Business-GoCardless versions before 1.01 for Perl contain an authorization bypass vulnerability where the redirect flow ID is not properly validated against the user session. This allows an attacker who obtains another customer's redirect flow ID to create payments or subscriptions against that customer's mandate without authorization. The flaw exists because the confirm_resource function does not verify the session token and completes redirect flows solely based on the redirect flow ID returned by the GoCardless API. The issue was fixed in version 1.01.
Business-GoCardless versions before 1.01 for Perl improperly verify cryptographic signatures on webhooks when the configured webhook secret is undefined or empty. This allows an attacker to forge webhooks by signing them with an empty key, which the system accepts as valid. The issue arises because the signature validation function does not reject empty or undefined secrets, which Digest::SHA treats as an empty key.
Business-GoCardless versions before 1.01 for Perl contain a vulnerability that allows remote attackers to exhaust memory by sending specially crafted webhook payloads. The flaw arises because legacy webhook payloads are flattened into key-value pairs without limits or throttling before signature verification, causing memory usage proportional to the payload size. This can lead to denial of service via memory exhaustion.
Starlet versions from 0.20 up to but not including 0.33 for Perl contain a vulnerability where unbounded buffering during decoding of chunked request bodies can lead to memory exhaustion. The decoder accumulates input without limits, allowing a remote attacker to exhaust a worker's memory with a single crafted request. This issue is fixed in version 0.33.
Starlet versions before 0.33 for Perl improperly send a body in responses to HEAD requests, causing corruption of subsequent responses on persistent or pipelined HTTP connections. This behavior can desynchronize proxies sharing connections across clients due to extra bytes being misinterpreted as the start of new responses. The issue is fixed in version 0.33.
Starlet versions from 0.20 up to but not including 0.33 for Perl contain an inefficient regular expression that can cause CPU exhaustion when decoding chunked request bodies. The flaw arises from a regex backtracking issue in parsing chunk-size lines, allowing a remote attacker to cause high CPU usage with a specially crafted request. This can occupy a worker thread for about a minute using a single 128 KiB request. The issue is fixed in version 0.33.
Starlet versions before 0.33 for Perl contain a vulnerability where a remote attacker can send a request with a large Content-Length header, causing the worker process to exhaust memory and exit with an uncatchable error. This leads to a denial of service by forcing worker restarts with minimal requests.
An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.
The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.
A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
The npm package @nexlayerlabs/postcss-keyframe-utils contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee elimination of the malicious software or attacker control.
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.
Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC.
Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.
phpMyAdmin versions up to 5.2.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows database users with CREATE privileges to inject malicious scripts via unescaped table names in the DesignerHistory.display() function. When another user interacts with the affected table name in Designer query mode, the injected script executes in their session.
vsftpd versions through 3.0.5 have an access control bypass vulnerability that allows authenticated FTP users to execute commands that should be denied. This occurs because the process_post_login() function's cmds_denied check compares literal tokens and does not properly handle RFC 775 X-prefixed aliases. Attackers can exploit this by sending commands such as XRMD, XMKD, XCWD, XPWD, or XCUP to perform restricted operations like deleting directories.
vsftpd versions through 3.0.5 have an authentication bypass vulnerability in the ssl_data_accept() function. This flaw allows unauthenticated attackers who share the victim's source IP to hijack FTPS data connections by resuming their own TLS session ticket. Attackers can obtain a ticket via AUTH TLS and then connect to the victim's PASV port to steal downloads or inject upload data.
Prometheus versions up to 3.15.1 have a credential leak vulnerability that enables attackers to capture Azure AD or Google IAM bearer tokens. This occurs when remote_write requests are redirected to a malicious host, allowing token replay and unauthorized metric writes to the victim's backend.
Plausible Analytics versions up to 3.2.1 have a mass assignment vulnerability in the update_traffic_change_notification function. Authenticated site editors can exploit this flaw by supplying a site_id parameter to reassign traffic change notifications to another site. This allows them to receive traffic alerts and visitor data for sites they do not own or manage.
Plausible Analytics Community Edition versions through 3.2.1 have an information exposure vulnerability that allows site editors to view pending invitation and ownership-transfer IDs. An attacker who obtains these IDs can register using the invitee's email and accept the invitation, thereby gaining the invited role or taking ownership of the site.
SQLite command-line shell versions through 3.54.1 have a command injection vulnerability in the .recover command. This flaw allows attackers to craft a database schema containing malicious dot-commands such as .shell or .system, which are emitted verbatim by the .recover command. When a victim pipes the output of .recover into sqlite3, these commands execute arbitrary OS commands.
SQLite versions prior to 3.54.0 have a stack exhaustion vulnerability in the countOfViewOptimization() function. This flaw can be triggered by executing a count(*) query over a large multi-row VALUES clause or by supplying a crafted view with deeply nested TK_PLUS expressions. The recursive freeing of these expressions in sqlite3ExprDeleteNN() exhausts the C stack, leading to a denial of service by crashing the host process.
OpenCart versions up to 4.1.0.4 have a business logic vulnerability that allows authenticated customers to place unpaid full-price orders by manipulating reward points after selecting the Free Checkout option. Attackers can apply reward points, save the Free Checkout selection, then submit zero points via the reward.save function, causing the order confirmation process to proceed without payment.