16 matches found
Security update for perl-Mojolicious (moderate)
openSUSE Security Update: Security update for perl-Mojolicious Announcement ID: openSUSE-SU-2026:0278-1 Rating: moderate References: 1271431 Cross-References: CVE-2026-15747 CVSS scores: CVE-2026-15747 SUSE: 5.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products:...
OPENSUSE-SU-2026:21496-1 Security update for perl-Mojolicious
This update for perl-Mojolicious fixes the following issues: Changes in perl-Mojolicious: - updated to 9.480.0 9.48 - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh random value on every request, instead of being reused for the whole...
openSUSE 16 Security Update : perl-Mojolicious (openSUSE-SU-2026:21451-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21451-1 advisory. Changes in perl-Mojolicious: - updated to 9.480.0 9.48 - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now mask...
perl-Mojolicious-9.480.0-1.1 on GA media (moderate)
perl-Mojolicious-9.480.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11282-1 Rating: moderate Cross-References: CVE-2026-15747 CVSS scores: CVE-2026-15747 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N CVE-2026-15747 SUSE : 5.9...
DEBIAN-CVE-2026-15747
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input...
CVE-2026-15747
creationtimestamp| type| source ---|---|--- 2026-07-14 17:41:05+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqmquxixea2t 2026-07-15 17:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqpbfq4srt2w 2026-07-16 09:32:04+00:00| seen|...
CVE-2018-15747
The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file...
MSC-2024-15747
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
CVE-2020-15747
CVE-2020-15747 entry is rejected/not used and does not represent an active vulnerability.
CVE-2019-15747
SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient checks on the server side...
CVE-2019-15747
CVE-2019-15747 affects SITOS six Build v6.2.1. A user with the Seminar Coordinator role can escalate to System Administrator due to insufficient server-side access checks, enabling privilege escalation. CVSS data in the records shows a high impact (CVSS‑3.1 base score 8.8) but no exploit details ...
CVE-2018-15747
The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file...
CVE-2018-15747
CVE-2018-15747 affects glot-www and its glot-code-runner component. The default configuration through 2018-05-19 allows remote attackers to execute arbitrary code by leveraging os.system within a Python/files/content JSON payload. This results in remote code execution (RCE) with network access an...
CVE-2018-15747
The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file...
CVE-2017-15747
CVE-2017-15747 affects IrfanView 4.50 (64-bit) with the CADImage plugin 12.0.0.5. A crafted .dwg file can trigger a Data Execution Prevention Violation and may allow arbitrary code execution or cause a denial of service. The connected SUSE/CVE and CNVD entries confirm the same affected product an...