Owasp

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-19886 2Fedoraproject Owasp 2Fedora Modsecurity Jun 17, 2026 Jan 21, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw i...Show more Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.Show less
CVE-2019-1020007 1Owasp 1Dependency Track Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dependency-Track before 3.5.1 allows XSS.
CVE-2018-16384 1Owasp 1Owasp Modsecurity Core Rule Set Nov 21, 2024 Sep 3, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be e...Show more A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.Show less
CVE-2018-13065 1Owasp 1Modsecurity Jul 3, 2025 Jul 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured
CVE-2018-12036 1Owasp 1Dependency Check Nov 21, 2024 Jun 7, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
CVE-2013-5960 1Owasp 1Enterprise Security Api Apr 29, 2026 Sep 30, 2013 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, whic...Show more The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.Show less
CVE-2013-5679 1Owasp 1Enterprise Security Api Apr 29, 2026 Sep 30, 2013 N/A· v4 N/A· v3 2.6 LOW· v2 The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which...Show more The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.Show less
CVE-2007-4385 1Owasp 1Stinger Apr 23, 2026 Aug 17, 2007 N/A· v4 N/A· v3 6.8 MEDIUM· v2 OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests. NOTE: this might be used to expose vulnerabilities in applica...Show more OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests. NOTE: this might be used to expose vulnerabilities in applications that would otherwise be protected by the validation routines.Show less
CVE-2006-3841 1Owasp 1Webscarab Apr 16, 2026 Jul 25, 2006 N/A· v4 N/A· v3 2.6 LOW· v2 Cross-site scripting (XSS) vulnerability in WebScarab before 20060718-1904, when used with Microsoft Internet Explorer 6 SP2 or Konqueror 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the URL,...Show more Cross-site scripting (XSS) vulnerability in WebScarab before 20060718-1904, when used with Microsoft Internet Explorer 6 SP2 or Konqueror 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the URL, which is not sanitized before being returned in an error message when WebScarab is not able to access the URL.Show less

Previous 1 23