https://github.com/github/securitylab/issues/551

https://github.com/github/securitylab/issues/561

https://github.com/github/securitylab/issues/688

https://github.com/github/securitylab/issues/700

https://github.com/github/securitylab/issues/710

## Summary:
libcurl `Curl_getworkingpath` function resolves `~` as remote users' home directory. This routine behaves in an undocumented way for `sftp` protocol. In particular it is said that `/~/`...

## Summary:
libcurl FTP(S) protocol will reuse connection even if different `CURLOPT_FTP_ACCOUNT` (libcurl) or `--ftp-account` (curl) is specified for different connections and the server requests...

## Summary:
When considering reuse of existing connections different `CURLOPT_GSSAPI_DELEGATION` (libcurl) `--delegation` (curl) option is not taken into consideration. This can lead to reuse of...

## Summary:
There's a check if SSH keys match between new and existing connection when considering reuse. This check is broken due to wrong comparison:
`#define PROTO_FAMILY_SSH ...

## Summary:
`CURLOPT_TELNETOPTIONS` allows setting various telnet options for telnet protocol. Due to missing encoding of "Interpret as Command" `IAC` (0xff) character, the attacker who can control...

## Summary:
- I discovered an issue referred to as no-redirect in a subdomain on state.gov.
When you enter the page, it directs you directly to the entrance. When I examined it via burp suite, it...

###Summary
Hello,

I would to like report this security flaw on http://mtn1app.mtncameroon.net . Using script nuclei i can found CVE-2021-44228. This is a critical issue cause as remote command...

Hello,

I found a Reflected Cross site Scripting (XSS) on https://api.mtn.sd/carbon/admin/login.jsp, CVE-2020-17453 . With this security flaw is possible rewrite the content of page, executing...

###CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()

QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column...

Hello, I'm Shuva Saha (scriptshuva). Today, I will be discussing a vulnerability I discovered: bypass of two-factor authentication (2FA)…

Hello everyone,