diff --git a/ql/src/Security/CWE-022/TaintedPath.qhelp b/ql/src/Security/CWE-022/TaintedPath.qhelp
index 71af3e45c62..061ffbe3471 100644
--- a/ql/src/Security/CWE-022/TaintedPath.qhelp
+++ b/ql/src/Security/CWE-022/TaintedPath.qhelp
@@ -46,6 +46,6 @@ information.
 </example>
 
 <references>
-<li>OWASP: <a href="https://www.owasp.org/index.php/Path_traversal">Path Traversal</a>.</li>
+<li>OWASP: <a href="https://owasp.org/www-community/attacks/Path_Traversal">Path Traversal</a>.</li>
 </references>
 </qhelp>
diff --git a/ql/src/Security/CWE-022/ZipSlip.qhelp b/ql/src/Security/CWE-022/ZipSlip.qhelp
index dac4dc8a44b..1322dc18c13 100644
--- a/ql/src/Security/CWE-022/ZipSlip.qhelp
+++ b/ql/src/Security/CWE-022/ZipSlip.qhelp
@@ -63,7 +63,7 @@ Snyk:
 </li>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Path_traversal">Path Traversal</a>.
+<a href="https://owasp.org/www-community/attacks/Path_Traversal">Path Traversal</a>.
 </li>
 </references>
 </qhelp>
diff --git a/ql/src/Security/CWE-643/XPathInjection.qhelp b/ql/src/Security/CWE-643/XPathInjection.qhelp
index 4c1d376202e..15fdfd7bb3d 100644
--- a/ql/src/Security/CWE-643/XPathInjection.qhelp
+++ b/ql/src/Security/CWE-643/XPathInjection.qhelp
@@ -38,7 +38,7 @@ which are safely resolved at runtime using the <code>goxpath.Opts</code> structu
 </example>
 
 <references>
-<li>OWASP: <a href="https://www.owasp.org/index.php?title=Testing_for_XPath_Injection_(OTG-INPVAL-010)">Testing for XPath Injection</a>.</li>
+<li>OWASP: <a href="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/09-Testing_for_XPath_Injection">Testing for XPath Injection</a>.</li>
 <li>OWASP: <a href="https://www.owasp.org/index.php/XPATH_Injection">XPath Injection</a>.</li>
 </references>
 </qhelp>