https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:03:08 +0000 https://cve.radiocsirt.org/vuln/cve-2022-23457 <p><strong>Affected:</strong> OWASP ESAPI org.owasp.esapi:esapi</p> <p>ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the &#39;input&#39; path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one&#39;s own implementation of the Validator interface. However, maintainers do not recommend this.</p> <p><strong>Affected:</strong> OWASP ESAPI org.owasp.esapi:esapi</p> <p>ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the &#39;input&#39; path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one&#39;s own implementation of the Validator interface. However, maintainers do not recommend this.</p> https://cve.radiocsirt.org/vuln/cve-2022-23457