modsecurity: lacking the complete content in FILES_TMP_CONTENT leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when FILESTMPCONTENT lacks complete content, which can lead to a Web Application Firewall bypass...

mod_security: incorrect parsing of HTTP multipart requests leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when HTTP multipart requests are incorrectly parsed and could bypass the Web Application Firewall. NOTE: This is related to CVE-2022-39956, but can be considered independent changes to the ModSecurity C language codebase...

modsecurity: lacking the complete content in FILES_TMP_CONTENT leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when FILESTMPCONTENT lacks complete content, which can lead to a Web Application Firewall bypass...

mod_security: incorrect parsing of HTTP multipart requests leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when HTTP multipart requests are incorrectly parsed and could bypass the Web Application Firewall. NOTE: This is related to CVE-2022-39956, but can be considered independent changes to the ModSecurity C language codebase...

Type Confusion

modsecurity-crs is vulnerable to Type Confusion. coreruleset does not block multiple Content-Type headers, which allows an attacker to bypass a WAF with a crafted payload, which occurs when the web application relies on only the last Content-Type headers...

CVE-2023-38285

A vulnerability was found in Trustwave's ModSecurity project due to an inefficient algorithmic complexity flaw. This issue is present in four transformation actions: removeWhitespace, removeNull, replaceNull, and removeCommentsChar. By sending a maliciously crafted HTTP request, an attacker could...

SUSE CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

DEBIAN-CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

CVE-2023-38285 vulnerabilities

Vulnerabilities for packages: modsecurity...

CVE-2023-38285 vulnerabilities

Vulnerabilities for packages: modsecurity...

Code injection

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

UBUNTU-CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

ModSecurity security vulnerabilities

ModSecurity is an intrusion detection and blocking engine that can be run as a module of the Apache Web Server or as a standalone application to enhance the security of Web applications and protect them from known and unknown attacks. A security vulnerability exists in Trustwave ModSecurity versi...

CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

CVE-2023-38285: Inefficient Algorithmic Complexity

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

PT-2023-26345

Name of the Vulnerable Software and Affected Versions Trustwave ModSecurity versions 3.0.0 through 3.0.9 Description The issue is related to Inefficient Algorithmic Complexity. Recommendations For Trustwave ModSecurity versions 3.0.0 through 3.0.9, update to version 3.0.10 or later to resolve the...

CVE-2023-38285

CVE-2023-38285 affects Trustwave ModSecurity 3.x prior to 3.0.10. The root cause is Inefficient Algorithmic Complexity in certain input handling, leading to potential denial of service with network-based exploitation. The CVSS indicates network attack vector, low attack complexity, and high avail...