CVE-2015-2992

Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.

• CWE-79

• http://jvn.jp/en/jp/JVN88408929/index.htmlThird Party Advisory, VDB Entry
• http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000124.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/76624Third Party Advisory, VDB Entry
• https://security.netapp.com/advisory/ntap-20200330-0001/Third Party Advisory
• http://jvn.jp/en/jp/JVN88408929/index.htmlThird Party Advisory, VDB Entry
• http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000124.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/76624Third Party Advisory, VDB Entry
• https://security.netapp.com/advisory/ntap-20200330-0001/Third Party Advisory

Published

Feb 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2986Cross-site scripting (XSS) vulnerability in rakuto.net hitSu…
• CVE-2015-2987Type74 ED before 4.0 misuses 128-bit ECB encryption for smal…
• CVE-2015-2988Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify…
• CVE-2015-2989Cross-site scripting (XSS) vulnerability in index.php in LEM…
• CVE-2015-2990Directory traversal vulnerability in zhtml.cgi in NEOJAPAN d…
• CVE-2015-2991Buffer overflow in NScripter before 3.00 allows remote attac…
• CVE-2015-2993SysAid Help Desk before 15.2 does not properly restrict acce…
• CVE-2015-2994Unrestricted file upload vulnerability in ChangePhoto.jsp in…
• CVE-2015-2995The RdsLogsEntry servlet in SysAid Help Desk before 15.2 doe…
• CVE-2015-2996Multiple directory traversal vulnerabilities in SysAid Help …
• CVE-2015-2997SysAid Help Desk before 15.2 allows remote attackers to obta…
• CVE-2015-2998SysAid Help Desk before 15.2 uses a hardcoded encryption key…