11224 matches found
Moderate: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
PT-2018-7147 · Red Hat · Curl +1
Name of the Vulnerable Software and Affected Versions: curl versions prior to 7.19.7-53 Description: The issue arises from an incorrect backport of a fix in curl, as shipped in Red Hat Enterprise Linux 6, due to a change in the HAVE GSSAPI define being substituted by USE HTTP NEGOTIATE. This...
curl security update
7.19.7-53 - treat Negotiate authentication as connection-oriented CVE-2017-2628...
DzSoft PHP Editor 4.2.7 - File Enumeration
DzSoft PHP Editor 4.2.7 - File Enumeration + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product:...
cURL: Certificate validation error
Background cURL is a tool and libcurl is a library for transferring data with URL syntax. Description cURL and applications linked against libcurl support “OCSP stapling”, also known as the TLS Certificate Status Request extension using the CURLOPTSSLVERIFYSTATUS option. When telling cURL to use...
GLSA-201703-04 : cURL: Certificate validation error
The remote host is affected by the vulnerability described in GLSA-201703-04 cURL: Certificate validation error cURL and applications linked against libcurl support OCSP stapling, also known as the TLS Certificate Status Request extension using the CURLOPTSSLVERIFYSTATUS option. When telling cURL...
DzSoft PHP Editor 4.2.7 File Enumeration
Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product: ========================= DzSoft PHP Editor v4.2.7 DzSoft PHP...
Urban Dictionary: Session replay vulnerability in www.urbandictionary.com
Session replay vulnerability in www.urbandictionary.com I considered titling this bug "Session tokens not expiring", which is what you need to tell your development team. But I titled it as I did to emphasize at least one attack made possible by the bug. There may be others. Description Privilege...
Sparrow Web Server Directory Traversal
Title: Sparrow Web Server - Path Traversal Author: Nassim Asrir Contact: [email protected] || https://www.linkedin.com/in/nassim-asrir-b73a57122/ Researcher At: Henceforth CVE: N/A Vendor : https://github.com/codercheng/sparrow Download : https://github.com/codercheng/sparrow Vulnerability Type:...
CVE-2015-8625
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ at sign character in unspecified POST array parameters...
Code injection
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ at sign character in unspecified POST array parameters...
UBUNTU-CVE-2015-8625
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ at sign character in unspecified POST array parameters...
CVE-2015-8625
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ at sign character in unspecified POST array parameters...
CVE-2015-8625
CVE-2015-8625 affects MediaWiki prior to specific point releases: 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1. The issue results from improper sanitization when MediaWiki uses the curl library, enabling a remote attacker to read arbitrary files via an @ character...
CVE-2015-8625
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ at sign character in unspecified POST array parameters...
CVE-2015-8625
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ at sign character in unspecified POST array parameters...
Amazon Linux AMI : curl (ALAS-2017-806)
libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. This flaw does not exist in the comman...
Internet Bug Bounty: heap-buffer-overflow (buffer read overrun) in curl: ourWriteOut() src/tool_writeout.c:115
Curl is a ubiquitous tool in use by millions of people around the world. I reported this flaw to the curl security mailing list on 10 March 2017: ./curl -q -K test000 ==21754==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dbb2 at pc 0x0000004fcd39 bp 0x7ffcd27dc250 sp...
[ASA-201703-1] curl: insufficient validation
Arch Linux Security Advisory ASA-201703-1 ========================================= Severity: Low Date : 2017-03-03 CVE-ID : CVE-2017-2629 Package : curl Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-179 Summary ======= The package curl before version...