Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.5curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms.Jul 7, 2022
- Medium4.3A malicious server can serve excessive amounts of headers in a HTTP response to curl and curl < 7.84.0 stores all of them.Jul 7, 2022
- Medium5.3AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances.Jul 5, 2022
- High7.8An issue was discovered in the Linux kernel through 5.18.9.Jul 4, 2022
- Medium5.5A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat…Jun 30, 2022
- Medium5.5A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c.Jun 30, 2022
- High7.3In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metac…Jun 21, 2022
- Medium5.5Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclos…Jun 15, 2022
- Medium5.5Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.Jun 15, 2022
- Medium5.5Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.Jun 15, 2022
- Low3.3The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used.Jun 5, 2022
- High7.8net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an inc…Jun 2, 2022
- High7.5libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously us…Jun 2, 2022
- High7.5libcurl provides the option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server…Jun 2, 2022
- Medium6.5A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but ano…Jun 2, 2022
- High7.5An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a differe…Jun 2, 2022
- Medium5.7An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials wh…Jun 2, 2022
- Medium6.3An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem.Jun 2, 2022
- UnknownIn ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking.EPSS 0.1%Jun 1, 2022
- High8.1An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making…May 26, 2022
- High7.8A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_in…May 26, 2022
- High8.8WebKitGTK Memory Corruption VulnerabilityKEVEPSS 1.6%May 23, 2022
- High7.8A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some…May 16, 2022
- High7.5RARLAB UnRAR Directory Traversal VulnerabilityKEVEPSS 99.2%May 9, 2022
- Critical9.8In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query.May 4, 2022