https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:04:50.582824+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-04337 bdu:2022-04337 2026-10-03T11:04:50.688756+00:00 bdu:2022-04337 https://cve.radiocsirt.org/vuln/certfr-2022-avi-659 certfr-2022-avi-659 — De multiples vulnérabilités ont été découvertes dans Oracle WebLogic. Certaines d'entre elles permettent à un attaquant… 2026-10-03T11:04:50.688797+00:00 certfr-2022-avi-659 https://cve.radiocsirt.org/vuln/euvd-2026-257661 EUVD-2026-257661 2026-10-03T11:04:50.688827+00:00 EUVD-2026-257661 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23457 fkie_cve-2022-23457 2026-10-03T11:04:50.688846+00:00

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.

 https://cve.radiocsirt.org/vuln/ghsa-8m5h-hrqm-pxm2 GHSA-8m5h-hrqm-pxm2 — Path traversal in the OWASP Enterprise Security API 2026-10-03T11:04:50.688896+00:00

Affected: Maven: org.owasp.esapi:esapi

### Impact The default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path.

### Patches This vulnerability is patched in release 2.3.0.0 of ESAPI. See https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.3.0.0 for details.

### Workarounds Yes; in theory, one _could_ write the own implementation of the Validator interface. This would most easily be done by sub-classing a version of the affected `DefaultValidator` class and then overriding the affected `getValidDirectoryPath()` to correct the issue. However, this is not recommended.

### For more information If you have any questions or comments about this advisory: * Email one of the project co-leaders. See email addresses listed on the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders". * Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.

 https://cve.radiocsirt.org/vuln/gsd-2022-23457 gsd-2022-23457 2026-10-03T11:04:50.688963+00:00 gsd-2022-23457 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-23457 UBUNTU-CVE-2022-23457 2026-10-03T11:04:50.688981+00:00

Affected: Ubuntu:Pro:16.04:LTS: libowasp-esapi-java, Ubuntu:Pro:18.04:LTS: libowasp-esapi-java, Ubuntu:Pro:20.04:LTS: libowasp-esapi-java, Ubuntu:Pro:22.04:LTS: libowasp-esapi-java

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0131 WID-SEC-W-2023-0131 — Oracle Health Sciences Applications: Mehrere Schwachstellen 2026-10-03T11:04:50.689034+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Health Sciences Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.