Owasp Enterprise Security Api vulnerabilities
4 known vulnerabilities affecting owasp/enterprise_security_api.
Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1MEDIUM2LOW1
Vulnerabilities
Page 1 of 1
CVE-2022-24891MEDIUMCVSS 6.1fixed in 2.3.0.02022-04-27
CVE-2022-24891 [MEDIUM] CWE-79 CVE-2022-24891: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control l
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail
nvd
CVE-2022-23457CRITICALCVSS 9.8fixed in 2.3.0.02022-04-25
CVE-2022-23457 [CRITICAL] CWE-22 CVE-2022-23457: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control l
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow
nvd
CVE-2013-5960MEDIUMCVSS 5.8≥ 2.0, < 2.1.0.12013-09-30
CVE-2013-5960 [MEDIUM] CVE-2013-5960: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterpr
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode
nvd
CVE-2013-5679LOWCVSS 2.6v2.0v2.0.12013-09-30
CVE-2013-5679 [LOW] CWE-310 CVE-2013-5679: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterpr
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the de
nvd