Owasp vulnerabilities
50 vulnerabilities
Known vulnerabilities in Owasp products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 20 products.
Products
20- Modsecurity15 vulnerabilities
- Owasp Modsecurity Core Rule Set9 vulnerabilities
- Enterprise Security Api4 vulnerabilities
- Modsecurity Core Rule Set4 vulnerabilities
- Defectdojo3 vulnerabilities
- Json Sanitizer3 vulnerabilities
- Dependency Check2 vulnerabilities
- Dependency Track2 vulnerabilities
- Java Html Sanitizer2 vulnerabilities
- Coreruleset1 vulnerabilities
- Csrfguard1 vulnerabilities
- Dependency Track Frontend1 vulnerabilities
- Enterprise Security Api For Java1 vulnerabilities
- Faction1 vulnerabilities
- Java Html Sanitizer1 vulnerabilities
- Nodegoat1 vulnerabilities
- Owasp Blt1 vulnerabilities
- Stinger1 vulnerabilities
- Webscarab1 vulnerabilities
- Zed Attack Proxy1 vulnerabilities
CVE-2018-16384debianmodsecurity-crs+2
EPSS score1.67%
A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.CVE-2018-13065owaspmodsecurityEPSS score1.35%
ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configuredCVE-2018-12036org.owaspdependency-check-maven+1EPSS score1.68%
OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.CVE-2013-5679mageiaowasp-esapi-java+2EPSS score2.43%
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.CVE-2013-5960org.owasp.esapiesapi+1EPSS score1.65%
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.CVE-2021-42717debianmodsecurity+10EPSS score3.25%
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.CVE-2021-42575com.googlecode.owasp-java-html-sanitizerowasp-java-html-sanitizer+3EPSS score2.97%
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.CVE-2021-4247owaspnodegoatEPSS score1.07%
A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the patch is 4a4d1db74c63fb4ff8d366551c3af006c25ead12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216184.CVE-2021-28490org.owaspcsrfguard+1EPSS score0.50%
In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.CVE-2021-35368debianmodsecurity-crs+4EPSS score2.73%
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.CVE-2021-23900com.mikesamueljson-sanitizer+1EPSS score2.13%
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.CVE-2021-23899com.mikesamueljson-sanitizer+1EPSS score2.09%
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.CVE-2007-4385owaspstingerEPSS score3.08%
OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests. NOTE: this might be used to expose vulnerabilities in applications that would otherwise be protected by the validation routines.CVE-2025-54571debianmodsecurity-apache+8EPSS score0.31%
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11
and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.CVE-2025-48866debianmodsecurity-apache+8EPSS score0.83%
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.CVE-2025-66021chainguardkeycloak-26.2+10EPSS score0.25%
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.CVE-2025-66022factionsecurityfaction+1EPSS score0.68%
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1.CVE-2020-13973com.mikesamueljson-sanitizer+1EPSS score1.11%
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.CVE-2020-22669debianmodsecurity-crs+3EPSS score1.32%
Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.CVE-2020-15598debianmodsecurity+3EPSS score2.92%
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit