CVE-2023-23914

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

• CWE-319
• CWE-319
• CWE-319

• https://hackerone.com/reports/1813864Exploit, Issue Tracking
• https://security.gentoo.org/glsa/202310-12Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230309-0006/Third Party Advisory
• https://hackerone.com/reports/1813864Exploit, Issue Tracking
• https://security.gentoo.org/glsa/202310-12Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230309-0006/Third Party Advisory

Published

Feb 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23909Out-of-bounds read for some Intel(R) Trace Analyzer and Coll…5.5
• CVE-2023-2391A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 a…4.8
• CVE-2023-23910Out-of-bounds write for some Intel(R) Trace Analyzer and Col…7.8
• CVE-2023-23911An improper access control vulnerability exists prior to v6 …7.5
• CVE-2023-23912A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5…8.8
• CVE-2023-23913There is a potential DOM based cross-site scripting issue in…6.3
• CVE-2023-23915A cleartext transmission of sensitive information vulnerabil…6.5
• CVE-2023-23916An allocation of resources without limits or throttling vuln…6.5
• CVE-2023-23917A prototype pollution vulnerability exists in Rocket.Chat se…8.8
• CVE-2023-23918A privilege escalation vulnerability exists in Node.js <19.6…7.5
• CVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18…7.5
• CVE-2023-2392A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8