Denial Of Service (DoS)

libcurl.so is vulnerable to denial of service. The vulnerability exists due to stack-based buffer overflow when curl is instructed to parse a .netrc file for credentials which allows an attacker to crash the application via malicious input...

.netrc parser out-of-bounds access

curl can be told to parse a .netrc file for credentials. If that file ends in a line with consecutive non-white space letters and no newline, curl could read past the end of the stack-based buffer, and if the read works, write a zero byte possibly beyond its boundary. This does in most cases caus...

CVE-2022-35260

curl can be told to parse a .netrc file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause ...

Information Disclosure

github.com/go-vela/server is vulnerable to information disclosure. The vulnerability exists due to an authentication mechanism added in version 0.7.0 which enables an attacker to obtain secrets utilizing the injected credentials within the /.netrc file...

CVE-2021-21432

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the /.netrc file. Refer to the referenced GitHub Security...

PT-2021-14504 · Vela · Vela

Name of the Vulnerable Software and Affected Versions: Vela versions 0.7.0 through 0.7.4 Description: The issue concerns an authentication mechanism added in version 0.7.0 of Vela, which enables malicious users to obtain secrets by utilizing injected credentials within the /.netrc file. This can ...