EUVD-2024-48211

Malicious code in bioql PyPI...

EUVD-2025-1809

Malicious code in bioql PyPI...

EUVD-2025-16332

Malicious code in bioql PyPI...

EUVD-2024-3571

Malicious code in bioql PyPI...

EUVD-2019-15026

Malicious code in bioql PyPI...

curl: AWS SigV4 Signature Disclosure via Verbose Logging in libcurl

Summary When libcurl is built with AWS SigV4 support, enabling verbose logging CURLOPTVERBOSE or --verbose causes the library to print both the string-to-sign and the final HMAC signature into logs. Because signatures remain valid for several minutes and are derived directly from AWS credentials,...

curl: Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurl

Summary: Concurrent SOCKS5 GSS-API authentications share a file-scope global gsscontext without synchronization, causing data races and undefined behavior. - Global context defined at: 52:54:curl/lib/socksgssapi.c static gssctxidt gsscontext = GSSCNOCONTEXT; - Passed by address into the GSS init...

CVE-2025-34199: Improper Certificate Validation

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 VA and SaaS deployments contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal...

Security Bulletin: Publicly disclosed libcurl vulnerabilities affects IBM Safer Payments (CVE-2024-9681)

Summary Libcurl is used by IBM Safer Payments as part of the AVRO support for Kafka. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2024-9681 DESCRIPTION: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making ...

Linux Distros Unpatched Vulnerability : CVE-2024-6197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to stack overwrite due to the libcurl package (CVE-2024-6197)

Summary libcurl is used by DataStage on Cloud Pak for Data as part of API communication. Vulnerability Details CVEID:CVE-2024-6197 DESCRIPTION: libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately...

Linux Distros Unpatched Vulnerability : CVE-2020-8231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. CVE-2020-8231 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2022-27782

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps...

Linux Distros Unpatched Vulnerability : CVE-2021-22924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, th...

The vulnerability of the libcurl library, related to errors in the certificate validation process, allows attackers to gain unauthorized access to protected information.

The vulnerability of the libcurl library is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the libcurl library, related to errors in the certificate validation process, allows attackers to gain unauthorized access to protected information.

The vulnerability of the libcurl library is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the WebSocket component in the libcurl library, related to infinite loop errors, allows attackers to cause a service failure.

The vulnerability of the WebSocket component in the libcurl library is related to infinite loop errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

CBL Mariner 2.0 Security Update: cmake / mysql (CVE-2025-4947)

The version of cmake / mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4947 advisory. - libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host...

Linux Distros Unpatched Vulnerability : CVE-2025-5399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop...

Tenable.ad < 3.77.12 Multiple Vulnerabilities (TNS-2025-14)

The version of Tenable.ad installed on the remote host is prior to 3.77.12. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-14 advisory. - Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcu...