Perl Onion

  •   AUTHORS
  •   CATEGORIES
  • #   TAGS

Use the logical-or and defined-or operators to provide default subroutine variable behaviour

Jul 6, 2013 by David Farrell

Perl subroutines do not have signatures so variables must be initialized and arguments assigned to them inside the subroutine code. This article describes two useful shortcuts that can simplify this process.

One trick that Perl programmers use is the logical-or operator (‘||’) to provide default behaviour for subroutine arguments. The default behaviour will only occur if the argument is provided is false (undefined, zero or a zero-length string). Imagine that we’re developing a subroutine that processes data for car insurance quotes - we’ll need to collect some basic data such as the applicant’s date of birth, sex and number of years driving. All of the arguments are mandatory - we can use the logical-or operator to return early if these arguments are false.

What this subroutine code does is assign the first element of the default array (@_) to $args using shift. By default shift will operate on @_, so there is no need to include it as an argument. Next the subroutine initializes and assigns the $dob and $sex variables. In both cases we use the logical-or (‘||’) operator to return early from the subroutine if these variables are false. This is a more concise code pattern than using an if statement block. We cannot use this trick to return early from the $years_driving variable as it may be provided as zero, which Perl treats as logical false but we want to keep. So in this case we have to first check if the argument was defined (which would include zero) and then use a ternary operator to either assign the value or return early.

Since version 5.10.0 Perl has has had the defined-or operator (‘//’). This will check if the variable is defined, and if it is not, Perl will execute the code on the right-side of the operator. We can use it to simplify our subroutine code:

In the modified code above, first we have included a line to use Perl 5.10.0 or greater - this will ensure that the version of Perl executing the code has the defined-or operator. Next we’ve simplified the code for $years_driving to use the logical-or operator. This will now accept zero as an argument, but return when $years_driving is undefined.

Default values

We can also use defined-or to provide default values for subroutine arguments. For example if we assumed that all users of our subroutine are male, we can change the $sex variable to default to ’M’.

Now if the $sex variable is undef, the process_quote_data subroutine will assign ’M’ as it’s value.

You can read more about these operators and in the perlop section of the official Perl documentation.

This article was originally posted on PerlTricks.com .

David Farrell

David is a professional programmer who regularly tweets and blogs about code and the art of programming.

Browse their articles

Something wrong with this article? Help us out by opening an issue or pull request on GitHub

To get in touch, send an email to [email protected] , or submit an issue to tpf/perldotcom on GitHub.

This work is licensed under a Creative Commons Attribution-NonCommercial 3.0 Unported License .

Creative Commons License

Perl.com and the authors make no representations with respect to the accuracy or completeness of the contents of all work on this website and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. The information published on this website may not be suitable for every situation. All work on this website is provided with the understanding that Perl.com and the authors are not engaged in rendering professional services. Neither Perl.com nor the authors shall be liable for damages arising herefrom.

logo

DESCRIPTION

This is in contrast to many other dynamic languages, where the operation is determined by the type of the first argument. It also means that Perl has two versions of some operators, one for numeric and one for string comparison. For example "$x == $y" compares two numbers for equality, and "$x eq $y" compares two strings.

There are a few exceptions though: "x" can be either string repetition or list repetition, depending on the type of the left operand, and "&" , "|" , "^" and "~" can be either string or numeric bit operations.

Operator Precedence and Associativity

Operator precedence means some operators are evaluated before others. For example, in "2 + 4 * 5" , the multiplication has higher precedence so "4 * 5" is evaluated first yielding "2 + 20 == 22" and not "6 * 5 == 30" .

Operator associativity defines what happens if a sequence of the same operators is used one after another: whether the evaluator will evaluate the left operations first, or the right first. For example, in "8 - 4 - 2" , subtraction is left associative so Perl evaluates the expression left to right. "8 - 4" is evaluated first making the expression "4 - 2 == 2" and not "8 - 2 == 6" .

Perl operators have the following associativity and precedence, listed from highest precedence to lowest. Operators borrowed from C keep the same precedence relationship with each other, even where C's precedence is slightly screwy. (This makes learning Perl easier for C folks.) With very few exceptions, these all operate on scalar values only, not array values.

In the following sections, these operators are covered in precedence order.

Many operators can be overloaded for objects. See overload.

Terms and List Operators (Leftward)

If any list operator ( "print()" , etc.) or any unary operator ( "chdir()" , etc.) is followed by a left parenthesis as the next token, the operator and arguments within parentheses are taken to be of highest precedence, just like a normal function call.

In the absence of parentheses, the precedence of list operators such as "print" , "sort" , or "chmod" is either very high or very low depending on whether you are looking at the left side or the right side of the operator. For example, in

the commas on the right of the "sort" are evaluated before the "sort" , but the commas on the left are evaluated after. In other words, list operators tend to gobble up all arguments that follow, and then act like a simple TERM with regard to the preceding expression. Be careful with parentheses:

Also note that

probably doesn't do what you expect at first glance. The parentheses enclose the argument list for "print" which is evaluated (printing the result of "$foo & 255" ). Then one is added to the return value of "print" (usually 1). The result is something like this:

To do what you meant properly, you must write:

See ``Named Unary Operators'' for more discussion of this.

Also parsed as terms are the "do {}" and "eval {}" constructs, as well as subroutine and method calls, and the anonymous constructors "[]" and "{}" .

See also ``Quote and Quote-like Operators'' toward the end of this section, as well as ``I/O Operators''.

The Arrow Operator

Otherwise, the right side is a method name or a simple scalar variable containing either the method name or a subroutine reference, and the left side must be either an object (a blessed reference) or a class name (that is, a package name). See perlobj.

The dereferencing cases (as opposed to method-calling cases) are somewhat extended by the experimental "postderef" feature. For the details of that feature, consult ``Postfix Dereference Syntax'' in perlref.

Auto-increment and Auto-decrement

Note that just as in C, Perl doesn't define when the variable is incremented or decremented. You just know it will be done sometime before or after the value is returned. This also means that modifying a variable twice in the same statement will lead to undefined behavior. Avoid statements like:

Perl will not guarantee what the result of the above statements is.

The auto-increment operator has a little extra builtin magic to it. If you increment a variable that is numeric, or that has ever been used in a numeric context, you get a normal increment. If, however, the variable has been used in only string contexts since it was set, and has a value that is not the empty string and matches the pattern "/^[a-zA-Z]*[0-9]*\z/" , the increment is done as a string, preserving each character within its range, with carry:

"undef" is always treated as numeric, and in particular is changed to 0 before incrementing (so that a post-increment of an undef value will return 0 rather than "undef" ).

The auto-decrement operator is not magical.

Exponentiation

Note that certain exponentiation expressions are ill-defined: these include "0**0" , "1**Inf" , and "Inf**0" . Do not expect any particular results from these special cases, the results are platform-dependent.

Symbolic Unary Operators

Unary "-" performs arithmetic negation if the operand is numeric, including any string that looks like a number. If the operand is an identifier, a string consisting of a minus sign concatenated with the identifier is returned. Otherwise, if the string starts with a plus or minus, a string starting with the opposite sign is returned. One effect of these rules is that "-bareword" is equivalent to the string "-bareword" . If, however, the string begins with a non-alphabetic character (excluding "+" or "-" ), Perl will attempt to convert the string to a numeric, and the arithmetic negation is performed. If the string cannot be cleanly converted to a numeric, Perl will give the warning Argument ``the string'' isn't numeric in negation (-) at ... .

Unary "~" performs bitwise negation, that is, 1's complement. For example, "0666 & ~027" is 0640. (See also ``Integer Arithmetic'' and ``Bitwise String Operators''.) Note that the width of the result is platform-dependent: "~0" is 32 bits wide on a 32-bit platform, but 64 bits wide on a 64-bit platform, so if you are expecting a certain bit width, remember to use the "&" operator to mask off the excess bits.

When complementing strings, if all characters have ordinal values under 256, then their complements will, also. But if they do not, all characters will be in either 32- or 64-bit complements, depending on your architecture. So for example, "~"\x{3B1}"" is "\x{FFFF_FC4E}" on 32-bit machines and "\x{FFFF_FFFF_FFFF_FC4E}" on 64-bit machines.

If the experimental ``bitwise'' feature is enabled via "use feature 'bitwise'" , then unary "~" always treats its argument as a number, and an alternate form of the operator, "~." , always treats its argument as a string. So "~0" and "~"0"" will both give 2**32-1 on 32-bit platforms, whereas "~.0" and "~."0"" will both yield "\xff" . This feature produces a warning unless you use "no warnings 'experimental::bitwise'" .

Unary "+" has no effect whatsoever, even on strings. It is useful syntactically for separating a function name from a parenthesized expression that would otherwise be interpreted as the complete list of function arguments. (See examples above under Terms and List Operators (Leftward).)

Unary "\" creates a reference to whatever follows it. See perlreftut and perlref. Do not confuse this behavior with the behavior of backslash within a string, although both forms do convey the notion of protecting the next thing from interpolation.

Binding Operators

If the right argument is an expression rather than a search pattern, substitution, or transliteration, it is interpreted as a search pattern at run time. Note that this means that its contents will be interpolated twice, so

is not ok, as the regex engine will end up trying to compile the pattern "\" , which it will consider a syntax error.

Binary "!~" is just like "=~" except the return value is negated in the logical sense.

Binary "!~" with a non-destructive substitution ( "s///r" ) or transliteration ( "y///r" ) is a syntax error.

Multiplicative Operators

Binary "/" divides two numbers.

Binary "%" is the modulo operator, which computes the division remainder of its first argument with respect to its second argument. Given integer operands $m and $n : If $n is positive, then "$m % $n" is $m minus the largest multiple of $n less than or equal to $m . If $n is negative, then "$m % $n" is $m minus the smallest multiple of $n that is not less than $m (that is, the result will be less than or equal to zero). If the operands $m and $n are floating point values and the absolute value of $n (that is "abs($n)" ) is less than "(UV_MAX + 1)" , only the integer portion of $m and $n will be used in the operation (Note: here "UV_MAX" means the maximum of the unsigned integer type). If the absolute value of the right operand ( "abs($n)" ) is greater than or equal to "(UV_MAX + 1)" , "%" computes the floating-point remainder $r in the equation "($r = $m - $i*$n)" where $i is a certain integer that makes $r have the same sign as the right operand $n ( not as the left operand $m like C function "fmod()" ) and the absolute value less than that of $n . Note that when "use integer" is in scope, "%" gives you direct access to the modulo operator as implemented by your C compiler. This operator is not as well defined for negative operands, but it will execute faster.

Binary "x" is the repetition operator. In scalar context or if the left operand is not enclosed in parentheses, it returns a string consisting of the left operand repeated the number of times specified by the right operand. In list context, if the left operand is enclosed in parentheses or is a list formed by "qw/ STRING /" , it repeats the list. If the right operand is zero or negative (raising a warning on negative), it returns an empty string or an empty list, depending on the context.

Additive Operators

Binary "-" returns the difference of two numbers.

Binary "." concatenates two strings.

Shift Operators

Binary ">>" returns the value of its left argument shifted right by the number of bits specified by the right argument. Arguments should be integers. (See also ``Integer Arithmetic''.)

Note that both "<<" and ">>" in Perl are implemented directly using "<<" and ">>" in C. If "use integer" (see ``Integer Arithmetic'') is in force then signed C integers are used, else unsigned C integers are used, even for negative shiftees. Either way, the implementation isn't going to generate results larger than the size of the integer type Perl was built with (32 bits or 64 bits).

The result of overflowing the range of the integers is undefined because it is undefined also in C. In other words, using 32-bit integers, "1 << 32" is undefined. Shifting by a negative number of bits is also undefined.

If you get tired of being subject to your platform's native integers, the "use bigint" pragma neatly sidesteps the issue altogether:

Named Unary Operators

If any list operator ( "print()" , etc.) or any unary operator ( "chdir()" , etc.) is followed by a left parenthesis as the next token, the operator and arguments within parentheses are taken to be of highest precedence, just like a normal function call. For example, because named unary operators are higher precedence than "||" :

but, because "*" is higher precedence than named operators:

Regarding precedence, the filetest operators, like "-f" , "-M" , etc. are treated like named unary operators, but they don't follow this functional parenthesis rule. That means, for example, that "-f($file).".bak"" is equivalent to "-f "$file.bak"" .

See also ``Terms and List Operators (Leftward)''.

Relational Operators

Binary "<" returns true if the left argument is numerically less than the right argument.

Binary ">" returns true if the left argument is numerically greater than the right argument.

Binary "<=" returns true if the left argument is numerically less than or equal to the right argument.

Binary ">=" returns true if the left argument is numerically greater than or equal to the right argument.

Binary "lt" returns true if the left argument is stringwise less than the right argument.

Binary "gt" returns true if the left argument is stringwise greater than the right argument.

Binary "le" returns true if the left argument is stringwise less than or equal to the right argument.

Binary "ge" returns true if the left argument is stringwise greater than or equal to the right argument.

Equality Operators

Binary "!=" returns true if the left argument is numerically not equal to the right argument.

Binary "<=>" returns -1, 0, or 1 depending on whether the left argument is numerically less than, equal to, or greater than the right argument. If your platform supports "NaN" 's (not-a-numbers) as numeric values, using them with "<=>" returns undef. "NaN" is not "<" , "==" , ">" , "<=" or ">=" anything (even "NaN" ), so those 5 return false. "NaN != NaN" returns true, as does "NaN !="   anything else . If your platform doesn't support "NaN" 's then "NaN" is just a string with numeric value 0.

(Note that the bigint, bigrat, and bignum pragmas all support "NaN" .)

