1312269 matches found
curl: Arbitrary File Read via file:// Protocol in cURL
cURL’s file:// protocol handler is enabled by default, allowing access to local files on the system. This behavior enables an attacker with the ability to run cURL commands to read arbitrary files on the host by specifying file paths or using directory traversal techniques. Steps to reproduce: 1...
curl: Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl
Summary: A Use-After-Free UAF vulnerability exists in libcurl when the OpenSSL SSLCTXsetkeylogcallback is set. The callback may be invoked after the associated SSL object has been freed via SSLfree, leading to access to a dangling pointer and potential crash or information leak via SSLgetexdata...
curl: Disclosure of email addresses
https://github.com/curl/curl/blob/master/.mailmap Impact Summary: Disclosure of email addresses...
curl: access notes without permission
https://web.archive.org/web//https://github.com/curl/curl Impact Summary: access notes without permission...
Monero: Reported Denial of Service
A vulnerability was reported in the Monero RPC server that could cause a denial of service. The issue was found in the "calcpow" RPC endpoint, where specially crafted input could cause the server to crash with the message "Cryptonight variant 1 needs at least 43 bytes of data". The problem was th...
Monero: Reported RPC Overflow
A stack buffer overflow was reported in the Monero RPC server. Specifically, on line 1291 of the corerpcserver.cpp file, an overflow could occur if the size of the b.data did not match the size of the crypto::keyimage. Additionally, a missing return statement was found following line 1289. The...
U.S. Dept Of Defense: Reflected XSS Vulnerability in SSL VPN Endpoint — CVE-2025-0133
A reflected Cross-Site Scripting XSS vulnerability was discovered in a SSL VPN endpoint. The vulnerability was assigned the CVE number CVE-2025-0133. The vulnerability allowed an unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of a victim who clicked on a...
curl: Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
Summary: The HTTP/2 proxy implementation in curl contains potential integer overflow vulnerabilities in buffer size calculations that could lead to memory corruption or denial of service. AI Usage Statement: This report was prepared by a human security researcher after manual code review. No AI w...
LinkedIn: Improper Access Control - Access to "Active Hiring" (Premium feature) filter results
An access control vulnerability was identified in LinkedIn's people search functionality that allowed unauthorized access to premium "Active Hiring" filter results. The vulnerability was found in the GraphQL API endpoint where premium feature restrictions were not properly enforced, allowing user...
Dependacy chain attack through hijacking broken github repository at https://github.com/huggingface/transformers/blob/main/src/\ntransformers/models/fuyu/\nconvert_fuyu_model_weights_to_hf.py
Description Type: Dependency Chain Attack through hijacking broken github repository Risk: High Allows arbitrary code execution in model conversion workflows Affected Asset: https://github.com/adept-ai-labs/adept-inference Broken URL in Hugging Face Transformers Root Cause The Hugging Face...
curl: CRLF injection in libcurl's SMTP client via --mail-from and --mail-rcpt allows SMTP command smuggling
Summary: libcurl's SMTP client is vulnerable to CRLF injection via the --mail-from and --mail-rcpt parameters. An attacker can inject newline characters to smuggle SMTP commands like VRFY, potentially enabling user enumeration or protocol abuse. While curl may fail after injection, the injected...
U.S. Dept Of Defense: SQL Injection in URI Path Leading to Full Database Disclosure on ████████
A time-based blind SQL injection vulnerability was discovered in the URI path of the /home/server-ocsp/ endpoint on a U.S. Government Public Key Infrastructure website. The vulnerability allowed an unauthenticated attacker to interact with the backend MySQL database and extract sensitive...
LangChain HTMLSectionSplitter – XXE caused by unsafe XSLT parsing
This report is not public...
curl: HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling
Summary A logic flaw in libcurl version 8.14.1 allows an attacker to bypass restrictive HTTP proxy firewalls by "tunneling" an arbitrary HTTP verb within a CONNECT request. By setting CURLOPTCUSTOMREQUEST to CONNECT for a standard http:// URL, an attacker can trick libcurl into creating a hybrid...
Lichess: CSRF at Network feature
A CSRF vulnerability was found in the network feature, where an attacker could change the Network Routing settings by sending a CSRF script to the victim...
curl: Stack-based Buffer Overflow in TELNET NEW_ENV Option Handling
Title: Stack-based Buffer Overflow in TELNET NEWENV Option Handling Vulnerability Description: Summary: A stack-based buffer overflow vulnerability exists in the libcurl TELNET handler. When libcurl connects to a malicious TELNET server, the server can trigger an overflow by sending a NEWENVIRON...
Path traversal, lead to remote code execution
Description clearml's safeextract is actually NOT secure. It fails to properly handle symbolic links and hard links. When these links point to files outside the TAR archive, it can lead to arbitrary file writes, potentially resulting in remote code execution. Due to a change in th...
Path traversal, lead to remote code execution
Description In zenml's PathMaterializer class, the load function uses ispathwithindirectory to validate files during data.tar.gz extraction. While this prevents path traversal vulnerabilities, it fails to effectively detect symbolic and hard links. with tarfile.openarchivepathlocal, "r:gz" as tar...
curl: Heap Buffer Overflow in libcurl curl_slist_append via Unterminated String
Summary A heap buffer overflow vulnerability exists in libcurl's curlslistappend function in lib/slist.c:94. When the function is called with a non-null-terminated string, the internal strdup call triggers strlen to read beyond allocated buffer boundaries, leading to a heap buffer overflow. This...
Insecure Temporary File Handling Vulnerability in llama-index-core
Description The getcachedir function in llama-index-core uses a predictable, hardcoded directory path /tmp/llamaindex on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct...