3
2016-04-12	CVE-2016-0785	Improper Input Validation vulnerability in Apache Struts Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. network low complexity apache CWE-20 critical	9.0
2015-07-16	CVE-2015-1831	Security Bypass vulnerability in Apache Struts 2.3.20 The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. network low complexity apache	7.5