OM
Product
Owasp Modsecurity Core Rule Set
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 4Medium 1Low 0
Watch
Add Owasp Modsecurity Core Rule Set to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-39956 | 9.8 | Sep 20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via… Affected: 3.0.0 before 3.2.2; 3.3.0 before 3.3.3 |
| CVE-2022-39955 | 9.8 | Sep 20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple… Affected: 3.0.0 before 3.2.2; 3.3.0 before 3.3.3 |
| CVE-2020-22669 | 9.8 | Sep 2 | Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability Affected: 3.2.0 |
| CVE-2021-35368 | 9.8 | Nov 5 | OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname Affected: 3.1.0 before 3.1.2; 3.2.0 before 3.2.1; 3.3.0 before 3.3.2 |
| CVE-2026-33691 | 7.5 | Apr 2 | OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks Affected: before 3.3.9; 4.0.0 before 4.25.0 |
| CVE-2022-39958 | 7.5 | Sep 20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP… Affected: 3.0.0 before 3.2.2; 3.3.0 before 3.3.3 |
| CVE-2022-39957 | 7.5 | Sep 20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass Affected: 3.0.0 before 3.2.2; 3.3.0 before 3.3.3 |
| CVE-2018-16384 | 7.5 | Sep 3 | A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as… Affected: through 3.0.2; 3.1.0; 3.1.0 |
| CVE-2026-21876 | 5.3 | Jan 8 | OWASP CRS has multipart bypass using multiple content-type parts Affected: before 3.3.8; 4.0.0 before 4.22.0 |
Showing 9