Binary "eq" returns true if the left argument is stringwise equal to the right argument.

Binary "ne" returns true if the left argument is stringwise not equal to the right argument.

Binary "cmp" returns -1, 0, or 1 depending on whether the left argument is stringwise less than, equal to, or greater than the right argument.

Binary "~~" does a smartmatch between its arguments. Smart matching is described in the next section.

"lt" , "le" , "ge" , "gt" and "cmp" use the collation (sort) order specified by the current "LC_COLLATE" locale if a "use locale" form that includes collation is in effect. See perllocale. Do not mix these with Unicode, only use them with legacy 8-bit locale encodings. The standard "Unicode::Collate" and "Unicode::Collate::Locale" modules offer much more powerful solutions to collation issues.

For case-insensitive comparisions, look at the ``fc'' in perlfunc case-folding function, available in Perl v5.16 or later:

Smartmatch Operator

It is also unique in that all other Perl operators impose a context (usually string or numeric context) on their operands, autoconverting those operands to those imposed contexts. In contrast, smartmatch infers contexts from the actual types of its operands and uses that type information to select a suitable comparison mechanism.

The "~~" operator compares its operands ``polymorphically'', determining how to compare them according to their actual types (numeric, string, array, hash, etc.) Like the equality operators with which it shares the same precedence, "~~" returns 1 for true and "" for false. It is often best read aloud as ``in'', ``inside of'', or ``is contained in'', because the left operand is often looked for inside the right operand. That makes the order of the operands to the smartmatch operand often opposite that of the regular match operator. In other words, the ``smaller'' thing is usually placed in the left operand and the larger one in the right.

The behavior of a smartmatch depends on what type of things its arguments are, as determined by the following table. The first row of the table whose types apply determines the smartmatch behavior. Because what actually happens is mostly determined by the type of the second operand, the table is sorted on the right operand instead of on the left.

Right operand is a Regexp:

The smartmatch implicitly dereferences any non-blessed hash or array reference, so the " HASH " and " ARRAY " entries apply in those cases. For blessed references, the " Object " entries apply. Smartmatches involving hashes only consider hash keys, never hash values.

The ``like'' code entry is not always an exact rendition. For example, the smartmatch operator short-circuits whenever possible, but "grep" does not. Also, "grep" in scalar context returns the number of matches, but "~~" returns only true or false.

Unlike most operators, the smartmatch operator knows to treat "undef" specially:

Each operand is considered in a modified scalar context, the modification being that array and hash variables are passed by reference to the operator, which implicitly dereferences them. Both elements of each pair are the same:

Two arrays smartmatch if each element in the first array smartmatches (that is, is ``in'') the corresponding element in the second array, recursively.

Because the smartmatch operator recurses on nested arrays, this will still report that ``red'' is in the array.

If two arrays smartmatch each other, then they are deep copies of each others' values, as this example reports:

If you were to set "$b[3] = 4" , then instead of reporting that ``a and b are deep copies of each other'', it now reports that "b smartmatches in a" . That's because the corresponding position in @a contains an array that (eventually) has a 4 in it.

Smartmatching one hash against another reports whether both contain the same keys, no more and no less. This could be used to see whether two records have the same field names, without caring what values those fields might have. For example:

or, if other non-required fields are allowed, use ARRAY ~~ HASH:

The smartmatch operator is most often used as the implicit operator of a "when" clause. See the section on ``Switch Statements'' in perlsyn.

Smartmatching of Objects

To avoid relying on an object's underlying representation, if the smartmatch's right operand is an object that doesn't overload "~~" , it raises the exception " "Smartmatching a non-overloaded object breaks encapsulation" ``. That's because one has no business digging around to see whether something is ''in" an object. These are all illegal on objects without a "~~" overload:

However, you can change the way an object is smartmatched by overloading the "~~" operator. This is allowed to extend the usual smartmatch semantics. For objects that do have an "~~" overload, see overload.

Using an object as the left operand is allowed, although not very useful. Smartmatching rules take precedence over overloading, so even if the object in the left operand has smartmatch overloading, this will be ignored. A left operand that is a non-overloaded object falls back on a string or numeric comparison of whatever the "ref" operator returns. That means that

does not invoke the overload method with " X " as an argument. Instead the above table is consulted as normal, and based on the type of " X " , overloading may or may not be invoked. For simple strings or numbers, ``in'' becomes equivalent to this:

For example, this reports that the handle smells IOish (but please don't really do this!):

That's because it treats $fh as a string like "IO::Handle=GLOB(0x8039e0)" , then pattern matches against that.

Bitwise And

Note that "&" has lower priority than relational operators, so for example the parentheses are essential in a test like

If the experimental ``bitwise'' feature is enabled via "use feature 'bitwise'" , then this operator always treats its operand as numbers. This feature produces a warning unless you also use "no warnings 'experimental::bitwise'" .

Bitwise Or and Exclusive Or

Binary "^" returns its operands XORed together bit by bit.

Although no warning is currently raised, the results are not well defined when these operations are performed on operands that aren't either numbers (see ``Integer Arithmetic'') nor bitstrings (see ``Bitwise String Operators'').

Note that "|" and "^" have lower priority than relational operators, so for example the parentheses are essential in a test like

C-style Logical And

C-style logical or, logical defined-or.

The "||" , "//" and "&&" operators return the last value evaluated (unlike C's "||" and "&&" , which return 0 or 1). Thus, a reasonably portable way to find out the home directory might be:

In particular, this means that you shouldn't use this for selecting between two aggregates for assignment:

As alternatives to "&&" and "||" when used for control flow, Perl provides the "and" and "or" operators (see below). The short-circuit behavior is identical. The precedence of "and" and "or" is much lower, however, so that you can safely use them after a list operator without the need for parentheses:

With the C-style operators that would have been written like this:

It would be even more readable to write that this way:

Using "or" for assignment is unlikely to do what you want; see below.

Range Operators

The range operator also works on strings, using the magical auto-increment, see below.

In scalar context, ".." returns a boolean value. The operator is bistable, like a flip-flop, and emulates the line-range (comma) operator of sed , awk , and various editors. Each ".." operator maintains its own boolean state, even across calls to a subroutine that contains it. It is false as long as its left operand is false. Once the left operand is true, the range operator stays true until the right operand is true, AFTER which the range operator becomes false again. It doesn't become false till the next time the range operator is evaluated. It can test the right operand and become false on the same evaluation it became true (as in awk ), but it still returns true once. If you don't want it to test the right operand until the next evaluation, as in sed , just use three dots ( "..." ) instead of two. In all other regards, "..." behaves just like ".." does.

The right operand is not evaluated while the operator is in the ``false'' state, and the left operand is not evaluated while the operator is in the ``true'' state. The precedence is a little lower than || and &&. The value returned is either the empty string for false, or a sequence number (beginning with 1) for true. The sequence number is reset for each range encountered. The final sequence number in a range has the string "E0" appended to it, which doesn't affect its numeric value, but gives you something to search for if you want to exclude the endpoint. You can exclude the beginning point by waiting for the sequence number to be greater than 1.

