Most recent entries from all

bdu:2021-03510

Withdrawn: BELL-CVE-2020-8286 — CVE-2020-8286 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-314 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2021-avi-314

Withdrawn: CLEANSTART-2026-AY18527 — Security fixes for CVE-2014-0138, CVE-2014-0139, CVE-2016-5419, CVE-2016-5420, CVE-2016-5421, CVE-2016-7141, CVE-2016-7…

Withdrawn by the publisher.

Affected: CleanStart: curl

Multiple security vulnerabilities affect the curl package. These issues are resolved in later releases. See references for individual vulnerability details.

cnvd-2021-40504

EUVD-2026-201770

fkie_cve-2020-8286

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

GHSA-xh5x-q49r-r9w4

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

gsd-2020-8286

ICSA-21-159-10 — Siemens SIMATIC TIM libcurl

The libcurl library versions 7.62.0 to and including 7.70.0 are vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). The libcurl library versions 7.41.0 to and including 7.73.0 are vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. This vulnerability could allow an attacker to pass a revoked certificate as valid.

msrc_CVE-2020-8286 — curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificati…

msrc_CVE-2020-8286

OESA-2021-1004 — curl security update

Affected: openEuler:20.03-LTS: curl, openEuler:20.03-LTS-SP1: curl

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\n Security Fix(es):\r\n\r\n Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.(CVE-2020-8231)\r\n\r\n curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.(CVE-2020-8286)\r\n\r\n curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.(CVE-2020-8285)\r\n\r\n A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.(CVE-2020-8284)\r\n\r\n

openSUSE-SU-2020:2238-1 — Security update for curl

Security update for curl

RHSA-2021:2471 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update

libcurl: partial password leak over DNS on HTTP redirect curl: FTP PASV command response can cause curl to connect to arbitrary host curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used curl: Inferior OCSP verification curl: Leak of authentication credentials in URL via automatic Referer curl: TLS 1.3 session ticket mix-up with HTTPS proxy host curl: Use-after-free in TLS session handling when using OpenSSL TLS backend

SUSE-SU-2020:3733-1 — Security update for curl

Security update for curl

UBUNTU-CVE-2020-8286

Affected: Ubuntu:16.04:LTS: curl, Ubuntu:18.04:LTS: curl, Ubuntu:20.04:LTS: curl

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

VDE-2022-019 — Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components

For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

WID-SEC-W-2023-1350 — Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.