1312280 matches found
curl: Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror
Summary: A resource leak was identified in src/toolparsecfg.c using the Clang Static Analyzer. When a file error occurs fileerror is true during config parsing, the function returns PARAMREADERROR without ensuring the file stream is properly closed, leading to a potential file descriptor leak...
curl: wcurl treats some URL operands after -- as curl options
I found that wcurl does not always keep operands after -- in a pure URL-data context. The documented way to pass curl options through wcurl is --curl-options, but a value supplied as a URL operand can still reach the final curl command as an option, for example wcurl -- "--url=file:///...". A...
curl: libcurl 8.20.0 incomplete fix for CVE-2026-7168: changing only CURLOPT_PROXYPORT leaks stale Proxy Digest auth to a different proxy
Summary: I found an incomplete-fix variant of CVE-2026-7168 in curl 8.20.0. The 8.20.0 fix clears state.proxydigest / state.authproxy when CURLOPTPROXY changes, but not when only CURLOPTPROXYPORT changes. On the same easy handle, request 1 through proxyA CURLOPTPROXYPORT=18197 learns Proxy Digest...
Patched get_file tar traversal remains exploitable on supported Python 3.11
Description Keras previously fixed keras.utils.getfile..., extract=True tar archive path traversal in GHSA-hjqc-jx6g-rwp9 / CVE-2025-12060 by routing archive extraction through extractopenarchive and using Python's tarfile.extractallfilter="data" protection for tar files. The remediation is...
curl: MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstate
Summary: In lib/mqtt.c, the state machine in mqttdoing lines 894-911 in curl 8.20.0 does not validate that PINGRESP 0xD0 and DISCONNECT 0xE0 packets have remaininglength == 0 as required by MQTT 3.1.1 spec sections 3.13.1 and 3.14.1. A malicious broker can send a PINGRESP fixed header with non-ze...
AWS VDP: bedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keys
A second Bedrock API key-accepting service plane called "bedrock-mantle" was discovered. This plane was not described in AWS's customer-facing Bedrock documentation. As a result, the AWS-published security controls to detect and prevent Bedrock API key abuse failed to apply to the bedrock-mantle...
Tor: Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown
A vulnerability was discovered in Tor's Conflux OOO queue accounting. The vulnerability could cause the global OOO queue byte counter to remain inflated after a Conflux set was torn down, even though the memory had already been freed. This was due to a lack of accounting updates during the teardo...
Monero: SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash
A vulnerability was discovered in the Monero project where the getspendproof and checkspendproof functions do not verify the returned transaction hash against the requested transaction ID. This allows a malicious or compromised daemon to provide a valid serialized transaction body for a different...
Monero: `check_reserve_proof` counts duplicate entries: one output can inflate `total`
A vulnerability was discovered in the checkreserveproof function in the Monero wallet software. The vulnerability allowed duplicate entries in the reserve proof, which could artificially inflate the reported total reserve amount without affecting the verification of individual entries. The issue...
Monero: `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment
The checkreserveproof function in the Monero codebase was found to sum RingCT ECDH amounts without checking the output commitment. The decoded amount was added to the total without verifying that it matched the commitment, which could allow a malicious prover to claim larger reserves than actuall...
curl: CVE-2026-7168: cross-proxy Digest auth state leak
Summary: On libcurl 8.19.0, Proxy Digest state learned from proxyA survives an independent transfer boundary on a reused easy handle and is emitted preemptively to proxyB when the proxy is changed. In the attached C PoC, the first CONNECT to proxyB carries Proxy-Authorization: Digest ... built fr...
Shopify: Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference template
Repository: https://github.com/Shopify/sample-django-app Description The /uninstall webhook endpoint in sample-django-app processes incoming requests without verifying the X-Shopify-Hmac-Sha256 header. Shopify explicitly requires this validation as a mandatory security measure for all webhook...
curl: CVE-2026-7009: OCSP stapling bypass with Apple SecTrust
Summary When curl is built with --with-apple-sectrust or -DUSEAPPLESECTRUST=ON and OpenSSL, the --cert-status / CURLOPTSSLVERIFYSTATUS option is silently bypassed when Apple SecTrust handles certificate chain verification instead of OpenSSL. The user explicitly requests OCSP stapling enforcement,...
HackerOne: Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql
The GraphQL query on hackerone.com/graphql allowed authenticated users to execute arbitrary Painless scripts through the sortquery argument, without server-side validation or allowlisting. This was confirmed by submitting requests with different Painless script payloads, and observing that the...
Monero: wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)
A vulnerability was discovered in the Monero wallet software that could cause the wallet-rpc process to crash when handling a malformed response from the daemon's /gettransactions endpoint. The vulnerability was due to the wallet software making assumptions about the response structure that were...
Brave Software: iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private Tabs
A vulnerability was discovered in the Brave browser for iOS where adding or opening a song in the Brave playlist and holding for the "Open in new Private Tab" option bypassed the Face ID or passcode requirement for accessing Private Tabs. This affected Brave iOS version 1.88 and iOS version 26.4....
Node.js: Permission Model Bypass via `process.report.writeReport()` Path Misvalidation
A flaw was discovered in the Node.js permission model that allowed bypassing of security controls via the process.report.writeReport path misvalidation...
Node.js: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat
Vulnerability description not provided...
Monero: `relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`
The relaytx wallet-RPC method in Monero was found to bypass the --restricted-rpc guard, allowing any caller to corrupt the wallet state by submitting a malicious pendingtx blob. The issue was that the onrelaytx handler did not perform any ownership checks on the supplied pendingtx before passing ...