Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.9An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user per…EPSS 1.8%Mar 30, 2023
- Medium5.9An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers.EPSS 1.8%Mar 30, 2023
- High8.8A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path…EPSS 2.4%Mar 30, 2023
- High8.8A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name a…EPSS 2.2%Mar 30, 2023
- Medium6.5An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server…EPSS 1.7%Feb 23, 2023
- Medium6.5A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs ar…EPSS 0.9%Feb 23, 2023
- Critical9.1A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially.EPSS 0.9%Feb 23, 2023
- Medium5.9A use after free vulnerability exists in curl <7.87.0.EPSS 2.7%Feb 9, 2023
- High7.5A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.EPSS 16.6%Dec 23, 2022
- Medium6.5curl can be told to parse a file for credentials.EPSS 2.7%Dec 5, 2022
- Critical9.8When doing HTTP(S) transfers, libcurl might erroneously use the read callback ( ) to ask for data to send, even when the option has been set, if the same handle previo…EPSS 5.1%Dec 5, 2022
- High8.1curl before 7.86.0 has a double free.EPSS 2.9%Oct 29, 2022
- High7.5In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP.EPSS 2.0%Oct 29, 2022
- High7.5SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.EPSS 23.3%Aug 3, 2022
- Medium4.3Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL.EPSS 1.4%Jun 2, 2022
- High7.5libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously us…EPSS 3.1%Jun 2, 2022
- High7.5The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host n…EPSS 2.5%Jun 2, 2022
- Medium5.3libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies.EPSS 2.8%Jun 2, 2022
- High7.5An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a differe…EPSS 3.3%Jun 2, 2022
- Low3.1curl 7.7 through 7.76.1 suffers from an information disclosure when the command line option, known as in libcurl, is used to send variable=content pairs to TELNET serv…EPSS 4.5%Jun 11, 2021
- Critical9.8There's a flaw in lz4.EPSS 3.4%Jun 2, 2021
- Low3.7curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets.EPSS 3.1%Apr 1, 2021
- High7.5Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.EPSS 5.3%Dec 14, 2020
- High7.5curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).EPSS 3.9%Dec 14, 2020
49 records · page 2 of 2
PreviousNext