I had the same problem. There is only one security filter that is causing the problem: uncheck the box: ‘Block WordPress specific terms (wp_, user_login, etc.) in application parameters.’ After that you can upload images again and still keep the firewall plugin active.
Hope that helps.
