165 results · Feed
-
High 8.8
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly r…
-
Medium 6.5
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functiona…
-
Critical 9.1
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functiona…
-
Medium 6.5
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HT…
-
Medium 5.9
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it support…
-
High 7.5CVE-2022-43551 EPSS 17%
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS…
-
Critical 9.8
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data …
-
High 8.1
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it se…
-
High 7.5
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, cur…
-
Low 3.7
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …
-
Medium 5.9
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…
-
Medium 4.3CVE-2022-32205 EPSS 31%
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 st…
-
Critical 9.8CVE-2022-32207 EPSS 12%
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the…
-
Medium 6.5CVE-2022-32206 EPSS 36%
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …
-
Medium 5.3
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, m…
-
High 7.5
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address th…
-
Unscored —
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header…
-
High 7.5
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…
-
Medium 5.7
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that c…
-
High 7.5
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's …
-
High 8.1
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-a…
-
Medium 5.9
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS …
-
High 7.5
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or F…
-
Critical 9.1
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointe…
-
Low 3.7CVE-2021-22924 Public exploit
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…
-
Medium 5.3
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used…
-
Low 3.1
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TEL…
-
Medium 4.3
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due…
-
Medium 5.3
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Act…
-
High 7.8
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead t…
-
Unscored —
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password…
-
Unscored —
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificati…
-
Unscored —
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
-
High 7.5
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildca…
-
Low 3.7
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP ad…
-
Critical 9.8CVE-2019-5482 EPSS 18%
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
-
Critical 9.8
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
-
High 7.8CVE-2019-5436 EPSS 50%
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4…
-
Medium 5.4CVE-2018-16890 Public exploit
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …
-
High 7.1CVE-2019-3822 EPSS 13%
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an…