https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 23:08:41 +0000 https://vulnerability.circl.lu/vuln/cve-2021-22876 <p><strong>Affected:</strong> https://github.com/curl/curl</p> <p>curl 7.1.1 to and including 7.75.0 is vulnerable to an &#34;Exposure of Private Personal Information to an Unauthorized Actor&#34; by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.</p> <p><strong>Affected:</strong> https://github.com/curl/curl</p> <p>curl 7.1.1 to and including 7.75.0 is vulnerable to an &#34;Exposure of Private Personal Information to an Unauthorized Actor&#34; by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.</p> https://vulnerability.circl.lu/vuln/cve-2021-22876 https://vulnerability.circl.lu/vuln/usn-4898-1 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: curl, Ubuntu:18.04:LTS: curl, Ubuntu:20.04:LTS: curl</p> <p>Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2021-22876)</p> <p>Mingtao Yang discovered that curl incorrectly handled session tickets when using an HTTPS proxy. A remote attacker in control of an HTTPS proxy could use this issue to bypass certificate checks and intercept communications. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-22890)</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: curl, Ubuntu:18.04:LTS: curl, Ubuntu:20.04:LTS: curl</p> <p>Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2021-22876)</p> <p>Mingtao Yang discovered that curl incorrectly handled session tickets when using an HTTPS proxy. A remote attacker in control of an HTTPS proxy could use this issue to bypass certificate checks and intercept communications. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-22890)</p> https://vulnerability.circl.lu/vuln/usn-4898-1