1001 matches found
Fedora 36 : curl (2022-d15a736748)
The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d15a736748 advisory. - fix too eager reuse of TLS and SSH connections CVE-2022-27782 - do not accept cookies for TLD with trailing dot CVE-2022-27779 - hsts: ignore...
[slackware-security] curl
New curl packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/curl-7.83.1-i586-1slack15.0.txz: Upgraded. This update fixes security issues: HSTS bypass via trailing dot. TLS and S...
CURL-CVE-2022-30115 HSTS bypass via trailing dot
curl's HSTS check could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This mechanism could be bypassed if the hostname in the given URL used ...
CVE-2022-30115
A vulnerability was found in curl. This issue occurs because when using its HTTP Strict Transport SecurityHSTS support, it can instruct curl to use HTTPS directly instead of using an insecure clear text HTTP step even when HTTP is provided in the URL. This flaw leads to a clear text transmission ...
CVE-2022-30115
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or th...
RHEL 8 : webkit2gtk3 (RHSA-2022:1777)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1777 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. The following packages have been upgraded to a later...
curl -- Multiple vulnerabilities
The curl project reports: CVE-2022-27778: curl removes wrong file on error CVE-2022-27779: cookie for trailing dot TLD CVE-2022-27780: percent-encoded path separator in URL host CVE-2022-27781: CERTINFO never-ending busy-loop CVE-2022-27782: TLS and SSH connection too eager reuse CVE-2022-30115:...
Moderate: webkit2gtk3 security, bug fix, and enhancement update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. The following packages have been upgraded to a later upstream version: webkit2gtk3 2.34.6. BZ1985042 Security Fixes: webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use...
webkit2gtk3 security, bug fix, and enhancement update
An update is available for webkit2gtk3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list WebKitGTK is the port of the portable web rendering engine WebKit to the...
CentOS 8 : webkit2gtk3 (CESA-2022:1777)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1777 advisory. - webkitgtk: Use-after-free leading to arbitrary code execution CVE-2021-30809 - webkitgtk: Type confusion issue leading to arbitrary code execution...
Mozilla Firefox Security Feature Issue Vulnerability (CNVD-2023-17326)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security signature issue vulnerability exists in Mozilla Firefox versions prior to 100.0 that stems from Firefox for Android not properly logging and retaining HSTS settings. An attacker can exploit...
Improper Access Cotrol
firefox is vulnerable to improper access control. The vulnerability exists because, when closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings which allows an attacker to gain access to the system...
curl: CVE-2022-30115: HSTS bypass via trailing dot
curl allows users to load a HSTS cache which will cause curl to use HTTPS instead of HTTP given a HTTP URL for a given site specified in the HSTS cache. If the trailing dot is used, the HSTS check will be bypassed. If a user has a preloaded hsts.txt: Your HSTS cache. https://curl.se/docs/hsts.htm...
Mozilla Firefox 输入验证错误漏洞
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security signature issue vulnerability exists in Mozilla Firefox versions prior to 100.0 that stems from Firefox for Android not properly logging and retaining HSTS settings. An attacker can exploit...
Security Vulnerabilities fixed in Firefox 100 — Mozilla
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existin...
Mozilla Firefox < 100.0
The version of Firefox installed on the remote Windows host is prior to 100.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-16 advisory. - Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in...
Mozilla Firefox < 100.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 100.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-16 advisory. - Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs...
PT-2022-2697
Name of the Vulnerable Software and Affected Versions cURL affected versions not specified Description The issue is related to the implementation of the HSTS HTTP Strict Transport Security mechanism in the cURL utility. It could be bypassed if the hostname in the given URL used a trailing dot whi...
HTTP Strict Transport Security (HSTS) Bypass
webkit2gtk is vulnerable to HTTP Strict Transport Security bypass. The vulnerability exists due to a lack of authentication of the security mechanism allowing an attacker to bypass the security HSTS...