10788 matches found
Security Bulletin: Vulnerabilities in Snappy, OpenSSL and cURL libcurl might affect IBM Storage Copy Data Management.
Summary IBM Storage Copy Data Management can be affected by vulnerabilities in Snappy, OpenSSL and cURL libcurl. An attacker, a local attacker or a remote attacker could exploit these vulnerabilities to cause JVM to crash, to cause a crash or memory contents to be sent to the peer, to bypass...
curl: Authorization Header Leak via --location-trusted in Curl
Curl's --location-trusted Option Leaks Authorization Header Across Domains The --location-trusted option in Curl forwards the Authorization header when following cross-origin redirects, exposing Basic Authentication credentials to untrusted hosts. - If an attacker controls a redirecting endpoint,...
OESA-2025-1025 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability has been found in cURL Network Utility Software and classified as problematic. Affected by this vulnerability is an unknown cod...
OESA-2025-1023 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability has been found in cURL Network Utility Software and classified as problematic. Affected by this vulnerability is an unknown cod...
OESA-2025-1021 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability has been found in cURL Network Utility Software and classified as problematic. Affected by this vulnerability is an unknown cod...
OESA-2025-1022 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability has been found in cURL Network Utility Software and classified as problematic. Affected by this vulnerability is an unknown cod...
[SECURITY] Fedora 41 Update: curl-8.9.1-3.fc41
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...
Medium: curl
Issue Overview: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform...
Medium: curl
Issue Overview: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform...
Fedora 41 : curl (2024-a94430d221)
The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a94430d221 advisory. - fix HSTS subdomain overwrites parent cache entry CVE-2024-9681 Tenable has extracted the preceding description block directly from the Fedora security...
Amazon Linux 2 : curl (ALAS-2025-2724)
The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2724 advisory. When curl is asked to use HSTS, the expiry time for a subdomain mightoverwrite a parent domain's cache entry, making it end sooner or...
Fedora 41 : php-tcpdf (2024-7d6412477b)
The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7d6412477b advisory. Version 6.8.0 2024-12-23 - Requires PHP 7.1+ and curl extension. - Escape error message. - Use strict time-constant function to compare TCPDF-tag...
PT-2025-47036
Name of the Vulnerable Software and Affected Versions curl versions prior to 8.17.0 Description The software is susceptible to a path traversal issue when handling URLs with percent-encoded slashes. This could allow an attacker to access files outside the intended directory. Recommendations Updat...
PT-2026-1657
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A bearer token leak occurs on a cross-protocol redirect. The issue involves curl and potentially allows unauthorized access due to the leakage of sensitive authentication tokens. Recommendations...
PT-2025-37027
Name of the Vulnerable Software and Affected Versions: curl affected versions not specified Description: The websocket code in curl did not update the 32-bit mask pattern for each new outgoing frame, as required by the specification. Instead, a fixed mask was used throughout the entire connection...
PT-2026-1660
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A key passphrase bypass is present in libssh when an agent is not set. This issue was discovered through analysis using curl. The potential impact is currently unknown. The vulnerability affects...
PT-2026-1658
Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description The curl software is subject to a security issue. Details regarding the nature of the issue are not available from the provided information. Recommendations At the moment, there is no informatio...
curl: CVE-2025-0167: netrc and default credential leak
Summary: The fix for CVE-2024-11053 seems to be incomplete.The information leak problem could be reproduced again if use netrc in step1. Affected version all Steps To Reproduce: 1. Adapt test479 to use netrc like belowboth of user and password are not provided for b.com: machine a.com login alice...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the unsafe configuration of CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER. Note: This is only exploitable when using libcurl. Remediation Upgrade tecnickcom/tcpdf to version 6.8.0 or higher...
