10767 matches found
Debian: Security Advisory (DSA-4098-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:0217-1)
This update for curl fixes one issues. This security issue was fixed : - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects bsc1077001 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...
Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2018-024-01)
New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-024-01. The text itself is copyright C Slackware Linux,...
CVE-2018-1000007
It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This could leak authentication token to external entities. Mitigation By default, curl and libcurl will not follow redirect requests. This flaw happens onl...
HTTP authentication leak in redirects
curl might leak authentication data to third parties. When asked to send custom headers in its HTTP requests, curl sends that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the...
The vulnerability of the syntax analyzer of the software tool for interacting with the curl server allows a hacker to perform read operations beyond the buffer in memory.
The vulnerability of the software tool’s syntax analyzer for interacting with servers using curl is related to an error during registration on the server using the FTP protocol. Exploiting this vulnerability allows a malicious actor to gain access to data beyond the boundaries of the allocated...
The vulnerability of the sendto function in the software tool for interacting with servers via curl allows a hacker to trigger a service failure or redirect traffic.
The vulnerability of the sendto function in the curl programming interface relates to reading beyond the buffer limit when using the TFTP protocol. Exploiting this vulnerability allows a malicious actor to cause service failures or redirect traffic through a specially crafted URL address...
Security fix for the ALT Linux 8 package curl version 7.58.0-alt1
Jan. 24, 2018 Anton Farygin 7.58.0-alt1 - new version - fixes: CVE-2018-1000005 HTTP/2 trailer out-of-bounds read CVE-2018-1000007 HTTP authentication leak in redirects...
macOS 10.13.x < 10.13.3 Multiple Vulnerabilities
The remote host is running a version of Mac OS X that is 10.13.x prior to 10.13.3. It is, therefore, affected by multiple vulnerabilities in the following components : - Audio - curl - IOHIDFamily - Kernel - LinkPresentation - QuartzCore - Sandbox - Security - WebKit - Wi-Fi Note that successful...
cURL -- Multiple vulnerabilities
The cURL project reports: libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HT...
cURL/libcURL CVE-2018-1000007 Information Disclosure Vulnerability
Description cURL/libcURL is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. curl 6.0 through 7.57.0 are vulnerable. Technologies Affected Haxx Curl 6.0 Haxx Curl 6.1 Haxx Curl 6.4 Haxx Cu...
macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-001) (Meltdown)
The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - Audio - curl - IOHIDFamily - Kernel - LinkPresentation - QuartzCore - Sandbox - Security - WebKit - Wi-Fi ...
UBUNTU-CVE-2018-1000007
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is...
About the security content of macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
About the security content of macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan This document describes the security content of macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan. About Apple securi...
GHSA-RHGQ-VV9X-J4P5 lawn-login exposes database password to unauthorized users
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...
lawn-login exposes database password to unauthorized users
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...
openSUSE Security Update : curl (openSUSE-2018-56)
This update for curl fixes the following issues : Security issues fixed : - CVE-2017-8816: Buffer overrun flaw in the NTLM authentication code bsc1069226. - CVE-2017-8817: Read out of bounds flaw in the FTP wildcard function bsc1069222. This update was imported from the SUSE:SLE-12:Update update...
PHPFreeChat 1.7 - Denial of Service
Exploit Title: phpFreeChat 1.7 and earlier - Denial of Service Version: 1.7 and earlier Date: 21/01/2018 Vendor Homepage: http://www.phpfreechat.net Software Link: http://www.phpfreechat.net/download Exploit Author: A. Pakbaz CVE : CVE-2018-5954 1 $pid=pcntlfork; if$pid0 echo "\nError! Reduce the...
curl/curl_fuzzer_http: Index-out-of-bounds in fuzz_handle_transfer
Detailed report: https://oss-fuzz.com/testcase?key=5049873339514880 Project: curl Fuzzer: libFuzzercurlfuzzerhttp Fuzz target binary: curlfuzzerhttp Job Type: libfuzzerubsancurl Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: fuzzhandletransfer curlfuzzer.cc...
Node.js third-party modules: [html-pages] Path Traversal in html-pages module allows to read any file from the server with curl
Hi, This report is about Directory Traversal vulnerability I found in html-pages module. Module: html-pages is a module which allows to browse directories and serve static files in the browser. The vulnerability exists in the latest available version 2.0.7 Link to npm page:...