62 results · Clear filters · Feed
-
Medium 6.5
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided…
-
Medium 5.3
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used…
-
Medium 4.3
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due…
-
Medium 5.3
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Act…
-
Medium 5.4CVE-2018-16890 Public exploit
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …
-
Medium 4.3
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-…
-
Medium 4.4
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function…
-
Medium 4.3
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy…
-
Medium 4.3
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to…
-
Medium 5.3
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back…
-
Medium 5.3
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead user…
-
Medium 5.3
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
-
Medium 6.5
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read v…
-
Medium 5.3
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an inpu…
-
Medium 5.3
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with…
-
Medium 5.3
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to …
-
Medium 4.3
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the…
-
Medium 4.8
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client ce…
-
Medium 6.5
curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good …
-
Medium 5.9
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's imp…
-
Medium 6.5
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those number…
-
Medium 6.5
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 b…