ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs

ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity

Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class…

In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request

Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or…

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx

ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element

ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture

ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header