12934 matches found
Moderate Photon OS Security Update - PHSA-2022-0176
Updates of 'curl' packages of Photon OS have been released...
Moderate Photon OS Security Update - PHSA-2022-0388
Updates of 'curl' packages of Photon OS have been released...
U.S. Dept Of Defense: CVE-2020-3187 - Unauthenticated Arbitrary File Deletion
A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...
Authentication Bypass
curl is vulnerable to authentication bypass. A remote attacker is able to reuse OAUTH2-authenticated connections due to improper verification of credentials during a transfer, which allows the attacker to impersonate another user on the system...
Vulnerabilities fixed in cURL
Vulnerabilities have been fixed in cURL. The vulnerabilities allow a remote malicious party potentially able to obtain sensitive data obtain or to bypass authentication. The developers of cURL have released updates to fix the vulnerabilities. More information can be found on the pages below:...
Ubuntu: Security Advisory (USN-5397-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-5397-1 curl vulnerabilities
Patrick Monnerat discovered that curl incorrectly handled certain OAUTH2. An attacker could possibly use this issue to access sensitive information. CVE-2022-22576 Harry Sintonen discovered that curl incorrectly handled certain requests. An attacker could possibly use this issue to expose sensiti...
USN-5397-1: curl vulnerabilities
Patrick Monnerat discovered that curl incorrectly handled certain OAUTH2. An attacker could possibly use this issue to access sensitive information. CVE-2022-22576 Harry Sintonen discovered that curl incorrectly handled certain requests. An attacker could possibly use this issue to expose sensiti...
curl: CVE-2022-27778: curl removes wrong file on error
Summary: Curl command has a logic flaw that results in removal of a wrong file when combining --no-clobber and --remove-on-error if the target file name exists and an error occurs. Steps To Reproduce: 1. echo "important file" foo 2. echo -ne "HTTP/1.1 200 OK\r\nContent-Length: 666\r\n\r\nHello\n"...
curl: CVE-2022-27779: cookie for trailing dot TLD
Summary: In CVE-2014-3620 curl prevents cookies from being set for Top Level Domains TLDs. According to the advisory, curl's "cookie parser has no Public Suffix awareness", but it will "reject TLDs from being allowed". However, a cookie can still be set for a TLD + trailing dot. A trailing dot...
PT-2022-2687
Name of the Vulnerable Software and Affected Versions curl versions prior to 7.83.1 MySQL Server versions 5.7.38 and earlier, 8.0.29 and earlier Description A use of incorrectly resolved name issue might remove the wrong file when --no-clobber is used together with --remove-on-error. This could...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : curl vulnerabilities (USN-5397-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5397-1 advisory. Patrick Monnerat discovered that curl incorrectly handled certain OAUTH2. An attacker could possibly use this issue to access...
PT-2022-2694
Name of the Vulnerable Software and Affected Versions cURL affected versions not specified Description The issue is related to the curl URL parser, which wrongly accepts percent-encoded URL separators like '/' when decoding the host name part of a URL. This can make it a different URL using the...
Slackware: Security Advisory (SSA:2022-117-01)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
FreeBSD : cURL -- Multiple vulnerabilities (92a4d881-c6cf-11ec-a06f-d4c9ef517024)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 92a4d881-c6cf-11ec-a06f-d4c9ef517024 advisory. - A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak...
CURL-CVE-2022-27776 Auth/cookie leak on redirect
curl might leak authentication or cookie header data on HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hos...
Auth/cookie leak on redirect
curl might leak authentication or cookie header data on HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hos...
CURL-CVE-2022-27775 Bad local IPv6 connection reuse
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take the IPv6 address zone id into account which could lead to libcurl reusing the wrong connection...
Internet Bug Bounty: CVE-2022-27776: Auth/cookie leak on redirect
Summary: curl/libcurl can be coaxed to leak Authorization / Cookie headers by redirecting request to http:// URL on the same host. Successful exploitation requires that the attacker can either Man-in-the-Middle the connection or can access the traffic at the recipient side for example by...
Internet Bug Bounty: CVE-2022-27775: Bad local IPv6 connection reuse
Summary: curl/libcurl doesn't consider IPv6 address zone index when doing connection reuse. if connection exists to specific IPv6 address and other conditions for connection reuse are fulfilled it will be reused for connections regardless of the zone index. Steps To Reproduce: 1. Set up a fake...