39 matches found
CVE-2026-119037
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signaturevalid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read...
CVE-2026-119038
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirmresource takes no session token from the caller. It reads the redirect flow back from the...
CVE-2026-119036
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and...
EUVD-2026-113912
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirmresource takes no session token from the caller. It reads the redirect flow back from the...
CVE-2026-119038
The Business::GoCardless Perl module (versions before 1.01 ) is vulnerable to an authorization bypass. The confirm_resource function fails to verify the session token provided by the caller, instead reading the token directly from the GoCardless API response. This allows an attacker who obtains a...
CVE-2026-119038 Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirmresource takes no session token from the caller. It reads the redirect flow back from the...
EUVD-2026-113911
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signaturevalid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read...
CVE-2026-119037 Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signaturevalid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read...
CVE-2026-119037
The Business::GoCardless Perl module (versions before 1.01 ) is vulnerable to forged webhooks due to improper cryptographic signature verification. The signature_valid function fails to reject undef or empty strings as webhook secrets; instead, these are treated as empty keys by Digest::SHA . If ...
CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and...
EUVD-2026-113910
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and...
CVE-2026-119036
The Business::GoCardless Perl module (versions before 1.01 ) is vulnerable to memory exhaustion due to improper handling of legacy webhook payloads. The software flattens the payload into key-value pairs before verifying the signature; a long key containing a long array results in memory consumpt...
CVE-2026-119037: Improper Verification of Cryptographic Signature
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signaturevalid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read...
CVE-2026-119036: Allocation of Resources Without Limits or Throttling
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and...
PT-2026-133527
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm resource takes no session token from the caller. It reads the redirect flow back from the...
PT-2026-133526
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read...
PT-2026-133525
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and...
CVE-2026-119038: Authorization Bypass Through User-Controlled Key
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirmresource takes no session token from the caller. It reads the redirect flow back from the...
CVE-2026-46700
Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...
CVE-2026-46700
Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...