CVE-2024-24059

springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files...

springboot-manager Security Vulnerability

springboot-manager is a backend management system based on SpringBoot + Thymeleaf + Layui + Apache Shiro + Redis + Mybatis Plus by Chinese liwenbin individual developer. A security vulnerability exists in springboot-manager v1.6, which stems from the system not filtering the suffix of uploaded...

curl: information disclosure by exploiting a mixed case flaw

A flaw was found in curl that verifies a given cookie domain against the Public Suffix List. This issue could allow a malicious HTTP server to set "super cookies" in curl that are passed back to more origins than what is otherwise allowed or possible...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2024-1102)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

curl: information disclosure by exploiting a mixed case flaw

A flaw was found in curl that verifies a given cookie domain against the Public Suffix List. This issue could allow a malicious HTTP server to set "super cookies" in curl that are passed back to more origins than what is otherwise allowed or possible...

curl: information disclosure by exploiting a mixed case flaw

A flaw was found in curl that verifies a given cookie domain against the Public Suffix List. This issue could allow a malicious HTTP server to set "super cookies" in curl that are passed back to more origins than what is otherwise allowed or possible...

curl: information disclosure by exploiting a mixed case flaw

A flaw was found in curl that verifies a given cookie domain against the Public Suffix List. This issue could allow a malicious HTTP server to set "super cookies" in curl that are passed back to more origins than what is otherwise allowed or possible...

Curl 7.46.0 <= 8.4.0 Information Disclosure (CVE-2023-46218)

The version of Curl installed on the remote host is between 7.46.0 and 8.4.0. It is, therefore, affected by an information disclosure vulnerability. A mixed case flaw in Curl's function that verifies a given cookie domain against the Public Suffix List PSL allows a malicious HTTP server to set...

Debian DSA-5587-1 : curl - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5587 advisory. Two security issues were discovered in Curl: Cookies were incorrectly validated against the public suffix list of domains and in some cases HSTS data could...

OESA-2023-1913 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowe...

Out Of Date Public Suffix List

gsemac.net is vulnerable to Old Public Suffix List. The library utilizes an out of date Public Suffix list. This list contains all the public suffixes such as .net and .com...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20 (SUSE-SU-2023:4708-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4708-1 advisory. Update to go1.20.12: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// sche...

Stale copy of the public suffix list

We have identified that this project contains an out-of-date version of the Public Suffix List https://publicsuffix.org/. We are carrying out research to identify the potential impacts of using old versions of the Public Suffix List, and we intend to publish our results in academic conferences an...

GHSA-W4X6-HH3X-WJRX Stale copy of the public suffix list

We have identified that this project contains an out-of-date version of the Public Suffix List https://publicsuffix.org/. We are carrying out research to identify the potential impacts of using old versions of the Public Suffix List, and we intend to publish our results in academic conferences an...

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk` even though `co.uk` is listed as a PSL domain.

...

PT-2023-33064 · Unknown · Gsemac.Common

Name of the Vulnerable Software and Affected Versions: Gsemac.Common affected versions not specified Description: The project contains an out-of-date version of the Public Suffix List. Using old versions of the Public Suffix List can lead to incorrect construction of privacy boundaries between...

Cookie Mixed Case PSL Bypass

Curl is vulnerable to Cookie Mixed Case PSL Bypass. The vulnerability is caused due to a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List PSL. This allows a malicious HTTP server to set "super cookies" in curl that are passed back to more origi...

Golang 1.20.x < 1.20.12, 1.21.x < 1.21.5 Multiple Vulnerabilities

The version of Golang running on the remote host is prior to 1.20.12 or 1.21.x prior to 1.21.5. It is, therefore, is affected by multiple vulnerabilities : - A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from t...

SUSE CVE-2023-45285

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...

SUSE CVE-2023-46218

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a...