https://github.com/curl/curl.

Information disclosure in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure

Improper certificate validation in https://github.com/curl/curl

• https://github.com/curl/curl
• Weak cryptography or TLS

Uncontrolled resource consumption in https://github.com/curl/curl

• https://github.com/curl/curl
• Denial of service

Use after free in https://github.com/curl/curl

• https://github.com/curl/curl
• Memory corruption

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have pr…

• https://github.com/curl/curl
• CWE-305

Double free in https://github.com/curl/curl

• https://github.com/curl/curl
• Memory corruption

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to che…

• https://github.com/curl/curl
• CWE-305

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers.

• https://github.com/curl/curl
• CWE-305

Path traversal in https://github.com/curl/curl

• https://github.com/curl/curl
• Path traversal

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during serve…

• https://github.com/curl/curl
• CWE-75

Resource allocation without limits in https://github.com/curl/curl

• https://github.com/curl/curl
• Denial of service

Cleartext transmission of sensitive information in https://github.com/curl/curl

• https://github.com/curl/curl
• Weak cryptography or TLS

Cleartext transmission of sensitive information in https://github.com/curl/curl

• https://github.com/curl/curl
• Weak cryptography or TLS

Use after free in https://github.com/curl/curl

• https://github.com/curl/curl
• Memory corruption

Cleartext transmission of sensitive information in https://github.com/curl/curl

• https://github.com/curl/curl
• Weak cryptography or TLS

Out-of-bounds read in https://github.com/curl/curl

• https://github.com/curl/curl
• Memory corruption

Information disclosure in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure

Improper input validation in https://github.com/curl/curl

• https://github.com/curl/curl
• CWE-20

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.

• https://github.com/curl/curl
• CWE-840

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In…

• https://github.com/curl/curl
• CWE-840

Resource allocation without limits in https://github.com/curl/curl

• https://github.com/curl/curl
• Denial of service

Resource allocation without limits in https://github.com/curl/curl

• https://github.com/curl/curl
• Denial of service

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

• https://github.com/curl/curl
• CWE-706

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL.

• https://github.com/curl/curl
• CWE-325

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection p…

• https://github.com/curl/curl
• CWE-840

Uncontrolled resource consumption in https://github.com/curl/curl

• https://github.com/curl/curl
• Denial of service

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.F…

• https://github.com/curl/curl
• CWE-177

Information disclosure in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure

Insufficiently protected credentials in https://github.com/curl/curl

• https://github.com/curl/curl
• Hard-coded credentials

Information disclosure in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure

Insufficiently protected credentials in https://github.com/curl/curl

• https://github.com/curl/curl
• Hard-coded credentials

Improper authentication in https://github.com/curl/curl

• https://github.com/curl/curl
• Authentication bypass

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that c…

• https://github.com/curl/curl
• CWE-310

Cleartext transmission of sensitive information in https://github.com/curl/curl

• https://github.com/curl/curl
• Weak cryptography or TLS
• CWE-325

Double free in https://github.com/curl/curl

• https://github.com/curl/curl
• Memory corruption

Improper input validation in https://github.com/curl/curl

• https://github.com/curl/curl
• CWE-20

libcurl-using applications can ask for a specific client certificate to be used in a transfer.

• https://github.com/curl/curl
• CWE-840

Information disclosure in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure

Cleartext transmission of sensitive information in https://github.com/curl/curl

• https://github.com/curl/curl
• Weak cryptography or TLS

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to…

• https://github.com/curl/curl
• CWE-840

Use after free in https://github.com/curl/curl

• https://github.com/curl/curl
• Memory corruption

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library.

• https://github.com/curl/curl
• CWE-840

Information disclosure in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets.

• https://github.com/curl/curl
• CWE-300

Exposure of personal information in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

• https://github.com/curl/curl
• CWE-99

Information disclosure in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure

Improper certificate validation in https://github.com/curl/curl

• https://github.com/curl/curl
• Weak cryptography or TLS

Use after free in https://github.com/curl/curl

• https://github.com/curl/curl
• Memory corruption

Uncontrolled recursion in https://github.com/curl/curl

• https://github.com/curl/curl
• Denial of service

Information disclosure in https://github.com/curl/curl

• https://github.com/curl/curl
• Information disclosure