PT-2026-28536

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description AVideo, an open source video platform, is susceptible to a Server-Side Request Forgery SSRF bypass. The isSSRFSafeURL function validates URLs against private IP ranges before fetching, but t...

Azure Linux 3.0 Security Update: cmake / curl (CVE-2024-6874)

The version of cmake / curl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6874 advisory. - libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a...

JLSEC-2025-37 libcurl's URL API function [`curl_url_get()`](https://curl.se/libcurl/c/curl_url_get.html) offers...

libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...

The vulnerability of the curl_url_get() function in the command-line utility cURL allows a attacker to cause a service failure.

The vulnerability of the curlurlget function in the command-line utility cURL is related to the release of previously unallocated memory due to the use of the Punycode method for converting IDN domains. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

SUSE CVE-2024-6874

libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...

AZL-49664 CVE-2024-6874 affecting package cmake for versions less than 3.30.3-2

libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...

PT-2024-5390

Name of the Vulnerable Software and Affected Versions cURL affected versions not specified Description The issue is related to the curl url get function in the cURL utility, which is used for Punycode conversions of IDN domains. When a name exactly 256 bytes is converted, it can cause the functio...

CVE-2023-4063: Uncontrolled Resource Consumption

Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request...

PT-2024-2421

Name of the Vulnerable Software and Affected Versions HP OfficeJet Pro printers affected versions not specified Description The issue is related to insufficient input validation in the printer's firmware, which can be exploited by a remote attacker to cause a Denial of Service. This can occur whe...

SUSE CVE-2012-4504

Stack-based buffer overflow in the url::getpac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file...

CVE-2021-24550: Improper Neutralization of Special Elements used in an SQL Command

The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue...

CVE-2002-2416: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. dot dot in a URL GET request...