CVE-2019-11390

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with seterrorhandler at the beginning and nested repetition operators. NOT...

CVE-2019-11387

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with nested repetition operators...

CVE-2019-11391

The CVE-2019-11391 entry concerns OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0. The vulnerability is tied to /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf, where a specially crafted string beginning with $a# and containing nested repetition operators could cause a denial of service ...

CVE-2019-11390

CVE-2019-11390 affects OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0. The issue resides in /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf where crafted input using set_error_handler# at the beginning and nested repetition operators can cause a denial of service (ReDOS). The Red Hat/SU...

CVE-2019-11390

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with seterrorhandler at the beginning and nested repetition operators. NOT...

CVE-2019-11389

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with next at the beginning and nested repetition operators. NOTE: the...

CVE-2019-11389

CVE-2019-11389 affects the OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0. The issue is in /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf, where a specially crafted string starting with next# and containing nested repetition operators can cause a denial of service (ReDoS) via the regul...

CVE-2019-11388

Affected product: OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0. Vulnerable component: /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf, where a specially crafted string with nested repetition operators can cause a denial of service (ReDOS). Underlying cause: nested repetition operators...

CVE-2019-11388

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes...

CVE-2019-11387

The CVE-2019-11387 entry describes a ReDOS vulnerability in OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0. Specifically, the rule file /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf can be triggered to cause a denial of service by feeding a specially crafted string with nested repeti...

FTW - Framework For Testing WAFs

This project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP requests that will trigger these rules...

crs-usa.com XSS vulnerability

Open Bug Bounty ID: OBB-716863 Description| Value ---|--- Affected Website:| crs-usa.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

CRS - OWASP ModSecurity Core Rule Set

The OWASP ModSecurity Core Rule Set CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. The Core Rule Se...

crs-usa.com XSS vulnerability

Open Bug Bounty ID: OBB-700316 Description| Value ---|--- Affected Website:| crs-usa.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

Command injection

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell...

CVE-2015-2210

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell...

CVE-2015-2210

Epicor CRS Retail Store contains a local code execution flaw in the Help window (v3.2.03.01.008). By injecting JavaScript into the Help window source, an attacker can create a button that spawns a command shell, via an ActiveX payload, allowing a local user to run arbitrary commands. Affected com...

CVE-2015-2210

The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell...

Cisco Carrier Routing System Denial of Service Vulnerability

The Cisco Carrier Routing System CRS is a carrier-grade routing system from Cisco. A denial of service vulnerability exists in Cisco CRS versions 5.1 and 5.1.4 on CRS Carrier Grade Services for CRS-1 and CRS-3 devices. A remote attacker could exploit this vulnerability by sending specially crafte...

CVE-2016-6401

Cisco Carrier Routing System CRS 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers to cause a denial of service line-card reload via crafted IPv6-over-MPLS packets, aka Bug ID CSCva32494...