CVE-2025-47947
Published May 21, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of servi…
Vendor archive
trustwave CVEs
Beta · best-effort18 CVEs tagged to vendor trustwave — 2 Critical, 7 High, 9 Medium, 0 Low, 0 Unrated.
CVE-2025-27110
Published Feb 25, 2025Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional…
CVE-2024-46292
Published Oct 9, 2024A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Su…
CVE-2023-24021
Published Jan 20, 2023Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall…
CVE-2022-48279
Published Jan 20, 2023In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-…
CVE-2021-42717
Published Dec 7, 2021ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to s…
CVE-2014-2727
Published Feb 19, 2020The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.
CVE-2017-18001
Published Dec 31, 2017Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain re…
CVE-2013-5705
Published Apr 15, 2014apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encodin…
CVE-2013-2765
Published Jul 15, 2013The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption)…
CVE-2013-1915
Published Apr 25, 2013ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an…
CVE-2012-4528
Published Dec 28, 2012The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart req…
CVE-2012-2751
Published Jul 22, 2012ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a reques…
CVE-2009-5031
Published Jul 22, 2012ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such…
CVE-2011-1906
Published May 5, 2011Trustwave WebDefend Enterprise before 5.0 7.01.903-1.4 stores specific user-account credentials in a MySQL database, which makes it easier for remote attackers to read the event c…
CVE-2011-0756
Published May 5, 2011The application server in Trustwave WebDefend Enterprise before 5.0 uses hardcoded console credentials, which makes it easier for remote attackers to read security-event data by u…
CVE-2009-1903
Published Jun 3, 2009The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use…
CVE-2009-1902
Published Jun 3, 2009The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header n…
Showing 1-18 of 18 CVEsPage 1 of 1