Versions of cURL and libcurl prior to 7.47.0 are affected by multiple vulnerabilities :

 - A flaw exists that allows traversing outside of a restricted path. The issue is due to the program not properly sanitizing colon characters, specifically path traversal style attacks (e.g. '../') supplied via file names. With a specially crafted file name, a context-dependent attacker can write arbitrary files. (CVE-2016-0754)
 - A flaw exists in the 'ConnectionExists()' function in 'lib/url.c' that is triggered as credentials are not properly compared in proxy NTLM authentication. This may allow a remote attacker to reuse connections. (CVE-2016-0755)

The version of Dell EMC NetWorker installed on the remote Windows host is prior to 19.14.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2026-253 advisory, including the following:

  - The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to     execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY     field in crafted serialized data, aka the 'negative zero' issue. (CVE-2016-2108)

  - Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1     before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact via a malformed DSA private key. (CVE-2016-0705)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. On systems     with a 32 bit size_t, an integer overflow in Curl_ntlm_core_mk_nt_hash can cause a heap buffer overflow     when the password length exceeds 2GB. (CVE-2018-14618)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
9760	cURL/libcurl 7.x < 7.47.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/11/11	2019/3/6	medium
379578	Dell NetWorker < 19.14.0.1 Multiple Vulnerabilities (DSA-2026-253)	Nessus	Windows	2026/11/12	2026/11/12	critical

偵測

搜尋 Plugin

medium

critical