Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: perlPackages.MojoliciousPluginAssetPack

Found 2 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-15747
created 5 days, 19 hours ago Activity log
  • Created suggestion 5 days, 19 hours ago
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.

Affected products

Mojolicious
  • <9.48

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-15344
6.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
created 5 months, 3 weeks ago Activity log
  • Created suggestion 5 months, 3 weeks ago
Tanium addressed a SQL injection vulnerability in Asset.

Tanium addressed a SQL injection vulnerability in Asset.

References

Affected products

Asset
  • <1.28.254
  • <1.32.161
  • <1.33.250

Matching in nixpkgs

pkgs.cassette

GTK4/Adwaita application that allows you to use Yandex Music service on Linux operating systems

pkgs.assetfinder

Find domains and subdomains related to a given domain

pkgs.assetripper

Tool for extracting assets from Unity serialized files and asset bundles

pkgs.taproot-assets

Daemon for the Taproot Assets protocol specification

Package maintainers