curl 安全漏洞

curl is a cURL open source tool for transferring data from or to a server. A security vulnerability exists in curl that stems from a global change to the TLS option in multi-threaded LDAPS transfers, which could cause certificate validation to be accidentally disabled...

CVE-2025-14017

When doing multi-threaded LDAPS transfers LDAP over TLS with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally...

CVE-2022-27523

A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the curre...

CVE-2022-27607

Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4HvccAtom class, a different issue than CVE-2018-14531...

CVE-2019-16200

GNU Serveez through 0.2.2 has an Information Leak. An attacker may send an HTTP POST request to the /cgi-bin/reader URI. The attacker must include a Content-length header with a large positive value that, when represented in 32 bit binary, evaluates to a negative number. The problem exists in the...

CVE-2019-16748

In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer over-read in CheckCertSignatureex in wolfcrypt/src/asn.c...

CVE-2019-12198

In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header...

CVE-2019-12159

GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function when called from getRequestType via a long URL...

CVE-2025-1908

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

broken TLS options for threaded LDAPS

When doing multi-threaded LDAPS transfers LDAP over TLS with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally...

CVE-2025-47395 Buffer Over-read in WLAN Firmware

Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element...

CVE-2025-47395 Buffer Over-read in WLAN Firmware

Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element...

CVE-2025-47331 Buffer Over-read in Video

Information disclosure while processing a firmware event...

CVE-2025-47330

CVE-2025-47330 affects Qualcomm chipsets, with the issue described as a transient denial-of-service during parsing of video packets from the video firmware. The published metrics indicate local attack vector, low privileges, no user interaction, and an availability impact rated as high (CVSS 3.1:...

CVE-2025-47330 Buffer Over-read in Video

Transient DOS while parsing video packets received from the video firmware...

Exploit for CVE-2020-98765

FirmwareForge - Advanced Firmware & Hardware Exploitation Tool...

Cloud Agent in 2025: A Year of Scale, Security, and Smarter Visibility

As we move into 2026, 2025 stands out as a defining year for the Qualys Cloud Agent. In 2025, Cloud Agent delivered deeper visibility into running systems and applications , stronger security controls , expanded support across operating systems and architectures , and meaningful platform...

CVE-2025-65212

An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the...

CVE-2025-65212

CVE-2025-65212 (NJHYST HY511 POE core) : The vulnerability affects HY511 POE core prior to 2.1 and plugins prior to 0.1, arising from insufficient cookie verification. An attacker can directly request the configuration file address and download the core configuration file without authenticating t...

Medium: libpng12

Issue Overview: A heap buffer over-read vulnerability exists in libpng's pngdoquantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palettelookup array bounds are not validated against externally-supplied image data, allowing an attacker to craf...