Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Curl
CRITICAL 9.8
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
Curl
CRITICAL 9.8
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
Curl
HIGH 7.8
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 au…
Curl
CRITICAL 9.1
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in informatio…
Curl
CRITICAL 9.8
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.
Curl
CRITICAL 9.8
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and clea…
Curl
HIGH 7.5
curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.
Curl
CRITICAL 9.8
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
Curl
CRITICAL 9.8
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.
Curl
HIGH 7.5
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent reque…
Curl
HIGH 7.5
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information…
Curl
HIGH 7.5
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowing…
Curl
MEDIUM 5.9
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with…
Curl
HIGH 7.5
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.
Curl
HIGH 7.0
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as i…
Curl
CRITICAL 9.8
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplicat…
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to …
Curl
HIGH 7.5
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could in…
Curl
MEDIUM 6.5
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validi…
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is…
Curl
CRITICAL 9.8
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attac…
Curl
CRITICAL 9.8
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that…
Curl
HIGH 8.1
curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a …
Curl
HIGH 8.1
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() fu…
Curl
CRITICAL 9.8
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, al…
Curl
HIGH 8.1
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, ma…
Curl
CRITICAL 9.8
curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not refl…
Curl
CRITICAL 9.8
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libc…
Curl
CRITICAL 9.8
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow…
Curl
CRITICAL 9.8
The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application …