If either operand of scalar ".." is a constant expression, that operand is considered true if it is equal ( "==" ) to the current input line number (the $. variable).

To be pedantic, the comparison is actually "int(EXPR) == int(EXPR)" , but that is only an issue if you use a floating point expression; when implicitly using $. as described in the previous paragraph, the comparison is "int(EXPR) == int($.)" which is only an issue when $. is set to a floating point value and you are not reading from a file. Furthermore, "span" .. "spat" or "2.18 .. 3.14" will not do what you want in scalar context because each of the operands are evaluated using their integer representation.

As a scalar operator:

Here's a simple example to illustrate the difference between the two range operators:

This program will print only the line containing ``Bar''. If the range operator is changed to "..." , it will also print the ``Baz'' line.

And now some examples as a list operator:

The range operator (in list context) makes use of the magical auto-increment algorithm if the operands are strings. You can say

to get all normal letters of the English alphabet, or

to get a hexadecimal digit, or

to get dates with leading zeros.

If the final value specified is not in the sequence that the magical increment would produce, the sequence goes until the next value would be longer than the final value specified.

If the initial value specified isn't part of a magical increment sequence (that is, a non-empty string matching "/^[a-zA-Z]*[0-9]*\z/" ), only the initial value will be returned. So the following will only return an alpha:

To get the 25 traditional lowercase Greek letters, including both sigmas, you could use this instead:

However, because there are many other lowercase Greek characters than just those, to match lowercase Greek characters in a regular expression, you could use the pattern "/(?:(?=\p{Greek})\p{Lower})+/" (or the experimental feature "/(?[ \p{Greek} & \p{Lower} ])+/" ).

Because each operand is evaluated in integer form, "2.18 .. 3.14" will return two elements in list context.

Conditional Operator

Scalar or list context propagates downward into the 2nd or 3rd argument, whichever is selected.

The operator may be assigned to if both the 2nd and 3rd arguments are legal lvalues (meaning that you can assign to them):

Because this operator produces an assignable result, using assignments without parentheses will get you in trouble. For example, this:

Really means this:

Rather than this:

That should probably be written more simply as:

Assignment Operators

Assignment operators work as in C. That is,

is equivalent to

although without duplicating any side effects that dereferencing the lvalue might trigger, such as from "tie()" . Other assignment operators work similarly. The following are recognized:

Although these are grouped by family, they all have the precedence of assignment. These combined assignment operators can only operate on scalars, whereas the ordinary assignment operator can assign to arrays, hashes, lists and even references. (See ``Context'' and ``List value constructors'' in perldata, and ``Assigning to References'' in perlref.)

Unlike in C, the scalar assignment operator produces a valid lvalue. Modifying an assignment is equivalent to doing the assignment and then modifying the variable that was assigned to. This is useful for modifying a copy of something, like this:

Although as of 5.14, that can be also be accomplished this way:

Similarly, a list assignment in list context produces the list of lvalues assigned to, and a list assignment in scalar context returns the number of elements produced by the expression on the right hand side of the assignment.

The three dotted bitwise assignment operators ( "&.=" "|.=" "^.=" ) are new in Perl 5.22 and experimental. See ``Bitwise String Operators''.

Comma Operator

In list context, it's just the list argument separator, and inserts both its arguments into the list. These arguments are also evaluated from left to right.

The "=>" operator (sometimes pronounced ``fat comma'') is a synonym for the comma except that it causes a word on its left to be interpreted as a string if it begins with a letter or underscore and is composed only of letters, digits and underscores. This includes operands that might otherwise be interpreted as operators, constants, single number v-strings or function calls. If in doubt about this behavior, the left operand can be quoted explicitly.

Otherwise, the "=>" operator behaves exactly as the comma operator or list argument separator, according to context.

For example:

is equivalent to:

It is NOT :

The "=>" operator is helpful in documenting the correspondence between keys and values in hashes, and other paired elements in lists.

The special quoting behavior ignores precedence, and hence may apply to part of the left operand:

That example prints something like "1314363215shiftbbb" , because the "=>" implicitly quotes the "shift" immediately on its left, ignoring the fact that "time.shift" is the entire left operand.

List Operators (Rightward)

However, some people find that code harder to read than writing it with parentheses:

in which case you might as well just use the more customary "||" operator:

See also discussion of list operators in Terms and List Operators (Leftward).

Logical Not

Logical and, logical or and exclusive or.

This means that it short-circuits: the right expression is evaluated only if the left expression is false. Due to its precedence, you must be careful to avoid using it as replacement for the "||" operator. It usually works out better for flow control than in assignments:

However, when it's a list-context assignment and you're trying to use "||" for control flow, you probably need "or" so that the assignment takes higher precedence.

Then again, you could always use parentheses.

Binary "xor" returns the exclusive-OR of the two surrounding expressions. It cannot short-circuit (of course).

There is no low precedence operator for defined-OR.

C Operators Missing From Perl

Quote and quote-like operators.

Non-bracketing delimiters use the same character fore and aft, but the four sorts of ASCII brackets (round, angle, square, curly) all nest, which means that

is the same as

Note, however, that this does not always work for quoting Perl code:

is a syntax error. The "Text::Balanced" module (standard as of v5.8, and from CPAN before then) is able to do this properly.

There can be whitespace between the operator and the quoting characters, except when "#" is being used as the quoting character. "q#foo#" is parsed as the string "foo" , while "q #foo#" is the operator "q" followed by a comment. Its argument will be taken from the next line. This allows you to write:

The following escape sequences are available in constructs that interpolate, and in transliterations:

Only hexadecimal digits are valid between the braces. If an invalid character is encountered, a warning will be issued and the invalid character and all subsequent characters (valid or invalid) within the braces will be discarded.

If there are no valid digits between the braces, the generated character is the NULL character ( "\x{00}" ). However, an explicit empty brace ( "\x{}" ) will not cause a warning (currently).

Only hexadecimal digits are valid following "\x" . When "\x" is followed by fewer than two valid digits, any valid digits will be zero-padded. This means that "\x7" will be interpreted as "\x07" , and a lone "\x" will be interpreted as "\x00" . Except at the end of a string, having fewer than two valid digits will result in a warning. Note that although the warning says the illegal character is ignored, it is only ignored as part of the escape and will still be used as the subsequent character in the string. For example:

In other words, it's the character whose code point has had 64 xor'd with its uppercase. "\c?" is DELETE on ASCII platforms because "ord("?") ^ 64" is 127, and "\c@" is NULL because the ord of "@" is 64, so xor'ing 64 itself produces 0.

Also, "\c\ X " yields " chr(28) . " X "" for any X , but cannot come at the end of a string, because the backslash would be parsed as escaping the end quote.

