Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2007-5034

elinks reveals POST data to HTTPS proxy

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Elinks Redhat
Products
Elinks Enterprise Linux
CVE-2006-5925

security flaw

Links web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbitrary code via shell metacharacters in an smb:// URI, as demonstrated by using PUT and GET statements.

CVSS 2.0 · 7.5 High EPSS 8.8% KEV · Not listed
Vendors
Elinks Links Redhat
Products
Elinks Links Enterprise Linux
CVE-2007-2027

elinks tries to load .po files from a non-absolute path

Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a "../po" directory, which can be leveraged to conduct format string attacks.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elinks Redhat
Products
Elinks Enterprise Linux
CVE-2008-7224

elinks: entity_cache static array buffer overflow (off-by-one)

Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link.

CVSS 2.0 · 7.8 High EPSS 2.8% KEV · Not listed
Vendors
Elinks Redhat
Products
Elinks Enterprise Linux
CVE-2002-1405

security flaw

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.

CVSS 2.0 · 5.0 Medium EPSS 5.0% KEV · Not listed
Vendors
Elinks Links Redhat and 1 more
Products
Elinks Links Enterprise Linux and 2 more
CVE-2012-4545

elinks: Improper delegation of client credentials during GSS negotiation

The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.

CVSS 2.0 · 5.1 Medium EPSS 1.9% KEV · Not listed
Vendors
Elinks Redhat
Products
Elinks Enterprise Linux
CVE-2012-6709

elinks/links: does not properly verify SSL certificates

ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Elinks Twibright
Products
Elinks Links