Trustwave Modsecurity
14 CVEs affecting Trustwave Modsecurity. Latest disclosed: 2025-05-21. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47947 | High | 7.5 | 2025-05-21 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerabl… |
CVE-2025-27110 | High | 7.5 | 2025-02-25 | Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and… |
CVE-2024-46292 | High | 7.5 | 2024-10-09 | A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this i… |
CVE-2023-24021 | High | 7.5 | 2023-01-20 | Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web A… |
CVE-2022-48279 | High | 7.5 | 2023-01-20 | In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is… |
CVE-2021-42717 | High | 7.5 | 2021-12-07 | ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web serv… |
CVE-2013-5705 | | 2014-04-15 | apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in… | |
CVE-2013-2765 | | 2013-07-15 | The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, a… | |
CVE-2013-1915 | | 2013-04-25 | ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory… | |
CVE-2012-4528 | | 2012-12-28 | The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application… | |
CVE-2012-2751 | | 2012-07-22 | ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Dispositi… | |
CVE-2009-5031 | | 2012-07-22 | ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perfor… | |
CVE-2009-1903 | | 2009-06-03 | The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF fi… | |
CVE-2009-1902 | | 2009-06-03 | The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a m… |