On ASCII platforms, the resulting characters from the list above are the complete set of ASCII controls. This isn't the case on EBCDIC platforms; see `` OPERATOR DIFFERENCES'' in perlebcdic for a full discussion of the differences between these for ASCII versus EBCDIC platforms.

Use of any other character following the "c" besides those listed above is discouraged, and as of Perl v5.20, the only characters actually allowed are the printable ASCII ones, minus the left brace "{" . What happens for any of the allowed other characters is that the value is derived by xor'ing with the seventh bit, which is 64, and a warning raised if enabled. Using the non-allowed characters generates a fatal error.

To get platform independent controls, you can use "\N{...}" .

If a character that isn't an octal digit is encountered, a warning is raised, and the value is based on the octal digits before it, discarding it and all following characters up to the closing brace. It is a fatal error if there are no octal digits at all.

Some contexts allow 2 or even 1 digit, but any usage without exactly three digits, the first being a zero, may give unintended results. (For example, in a regular expression it may be confused with a backreference; see ``Octal escapes'' in perlrebackslash.) Starting in Perl 5.14, you may use "\o{}" instead, which avoids all these problems. Otherwise, it is best to use this construct only for ordinals "\077" and below, remembering to pad to the left with zeros to make three digits. For larger ordinals, either use "\o{}" , or convert to something else, such as to hex and use "\N{U+}" (which is portable between platforms with different character sets) or "\x{}" instead.

There are a couple of exceptions to the above rule. "\N{U+ hex number }" is always interpreted as a Unicode code point, so that "\N{U+0050}" is "P" even on EBCDIC platforms. And if "use encoding" is in effect, the number is considered to be in that encoding, and is translated from that into the platform's native encoding if there is a corresponding native character; otherwise to Unicode.

NOTE : Unlike C and other languages, Perl has no "\v" escape sequence for the vertical tab ( VT, which is 11 in both ASCII and EBCDIC ), but you may use "\N{VT}" , "\ck" , "\N{U+0b}" , or "\x0b" . ( "\v" does have meaning in regular expression patterns in Perl, see perlre.)

The following escape sequences are available in constructs that interpolate, but not in transliterations.

See ``quotemeta'' in perlfunc for the exact definition of characters that are quoted by "\Q" .

"\L" , "\U" , "\F" , and "\Q" can stack, in which case you need one "\E" for each. For example:

If a "use locale" form that includes "LC_CTYPE" is in effect (see perllocale), the case map used by "\l" , "\L" , "\u" , and "\U" is taken from the current locale. If Unicode (for example, "\N{}" or code points of 0x100 or beyond) is being used, the case map used by "\l" , "\L" , "\u" , and "\U" is as defined by Unicode. That means that case-mapping a single character can sometimes produce a sequence of several characters. Under "use locale" , "\F" produces the same results as "\L" for all locales but a UTF-8 one, where it instead uses the Unicode definition.

All systems use the virtual "\n" to represent a line terminator, called a ``newline''. There is no such thing as an unvarying, physical newline character. It is only an illusion that the operating system, device drivers, C libraries, and Perl all conspire to preserve. Not all systems read "\r" as ASCII CR and "\n" as ASCII LF. For example, on the ancient Macs (pre-MacOS X) of yesteryear, these used to be reversed, and on systems without a line terminator, printing "\n" might emit no actual data. In general, use "\n" when you mean a ``newline'' for your system, but use the literal ASCII when you need an exact character. For example, most networking protocols expect and prefer a CR+LF ( "\015\012" or "\cM\cJ" ) for line terminators, and although they often accept just "\012" , they seldom tolerate just "\015" . If you get in the habit of using "\n" for networking, you may be burned some day.

For constructs that do interpolate, variables beginning with " "$" `` or '' "@" " are interpolated. Subscripted variables such as $a[3] or "$href->{key}[0]" are also interpolated, as are array and hash slices. But method calls such as "$obj->meth" are not.

Interpolating an array or slice interpolates the elements in order, separated by the value of $" , so is equivalent to interpolating "join $", @array" . ``Punctuation'' arrays such as "@*" are usually interpolated only if the name is enclosed in braces "@{*}" , but the arrays @_ , "@+" , and "@-" are interpolated even without braces.

For double-quoted strings, the quoting from "\Q" is applied after interpolation and escapes are processed.

For the pattern of regex operators ( "qr//" , "m//" and "s///" ), the quoting from "\Q" is applied after interpolation is processed, but before escapes are processed. This allows the pattern to match literally (except for "$" and "@" ). For example, the following matches:

Because "$" or "@" trigger interpolation, you'll need to use something like "/\Quser\E\@\Qhost/" to match them literally.

Patterns are subject to an additional level of interpretation as a regular expression. This is done as a second pass, after variables are interpolated, so that regular expressions may be incorporated into the pattern from the variables. If this is not what you want, use "\Q" to interpolate a variable literally.

Apart from the behavior described above, Perl does not expand multiple levels of interpolation. In particular, contrary to the expectations of shell programmers, back-quotes do NOT interpolate within double quotes, nor do single quotes impede evaluation of variables when used within double quotes.

Regexp Quote-Like Operators

For example,

The result may be used as a subpattern in a match:

Since Perl may compile the pattern at the moment of execution of the "qr()" operator, using "qr()" may have speed advantages in some situations, notably if the result of "qr()" is used standalone:

Precompilation of the pattern into an internal representation at the moment of "qr()" avoids the need to recompile the pattern every time a match "/$pat/" is attempted. (Perl has many other internal optimizations, but none would be triggered in the above example if we did not use "qr()" operator.)

Options (specified by the following modifiers) are:

If a precompiled pattern is embedded in a larger pattern then the effect of "msixpluadn" will be propagated appropriately. The effect that the "/o" modifier has is not propagated, being restricted to those patterns explicitly using it.

The last four modifiers listed above, added in Perl 5.14, control the character set rules, but "/a" is the only one you are likely to want to specify explicitly; the other three are selected automatically by various pragmas.

See perlre for additional information on valid syntax for STRING , and for a detailed look at the semantics of regular expressions. In particular, all modifiers except the largely obsolete "/o" are further explained in ``Modifiers'' in perlre. "/o" is described in the next section.

Options are as described in "qr//" above; in addition, the following match process modifiers are available:

If "/" is the delimiter then the initial "m" is optional. With the "m" you can use any pair of non-whitespace ( ASCII ) characters as delimiters. This is particularly useful for matching path names that contain "/" , to avoid LTS (leaning toothpick syndrome). If "?" is the delimiter, then a match-only-once rule applies, described in "m? PATTERN ?" below. If "'" (single quote) is the delimiter, no interpolation is performed on the PATTERN . When using a delimiter character valid in an identifier, whitespace is required after the "m" .

