99 results · Feed
-
Critical 9.8CVE-2022-32207 EPSS 12%
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the…
-
Medium 6.5CVE-2022-32206 EPSS 36%
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …
-
Unscored —
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is use…
-
Medium 5.3
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, m…
-
High 7.5
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…
-
Unscored —
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.c…
-
High 7.5
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's …
-
Unscored —
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step e…
-
Medium 5.9
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS …
-
High 7.5
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or F…
-
Critical 9.1
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointe…
-
Low 3.7CVE-2021-22924 Public exploit
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…
-
Unscored —
When curl is instructed to get content using the metalink feature, and a user name and password are used to download th…
-
Medium 6.5
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided…
-
High 7.5CVE-2021-22926 EPSS 15%
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `C…
-
Medium 5.3
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used…
-
Unscored —CVE-2021-22901 EPSS 64%
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used whe…
-
Medium 5.3
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURL…
-
Low 3.1
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TEL…