10750 matches found
curl: HTTP Request Smuggling Vulnerability Analysis - cURL Security Report
HTTP Request Smuggling Vulnerability Report - cURL Summary: cURL does not explicitly reject HTTP requests that contain both Transfer-Encoding and Content-Length headers, which can lead to HTTP request smuggling vulnerabilities CWE-444 when the request passes through intermediary systems proxies,...
Fedora 42 : php (2025-2c344545bf)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2c344545bf advisory. PHP version 8.4.10 03 Jul 2025 BcMath: Fixed bug GH-18641 Accessing a BcMath\Number property by ref crashes. nielsdos Core: Fixed bugs GH-17711 and...
CBL Mariner 2.0 Security Update: curl / mysql (CVE-2025-0665)
The version of curl / mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-0665 advisory. - libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channe...
Azure Linux 3.0 Security Update: curl / mysql (CVE-2025-0665)
The version of curl / mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-0665 advisory. - libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channe...
curl: Arbitrary File Read via file:// Protocol in cURL
cURL’s file:// protocol handler is enabled by default, allowing access to local files on the system. This behavior enables an attacker with the ability to run cURL commands to read arbitrary files on the host by specifying file paths or using directory traversal techniques. Steps to reproduce: 1...
curl: access notes without permission
https://web.archive.org/web//https://github.com/curl/curl Impact Summary: access notes without permission...
CVE-2025-7103 BoyunCMS curl Index.php server-side request forgery
A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The...
BoyunCMS 安全漏洞
BoyunCMS is an enterprise content management system from China Boyun Boyun Company. A security vulnerability exists in BoyunCMS 1.4.20 and earlier versions, which originates from improper handling of the component curl in the file /application/pay/controller/Index.php, which may lead to server-si...
curl: Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
Summary: The HTTP/2 proxy implementation in curl contains potential integer overflow vulnerabilities in buffer size calculations that could lead to memory corruption or denial of service. AI Usage Statement: This report was prepared by a human security researcher after manual code review. No AI w...
curl-8.14.1-4.1 on GA media (moderate)
curl-8.14.1-4.1 on GA media Announcement ID: openSUSE-SU-2025:15213-1 Rating: moderate Cross-References: CVE-2025-5399 CVSS scores: CVE-2025-5399 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2025-5399 SUSE : 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affect...
OPENSUSE-SU-2025:15213-1 curl-8.14.1-4.1 on GA media
These are all security issues fixed in the curl-8.14.1-4.1 package on the GA media of openSUSE Tumbleweed...
curl: HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling
Summary A logic flaw in libcurl version 8.14.1 allows an attacker to bypass restrictive HTTP proxy firewalls by "tunneling" an arbitrary HTTP verb within a CONNECT request. By setting CURLOPTCUSTOMREQUEST to CONNECT for a standard http:// URL, an attacker can trick libcurl into creating a hybrid...
Moodle 安全漏洞
Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from a DNS rebinding risk in cURL request processing...
Photon OS 3.0: Curl PHSA-2024-3.0-0743
An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-3.0-0743. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
CLSA-2025-1751135005 curl: Fix of CVE-2024-7264
CVE-2024-7264: fix out-of-bound read in GTime2str function...
curl: arbitrary file read via `file://` path traversal with `--path-as-is`
Summary: Using --path-as-is with a file:// URL skips normalization of .. segments allowing reading of any local file the process can access Affected version curl 8.15.0-DEV commit 2a9dfe275, June 27, 2025 on Kali Linux 2024.3, x8664 Steps To Reproduce: 1. bulild curl with debug and ASan: git clon...
Curl 8.13.0 < 8.14.1 DoS (CVE-2025-5399)
The version of Curl installed on the remote host is is missing security update. It is, therefore, affected by a denial of service vulnerability. - Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless...
CLSA-2025-1750785256 curl: Fix of CVE-2024-7264
CVE-2024-7264: fix out-of-bound read in GTime2str function...
