gotestwaf

GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...

CVE-2026-61813

OWASP ModSecurity sets libcurl CURLOPTSSLVERIFYHOST to 1 instead of 2 when downloading remote content SecRemoteRules and similar; v3 HttpsClient::download, v2 mscremotedownloadcontent, weakening TLS hostname verification. Affects v2 2.9.0-rc1 through 2.9.14 fixed 2.9.15 and v3 3.0.0-rc1 through...

WS-2026-0087

In OWASP ModSecurity, t:base64DecodeExt discards the entire decoded value while reporting success when the input contains a malformed single-character X== padding group anywhere in the string, letting attackers bypass rules that match on the decoded content. The advisory lists 2.9.15 and 3.0.17 a...

WS-2026-0088

In OWASP ModSecurity, the t:removeComments transformation fails to strip a second comment that directly follows the first and reads one byte past the buffer, letting SQLi/XSS payloads hidden in adjacent comments bypass rules. Affects v2 2.6.2-rc1 through 2.9.14 fixed 2.9.15 and v3 3.0.0-rc1 throu...

CVE-2026-61812

The t:htmlEntityDecode transformation in OWASP ModSecurity decodes only five named HTML entities and in v3 matches entity-name prefixes, e.g. decodes to , so payloads using other entities such as evade rules. Affects v2 2.1.0-rc7 through 2.9.14 fixed 2.9.15 and v3 3.0.0-rc1 through 3.0.16 fixed...

owasp-modsecurity-crs-4.29.0-1.1 on GA media (moderate)

owasp-modsecurity-crs-4.29.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11632-1 Rating: moderate Cross-References: CVE-2026-33691 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

CVE-2019-11388

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes...

CVE-2019-11390

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with seterrorhandler at the beginning and nested repetition operators. NOT...

EUVD-2019-3065

Malware in sbrugna...

EUVD-2021-22011

Malware in sbrugna...

EUVD-2019-4935

Malware in sbrugna...

EUVD-2018-8230

Malware in sbrugna...

EUVD-2022-42402

Malicious code in bioql PyPI...

EUVD-2022-42399

Malicious code in bioql PyPI...

CVE-2023-38199

coreruleset aka OWASP ModSecurity Core Rule Set through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the...

CVE-2019-11391

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with $a at the beginning and nested repetition operators. NOTE: the softwa...

CVE-2019-13464

An issue was discovered in OWASP ModSecurity Core Rule Set CRS 3.0.2. Use of X.Filename instead of XFilename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid...

Linux Distros Unpatched Vulnerability : CVE-2022-39958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly...

Linux Distros Unpatched Vulnerability : CVE-2023-38199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - coreruleset aka OWASP ModSecurity Core Rule Set through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attacker...

owasp-modsecurity-crs-4.10.0-1.1 on GA media (moderate)

owasp-modsecurity-crs-4.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14717-1 Rating: moderate Cross-References: CVE-2023-5003 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...