curl: Memory Leak in libcurl via Location Header Handling (CWE-770)

Summary: This report details a memory leak vulnerability in libcurl that occurs when processing HTTP 3xx redirect responses containing a Location: header. Specifically, the memory allocated for the Location: header's value is not properly deallocated when the Curleasy handle is reused for...

curl: Heap buffer overflow vulnerability in conncache.c: incorrect use of pointer arrays resulting in out-of-bounds memory writes.

In the conncache.c file, the cpoolbundle structure incorrectly uses a pointer array char dest1 instead of a flexible array char dest to store string data, leading to a heap buffer overflow when calling memcpy in the cpoolbundlecreate function. Impact Summary: The vulnerability is a heap buffer...

Mozilla: IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim Account

A critical vulnerability was identified in the Firefox Accounts API that allowed an authenticated attacker to permanently delete any user's account by sending a POST /v1/account/destroy request using the attacker's session, but including the victim's email and password hash in the JSON payload. T...

curl: Stack Buffer Overflow in curl's OpenSSL Provider Handling

Summary Hello curl Team, I found a stack buffer overflow in curl's OpenSSL provider handling code. The bug is in osslsetprovider function located in lib/vtls/openssl.c. When a provider name longer than MAXPROVIDERLEN is passed, the function copies it to a fixed-size buffer without proper length...

curl: CVE-2025-5025: No QUIC certificate pinning with wolfSSL

Summary: When using wolfSSL as the TLS backend, certificate pinning does not work when using HTTP/3. The code should invoke wsslverifypinned, but it has not been implemented. Affected version curl -V WARNING: this libcurl is Debug-enabled, do not use in production curl 8.13.0 x8664-pc-linux-gnu...

LinkedIn: Previous commentor on post can still comment even after comment permission is changed to disabled

A logic error existed in the comment permission system that allowed users who had previously commented on a post to continue posting additional comments even after the post owner disabled commenting functionality. The vulnerability occurred when an account created a post with comments enabled,...

curl: CVE-2025-4947: QUIC certificate check skip with wolfSSL

Summary: When using WolfSSL as the TLS backend, there is an issue where the CN or SAN in the certificate is not verified when connecting to an IP address over HTTP/3. wolfSSLX509checkhost is only called when peer-sni is not NULL. However, when an IP address is specified, peer-sni is NULL, so the...

curl: `Curl_socketpair()` fallback vulnerable to man-in-the-middle attack

In Curlsocketpair in curl/lib/socketpair.c if the operating system lacks a native socketpair function, libcurl will create its own pair of sockets. To do this, libcurl first creates a listening socket, then it creates a client socket, which it then connects to the listening socket. During the tim...

Mars: [XSS] Reflected XSS via POST request in (███████)

A reflected Cross-Site Scripting XSS vulnerability was identified in the celular parameter of a POST request to the homepage of a Mars-owned website. The vulnerability was classified as medium severity with a CVSS score of 6.2. The application failed to properly sanitize user input before renderi...

IDOR Vulnerability in Template Creation via `projectId` Manipulation

Description An Insecure Direct Object Reference IDOR vulnerability exists in the POST /v1/templates endpoint of the Lunary API. This allows an authenticated user to create templates in another user’s project by modifying the projectId query parameter. This occurs due to a lack of server-side...

Nextcloud: Tables app allowed users to view columns metadata information of any table

The Tables app allowed users to view columns metadata information of any table...

Nextcloud: Missing ownership check in Tables app allows moving columns into tables of other users

The Tables app in the specified software had a vulnerability that allowed moving columns into tables of other users without proper ownership checks...

curl: Memory Leak

in getparameter via strdup in toolgetparam.c SIGSEGV Project: cURL File: src/toolgetparam.c Function: getparameter → indirectly via getstr Detected By: AddressSanitizer ASan Command Used: ASANOPTIONS="detectleaks=1:verbosity=2:malloccontextsize=50" ./curl -K Overview A memory leak vulnerability h...

U.S. Dept Of Defense: Cross-Site Scripting via 'wikitext' parameter

A Cross-Site Scripting XSS vulnerability was discovered in the 'wikitext' parameter of a web application. The vulnerability allowed an attacker to inject malicious scripts that could be executed by the application. No further details were provided regarding the impact or the affected product...

U.S. Dept Of Defense: Cross-Site Scripting via 'description_extra' parameter

A Cross-Site Scripting XSS vulnerability was discovered in the 'descriptionextra' parameter of the application. The vulnerability allowed an attacker to inject malicious scripts that could be executed, potentially leading to unintended consequences. The vulnerability was reported and the necessar...

U.S. Dept Of Defense: Cross-Site Scripting via 'return_link_url' parameter

A Cross-Site Scripting XSS vulnerability was discovered on a website. The vulnerability was found in the 'returnlinkurl' parameter, which allowed an attacker to inject malicious scripts that could be executed. Exploitation of this vulnerability could have led to consequences such as cookie theft...

Tools for Humanity: Unlock underage blocked app without support interaction using airplane mode

The vulnerability allowed users to bypass the support requirement to unlock their blocked accounts in the iOS app. By changing the date of birth to an underage value, the app would lock the account and require contacting support for unlocking. However, by using airplane mode, users could initiate...

U.S. Dept Of Defense: Cross-Site Scripting via 'autoPlay' parameter

A Cross-Site Scripting XSS vulnerability was discovered on a website through the 'autoPlay' parameter in the GET method. Exploitation of this vulnerability allowed the injection of malicious scripts that could be executed. A proof-of-concept was provided demonstrating an alert pop-up...

U.S. Dept Of Defense: Cross-Site Scripting via 'currentImage' parameter

A Cross-Site Scripting XSS vulnerability was discovered on a website from the U.S. Navy through the 'currentImage' parameter in the GET method. The vulnerability allowed for the injection of malicious scripts that could potentially be executed. A proof of concept was provided that demonstrated th...

curl: curl -OJ allows creating custom .curlrc file which allows exfiltrating private data, among other things

Summary: If someone convinces someone to use curl -OJ http://example.com/somefile.txt, the Content-Disposition header can be used to create a .curlrc file if one doesn't exist and one is running curl from the home directory. From that point on, the attack controls any argument to all curl...