CVE-2023-44487

Si prega di notare che il codice sopra utilizza la libreria libcurl per effettuare richieste HTTP. È necessario installare libcurl e collegarlo durante la compilazione del codice. Il codice è una versione semplificata e potrebbe essere necessario modificarlo in base ai requisiti specifici e al...

CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow

Dichiarazione di non responsabilità Questo articolo è destinato esclusivamente alla discussione tecnica e all'apprendimento. Qualsiasi conseguenza o danno, diretto o indiretto, derivante dall'uso delle informazioni fornite in questo articolo è di esclusiva responsabilità dell'utente; l'autore...

xzf

Introduzione xzf è un semplice PoC che dimostra come i dati EXIF possono essere usati per il command and control. xzf recupera un'immagine da un URL predefinito, quindi legge il tag Software per una stringa di autenticazione. Se la stringa corrisponde, xzf eseguirà qualsiasi cosa contenuta nel ta...

CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – Confusione del tunnel CONNECT HTTP/2 di libcurl Codice del programma simulazione in C root@kitploit: // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with...

cve-2021-42013

CVE-2021-42013 Implementazione in C del famigerato exploit per Apache 2.4.50 Compilazione $ gcc cve-2021-42013.c -lcurl -o cve-2021-42013 Utilizzo $ ./cve-2021-42013 Esempio...

thetick

The Tick Una semplice backdoor Linux embedded. The Tick Compilazione Installazione Utilizzo Media Compilazione The Tick dipende solo da libcurl, quindi assicurati di avere il pacchetto di sviluppo corrispondente. Ad esempio, sulle distribuzioni basate su Debian dovresti fare quanto segue:...

CVE-2026-33752

CVE-2026-33752 CVE-2026-33752 SSRF basato su reindirizzamento che porta all'accesso alla rete interna in curlcffi Riepilogo curlcffi non limita le richieste agli intervalli IP interni e segue automaticamente i reindirizzamenti tramite la libreria libcurl sottostante. Per questo motivo, un URL...

external_curl_AOSP10_r33_CVE-2021-22924

root@kitploit: | | | | | | / | | | | | | | | | || | | | |/|| \| README Curl ist ein Kommandozeilenwerkzeug zur Übertragung von Daten, die mit URL-Syntax angegeben werden. Finden Sie heraus, wie Sie curl verwenden, indem Sie die Manpage curl.1 oder das MANUAL-Dokument lesen. Finden Sie heraus,...

lulzbuster

Beschreibung Ein multithreaded, sehr schneller und intelligenter HTTPS-Verzeichnis- und Datei-Bruteforcer, geschrieben in C auf Basis von libcurl. Bei Angabe einer Ziel-URL und einer Wortliste werden gültige Pfade durch parallele HTTP-Anfragen aufgespürt, wobei nur Antworten gemeldet werden, die...

curl: 46: `--libcurl` output carries `--insecure` across `--next` boundaries

Summary When --libcurl generates C source for a command that uses --next to separate multiple operations, local options from earlier operations leak into later ones. Specifically, if the first operation uses --insecure and the second does not, the generated program silently skips TLS certificate...

CVE-2026-8932

🚨 CVE-2026-8932 - O Bug de Segurança Mais Antigo do libcurl Correspondência de Configuração mTLS Incompleta no libcurl A vulnerabilidade de segurança mais antiga já corrigida no libcurl—permanecendo despercebida por mais de 25 anos. 📖 Visão Geral CVE-2026-8932 é uma vulnerabilidade de segurança n...

curl: Unbound cross-peer HTTP Digest challenge state

Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...

Astra Linux – Vulnerability in curl

libcurl will reuse a previously established connection even when options related to TLS or SSH have been changed, which should prevent such reuses. libcurl stores previously used connections in a connection pool, allowing for reuse if one of them matches the current setup. However, several TLS an...

Tenable Security Center < 6.9.0 Multiple Vulnerabilities (TNS-2026-22)

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-22 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers...

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements:...

curl: curl: Man-in-the-middle attack via SSH host key bypass

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the knownhosts file. The callback...

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...

curl: curl: Man-in-the-middle attack via SSH host key bypass

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the knownhosts file. The callback...

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...

curl: libcurl: Improper certificate validation due to cached TLS settings reuse

A flaw was found in libcurl. When handling secure connections TLS and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server's security certificate that it should have otherwise...