Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:40:43 +0000 CVE-2023-46218 https://cve.radiocsirt.org/vuln/cve-2023-46218 <p><strong>Affected:</strong> curl, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE, Siemens RUGGEDCOM ROX RX1400, Siemens RUGGEDCOM ROX RX1500, Siemens RUGGEDCOM ROX RX1501, Siemens RUGGEDCOM ROX RX1510 and 6 more</p> <p>This flaw allows a malicious HTTP server to set &#34;super cookies&#34; in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.</p> <p>It could do this by exploiting a mixed case flaw in curl&#39;s function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.</p> <p><strong>Affected:</strong> curl, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE, Siemens RUGGEDCOM ROX RX1400, Siemens RUGGEDCOM ROX RX1500, Siemens RUGGEDCOM ROX RX1501, Siemens RUGGEDCOM ROX RX1510 and 6 more</p> <p>This flaw allows a malicious HTTP server to set &#34;super cookies&#34; in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.</p> <p>It could do this by exploiting a mixed case flaw in curl&#39;s function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.</p> https://cve.radiocsirt.org/vuln/cve-2023-46218