CVSS: 9.8EPSS: 4%CPEs: 12EXPL: 0CVE-2015-3153 – Debian Security Advisory 3240-1
https://notcve.org/view.php?id=CVE-2015-3153
30 Apr 2015 — The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents. La configuración por defecto para cURL y libcurl anterior a 7.42.1 envía cabeceras HTTP personalizadas tanto al servidor proxy como al de destinación, lo que podría permitir a servidores proxy remotos obtener información sensible mediante la lectura de los contenidos de cabeceras... • http://curl.haxx.se/docs/adv_20150429.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 70%CPEs: 41EXPL: 1CVE-2015-3145 – Gentoo Linux Security Advisory 201509-02
https://notcve.org/view.php?id=CVE-2015-3145
22 Apr 2015 — The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character. La función sanitize_cookie_path en cURL y libcurl 7.31.0 hasta 7.41.0 no calcula correctamente un indice, lo que permite a atacantes remotos causar una denegación de servicio (escritura fuera de rango y ca... • https://github.com/serz999/CVE-2015-3145 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 3%CPEs: 159EXPL: 0CVE-2015-3148 – curl: Negotiate not treated as connection-oriented
https://notcve.org/view.php?id=CVE-2015-3148
22 Apr 2015 — cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request. cURL y libcurl 7.10.6 hasta la versión 7.41.0 no reutiliza adecuadamente la conexiones Negotiate autenticadas, lo que permite a atacantes remotos conectarse como otros usuarios a través de una solicitud. It was discovered that libcurl could incorrectly reuse Negotiate authenticated HTTP connections for subsequent requests. If an application... • http://advisories.mageia.org/MGASA-2015-0179.html • CWE-284: Improper Access Control CWE-287: Improper Authentication •
CVSS: 9.0EPSS: 1%CPEs: 19EXPL: 0CVE-2015-3144 – Gentoo Linux Security Advisory 201509-02
https://notcve.org/view.php?id=CVE-2015-3144
22 Apr 2015 — The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80." La función fix_hostname en cURL y libcurl 7.37.0 hasta 7.41.0 no calcula correctamente un indice, lo que permite a atacantes remotos causar una denegación de servicio (lectura o escritura fuera... • http://curl.haxx.se/docs/adv_20150422D.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 3%CPEs: 155EXPL: 0CVE-2015-3143 – curl: re-using authenticated connection when unauthenticated
https://notcve.org/view.php?id=CVE-2015-3143
22 Apr 2015 — cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015. cURL y libcurl 7.10.6 hasta 7.41.0 no reutilizan correctamente las conexiones NTLM, lo que permite a atacantes remotos conectar como otros usuarios a través de una solicitud no autenticada, un problema similar a CVE-2014-0015. It was discovered that libcurl could incorrectly reuse NTLM-authenticated connect... • http://advisories.mageia.org/MGASA-2015-0179.html • CWE-264: Permissions, Privileges, and Access Controls CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 1%CPEs: 17EXPL: 0CVE-2014-3613 – curl: incorrect handling of IP addresses in cookie domain
https://notcve.org/view.php?id=CVE-2014-3613
11 Sep 2014 — cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1. cURL y libcurl anteriores a 7.38.0 no manejan correctamente las direcciones IP en nombres de dominio de cookies, lo que permite a atacantes remotos usar cookies definidas por ellos mismos o enviar cookies arbitrarias a ciertos sitios, como or... • http://curl.haxx.se/docs/adv_20140910A.html • CWE-284: Improper Access Control CWE-310: Cryptographic Issues •
CVSS: 7.3EPSS: 2%CPEs: 17EXPL: 0CVE-2014-3620 – Mandriva Linux Security Advisory 2014-187
https://notcve.org/view.php?id=CVE-2014-3620
11 Sep 2014 — cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain. cURL y libcurl anteriores a 7.38.0 permite a atacantes remotos evadir Same Origin Policy y configurar cookies para sitios arbitrarios mediante la configuración de una cookie de un dominio de nivel superior. Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same serve... • http://curl.haxx.se/docs/adv_20140910B.html • CWE-310: Cryptographic Issues •
CVSS: 9.8EPSS: 1%CPEs: 130EXPL: 0CVE-2014-0139 – Gentoo Linux Security Advisory 201406-21
https://notcve.org/view.php?id=CVE-2014-0139
29 Mar 2014 — cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. cURL y libcurl 7.1 anterior a 7.36.0, cuando utilizando las librerías OpenSSL, axtls, gsossl o gskit para TLS, reconoce una dirección IP comodín (wildcard) en el ... • http://advisories.mageia.org/MGASA-2015-0165.html • CWE-310: Cryptographic Issues •
CVSS: 9.8EPSS: 2%CPEs: 131EXPL: 0CVE-2014-0138 – curl: wrong re-use of connections in libcurl
https://notcve.org/view.php?id=CVE-2014-0138
29 Mar 2014 — The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015. La configuración por defecto en cURL y libcurl 7.10.6 anterior a 7.36.0 re-utiliza conexiones (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP y (10) LDAP... • http://curl.haxx.se/docs/adv_20140326A.html • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 0%CPEs: 22EXPL: 0CVE-2014-2522 – Slackware Security Advisory - curl Updates
https://notcve.org/view.php?id=CVE-2014-2522
29 Mar 2014 — curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. curl y libcurl versiones 7.27.0 hasta 7.35.0, cuando se ejecuta en Windows y utiliza el backend TLS SChannel/W... • http://curl.haxx.se/docs/adv_20140326D.html • CWE-20: Improper Input Validation •