Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 877

Export CSV
CVE-2024-52533

glib: buffer overflow in set_connect_msg()

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Debian Gnome Netapp and 1 more
Products
Debian Linux Glib Active Iq Unified Manager and 2 more
CVE-2024-2398

HTTP/2 push headers memory-leak

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

CVSS 3.1 · 8.6 High EPSS 36.1% KEV · Not listed
Vendors
Apple Curl Fedoraproject and 3 more
Products
Macos Curl Fedora and 24 more
CVE-2024-2379

QUIC certificate check bypass with wolfSSL

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

CVSS 3.1 · 6.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Apple Haxx Netapp and 1 more
Products
Macos Curl Active Iq Unified Manager and 18 more
CVE-2023-27538

curl: SSH connection too eager reuse still

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

CVSS 3.1 · 7.7 High EPSS 1.5% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 4 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 13 more
CVE-2023-27536

curl: GSS delegation too eager connection re-use

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

CVSS 3.1 · 5.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Fedoraproject Haxx and 3 more
Products
Debian Linux Fedora Libcurl and 13 more
CVE-2023-27535

curl: FTP too eager connection reuse

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

CVSS 3.1 · 5.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Fedoraproject Haxx and 3 more
Products
Debian Linux Fedora Libcurl and 13 more
CVE-2023-27534

curl: SFTP path ~ resolving discrepancy

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.

CVSS 3.1 · 8.8 High EPSS 2.4% KEV · Not listed
Vendors
Broadcom Fedoraproject Haxx and 3 more
Products
Brocade Fabric Operating System Firmware Fedora Curl and 12 more
CVE-2023-27533

curl: TELNET option IAC injection

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Haxx Netapp and 2 more
Products
Fedora Curl Active Iq Unified Manager and 12 more
CVE-2023-23915

curl: HSTS amnesia with --parallel

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Haxx Netapp Redhat and 1 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 10 more
CVE-2023-23914

curl: HSTS ignored on multiple requests

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Haxx Netapp Redhat and 1 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 10 more
CVE-2023-0361

gnutls: timing side-channel in the TLS RSA key exchange code

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

CVSS 3.1 · 7.4 High EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Gnu and 2 more
Products
Debian Linux Fedora Gnutls and 5 more
CVE-2022-45061

python: CPU denial of service via inefficient IDNA decoder

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Netapp Python and 1 more
Products
Fedora Active Iq Unified Manager Bootstrap Os and 10 more
CVE-2022-43680

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Fedoraproject Libexpat Project and 2 more
Products
Debian Linux Fedora Libexpat and 21 more
CVE-2022-43551

curl: HSTS bypass via IDN

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

CVSS 3.1 · 7.5 High EPSS 16.6% KEV · Not listed
Vendors
Fedoraproject Haxx Netapp and 2 more
Products
Fedora Curl Active Iq Unified Manager and 5 more
CVE-2022-40304

libxml2: dict corruption caused by entity reference cycles

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

CVSS 3.1 · 7.8 High EPSS 5.8% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-40303

libxml2: integer overflows with XML_PARSE_HUGE

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

CVSS 3.1 · 7.5 High EPSS 41.4% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more