19480 matches found
CVE-2026-86411
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CVE-2026-86411
An "ftp://" transfer configured with "CURLUSESSLNONE" can reuse a pooled FTP control connection that a previous easy handle upgraded with "STARTTLS" and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
curl: A server response that answers nothing is used as the next transfer's reply — and with IMAP, a fully compliant server does this by accident
Name: Maturi Jaswanth Sai Madhu Mohan Product: curl / libcurl — all four pingpong protocols demonstrated: IMAP, POP3, SMTP and FTP — the same protocol set curl's own CVE-2026-92387 names Affected: reproduced on current git master dbb8262a9c 8.23.1-DEV, fetched and rebuilt today, on d1d4b5931a, on...
Cerberus FTP Server path traversal vulnerability
Versions of the Cerberus FTP Server prior to 2026.3.0 have a path traversal vulnerability. This vulnerability stems from improper handling of parameters. Attackers can exploit this vulnerability by performing UNC path injections and providing malicious SMB share paths. This allows them to execute...
USN-8941-1 squid, squid3 vulnerabilities
It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. CVE-2026-61642 It was discovered that Squid incorrectly handled certain...
USN-8941-1: Squid vulnerabilities
It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. CVE-2026-61642 It was discovered that Squid incorrectly handled certain...
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Freefloat Freefloat_Ftp_Server
🐞 CVE-2025-5548 — FreeFloat FTP Server 1.0 Stack-Based Buffer...
Ubuntu: USN-8927-1 (CVE-2026-92387): curl vulnerabilities
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...
Red Hat: CVE-2026-92388: curl: curl: FTP wildcard write callback mixup
When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...
FreeFloat FTP Server 1.0 NOOP Command Buffer Overflow
FreeFloat FTP Server version 1.0 contains a buffer overflow in its NOOP command handler. The supplied proof of concept documents analysis, fuzzing, offset discovery, and return-address control. https://packetstorm.news/download/236480...
PT-2026-120146
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...
PCMan FTP Server 2.0 PWD Command Buffer Overflow
PCMan FTP Server version 2.0 contains a buffer overflow in the PWD command that allows remote attackers to execute arbitrary code. This Metasploit module sends a crafted FTP PWD request to demonstrate the issue. https://packetstorm.news/download/236498...
Siemens APOGEE Controllers Stack-based Buffer Overflow (CVE-2026-102074)
The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more informatio...
CVE-2026-79983
A flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or network attacker modifying server responses can supply...
curl resource management error vulnerability
The curl versions 8.10.0, 8.10.1, 8.11.0, 8.11.1, 8.12.0, 8.12.1, 8.13.0, 8.14.0, 8.14.1, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 8.20.0, 8.21.0, and 8.22.0 have a resource management error vulnerability. This vulnerability arises from malicious FTP, IMAP, POP3, or SMTP servers that completely...
Curl session mechanism vulnerabilities
Curl versions 8.21.0 and earlier have a session mechanism vulnerability. This vulnerability arises from the fact that the ftp:// transfer, configured with CURLESSLNONE, reuses the previously upgraded and client-certified pool-based FTP control connection via STARTTLS. The second handle does not...
curl resource management error vulnerability
The Curl version 7.21.0 to 8.22.0 contains a resource management vulnerability. This vulnerability arises from the failure of FTP wildcard LIST operations, which does not restore the write callback properly. As a result, the write callback is set to an internal parser, and the data written by the...
Exploit for CVE-2024-58299
Description This pull request addresses a security vulnerabil...