Advisories · Technology
CJCOLLIER Google::Auth.
Every CVE that names CJCOLLIER Google::Auth among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call
- CJCOLLIER Google::Auth
- Command injection
- CWE-829
- CVSS 7.5 High
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON
- CJCOLLIER Google::Auth
- Information disclosure
- Server-side request forgery (SSRF)