Date
Monthly
CPU exhaustion in the Perl module Date::Manip through version 6.99 allows unauthenticated remote attackers to cause unbounded denial of service by supplying strings containing long whitespace runs to any of the three exposed parsing entry points. The flaw is quadratic backtracking (CWE-1333) in the unanchored substitution within _parse_time: no time value is needed in the input, only a large block of whitespace, making it trivially deliverable via any user-controlled field that reaches the parser. SSVC rates this automatable with no confirmed active exploitation and EPSS sits at 0.19%, but any Internet-facing application that passes unsanitised date strings to Date::Manip is a viable DoS target.
Silent date corruption in Date::Manip through version 6.99 allows any caller passing untrusted character strings to ParseDate() or Date::Manip::Date->parse() to receive silently incorrect parsed dates when non-ASCII Unicode decimal digits (such as Arabic-Indic, Devanagari, or other Unicode script numerals) appear in year, month, or day fields. Perl's \d regex shorthand matches the full Unicode decimal-digit property (\p{Nd}), so non-ASCII digits are captured; subsequent numeric range validation then passes them because Perl truncates the string-to-number conversion at the first non-ASCII character, producing an in-range but wrong value — for example, '202٤' evaluates to year 202, not 2024. No public exploit has been identified at time of analysis and EPSS is very low (0.19%), but SSVC flags the flaw as automatable and the impact is meaningful for any application where Date::Manip parses externally-supplied dates to gate expiry checks, retention windows, or access-control logic.
Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission to create a date field to inject arbitrary web script or. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer Date Tools" privilege to. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable.
CPU exhaustion in the Perl module Date::Manip through version 6.99 allows unauthenticated remote attackers to cause unbounded denial of service by supplying strings containing long whitespace runs to any of the three exposed parsing entry points. The flaw is quadratic backtracking (CWE-1333) in the unanchored substitution within _parse_time: no time value is needed in the input, only a large block of whitespace, making it trivially deliverable via any user-controlled field that reaches the parser. SSVC rates this automatable with no confirmed active exploitation and EPSS sits at 0.19%, but any Internet-facing application that passes unsanitised date strings to Date::Manip is a viable DoS target.
Silent date corruption in Date::Manip through version 6.99 allows any caller passing untrusted character strings to ParseDate() or Date::Manip::Date->parse() to receive silently incorrect parsed dates when non-ASCII Unicode decimal digits (such as Arabic-Indic, Devanagari, or other Unicode script numerals) appear in year, month, or day fields. Perl's \d regex shorthand matches the full Unicode decimal-digit property (\p{Nd}), so non-ASCII digits are captured; subsequent numeric range validation then passes them because Perl truncates the string-to-number conversion at the first non-ASCII character, producing an in-range but wrong value — for example, '202٤' evaluates to year 202, not 2024. No public exploit has been identified at time of analysis and EPSS is very low (0.19%), but SSVC flags the flaw as automatable and the impact is meaningful for any application where Date::Manip parses externally-supplied dates to gate expiry checks, retention windows, or access-control logic.
Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission to create a date field to inject arbitrary web script or. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer Date Tools" privilege to. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable.