10898 matches found
Denial Of Service (DoS)
curl is vulnerable to denial of service. The vulnerability exists due to the never-ending busy-loop in erroneous function, allowing an attacker to cause an application crash by sending a HTTP request...
point-cli allows local users to obtain sensitive information by listing the process
lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...
SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2022:1657-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1657-1 advisory. - CVE-2022-27776: Fixed auth/cookie leak on redirect bsc1198766 - CVE-2022-27775: Fixed bad loca...
curl: CVE-2022-32205: Set-Cookie denial of service
Summary: Curl fails to limit the number of cookies that can be set by a single host/domain. It can easily lead to a situation where constructing the request towards a host will end up consuming more than DYNHTTPREQUEST memory, leading to instant CURLEOUTOFMEMORY. Any host in a given domain can...
curl: Credential leak when use two url
Summary: Curl can leak user credentials if use two url. Steps To Reproduce: 1. curl -I -v -u aaa:bbb hackerone.com curl.se 2. the output is: Connected to hackerone.com 104.16.100.52 port 80 0 Server auth using Basic with user 'aaa' HEAD / HTTP/1.1 Host: hackerone.com Authorization: Basic...
SUSE-SU-2022:1657-1 Security update for curl
This update for curl fixes the following issues: - CVE-2022-27776: Fixed auth/cookie leak on redirect bsc1198766 - CVE-2022-27775: Fixed bad local IPv6 connection reuse bsc1198723 - CVE-2022-22576: Fixed OAUTH2 bearer bypass in connection re-use bsc1198614...
Information Disclosure
curl is vulnerable to information disclosure. The vulnerability exists in url.c due to the cleartext transmission of sensitive information which allows an attacker to gain access to sensitive information...
curl: Credential leak on redirect
Summary: add summary of the vulnerability Curl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect , like the Proxy-Authorization 、x-auth-token header. It is a bypass of fix https://hackerone.com/reports/1547048 , CVE-2022-27776 . Steps To Reproduce: add details fo...
GHSA-JCGC-VXQG-85XX Sensitive Data Exposure in elFinder
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safemode or openbasedir is not set...
Sensitive Data Exposure in elFinder
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safemode or openbasedir is not set...
curl information leakage vulnerability
curl is a tool used to transfer data from and to servers. curl versions 7.82.0 to 7.83.1 are vulnerable to an information disclosure vulnerability that stems from the fact that libcurl incorrectly allows cookies to be set for top-level domains TLDs if the hostname has a trailing dot, which can te...
curl denial-of-service vulnerability (CNVD-2022-70596)
curl is a tool used to transfer data from or to a server. curl suffers from a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited by attackers to cause a denial of service of the application...
Fedora: Security Advisory for curl (FEDORA-2022-d15a736748)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
FreeBSD : curl -- Multiple vulnerabilities (11e36890-d28c-11ec-a06f-d4c9ef517024)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 11e36890-d28c-11ec-a06f-d4c9ef517024 advisory. - Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an...
[SECURITY] Fedora 36 Update: curl-7.82.0-5.fc36
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...
CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection
Rapid7 discovered and reported a vulnerability that affects Zyxel firewalls supporting Zero Touch Provisioning ZTP, which includes the ATP series, VPN series, and the USG FLEX series including USG20-VPN and USG20W-VPN. The vulnerability, identified as CVE-2022-30525, allows an unauthenticated and...
curl: error parse uri path in curl
Summary: add summary of the vulnerability The uri path error could lead to security filter bypasses. For example, we can use curl -vv 'fh-jle:///etc/passwd' to bypass file protocol black list we can use curl -vv 'http://1.1.1.1:80-9000' to scan the open port in the host etc ... Steps To Reproduce...
CVE-2022-27776 affecting package curl 7.76.0-9
CVE-2022-27776 affecting package curl 7.76.0-9. A patched version of the package is available...