https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html [No Types Assigned]

https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E [No Types Assigned]

https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E [No Types Assigned]

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html [No Types Assigned]

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html [No Types Assigned]

http://www.securityfocus.com/archive/1/534161/100/0/threaded [No Types Assigned]

http://www.securityfocus.com/archive/1/archive/1/534161/100/0/threaded [No Types Assigned]

https://access.redhat.com/errata/RHSA-2018:2669 [No Types Assigned]

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html [No Types Assigned]

https://security.netapp.com/advisory/ntap-20180629-0006/ [No Types Assigned]

http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.html [No Types Assigned]

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html [No Types Assigned]

https://security.netapp.com/advisory/ntap-20140911-0001/ [No Types Assigned]

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html [No Types Assigned]

http://advisories.mageia.org/MGASA-2014-0219.html [No Types Assigned]

http://secunia.com/advisories/57477 [No Types Assigned]

http://secunia.com/advisories/58710 [No Types Assigned]

http://secunia.com/advisories/58947 [No Types Assigned]

http://secunia.com/advisories/59118 [No Types Assigned]

http://secunia.com/advisories/59228 [No Types Assigned]

http://secunia.com/advisories/59245 [No Types Assigned]

http://secunia.com/advisories/59246 [No Types Assigned]

http://secunia.com/advisories/59430 [No Types Assigned]

http://secunia.com/advisories/59464 [No Types Assigned]

http://secunia.com/advisories/59479 [No Types Assigned]

http://secunia.com/advisories/59480 [No Types Assigned]

http://secunia.com/advisories/59718 [No Types Assigned]

http://www.ibm.com/support/docview.wss?uid=swg21675496 [No Types Assigned]

http://www.mandriva.com/security/advisories?name=MDVSA-2014:095 [No Types Assigned]

http://www.vmware.com/security/advisories/VMSA-2014-0008.html [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21674128 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21674812 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21675266 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21675387 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21675689 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21675898 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21675972 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21676110 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg21677110 [No Types Assigned]

http://www-01.ibm.com/support/docview.wss?uid=swg27042296 [No Types Assigned]

http://www.securityfocus.com/bid/67121 [No Types Assigned]

https://security.gentoo.org/glsa/201607-09 [No Types Assigned]

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://marc.info/?l=bugtraq&m=140119284401582&w=2

http://marc.info/?l=bugtraq&m=140801096002766&w=2

http://seclists.org/fulldisclosure/2015/Apr/5

http://www.securityfocus.com/archive/1/archive/1/535181/100/0/threaded

http://packetstormsecurity.com/files/131271/VMware-Security-Advisory-2015-0003.html

Apache Commons BeanUtils, según se distribuye en lib/commons-beanutils-1.8.0.jar en Apache Struts 1.x hasta la versión 1.3.10 y en otros productos que requieren commons-beanutils hasta la versión 1.9.2, no suprime la propiedad class, lo que permite a atacantes remotos "manipular" el ClassLoader y ejecutar código arbitrario a través del parámetro class, según lo demostrado por el paso de este parámetro al método getClass del objeto ActionForm en Struts 1.

El objeto ActionForm en Apache Struts 1.x hasta 1.3.10 permite a atacantes remotos "manipular" ClassLoader y ejecutar código arbitrario a través del parámetro class, que se pasa posteriormente al método getClass.

Configuration 1
     OR
          *cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.3.10:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.6:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:

Configuration 1
     OR
          *cpe:2.3:a:apache:commons_beanutils:1.9.1:*:*:*:*:*:*:* (and previous)
Configuration 2
     OR
          *cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.3.10:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*
          *cpe:2.3:a:apache:struts:1.2.6

http://www-01.ibm.com/support/docview.wss?uid=swg21676091

http://packetstormsecurity.com/files/131271/VMware-Security-Advisory-2015-0003.html

http://seclists.org/fulldisclosure/2015/Apr/5

http://www.securityfocus.com/archive/1/archive/1/535181/100/0/threaded

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

http://seclists.org/fulldisclosure/2014/Dec/23

http://www.securityfocus.com/archive/1/archive/1/534161/100/0/threaded

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

http://marc.info/?l=bugtraq&m=141451023707502&w=2

http://www.debian.org/security/2014/dsa-2940