PT-2024-1513 · Unknown +2 · Libmodsecurity +3

Name of the Vulnerable Software and Affected Versions: ModSecurity / libModSecurity versions 3.0.0 through 3.0.11 Description: The issue is related to a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in...

ModSecurity Security Vulnerabilities

ModSecurity is an intrusion detection and blocking engine that can be run as a module of the Apache Web Server or as a standalone application to enhance the security of Web applications and protect them from known and unknown attacks. A security vulnerability exists in ModSecurity libModSecurity...

The vulnerability of the WAF engine for Apache ModSecurity, related to security configuration errors, allows attackers to bypass existing network firewall rules.

The vulnerability of the WAF engine for Apache ModSecurity is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass existing network firewall rules...

openSUSE 15 Security Update : modsecurity (openSUSE-SU-2023:0269-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0269-1 advisory. - DISPUTED Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports Trustwave has...

openSUSE 15 Security Update : modsecurity (openSUSE-SU-2023:0257-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0257-1 advisory. - DISPUTED Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports Trustwave has...

Security update for modsecurity (moderate)

openSUSE Security Update: Security update for modsecurity Announcement ID: openSUSE-SU-2023:0269-1 Rating: moderate References: 1210993 1213702 Cross-References: CVE-2020-15598 CVE-2021-42717 CVE-2023-28882 CVE-2023-38285 CVSS scores: CVE-2020-15598 NVD : 7.5...

OPENSUSE-SU-2023:0269-1 Security update for modsecurity

This update for modsecurity fixes the following issues: Update to version 3.0.10: Security impacting issue fix boo1213702, CVE-2023-38285 - Fix: worst-case time in implementation of four transformations - Additional information on this issue is available at...

OPENSUSE-SU-2023:0257-1 Security update for modsecurity

This update for modsecurity fixes the following issues: Update to version 3.0.10: Security impacting issue fix boo1213702, CVE-2023-38285 - Fix: worst-case time in implementation of four transformations - Additional information on this issue is available at...

WAF Bypass

Modsecurity is vulnerable to WAF bypass attack. This issue is due to HTTP multipart requests being incorrectly parsed. The attacker could obtain unauthorized resource by exploiting this vulnerability...

Ubuntu: Security Advisory (USN-6370-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6370-1: ModSecurity vulnerabilities

It was discovered that ModSecurity incorrectly handled certain nested JSON objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2021-42717 It was discovered that ModSecurity incorrect...

USN-6370-1 modsecurity-apache vulnerabilities

It was discovered that ModSecurity incorrectly handled certain nested JSON objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2021-42717 It was discovered that ModSecurity incorrect...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM : ModSecurity vulnerabilities (USN-6370-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6370-1 advisory. It was discovered that ModSecurity incorrectly handled certain nested JSON objects. An attacker could possibly use th...

CVE-2023-40586

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an...

Design/Logic Flaw

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an...

CVE-2023-40586 go package github.com/corazawaf/coraza is vulnerable to denial of service

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an...

CVE-2023-40586 go package github.com/corazawaf/coraza is vulnerable to denial of service

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an...

CVE-2023-40586 go package github.com/corazawaf/coraza is vulnerable to denial of service

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an...

CVE-2023-40586

CVE-2023-40586 affects OWASP Coraza WAF (Go) where misuse of log.Fatalf in the multipart body processing leads to immediate crash when a crafted request triggers an error in mime.ParseMediaType. Patch is available in version 3.0.1; remediation is to upgrade to 3.0.1+ (or apply fix). The Red Hat/V...

modsecurity: lacking the complete content in FILES_TMP_CONTENT leads to web application firewall bypass

A vulnerability was found in ModSecurity. This issue occurs when FILESTMPCONTENT lacks complete content, which can lead to a Web Application Firewall bypass...