CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 11/06/2021 |
| CVE-2021-22898 | BASSO3.1 | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data f | 11/06/2021 |
| CVE-2021-22897 | MEDIO5.3 | curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if | 11/06/2021 |
| CVE-2020-8284 | BASSO3.7 | A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. | 14/12/2020 |
| CVE-2020-8177 | ALTO7.8 | curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used. | 14/12/2020 |
| CVE-2020-8169 | ALTO7.5 | curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). | 14/12/2020 |
| CVE-2016-4606 | CRITICO9.8 | Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks. | 21/02/2020 |
| CVE-2019-5482 | CRITICO9.8 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. | 16/09/2019 |
| CVE-2019-5481 | CRITICO9.8 | Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. | 16/09/2019 |
| CVE-2019-5443 | ALTO7.8 | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants. | 02/07/2019 |
| CVE-2019-5435 | BASSO3.7 | An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. | 28/05/2019 |
| CVE-2018-16842 | CRITICO9.1 | Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. | 31/10/2018 |
| CVE-2018-16840 | CRITICO9.8 | A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write | 31/10/2018 |
| CVE-2018-16839 | CRITICO9.8 | Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. | 31/10/2018 |
| CVE-2003-1605 | ALTO7.5 | curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server. | 23/08/2018 |
| CVE-2016-8625 | ALTO7.5 | curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host. | 01/08/2018 |
| CVE-2016-8623 | ALTO7.5 | A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. | 01/08/2018 |
| CVE-2016-8620 | CRITICO9.8 | The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input. | 01/08/2018 |