https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 07:00:03 +0000 https://cve.radiocsirt.org/vuln/cve-2026-5080 <p><strong>Affected:</strong> BIGPRESH Dancer::Session::Abstract</p> <p>Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely.</p> <p>The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand() function to return a number between 0 and 999-billion, and concatenating that result three times.</p> <p>The path name might be known or guessed by an attacker, especially for applications known to be written using Dancer with standard installation locations.</p> <p>The epoch time can be guessed by an attacker, and may be leaked in the HTTP header.</p> <p>The process id comes from a small set of numbers, and workers may have sequential process ids.</p> <p>The built-in rand() function is seeded with 32-bits and is considered unsuitable for security applications.</p> <p>Predictable session ids could allow an attacker to gain access to systems.</p> <p><strong>Affected:</strong> BIGPRESH Dancer::Session::Abstract</p> <p>Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely.</p> <p>The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand() function to return a number between 0 and 999-billion, and concatenating that result three times.</p> <p>The path name might be known or guessed by an attacker, especially for applications known to be written using Dancer with standard installation locations.</p> <p>The epoch time can be guessed by an attacker, and may be leaked in the HTTP header.</p> <p>The process id comes from a small set of numbers, and workers may have sequential process ids.</p> <p>The built-in rand() function is seeded with 32-bits and is considered unsuitable for security applications.</p> <p>Predictable session ids could allow an attacker to gain access to systems.</p> https://cve.radiocsirt.org/vuln/cve-2026-5080