Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 195

Export CSV
CVE-2022-1292

The c_rehash script allows command injection

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

CVSS 3.1 · 9.8 Critical EPSS 82.6% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 4 more
Products
Debian Linux Fedora A250 and 55 more
CVE-2015-5477

bind: TKEY query handling flaw leading to denial of service

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

CVSS 3.1 · 7.5 High EPSS 99.6% KEV · Listed
Vendors
Apple Canonical Debian and 10 more
Products
Os X Server Ubuntu Linux Debian Linux and 76 more
CVE-2023-27537

curl: HSTS double-free

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

CVSS 3.1 · 5.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Broadcom Haxx Netapp and 1 more
Products
Brocade Fabric Operating System Firmware Libcurl Active Iq Unified Manager and 10 more
CVE-2022-27779

curl: cookie for trailing dot TLD

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 12 more
CVE-2023-27538

curl: SSH connection too eager reuse still

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection.

CVSS 3.1 · 7.7 High EPSS 1.5% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 4 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 13 more
CVE-2023-27533

curl: TELNET option IAC injection

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Haxx Netapp and 2 more
Products
Fedora Curl Active Iq Unified Manager and 12 more
CVE-2023-23916

curl: HTTP multi-header compression denial of service

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Haxx and 3 more
Products
Debian Linux Fedora Curl and 16 more
CVE-2023-23915

curl: HSTS amnesia with --parallel

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Haxx Netapp Redhat and 1 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 10 more
CVE-2023-23914

curl: HSTS ignored on multiple requests

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Haxx Netapp Redhat and 1 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 10 more
CVE-2022-40304

libxml2: dict corruption caused by entity reference cycles

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

CVSS 3.1 · 7.8 High EPSS 5.8% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-40303

libxml2: integer overflows with XML_PARSE_HUGE

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

CVSS 3.1 · 7.5 High EPSS 41.4% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-35260

curl: .netrc parser out-of-bounds access

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Apple Haxx Netapp and 1 more
Products
Macos Curl Clustered Data Ontap and 9 more
CVE-2022-35252

curl: Incorrect handling of control code characters in cookies

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

CVSS 3.1 · 3.7 Low EPSS 3.8% KEV · Not listed
Vendors
Apple Debian Haxx and 3 more
Products
Macos Debian Linux Curl and 18 more
CVE-2022-32221

curl: POST following PUT confusion

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

CVSS 3.1 · 9.8 Critical EPSS 5.1% KEV · Not listed
Vendors
Apple Debian Haxx and 3 more
Products
Macos Debian Linux Curl and 13 more
CVE-2022-32208

curl: FTP-KRB bad message verification

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

CVSS 3.1 · 5.9 Medium EPSS 8.4% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 18 more
CVE-2022-32207

curl: Unpreserved file permissions

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

CVSS 3.1 · 9.8 Critical EPSS 12.3% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 18 more
CVE-2022-32206

curl: HTTP compression denial of service

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

CVSS 3.1 · 6.5 Medium EPSS 36.3% KEV · Not listed
Vendors
Debian Fedoraproject Haxx and 4 more
Products
Debian Linux Fedora Curl and 32 more
CVE-2022-32205

curl: Set-Cookie denial of service

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

CVSS 3.1 · 4.3 Medium EPSS 31.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 26 more
CVE-2022-30115

curl: HSTS bypass via trailing dot

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

CVSS 3.1 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 12 more