Moderate: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

curl: NTLMv2 type-3 header stack buffer overflow

A stack-based buffer overflow was found in the way curl handled NTLMv2 type-3 headers. When connecting to a remote malicious server which uses NTLM authentication, the flaw could cause curl to crash...

curl: SMTP end-of-response out-of-bounds read

An out-of-bounds read flaw was found in the way curl handled certain SMTP responses. A remote attacker could use this flaw to crash curl...

Scripteen Image Upload Shell Upload

Exploit Title : Scripteen İmage Upload Script Arbitrary File Injection + Venedor Home Page : https://scripteen.com/ + Author : z3r0fy + Twitter : z3r0fy + Website : www.bugcontainer.gq + CX Security Link : https://cxsecurity.com/issue/WLB-2019100145 + Description : Due to these codes in the...

curl: SMB access smuggling via FILE URL on Windows

Summary: While CURL 7.62 parses URLs that have an ? parameter separator char after the fragment separator, CURL urlapi code treats the path with the hash part as it being the same one, this may allow some problem on specific protocols that may have a security impact. On HTTP, an attacker may be...

iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure

!/bin/bash iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P getjpeg Stream Disclosure Vendor: iSeeQ Product web page: http://www.iseeq.co.kr Affected version: WH-H4 1.03R / 2.0.0.P Summary: The 4/8/16 channel hybrid standalone DVR delivers high quality pictures which adopts high performance video processin...

The vulnerability of the curl_url_set() function in the libcurl library allows a hacker to trigger a service failure.

The vulnerability of the curlurlset function in the libcurl library is related to integer overflow. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the libcurl library, related to improper code generation, allows attackers to escalate their privileges or execute arbitrary code.

The vulnerability of the libcurl library is related to incorrect code generation management. Exploiting this vulnerability can allow an attacker to enhance their privileges or execute arbitrary code...

CVE-2002-2444

Snoopy before 2.0.0 has a security hole in exec cURL...

CVE-2002-2444

Snoopy before 2.0.0 has a security hole in exec cURL...

CVE-2002-2444

CVE-2002-2444 affects Snoopy prior to 2.0.0, with a security hole in exec cURL. The initial entry reports CVSS v2 base score 7.5 (HIGH) and CVSS v3.1 base score 9.8 (CRITICAL). No exploitation details or remediation are provided in the connected documents.

CVE-2002-2444

Snoopy before 2.0.0 has a security hole in exec cURL...

Amazon Linux 2 : curl (ALAS-2019-1340)

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.CVE-2019-5481 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.CVE-2019-5482 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Lin...

Photon OS 3.0: Curl PHSA-2019-3.0-0032

An update of the curl package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-3.0-0032. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid130111;...

Medium: curl

Issue Overview: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.CVE-2019-5481 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.CVE-2019-5482 Affected Packages: curl Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

MySQL 8.0.x < 8.0.18 Multiple Vulnerabilities (Oct 2019 CPU)

The version of MySQL running on the remote host is 8.0.x prior to 8.0.18. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the October 2019 Critical Patch Update advisory: - Vulnerability in the MySQL Server product of Oracle...

curl: curl successfully matches IP address literal in URL against IP address literal in certificate Common Name

Summary: A user may invoke the curl command line utility with an IP address literal in the URL, such as https://192.168.124.2/... If the HTTPS server presents a certificate whose Common Name matches this IP address literal as a string that is, Common Name is the ASCII string 192.168.124.2, then...

Vulnerabilities fixed in MySQL

There are multiple vulnerabilities in MySQL Server, MYSQL Workbench, the MySQL Connectors and an under windows included version of the utility cURL. These vulnerabilities could potentially lead to execution of arbitrary code with the privileges of the application, access to sensitive information ...

NewStart CGSL CORE 5.04 / MAIN 5.04 : curl Vulnerability (NS-SA-2019-0193)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has curl packages installed that are affected by a vulnerability: - Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the toolmsgs.c:voutf function that may result in information exposure an...

NewStart CGSL CORE 5.04 / MAIN 5.04 : curl Vulnerability (NS-SA-2019-0182)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has curl packages installed that are affected by a vulnerability: - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curlntlmcoremknthash multiplies the length ...