PATTERN may contain variables, which will be interpolated every time the pattern search is evaluated, except for when the delimiter is a single quote. (Note that $( , $) , and $| are not interpolated because they look like end-of-string tests.) Perl will not recompile the pattern unless an interpolated variable that it contains changes. You can force Perl to skip the test and never recompile by adding a "/o" (which stands for ``once'') after the trailing delimiter. Once upon a time, Perl would recompile regular expressions unnecessarily, and this modifier was useful to tell it not to do so, in the interests of speed. But now, the only reasons to use "/o" are one of:

then perl will recompile each time, even though the pattern string hasn't changed, to ensure that the current value of $x is seen each time. Use "/o" if you want to avoid this.

The bottom line is that using "/o" is almost never a good idea.

Note that it's possible to confuse Perl into thinking "//" (the empty regex) is really "//" (the defined-or operator). Perl is usually pretty good about this, but some pathological cases might trigger this, such as "$x///" (is that "($x) / (//)" or "$x // /" ?) and "print $fh //" ( "print $fh(//" or "print($fh //" ?). In all of these examples, Perl will assume you meant defined-or. If you meant the empty regex, just use parentheses or spaces to disambiguate, or even prefix the empty regex with an "m" (so "//" becomes "m//" ).

This last example splits $foo into the first two words and the remainder of the line, and assigns those three fields to $F1 , $F2 , and $Etc . The conditional is true if any variables were assigned; that is, if the pattern matched.

The "/g" modifier specifies global pattern matching---that is, matching as many times as possible within the string. How it behaves depends on the context. In list context, it returns a list of the substrings matched by any capturing parentheses in the regular expression. If there are no parentheses, it returns a list of all the matched strings, as if there were parentheses around the whole pattern.

In scalar context, each execution of "m//g" finds the next match, returning true if it matches, and false if there is no further match. The position after the last match can be read or set using the "pos()" function; see ``pos'' in perlfunc. A failed match normally resets the search position to the beginning of the string, but you can avoid that by adding the "/c" modifier (for example, "m//gc" ). Modifying the target string also resets the search position.

Here's another way to check for sentences in a paragraph:

Here's how to use "m//gc" with "\G" :

The last example should print:

Notice that the final match matched "q" instead of "p" , which a match without the "\G" anchor would have done. Also note that the final match did not update "pos" . "pos" is only updated on a "/g" match. If the final match did indeed match "p" , it's a good bet that you're running a very old (pre-5.6.0) version of Perl.

A useful idiom for "lex" -like scanners is "/\G.../gc" . You can combine several regexps like this to process a string part-by-part, doing different actions depending on which regexp matched. Each regexp tries to match where the previous one leaves off.

Here is the output (split into several lines):

Another example switched the first ``latin1'' encoding it finds to ``utf8'' in a pod file:

The match-once behavior is controlled by the match delimiter being "?" ; with any other delimiter this is the normal "m//" operator.

In the past, the leading "m" in "m? PATTERN ?" was optional, but omitting it would produce a deprecation warning. As of v5.22.0, omitting it produces a syntax error. If you encounter this construct in older code, you can just add "m" .

If the "/r"

If no string is specified via the "=~" or "!~" operator, the $_ variable is searched and modified. Unless the "/r" option is used, the string specified must be a scalar variable, an array element, a hash element, or an assignment to one of those; that is, some sort of scalar lvalue.

If the delimiter chosen is a single quote, no interpolation is done on either the PATTERN or the REPLACEMENT . Otherwise, if the PATTERN contains a "$" that looks like a variable rather than an end-of-string test, the variable will be interpolated into the pattern at run-time. If you want the pattern compiled only once the first time the variable is interpolated, use the "/o" option. If the pattern evaluates to the empty string, the last successfully executed regular expression is used instead. See perlre for further explanation on these.

Options are as with "m//" with the addition of the following replacement specific options:

Any non-whitespace delimiter may replace the slashes. Add space after the "s" when using a character allowed in identifiers. If single quotes are used, no interpretation is done on the replacement string (the "/e" modifier overrides this, however). Note that Perl treats backticks as normal delimiters; the replacement text is not evaluated as a command. If the PATTERN is delimited by bracketing quotes, the REPLACEMENT has its own pair of quotes, which may or may not be bracketing quotes, for example, "s(foo)(bar)" or "s<foo>/bar/" . A "/e" will cause the replacement portion to be treated as a full-fledged Perl expression and evaluated right then and there. It is, however, syntax checked at compile-time. A second "e" modifier will cause the replacement portion to be "eval" ed before being run as a Perl expression.

Note the use of "$" instead of "\" in the last example. Unlike sed , we use the \< digit > form only in the left hand side. Anywhere else it's $< digit >.

Occasionally, you can't use just a "/g" to get all the changes to occur that you might want. Here are two common cases:

Quote-Like Operators

Because backticks do not affect standard error, use shell file descriptor syntax (assuming the shell supports this) if you care to address this. To capture a command's STDERR and STDOUT together:

To capture a command's STDOUT but discard its STDERR:

To capture a command's STDERR but discard its STDOUT (ordering is important here):

To exchange a command's STDOUT and STDERR in order to capture the STDERR but leave its STDOUT to come out the old STDERR:

To read both a command's STDOUT and its STDERR separately, it's easiest to redirect them separately to files, and then read from those files when the program is done:

The STDIN filehandle used by the command is inherited from Perl's STDIN. For example:

will print the sorted contents of the file named ``stuff'' .

Using single-quote as a delimiter protects the command from Perl's double-quote interpolation, passing it on to the shell instead:

How that string gets evaluated is entirely subject to the command interpreter on your system. On most platforms, you will have to protect shell metacharacters if you want them treated literally. This is in practice difficult to do, as it's unclear how to escape which characters. See perlsec for a clean and safe example of a manual "fork()" and "exec()" to emulate backticks safely.

On some platforms (notably DOS-like ones), the shell may not be capable of dealing with multiline commands, so putting newlines in the string may not get you what you want. You may be able to evaluate multiple commands in a single line by separating them with the command separator character, if your shell supports that (for example, ";" on many Unix shells and "&" on the Windows NT "cmd" shell).

Perl will attempt to flush all files opened for output before starting the child process, but this may not be supported on some platforms (see perlport). To be safe, you may need to set $| ( $AUTOFLUSH in "English" ) or call the "autoflush()" method of "IO::Handle" on any open handles.

Beware that some command shells may place restrictions on the length of the command line. You must ensure your strings don't exceed this limit after any necessary interpolations. See the platform-specific release notes for more details about your particular environment.

Using this operator can lead to programs that are difficult to port, because the shell commands called vary between systems, and may in fact not be present at all. As one example, the "type" command under the POSIX shell is very different from the "type" command under DOS. That doesn't mean you should go out of your way to avoid backticks when they're the right way to get something done. Perl was made to be a glue language, and one of the things it glues together is commands. Just understand what you're getting yourself into.

See ``I/O Operators'' for more discussion.

the differences being that it generates a real list at compile time, and in scalar context it returns the last element in the list. So this expression:

is semantically equivalent to the list:

Some frequently seen examples:

A common mistake is to try to separate the words with commas or to put comments into a multi-line "qw" -string. For this reason, the "use warnings" pragma and the -w switch (that is, the $^W variable) produces warnings if the STRING contains the "," or the "#" character.

