Owasp vulnerabilitiesNone on the known-exploited list.
Owasp has 30 published vulnerabilities across 17 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Owasp Modsecurity Core Rule Set, with 8. If you run Owasp software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Owasp products have the most vulnerabilities?
Owasp Modsecurity Core Rule Set leads with 8 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Owasp vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Owasp's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Owasp flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 3.1%CVE-2007-4385Medium
OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests.
- 3.0%CVE-2021-42575Critical
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
- 2.8%CVE-2022-23457High
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library.
- 2.7%CVE-2021-35368Critical
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.
- 2.4%
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext,...
- 2.1%CVE-2021-23900High
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input.
- 2.1%CVE-2021-23899Critical
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input.
- 1.7%CVE-2022-24891Medium
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library.
- 1.7%CVE-2018-12036High
OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
- 1.7%CVE-2018-16384High
A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to...
All Owasp products we track.
16 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Owasp Modsecurity Core Rule Setowasp_modsecurity_core_rule_set8 vulnerabilities16 versions
- Enterprise Security APIenterprise_security_api4 vulnerabilities11 versions
- JSON-Sanitizerjson-sanitizer3 vulnerabilities5 versions
- Dependency-Checkdependency-check2 vulnerabilities87 versions
- Dependency-Trackdependency-track2 vulnerabilities41 versions
- Corerulesetcoreruleset1 vulnerability21 versions
- Csrfguardcsrfguard1 vulnerability9 versions
- Defectdojodefectdojo1 vulnerability271 versions
- Dependency-Track Frontenddependency-track_frontend1 vulnerability11 versions
- Enterprise Security API for Javaenterprise_security_api_for_java1 vulnerability1 version
- Java Html Sanitizerjava_html_sanitizer1 vulnerability2 versions
- Modsecuritymodsecurity1 vulnerability73 versions
- Nodegoatnodegoat1 vulnerability1 version
- Webscarabwebscarab1 vulnerability1 version
- Zed Attack Proxyzed_attack_proxy1 vulnerability339 versions
- Factionfaction0 vulnerabilities99 versions
This directory lists the 16 Owasp products with at least one tracked version, of 17 in our catalogue.
Running Owasp? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests. NOTE: this might be used to expose vulnerabilities in applications that would otherwise be protected by the validation routines.
- Matched to
- Stinger on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 30 published vulnerabilities across 17 products and 988 versions from Owasp.
None of Owasp's vulnerabilities is on the list of flaws known to be exploited today.
Owasp Modsecurity Core Rule Set, with 8 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Owasp products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.