TC
Vendor
The curl Project
14
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2018-16890 | CU curl The curl Project | 7.5 | Feb 6 | libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read |
| CVE-2019-3823 | CU curl The curl Project | 7.5 | Feb 6 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP |
| CVE-2019-3822 | CU curl The curl Project | 9.8 | Feb 6 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow |
| CVE-2016-8619 | CU curl The Curl Project | 9.8 | Aug 1 | The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free |
| CVE-2016-8615 | CU curl The Curl Project | 7.5 | Aug 1 | A flaw was found in curl before version 7.51 |
| CVE-2016-8616 | CU curl The Curl Project | 5.9 | Aug 1 | A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections |
| CVE-2016-8620 | CU curl The Curl Project | 9.8 | Aug 1 | The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input |
| CVE-2016-8623 | CU curl The Curl Project | 7.5 | Aug 1 | A flaw was found in curl before version 7.51.0 |
| CVE-2016-8625 | CU curl The Curl Project | 7.5 | Aug 1 | curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer… |
| CVE-2016-8621 | CU curl The Curl Project | 7.5 | Jul 31 | The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short |
| CVE-2016-8617 | CU curl The Curl Project | 7.0 | Jul 31 | The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME` |
| CVE-2016-8624 | CU curl The Curl Project | 7.5 | Jul 31 | curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into… |
| CVE-2016-8622 | CU curl The Curl Project | 9.8 | Jul 31 | The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape` |
| CVE-2016-8618 | CU curl The Curl Project | 9.8 | Jul 31 | The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit… |