https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 02:35:21 +0000 https://cve.radiocsirt.org/vuln/cve-2026-56016 <p><strong>Affected:</strong> MARKSTOS CGI::Session::ID::md5</p> <p>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.</p> <p>The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&#39;s rand() is unsuitable for security purposes because it is predictable and reversible.</p> <p>An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.</p> <p><strong>Affected:</strong> MARKSTOS CGI::Session::ID::md5</p> <p>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.</p> <p>The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&#39;s rand() is unsuitable for security purposes because it is predictable and reversible.</p> <p>An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.</p> https://cve.radiocsirt.org/vuln/cve-2026-56016