If the "/r" (non-destructive) option is present, a new copy of the string is made and its characters transliterated, and this copy is returned no matter whether it was modified or not: the original string is always left unchanged. The new copy is always a plain string, even if the input string is an object or a tied variable.

Unless the "/r" option is used, the string specified with "=~" must be a scalar variable, an array element, a hash element, or an assignment to one of those; in other words, an lvalue.

A character range may be specified with a hyphen, so "tr/A-J/0-9/" does the same replacement as "tr/ACEGIBDFHJ/0246813579/" . For sed devotees, "y" is provided as a synonym for "tr" . If the SEARCHLIST is delimited by bracketing quotes, the REPLACEMENTLIST has its own pair of quotes, which may or may not be bracketing quotes; for example, "tr[aeiouy][yuoiea]" or "tr(+\-*/)/ABCD/" .

Characters may be literals or any of the escape sequences accepted in double-quoted strings. But there is no interpolation, so "$" and "@" are treated as literals. A hyphen at the beginning or end, or preceded by a backslash is considered a literal. Escape sequence details are in the table near the beginning of this section. It is a bug in Perl v5.22 that something like

does not treat that range as fully Unicode.

Note that "tr" does not do regular expression character classes such as "\d" or "\pL" . The "tr" operator is not equivalent to the tr (1) utility. If you want to map strings between lower/upper cases, see ``lc'' in perlfunc and ``uc'' in perlfunc, and in general consider using the "s" operator if you need regular expressions. The "\U" , "\u" , "\L" , and "\l" string-interpolation escapes on the right side of a substitution operator will perform correct case-mappings, but "tr[a-z][A-Z]" will not (except sometimes on legacy 7-bit data).

Note also that the whole range idea is rather unportable between character sets---and even within character sets they may cause results you probably didn't expect. A sound principle is to use only ranges that begin from and end at either alphabets of equal case (a-e, A-E), or digits (0-4). Anything else is unsafe. If in doubt, spell out the character sets in full.

If the "/c" modifier is specified, the SEARCHLIST character set is complemented. If the "/d" modifier is specified, any characters specified by SEARCHLIST not found in REPLACEMENTLIST are deleted. (Note that this is slightly more flexible than the behavior of some tr programs, which delete anything they find in the SEARCHLIST , period.) If the "/s" modifier is specified, sequences of characters that were transliterated to the same character are squashed down to a single instance of the character.

If the "/d" modifier is used, the REPLACEMENTLIST is always interpreted exactly as specified. Otherwise, if the REPLACEMENTLIST is shorter than the SEARCHLIST , the final character is replicated till it is long enough. If the REPLACEMENTLIST is empty, the SEARCHLIST is replicated. This latter is useful for counting characters in a class or for squashing character sequences in a class.

If multiple transliterations are given for a character, only the first one is used:

will transliterate any A to X.

Because the transliteration table is built at compile time, neither the SEARCHLIST nor the REPLACEMENTLIST are subjected to double quote interpolation. That means that if you want to use variables, you must use an "eval()" :

The terminating string may be either an identifier (a word), or some quoted text. An unquoted identifier works like double quotes. There may not be a space between the "<<" and the identifier, unless the identifier is explicitly quoted. (If you put a space it will be treated as a null identifier, which is valid, and matches the first empty line.) The terminating string must appear by itself (unquoted and with no surrounding whitespace) on the terminating line.

If the terminating string is quoted, the type of quotes used determine the treatment of the text.

Just as in the shell, a backslashed bareword following the "<<" means the same thing as a single-quoted string does:

This is the only form of quoting in perl where there is no need to worry about escaping content, something that code generators can and do make good use of.

It is possible to stack multiple here-docs in a row:

Just don't forget that you have to put a semicolon on the end to finish the statement, as Perl doesn't know you're not going to try to do this:

If you want to remove the line terminator from your here-docs, use "chomp()" .

If you want your here-docs to be indented with the rest of the code, you'll need to remove leading whitespace from each line manually:

If you use a here-doc within a delimited construct, such as in "s///eg" , the quoted material must still come on the line following the "<<FOO" marker, which means it may be inside the delimited construct:

It works this way as of Perl 5.18. Historically, it was inconsistent, and you would have to write

outside of string evals.

Additionally, quoting rules for the end-of-string identifier are unrelated to Perl's quoting rules. "q()" , "qq()" , and the like are not supported in place of '' and "" , and the only interpolation is for backslashing the quoting character:

Finally, quoted strings cannot span multiple lines. The general rule is that the identifier must be a string literal. Stick with that, and you should be safe.

Gory details of parsing quoted constructs

This section hopes to clarify how Perl handles quoted constructs. Although the most common reason to learn this is to unravel labyrinthine regular expressions, because the initial steps of parsing are the same for all quoting operators, they are all discussed together.

The most important Perl parsing rule is the first one discussed below: when processing a quoted construct, Perl first finds the end of that construct, then interprets its contents. If you understand this rule, you may skip the rest of this section on the first reading. The other rules are likely to contradict the user's expectations much less frequently than this first one.

Some passes discussed below are performed concurrently, but because their results are the same, we consider them individually. For different quoting constructs, Perl performs different numbers of passes, from one to four, but these passes are always performed in the same order.

If the construct is a here-doc, the ending delimiter is a line that has a terminating string as the content. Therefore "<<EOF" is terminated by "EOF" immediately followed by "\n" and starting from the first column of the terminating line. When searching for the terminating line of a here-doc, nothing is skipped. In other words, lines after the here-doc syntax are compared with the terminating string line by line.

For the constructs except here-docs, single characters are used as starting and ending delimiters. If the starting delimiter is an opening punctuation (that is "(" , "[" , "{" , or "<" ), the ending delimiter is the corresponding closing punctuation (that is ")" , "]" , "}" , or ">" ). If the starting delimiter is an unpaired character like "/" or a closing punctuation, the ending delimiter is the same as the starting delimiter. Therefore a "/" terminates a "qq//" construct, while a "]" terminates both "qq[]" and "qq]]" constructs.

When searching for single-character delimiters, escaped delimiters and "\\" are skipped. For example, while searching for terminating "/" , combinations of "\\" and "\/" are skipped. If the delimiters are bracketing, nested pairs are also skipped. For example, while searching for a closing "]" paired with the opening "[" , combinations of "\\" , "\]" , and "\[" are all skipped, and nested "[" and "]" are skipped as well. However, when backslashes are used as the delimiters (like "qq\\" and "tr\\\" ), nothing is skipped. During the search for the end, backslashes that escape delimiters or other backslashes are removed (exactly speaking, they are not copied to the safe location).

