CallBackery versions before 0.62.0 for Perl contain a denial of service vulnerability due to unsafe interpolation of the request path as a regular expression under CGI, FastCGI, and PSGI environments. This allows an unauthenticated attacker to craft a request path with backreferences that causes exponential backtracking, potentially keeping a worker process busy for minutes.
CallBackery versions before 0.62.0 for Perl contain a vulnerability that allows OS command execution via sqlite3 shell commands embedded in a restored configuration backup. The restoreConfigBlob() function feeds a database dump from a backup to the sqlite3 command-line shell, which executes lines starting with a dot as shell commands. This enables an attacker who can supply a backup to execute arbitrary commands with the application's user privileges.
Business::GoCardless versions before 1.01 for Perl have a vulnerability where redirect flows are completed without verifying the session token. This allows an attacker who obtains another customer's redirect flow ID to create payments or subscriptions against that customer's mandate.
CallBackery versions before 0.62.0 for Perl expose users to information disclosure by sending them their own password hash and an admin-only note via the getUserConfig function. Non-administrative users can access sensitive notes intended only for administrators, and attackers with a session token can obtain password hashes to attempt offline cracking.
OpenManage Enterprise versions prior to 4.8.0 contain an improper resource locking vulnerability (CVE-2026-111498). This flaw could allow a high privileged local attacker to bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 4.7. No public exploits or known active exploitation have been reported. A fix is available starting from version 4.8.0.
CallBackery versions before 0.62.0 for Perl are vulnerable to log injection via newlines in the login name. The login() function writes the login name to application logs without escaping control characters, allowing an unauthenticated attacker to forge log records, including fake administrator login entries.
Business::GoCardless versions before 1.01 for Perl contain a vulnerability that allows remote attackers to exhaust memory by sending specially crafted legacy webhook payloads. The flaw arises because the software flattens the payload into key-value pairs before verifying the webhook signature, leading to memory exhaustion proportional to the payload size. This can be triggered with a single request carrying no valid signature.
CallBackery versions prior to 0.62.0 for Perl contain a vulnerability in the createRxValidator function where form field validation patterns are improperly constructed. This allows authenticated users to submit values that should be rejected by the intended pattern checks. Such values may then be written into generated configuration files, potentially leading to security issues related to configuration integrity.
CallBackery versions prior to 0.62.0 for Perl use a weak method to encrypt configuration backups by deriving the AES key directly from the backup password padded with 'x' characters and truncated to 32 bytes, without salt or key derivation. This allows an attacker who obtains a backup to perform fast offline password guessing at raw AES speed, potentially recovering all credentials stored in the backup.
CallBackery versions prior to 0.62.0 for Perl store user passwords using unsalted HMAC-SHA1 hashes without a key, resulting in identical hashes for identical passwords and no computational delay to slow guessing attacks. This weak password hashing approach allows an attacker who gains access to the user table to efficiently perform offline password guessing.
DateTime::Lite versions before 0.8.1 for Perl contain a vulnerability where adding a large number of seconds to a date-time object with a non-floating time zone causes a CPU exhaustion condition. This occurs because the _normalize_leap_seconds function processes time additions one day at a time without limiting the number of iterations, allowing an attacker to keep the process busy indefinitely.
Business::GoCardless versions before 1.01 for Perl accept forged webhooks if the configured webhook secret is undefined or empty. This occurs because the signature validation function does not reject empty or undefined secrets, allowing an attacker to forge webhook signatures using an empty key.
Starlet versions before 0.33 for Perl contain a vulnerability where a request declaring a large Content-Length header can cause a worker process to exhaust memory and exit unexpectedly. This occurs because the request body is read in a loop that attempts to allocate a buffer equal to the declared Content-Length before any data is received, leading to an uncatchable out-of-memory error. A remote attacker can exploit this by sending small requests with large Content-Length headers to repeatedly force worker restarts.
CallBackery versions prior to 0.62.0 for Perl create a world-readable configuration dump file in /tmp during backups. This dump contains sensitive data including all user password hashes and form values. The dump file is not removed after creation and inherits the process umask, allowing local users to read it or redirect it via a symlink to a file of their choosing.
HTTP::Parser::XS versions before 0.18 for Perl have a vulnerability where the PATH_INFO is truncated at an encoded NUL byte (%00) during HTTP request parsing. This occurs because the XS parser URL-decodes the request path and uses strlen() to measure it, causing the path to end prematurely at the first decoded NUL byte. The pure-Perl backend is not affected. This discrepancy can allow a remote attacker to send a path that a proxy or filter inspects fully, while the application routes on a truncated, shorter path.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw allows a low privileged attacker with remote access to potentially expose sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.1. No specific patch information is provided in the input data.
Dell OpenManage Enterprise versions prior to 4.8.0 have an Improper Restriction of Excessive Authentication Attempts vulnerability (CWE-307). This flaw allows an unauthenticated attacker with adjacent network access to potentially exploit the system, which could lead to phishing attacks. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity). No patch or remediation details are provided in the available data.
Starlet versions from 0.20 up to but not including 0.33 for Perl contain a vulnerability that allows remote attackers to exhaust memory via unbounded buffering when decoding chunked request bodies. The vulnerability arises because the decoder accumulates input in a buffer without limiting the length of chunk-size lines or the data of large chunks, enabling a single request to consume excessive memory.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an Insufficiently Protected Credentials vulnerability (CVE-2026-111502). This flaw allows a low privileged attacker with remote access to potentially disclose sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality. The CVSS score is 4.3 (medium severity).
CallBackery versions prior to 0.60.1 for Perl contain a path traversal vulnerability in the /doc route that allows unauthenticated clients to read the POD (Plain Old Documentation) of any file accessible by the server process. This occurs because the documentation plugin mounted at /doc does not validate input before passing it to Pod::Simple::Search->find, enabling traversal outside the intended directories.