CVE-2020-10148-Solarwinds-Orion

CVE-2020-10148 Solarwinds Orion CVE-2020-10148.py をダウンロードする wget https://gist.githubusercontent.com/0xsha/75616ef6f24067c4fb5b320c5dfa4965/raw/0d7db4f2ea5aacc0ada7b1a7b23f2ce8ba39315f/CVE-2020-10148.py Shodan で Solarwinds Orion を探す...

solarwinds-sunburst-cve-2020-10148

🔍 취약점 연구 소프트웨어 생태계의 실제 보안 사고를 다루는 심층 취약점 분석 글을 선별한 컬렉션입니다. 각 항목은 전체 기술 분석, 개념 증명PoC, IOC 목록 및 수정 지침을 포함합니다. 목적: 교육 참고 자료 및 포트폴리오. 모든 PoC 코드는 탐지 및 연구 목적으로만 사용됩니다. 색인 | 취약점| 유형| 심각도| 날짜| 상태 ---|---|---|---|---|--- 002| SolarWinds Orion 취약점 CVE-2020-10148| 공급망| 🔴 심각| 2020년 12월 11일| ✅ 완료 구조 각 항목은 일관된...

Photon OS 5.0: Curl PHSA-2025-5.0-91-0660

An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0660. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

ROOT-OS-DEBIAN-12-CVE-2025-10148 CVE-2025-10148 in rootio-curl - Patched by Root

Root has patched CVE-2025-10148 in the rootio-curl package for Root:Debian:12. Multiple fixed versions available...

CVE-2015-10148

creationtimestamp| type| source ---|---|--- 2026-04-03 23:07:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimtl3ymni23 2026-04-04 01:29:22+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3min3ijexda22...

openSUSE 16 Security Update : curl (openSUSE-SU-2025-20090-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20090-1 advisory. - CVE-2025-9086: Fixed Out of bounds read for cookie path bsc1249191 - CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes...

CVE-2025-10148 affecting package curl for versions less than 8.11.1-4

CVE-2025-10148 affecting package curl for versions less than 8.11.1-4. A patched version of the package is available...

RockyLinux 9 : python3.11 (RLSA-2025:10148)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:10148 advisory. cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4435 cpython: Bypass extraction filter to modify file metadata outside extraction...

Security update for curl

This update for curl fixes the following issues: tooloperate: fix return code when --retry is used but not triggered bsc1249367 Security fixes: CVE-2025-9086: Fixed Out of bounds read for cookie path bsc1249191 CVE-2025-10148: Fixed predictable WebSocket mask bsc1249348 Patch Instructions: To...

Security update for curl

This update for curl fixes the following issues: CVE-2025-9086: Fixed Out of bounds read for cookie path bsc1249191 CVE-2025-10148: Predictable WebSocket mask bsc1249348 Fix the --ftp-pasv option in curl v8.14.1 bsc1246197 tooloperate: fix return code when --retry is used but not triggered...

Fedora: Security Advisory (FEDORA-2025-97ae15dc56)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2025:03267-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03267-1 advisory. Security issues fixed: - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to...

SUSE SLED15: brotli / curl / libbrotli-devel / libbrotlicommon1 / etc (SUSE-SU-2025:03268-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03268-1 advisory. Security issues fixed: - CVE-2025-9086: bug in patch comparison logic when processing cookies c...

Security update for curl

This update for curl fixes the following issues: Security issues fixed: CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer bsc1249191. CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server...

SUSE: Security Advisory (SUSE-SU-2025:03173-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2025:03198-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-10148

A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy whether configured or transparent will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores...

Security update for curl

This update for curl fixes the following issues: Update to version 8.14.1 jscPED-13055, jscPED-13056. Security issues fixed: CVE-2025-0665: eventfd double close can cause libcurl to act unreliably bsc1236589. CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks...

AZL-67272 CVE-2025-10148 affecting package curl for versions less than 8.8.0-7

curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...

CVE-2025-10148 predictable WebSocket mask

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two...