Skip to content
OpenAdvisories

Package · Maven

org.owasp.esapi:esapi

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium —
    GHSA-r68h-jhhj-9jvm

    Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year

    ### Impact The `Validator.isValidSafeHTML` method can result in false negatives where it reports some input as safe (i.e., returns true), but really isn't, and using that same input as-is can in certain circumstances result in XSS vulnerabilities. Because thi…

    org.owasp.esapi:esapi Maven
  • Medium 5.4
    CVE-2022-24891 Public exploit

    Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

    ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteUR…

    ESAPI esapi-java-legacy org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  • Medium 5.9
    CVE-2010-3300

    Padding oracle attacks

    It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.

    org.owasp.esapi:esapi Maven
  • Medium —
    CVE-2013-5960

    Missing Cryptographic Step in OWASP Enterprise Security API for Java

    The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers …

    org.owasp.esapi:esapi Maven