Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2700▼ 69 respecto a la semana anterior
Críticas / altas1449▲ 307 respecto a la semana anterior
Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)64▼ 462 respecto a la semana anterior
5 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (6.1) | 1.7% | — | Owasp Enterprise Security APIOracle Weblogic ServerNetapp Active IQ Unified ManagerNetapp Oncommand Workflow Automation | 27/4/2022 | 17/6/2026 | ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can… | |
| Modificada | Crítica (9.8) | 2.8% | — | Owasp Enterprise Security APIOracle Weblogic ServerNetapp Active IQ Unified ManagerNetapp Oncommand Workflow Automation | 25/4/2022 | 17/6/2026 | ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent… | |
| Modificada | Media (5.9) | 0.45% | — | Owasp Enterprise Security API FOR Java | 22/6/2021 | 16/6/2026 | It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks. | |
| Modificada | Media (5.8) | 1.7% | — | Owasp Enterprise Security API | 30/9/2013 | 16/6/2026 | The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via… | |
| Modificada | Baja (2.6) | 2.4% | — | Owasp Enterprise Security API | 30/9/2013 | 16/6/2026 | The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an… |