1014 matches found
CVE-2008-7295
Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security HSTS...
CLSA-2026-1767628458 curl: Fix of CVE-2024-9681
CVE-2024-9681: improve HSTS subdomain handling to prevent incorrectly overriding parent domain entries...
CLSA-2025-1764773365 curl: Fix of CVE-2024-9681
CVE-2024-9681: improve HSTS subdomain handling to prevent incorrectly overriding parent domain entries...
TencentOS Server 4: curl (TSSA-2024:0355)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0355 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
TencentOS Server 4: curl (TSSA-2024:0874)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0874 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
Siemens SCALANCE and RUGGEDCOM Devices Incorrect Comparison (CVE-2024-9681)
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with host...
Siemens SIMATIC S7-1500 Cleartext Transmission of Sensitive Information (CVE-2022-43551)
A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...
Siemens SIMATIC S7-1500 Cleartext Transmission of Sensitive Information (CVE-2022-42916)
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly instead of using an insecure cleartext HTTP step even when HTTP is provided in the URL. This mechanism could be bypassed if the host nam...
Siemens SIMATIC S7-1500 Missing Encryption of Sensitive Data (CVE-2023-46219)
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mo...
Siemens SIMATIC S7-1500 Double Free (CVE-2023-27537)
A double free vulnerability exists in libcurl 8.0.0 when sharing HSTS data between separate handles. This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks...
Siemens SIMATIC S7-1500 Cleartext Transmission of Sensitive Information (CVE-2022-30115)
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or th...
Siemens SIMATIC S7-1500 Cleartext Transmission of Sensitive Information (CVE-2023-23915)
A cleartext transmission of sensitive information vulnerability exists in curl v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP...
curl: curl’s persistence files inherit world-readable/writable perms from umask, leaking and tampering with cookies/HSTS/Alt-Svc caches
Executive Summary Curlfopen clones the permissions of any pre-existing persistence file when creating its temporary file. When the persistence file does not exist, it first creates one with the process umask typically 022, i.e., 0644. That mode is then copied to the temp file via 0600 | sb.stmode...
JLSEC-2025-32 A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate...
A double free vulnerability exists in libcurl 8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread...
EUVD-2017-14859
Malware in sbrugna...
EUVD-2015-1410
Malware in sbrugna...
EUVD-2013-2985
Malware in sbrugna...
EUVD-2015-1233
Malware in sbrugna...