modsecurity vulnerabilities (Debian)
20 vulnerabilities.
-
modsecurityDebian [GHSA-5m93-4h75-3p2w: @rxGlobal PCRE2 error handling: match-limit fail-open and invalid-pattern crash] No score -
modsecurityDebian [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules] No score -
modsecurityDebian [GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment terminator, bypassing rules] No score -
modsecurityDebian [GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS] No score -
modsecurityDebian [GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical Content-Type casing] No score -
modsecurityDebian [GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer] No score -
modsecurityDebian [GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion] No score -
modsecurityDebian ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass 8.6 High -
modsecurityDebian ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture 5.8 Medium -
modsecurityDebian ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators 8.2 High -
modsecurityDebian libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings 8.2 High -
modsecurityDebian Libmodsecurity3 has possible bypass of encoded HTML entities 7.9 High -
modsecurityDebian WAF bypass of the ModSecurity v3 release line 8.6 High -
modsecurityDebian Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. 7.5 High -
modsecurityDebian Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash... 7.5 High -
modsecurityDebian In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed... 7.5 High -
modsecurityDebian ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects... 7.5 High -
modsecurityDebian ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string... 5.3 Medium -
modsecurityDebian ** DISPUTED ** Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special... 7.5 High -
modsecurityDebian Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may,... 7.5 High