Vulnerabilities > Haxx > Curl > 7.19.4
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-07-31 | CVE-2016-8624 | Improper Input Validation vulnerability in Haxx Curl curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. | 7.5 |
| 2018-07-31 | CVE-2016-8618 | Double Free vulnerability in Haxx Curl The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. | 9.8 |
| 2018-07-27 | CVE-2017-2629 | Improper Certificate Validation vulnerability in Haxx Curl curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. | 4.0 |
| 2018-04-23 | CVE-2016-9594 | Improper Initialization vulnerability in Haxx Curl curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. | 8.1 |
| 2018-04-23 | CVE-2016-9586 | Heap-based Buffer Overflow vulnerability in Haxx Curl curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. | 8.1 |
| 2018-03-14 | CVE-2018-1000120 | Out-of-bounds Write vulnerability in multiple products A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. | 7.5 |
| 2018-01-24 | CVE-2018-1000007 | libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. | 5.0 |
| 2017-06-14 | CVE-2017-9502 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Haxx Curl In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. | 5.0 |
| 2016-06-24 | CVE-2016-4802 | Permissions, Privileges, and Access Controls vulnerability in Haxx Curl Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or telnet is enabled, allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) security.dll, (2) secur32.dll, or (3) ws2_32.dll in the application or current working directory. | 6.9 |
| 2016-01-29 | CVE-2016-0755 | Improper Authentication vulnerability in multiple products The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015. | 5.0 |