Posted by Daniel Owens via Fulldisclosure on Nov 04 The Apache Struts2 Tiles plugin version =6.3.0) codebase includes a `ViewPreparer` construct, replete with multiple ViewPreparer factories, that contains several important vulnerabilities including unsynchronised, unbounded caches.
Apache Struts2 Tiles Plugin =6.3.0 Preparer Cache Vulnerabilities
About this summary. This is a short excerpt from the description that Full Disclosure published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/fulldisclosure/2026/Nov/11
Source attribution: headline and facts are from Full Disclosure (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Private Vulnerability Testing for User Oversharing
arXiv:2611.05779v1 Announce Type: new Abstract: Users can inadvertently increase their vulnerability to privacy attacks by oversharing personal information. In…
SenTrojan: Revealing Analog Hardware Trojan Attacks on Sensors
arXiv:2611.06103v1 Announce Type: new Abstract: Sensors bridge the physical and digital worlds, making their integrity critical to cyber-physical system security…
Analysis of Local Open-Weight LLM Agents on Vulnerability-Reproduction Tasks
arXiv:2611.06257v1 Announce Type: new Abstract: Open-weight language models that fit on a single consumer GPU are becoming capable on a growing range of tasks, and they…
Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
arXiv:2611.06477v1 Announce Type: new Abstract: Early assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce…
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal…
Hackers stole DreamHost customer files and inboxes during months-long attack
The web host said hackers exploited a vulnerability to access customer emails and files during a "deliberate attack."