Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8When doing HTTP(S) transfers, libcurl might erroneously use the read callback ( ) to ask for data to send, even when the option has been set, if the same handle previo…Check if you run itEPSS 5.09%Dec 5, 2022
- High7.5libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously us…Check if you run itEPSS 3.09%Jun 2, 2022
- High7.5libcurl provides the option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server…Check if you run itEPSS 2.90%Jun 2, 2022
- Medium5.3libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies.Check if you run itEPSS 2.79%Jun 2, 2022
- High7.5A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server ( on the command line or set to or wit…Check if you run itEPSS 4.54%Sep 29, 2021
- Critical9.1When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use t…Check if you run itEPSS 6.68%Sep 23, 2021
- High7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer.Check this weekEPSS 15.14%Aug 5, 2021
- Medium5.3curl supports the command line option, known as in libcurl.Check if you run itEPSS 5.37%Aug 5, 2021
- Low3.7libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the confi…Check if you run itEPSS 6.27%Aug 5, 2021
- High8.1curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.Check this weekEPSS 63.53%Jun 11, 2021
- Low3.1curl 7.7 through 7.76.1 suffers from an information disclosure when the command line option, known as in libcurl, is used to send variable=content pairs to TELNET serv…Check if you run itEPSS 4.51%Jun 11, 2021
- Medium5.3curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use…Check if you run itEPSS 4.26%Jun 11, 2021
- Low3.7curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets.Check if you run itEPSS 3.06%Apr 1, 2021
- Medium5.3curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header.Check if you run itEPSS 5.30%Apr 1, 2021
- High7.5curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.Check if you run itEPSS 4.63%Dec 14, 2020
- High7.5curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.Check if you run itEPSS 9.77%Dec 14, 2020
- High7.5Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.Check if you run itEPSS 5.34%Dec 14, 2020
- High7.8A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.Check this weekEPSS 49.74%May 28, 2019
- Low3.7An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.Check if you run itEPSS 5.66%May 28, 2019
44 records · page 2 of 2
PreviousNext