CallBackery versions prior to 0.62.0 for Perl contain a vulnerability in the createRxValidator function where form field validation patterns are improperly constructed. This allows authenticated users to submit values that should be rejected by the intended pattern checks. Such values may then be written into generated configuration files, potentially leading to security issues related to configuration integrity.
CallBackery versions prior to 0.62.0 for Perl use a weak method to encrypt configuration backups by deriving the AES key directly from the backup password padded with 'x' characters and truncated to 32 bytes, without salt or key derivation. This allows an attacker who obtains a backup to perform fast offline password guessing at raw AES speed, potentially recovering all credentials stored in the backup.
CallBackery versions prior to 0.62.0 for Perl store user passwords using unsalted HMAC-SHA1 hashes without a key, resulting in identical hashes for identical passwords and no computational delay to slow guessing attacks. This weak password hashing approach allows an attacker who gains access to the user table to efficiently perform offline password guessing.
DateTime::Lite versions before 0.8.1 for Perl contain a vulnerability where adding a large number of seconds to a date-time object with a non-floating time zone causes a CPU exhaustion condition. This occurs because the _normalize_leap_seconds function processes time additions one day at a time without limiting the number of iterations, allowing an attacker to keep the process busy indefinitely.
Business::GoCardless versions before 1.01 for Perl accept forged webhooks if the configured webhook secret is undefined or empty. This occurs because the signature validation function does not reject empty or undefined secrets, allowing an attacker to forge webhook signatures using an empty key.
Starlet versions before 0.33 for Perl contain a vulnerability where a request declaring a large Content-Length header can cause a worker process to exhaust memory and exit unexpectedly. This occurs because the request body is read in a loop that attempts to allocate a buffer equal to the declared Content-Length before any data is received, leading to an uncatchable out-of-memory error. A remote attacker can exploit this by sending small requests with large Content-Length headers to repeatedly force worker restarts.
CallBackery versions prior to 0.62.0 for Perl create a world-readable configuration dump file in /tmp during backups. This dump contains sensitive data including all user password hashes and form values. The dump file is not removed after creation and inherits the process umask, allowing local users to read it or redirect it via a symlink to a file of their choosing.
HTTP::Parser::XS versions before 0.18 for Perl have a vulnerability where the PATH_INFO is truncated at an encoded NUL byte (%00) during HTTP request parsing. This occurs because the XS parser URL-decodes the request path and uses strlen() to measure it, causing the path to end prematurely at the first decoded NUL byte. The pure-Perl backend is not affected. This discrepancy can allow a remote attacker to send a path that a proxy or filter inspects fully, while the application routes on a truncated, shorter path.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw allows a low privileged attacker with remote access to potentially expose sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.1. No specific patch information is provided in the input data.
Dell OpenManage Enterprise versions prior to 4.8.0 have an Improper Restriction of Excessive Authentication Attempts vulnerability (CWE-307). This flaw allows an unauthenticated attacker with adjacent network access to potentially exploit the system, which could lead to phishing attacks. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity). No patch or remediation details are provided in the available data.
Starlet versions from 0.20 up to but not including 0.33 for Perl contain a vulnerability that allows remote attackers to exhaust memory via unbounded buffering when decoding chunked request bodies. The vulnerability arises because the decoder accumulates input in a buffer without limiting the length of chunk-size lines or the data of large chunks, enabling a single request to consume excessive memory.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an Insufficiently Protected Credentials vulnerability (CVE-2026-111502). This flaw allows a low privileged attacker with remote access to potentially disclose sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality. The CVSS score is 4.3 (medium severity).
CallBackery versions prior to 0.60.1 for Perl contain a path traversal vulnerability in the /doc route that allows unauthenticated clients to read the POD (Plain Old Documentation) of any file accessible by the server process. This occurs because the documentation plugin mounted at /doc does not validate input before passing it to Pod::Simple::Search->find, enabling traversal outside the intended directories.
Starlet versions from 0.20 up to but not including 0.33 for Perl contain a vulnerability that allows CPU exhaustion via regular expression backtracking when decoding chunked request bodies. The flaw arises because the chunk-size line matching can cause the regex engine to retry matches quadratically with the length of the input, and there is no limit on the length of the run. A remote attacker can exploit this by sending a specially crafted 128 KiB request, causing a worker to consume about a minute of CPU time.
FOSSBilling versions before 0.8.9 have a Cross-Site Request Forgery (CSRF) vulnerability in the staff guest login endpoint. This flaw allows remote attackers to force authentication by exploiting missing CSRF or Origin validation on the staff_login action. An attacker can craft an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.
Starlet versions before 0.33 for Perl improperly send a body in responses to HEAD requests, causing corruption of subsequent responses on persistent or pipelined HTTP connections. This occurs because the request method is not passed to the response writer, resulting in unintended body content being sent. This behavior can desynchronize clients or proxies sharing the connection.
A time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's net/sched act_api component could lead to a NULL pointer dereference. The issue arises from separate reads of a pointer that may be cleared concurrently, causing a NULL dereference in tcf_action_goto_chain_exec(). The flaw has been fixed by consolidating the pointer read and check into a single operation.
Python's ssl module has been updated to include a denylist of known compromised intermediate certificates. This enhancement ensures that such certificates are automatically rejected regardless of the SSLContext policy configuration, improving user security even when certificate revocation is not configured. The vulnerability affects multiple Python versions prior to their respective fixed releases.
The npm package 'tabby-fknat' version 0.1.2 contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, complete remediation may require rotating all secrets and keys from a different, trusted machine.