Filtered by vendor Owasp
Subscribe
Search
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-35368 | 3 Debian, Fedoraproject, Owasp | 3 Debian Linux, Fedora, Owasp Modsecurity Core Rule Set | 2023-08-08 | 7.5 HIGH | 9.8 CRITICAL |
| OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname. | |||||
| CVE-2022-23457 | 1 Owasp | 1 Enterprise Security Api | 2022-07-25 | 7.5 HIGH | 9.8 CRITICAL |
| ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this. | |||||
| CVE-2021-42575 | 2 Oracle, Owasp | 2 Primavera Unifier, Java Html Sanitizer | 2022-07-25 | 7.5 HIGH | 9.8 CRITICAL |
| The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements. | |||||
| CVE-2021-23899 | 1 Owasp | 1 Json-sanitizer | 2021-01-19 | 7.5 HIGH | 9.8 CRITICAL |
| OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents. | |||||