3 results · Feed
-
High 7.3
ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element
A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initia…
-
Medium 5.4
Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteUR…
-
High 7.5
Path Traversal in ESAPI
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the test…