195 matches found
CVE-2019-11390
CVE-2019-11390 affects OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0. The issue resides in /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf where crafted input using set_error_handler# at the beginning and nested repetition operators can cause a denial of service (ReDOS). The Red Hat/SU...
CVE-2019-11389
An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with next at the beginning and nested repetition operators. NOTE: the...
CVE-2019-11388
An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes...
CVE-2019-11388
Affected product: OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0. Vulnerable component: /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf, where a specially crafted string with nested repetition operators can cause a denial of service (ReDOS). Underlying cause: nested repetition operators...
CVE-2019-11388
An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes...
CVE-2019-11387
An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with nested repetition operators...
CVE-2019-11387
An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with nested repetition operators...
PT-2019-12276 · Owasp +1 · Owasp Modsecurity Core Rule Set +1
Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions through 3.1.0 Description: An issue was discovered that allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with set error handler at the beginning and...
PT-2019-12275 · Owasp +1 · Owasp Modsecurity Core Rule Set +1
Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions through 3.1.0 Description: An issue was discovered that allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with next at the beginning and nested...
PT-2019-12277 · Owasp +1 · Owasp Modsecurity Core Rule Set +1
Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions through 3.1.0 Description: An issue was discovered that allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with $a at the beginning and nested...
PT-2019-12274 · Owasp +1 · Owasp Modsecurity Core Rule Set +1
Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions through 3.1.0 Description: An issue was discovered in OWASP ModSecurity Core Rule Set CRS that allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with...
CRS - OWASP ModSecurity Core Rule Set
The OWASP ModSecurity Core Rule Set CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. The Core Rule Se...
UBUNTU-CVE-2018-16384
A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...
DEBIAN-CVE-2018-16384
A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...
CVE-2018-16384
CVE-2018-16384 describes a SQL injection bypass in the OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) via a crafted payload {ab}, where a is a function name (e.g., if) and b is the SQL to execute. Public details reference CRS versions up to 3.1.0-rc3, with later advisories noting related...
PT-2018-13536 · Owasp · Owasp Modsecurity Core Rule Set
Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set versions prior to 3.1.0-rc4 Description: A SQL injection bypass issue exists, allowing attackers to bypass security controls. This is achieved by using a special syntax ab, where a is a special function name,...
CVE-2018-16384
A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...
CVE-2018-16384
A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...
Apache Struts Vulnerability CVE-2018-11776
On Wednesday, August 22nd, the Apache team patched another vulnerability in the Apache Struts2 framework. Apache Struts is an open-source web application framework for developing Java web applications. The vulnerability exists when these conditions are met: 1. The alwaysSelectFullNamespace flag...