Skip to content

Issues: coreruleset/coreruleset

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

81 Open 2,482 Closed
81 Open 2,482 Closed
Author
Filter by author
Label
Filter by label
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Milestones
Filter by milestone
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

FP: "time express" in json value ➕ False Positive v4 unix rce One of the many reports on FPs with the new unix rce rules in v4
#3711 opened May 22, 2024 by niklasweimann
4
Changed behavior with httpd/mod_security due outbound anomaly score resetting in v4.2.0 ➕ False Positive
#3696 opened May 8, 2024 by arminabf
6
Monthly Chat Agenda May 2024 (2024-05-06 and 2024-05-20) 🔖 Meeting Agenda
#3694 opened May 6, 2024 by dune73
1
Decide what to do about test 933161-4 🧹 cleanup House cleaning
#3693 opened May 5, 2024 by theseion
2
Catch double charset evasion ➖ False Negative - Evasion
#3692 opened May 5, 2024 by theseion
Apache 403 Forbidden error handling and duplicate HTTP response headers 🐛 bug Something isn't working
#3679 opened Apr 22, 2024 by ablanken
10
How to build rule exclusions for specific sites on a Multisite server? ➕ False Positive
#3655 opened Apr 9, 2024 by Danrancan
16
Rule 933150 Has False Positive for URLs ➕ False Positive
#3641 opened Apr 2, 2024 by ssigwart
1 task done
6
document.querySelector('p').textContent="XSS" and document.body.appendChild not being detected ➖ False Negative - Evasion
#3634 opened Mar 27, 2024 by dune73
Javascript "console.log()" and "console.dir()" not being detected ➖ False Negative - Evasion
#3633 opened Mar 27, 2024 by dune73
4
JS "fetch" and "import" (partially) not being detected ➖ False Negative - Evasion
#3632 opened Mar 27, 2024 by dune73
Shell false positives for rules 932260 and 932236 ➕ False Positive v4 unix rce One of the many reports on FPs with the new unix rce rules in v4
#3631 opened Mar 25, 2024 by superlgn
5
FP sql injection in pattern with integer after string "update" e.g. "update 1" ➕ False Positive ⏳ awaiting feedback CRS dev asked feedback ❓ Need more info
#3630 opened Mar 24, 2024 by joshi-mohit
8
Clarify CRS 3 maintenance plans 👍 Feature Request
#3624 opened Mar 20, 2024 by rainerjung
3
Removal of severity from blocking rules leads to CrowdSec hiccoughs when running CRS4 🐛 bug Something isn't working
#3607 opened Mar 9, 2024 by dune73
2
coraza-caddy is working on sandbox ? sandbox Sandbox related problems 👍 Feature Request
#3597 opened Mar 3, 2024 by Barnoux
@fzipi
2
Versioning clarification 👍 Feature Request
#3582 opened Feb 21, 2024 by jcchavezs
1
Linter should check that all rules have the correct CRS tag and version 👍 Feature Request
#3573 opened Feb 16, 2024 by theseion
@airween
14
Document rule exclusion pkg to plugin migration from CRS3 to CRS4 in separate blog post v4-doc v4 documentation and administration
#3565 opened Feb 14, 2024 by dune73
2
Detect RCE in User-Agent header (was 932200) v4.1 Target Release v4.1 👍 Feature Request
#3558 opened Feb 13, 2024 by fzipi
Clean up unix-evasion-prefix.ra 🚀 enhancement New feature or request
#3534 opened Feb 6, 2024 by theseion
@theseion
2
932239 may be missing urlDecodeUni 🐛 bug Something isn't working
#3504 opened Jan 22, 2024 by theseion
@theseion
2
Detect RCE in fragments of URLs in Referer header (932205) 🚀 enhancement New feature or request
#3498 opened Jan 20, 2024 by theseion
1
False positive on interactions with GoToSocial ➕ False Positive
#3497 opened Jan 19, 2024 by kvibber
10
Regression test badge for older releases can become inactive 📖 documentation Improvements or additions to documentation
#3496 opened Jan 18, 2024 by theseion
5
ProTip! Add no:assignee to see everything that’s not assigned.