Marian Ventuneac

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions prior to 2.2.3 OpenSymphony WebWork (affected versions not specified) **Description** The issue allows remote attackers to inject arbitrary web script or HTML via various vectors, including an action name, the action attribute of an s:submit element, or the method attribute of an s:submit element. This is possible due to the lack of escaping for action names in automatically generated error pages in XWork. When Dynamic Method Invocation (DMI) is enabled, the action name can be generated dynamically based on request parameters, allowing for a successful attack by calling non-existing pages and methods to produce error pages with injected code. **Recommendations** For Apache Struts versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. For OpenSymphony WebWork, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions 2.2.1 OpenSymphony WebWork version 2.2.1 **Description** The issue allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an `s:submit` element and a nonexistent method. **Recommendations** For Apache Struts version 2.2.1, update to a version that fixes this issue. For OpenSymphony WebWork version 2.2.1, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the `s:submit` element to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Barracuda Spam Firewall versions prior to 3.5.12.007 **Description** The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via a `pattern x` parameter in a `search count equals` action. For example, the `pattern 0` parameter can be used to demonstrate this issue. **Recommendations** For versions prior to 3.5.12.007, update to version 3.5.12.007 or later to resolve the issue. As a temporary workaround, consider restricting access to the `index.cgi` page in the Account View section to minimize the risk of exploitation. Avoid using the `pattern x` parameter in the affected API endpoint until the issue is resolved.