Www
Monthly
Local privilege escalation in WWW::Mechanize::Cached for Perl (versions before 2.00) allows authenticated local attackers to inject malicious cached HTTP responses and achieve arbitrary code execution. The module creates world-writable cache directories under /tmp/FileCache with 0777 permissions, enabling any local user to replace cached responses that are deserialized via Storable::thaw. EPSS exploitation probability is low (0.05%, 16th percentile) and no active exploitation is confirmed at time of analysis. Vendor-released patch available in version 2.00 with upstream fix confirmed via GitHub commit b821647.
WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. [CVSS 7.3 HIGH]
Local privilege escalation in WWW::Mechanize::Cached for Perl (versions before 2.00) allows authenticated local attackers to inject malicious cached HTTP responses and achieve arbitrary code execution. The module creates world-writable cache directories under /tmp/FileCache with 0777 permissions, enabling any local user to replace cached responses that are deserialized via Storable::thaw. EPSS exploitation probability is low (0.05%, 16th percentile) and no active exploitation is confirmed at time of analysis. Vendor-released patch available in version 2.00 with upstream fix confirmed via GitHub commit b821647.
WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. [CVSS 7.3 HIGH]