https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 16:37:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329229 EUVD-2026-329229 https://cve.radiocsirt.org/vuln/euvd-2026-329229 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9733 <p>Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.</p> <p>When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl&#39;s built-in rand function.</p> <p>A predictable state allows an attacker to hijack another user&#39;s session through cross site request forgery (CSRF).</p> <p>Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.</p> <p>When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl&#39;s built-in rand function.</p> <p>A predictable state allows an attacker to hijack another user&#39;s session through cross site request forgery (CSRF).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9733 https://cve.radiocsirt.org/vuln/ghsa-rq65-66g5-5pg2 <p>Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.</p> <p>When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl&#39;s built-in rand function.</p> <p>A predictable state allows an attacker to hijack another user&#39;s session through cross site request forgery (CSRF).</p> <p>Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.</p> <p>When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl&#39;s built-in rand function.</p> <p>A predictable state allows an attacker to hijack another user&#39;s session through cross site request forgery (CSRF).</p> https://cve.radiocsirt.org/vuln/ghsa-rq65-66g5-5pg2