SpiderLabs/owasp-modsecurity-crs

False detection?
#682 opened Feb 1, 2017 by SM91337
Include known Tor Exit node IPs in IP reputation filter v3.1.0-rc1 Candidate Issue
#681 opened Jan 26, 2017 by dune73

2
Improve WordPress wp_http_referer exclusions
#680 opened Jan 25, 2017 by lifeforms CRS v3.0.1

2
Naughty strings Published Research
#676 opened Jan 16, 2017 by lifeforms

1
FP on 941120 (XSS Filter - Category 2: Event Handler Vector) False Positive
#675 opened Jan 3, 2017 by jhaar CRS v3.0.1

2
Command Injection without spaces False Negative - Evasion v3.1.0-rc1 Candidate Issue
#673 opened Dec 14, 2016 by dune73

2
Javascript evasions False Negative - Evasion Published Research v3.1.0-rc1 Candidate Issue
#672 opened Dec 13, 2016 by dune73

3
932140 (Remote Command Execution: Windows FOR/IF Command Found) FP on SAML data False Positive v3.0-dev Development
#671 opened Dec 12, 2016 by jhaar

5
wrong matched_var_name in TX: vars
#668 opened Nov 29, 2016 by lex-melnyk
Where did the Slowloris rule go?
#667 opened Nov 28, 2016 by theseion

13
Unix RCE: add 'popd' to blacklist False Negative - Evasion Published Research
#665 opened Nov 25, 2016 by lifeforms

1
Shell evasion by $IFS / ${IFS} False Negative - Evasion
#664 opened Nov 25, 2016 by lifeforms

2
libinjection XSS FP with 'on' in URLs False Positive
#663 opened Nov 25, 2016 by lifeforms

1
Drupal: form_build_id FP, simplify exclusions False Positive v3.0-dev Development
#661 opened Nov 25, 2016 by lifeforms

2
WordPress false positives False Positive
#660 opened Nov 25, 2016 by tomsommer

3
KNOWN_BUGS: Talk about missing YAJL/JSON support in ModSec binaries v3.0-dev Development
#659 opened Nov 25, 2016 by dune73
Rule 920420: POST with Content-type application/octet-stream is not allowed False Positive v3.0-dev Development
#657 opened Nov 24, 2016 by tomsommer

6
Rule 933100 FP on "<?xml" body False Positive v3.0-dev Development
#654 opened Nov 24, 2016 by tomsommer CRS v3.0.1

8
Trusting X-Forwarded-For for real_ip collection False Negative - Evasion
#653 opened Nov 22, 2016 by 0xd012 CRS v3.1.0 RC1

3
XSS and SQLi coverage of REQUEST_URI / REQUEST_FILENAME / PATH_INFO v3.1.0-rc1 Candidate Issue
#652 opened Nov 19, 2016 by dune73

1
Consistent support for the "ver" action v3.1.0-rc1 Candidate Issue
#650 opened Nov 18, 2016 by dune73
Cover these techniques: SHELLING - an offensive approach ... command injection Published Research
#646 opened Nov 14, 2016 by dune73
Detection of CRLF in automatically URLDecoded elements
#638 opened Oct 31, 2016 by csanders-git CRS v3.1.0 RC1

5
ModSecurity version 3 as part of the QA
#637 opened Oct 31, 2016 by zimmerle

2
Remove maturity, accuracy and possibly even version v3.1.0-rc1 Candidate Issue
#631 opened Oct 31, 2016 by dune73 CRS v3.1.0 RC1

4

Previous 1 2 3 4 Next

ProTip! Type g p on any issue or pull request to go back to the pull request listing page.

SpiderLabs/owasp-modsecurity-crs

Join GitHub