2 results · Clear filters · Feed
-
High 8.1
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who kn…
-
High 7.5
The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to gu…