11 results · Feed
-
Critical 9.1
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field place…
-
Medium 6.5
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply …
-
High 8.1
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who kn…
-
Medium 5.3
Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default
Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's confi…
-
High 7.5
The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to gu…
-
Medium 4.3
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial …
-
Medium 5.3
The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to in…
-
Unscored —
Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified i…
-
Unscored —
Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote att…
-
Unscored —
Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files…