CVE-2023-23915

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.

• CWE-319
• CWE-319

• https://hackerone.com/reports/1826048Not Applicable
• https://security.gentoo.org/glsa/202310-12Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230309-0006/Third Party Advisory
• https://hackerone.com/reports/1826048Not Applicable
• https://security.gentoo.org/glsa/202310-12Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230309-0006/Third Party Advisory

Published

Feb 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2391A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 a…4.8
• CVE-2023-23910Out-of-bounds write for some Intel(R) Trace Analyzer and Col…7.8
• CVE-2023-23911An improper access control vulnerability exists prior to v6 …7.5
• CVE-2023-23912A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5…8.8
• CVE-2023-23913There is a potential DOM based cross-site scripting issue in…6.3
• CVE-2023-23914A cleartext transmission of sensitive information vulnerabil…9.1
• CVE-2023-23916An allocation of resources without limits or throttling vuln…6.5
• CVE-2023-23917A prototype pollution vulnerability exists in Rocket.Chat se…8.8
• CVE-2023-23918A privilege escalation vulnerability exists in Node.js <19.6…7.5
• CVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18…7.5
• CVE-2023-2392A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8
• CVE-2023-23920An untrusted search path vulnerability exists in Node.js. <1…4.2