For constructs with three-part delimiters ( "s///" , "y///" , and "tr///" ), the search is repeated once more. If the first delimiter is not an opening punctuation, the three delimiters must be the same, such as "s!!!" and "tr)))" , in which case the second delimiter terminates the left part and starts the right part at once. If the left part is delimited by bracketing punctuation (that is "()" , "[]" , "{}" , or "<>" ), the right part needs another pair of delimiters such as "s(){}" and "tr[]//" . In these cases, whitespace and comments are allowed between the two parts, although the comment must follow at least one whitespace character; otherwise a character expected as the start of the comment may be regarded as the starting delimiter of the right part.

During this search no attention is paid to the semantics of the construct. Thus:

do not form legal quoted expressions. The quoted part ends on the first """ and "/" , and the rest happens to be a syntax error. Because the slash that terminated "m//" was followed by a "SPACE" , the example above is not "m//x" , but rather "m//" with no "/x" modifier. So the embedded "#" is interpreted as a literal "#" .

Also no attention is paid to "\c\" (multichar control char syntax) during this search. Thus the second "\" in "qq/\c\/" is interpreted as a part of "\/" , and the following "/" is not recognized as a delimiter. Instead, use "\034" or "\x1c" at the end of quoted constructs.

Let it be stressed that whatever falls between "\Q" and "\E" is interpolated in the usual way. Something like "\Q\\E" has no "\E" inside. Instead, it has "\Q" , "\\" , and "E" , so the result is the same as for "\\\\E" . As a general rule, backslashes between "\Q" and "\E" may lead to counterintuitive results. So, "\Q\t\E" is converted to "quotemeta("\t")" , which is the same as "\\\t" (since TAB is not alphanumeric). Note also that:

may be closer to the conjectural intention of the writer of "\Q\t\E" .

Interpolated scalars and arrays are converted internally to the "join" and "." catenation operations. Thus, "$foo XXX '@arr'" becomes:

All operations above are performed simultaneously, left to right.

Because the result of "\Q  STRING  \E" has all metacharacters quoted, there is no way to insert a literal "$" or "@" inside a "\Q\E" pair. If protected by "\" , "$" will be quoted to become "\\\$" ; if not, it is interpreted as the start of an interpolated scalar.

Note also that the interpolation code needs to make a decision on where the interpolated scalar ends. For instance, whether "a $x -> {c}" really means:

Most of the time, the longest possible text that does not include spaces between components and which contains matching braces or brackets. because the outcome may be determined by voting based on heuristic estimators, the result is not strictly predictable. Fortunately, it's usually correct for ambiguous cases.

It is at this step that "\1" is begrudgingly converted to $1 in the replacement text of "s///" , in order to correct the incorrigible sed hackers who haven't picked up the saner idiom yet. A warning is emitted if the "use warnings" pragma or the -w command-line flag (that is, the $^W variable) was set.

Processing of "\N{...}" is also done here, and compiled into an intermediate form for the regex compiler. (This is because, as mentioned below, the regex compilation may be done at execution time, and "\N{...}" is a compile-time construct.)

However any other combinations of "\" followed by a character are not substituted but only skipped, in order to parse them as regular expressions at the following step. As "\c" is skipped at this step, "@" of "\c@" in RE is possibly treated as an array symbol (for example @foo ), even though the same text in "qq//" gives interpolation of "\c@" .

Code blocks such as "(?{BLOCK})" are handled by temporarily passing control back to the perl parser, in a similar way that an interpolated array subscript expression such as "foo$array[1+f("[xyz")]bar" would be.

Moreover, inside "(?{BLOCK})" , "(?# comment )" , and a "#" -comment in a "/x" -regular expression, no processing is performed whatsoever. This is the first step at which the presence of the "/x" modifier is relevant.

Interpolation in patterns has several quirks: $| , $( , $) , "@+" and "@-" are not interpolated, and constructs $var[SOMETHING] are voted (by several different estimators) to be either an array element or $var followed by an RE alternative. This is where the notation "${arr[$bar]}" comes handy: "/${arr[0-9]}/" is interpreted as array element "-9" , not as a regular expression from the variable $arr followed by a digit, which would be the interpretation of "/$arr[0-9]/" . Since voting among different estimators may occur, the result is not predictable.

The lack of processing of "\\" creates specific restrictions on the post-processed text. If the delimiter is "/" , one cannot get the combination "\/" into the result of this step. "/" will finish the regular expression, "\/" will be stripped to "/" on the previous step, and "\\/" will be left as is. Because "/" is equivalent to "\/" inside a regular expression, this does not matter unless the delimiter happens to be character special to the RE engine, such as in "s*foo*bar*" , "m[foo]" , or "?foo?" ; or an alphanumeric char, as in:

In the RE above, which is intentionally obfuscated for illustration, the delimiter is "m" , the modifier is "mx" , and after delimiter-removal the RE is the same as for "m/ ^ a \s* b /mx" . There's more than one reason you're encouraged to restrict your delimiters to non-alphanumeric, non-whitespace choices.

This step is the last one for all constructs except regular expressions, which are processed further.

Whatever happens in the RE engine might be better discussed in perlre, but for the sake of continuity, we shall do so here.

This is another step where the presence of the "/x" modifier is relevant. The RE engine scans the string from left to right and converts it into a finite automaton.

Backslashed characters are either replaced with corresponding literal strings (as with "\{" ), or else they generate special nodes in the finite automaton (as with "\b" ). Characters special to the RE engine (such as "|" ) generate corresponding nodes or groups of nodes. "(?#...)" comments are ignored. All the rest is either converted to literal strings to match, or else is ignored (as is whitespace and "#" -style comments if "/x" is present).

Parsing of the bracketed character class construct, "[...]" , is rather different than the rule used for the rest of the pattern. The terminator of this construct is found using the same rules as for finding the terminator of a "{}" -delimited construct, the only exception being that "]" immediately following "[" is treated as though preceded by a backslash.

The terminator of runtime "(?{...})" is found by temporarily switching control to the perl parser, which should stop at the point where the logically balancing terminating "}" is found.

It is possible to inspect both the string given to RE engine and the resulting finite automaton. See the arguments "debug" / "debugcolor" in the "use re" pragma, as well as Perl's -Dr command-line switch documented in ``Command Switches'' in perlrun.

It is at this stage that "split()" silently optimizes "/^/" to mean "/^/m" .

I/O Operators

A string enclosed by backticks (grave accents) first undergoes double-quote interpolation. It is then interpreted as an external command, and the output of that command is the value of the backtick string, like in a shell. In scalar context, a single string consisting of all output is returned. In list context, a list of values is returned, one per line of output. (You can set $/ to use a different line terminator.) The command is executed each time the pseudo-literal is evaluated. The status value of the command is returned in $? (see perlvar for the interpretation of $? ). Unlike in csh , no translation is done on the return data---newlines remain newlines. Unlike in any of the shells, single quotes do not hide variable names in the command from interpretation. To pass a literal dollar-sign through to the shell you need to hide it with a backslash. The generalized form of backticks is "qx//" . (Because backticks always undergo shell expansion as well, see perlsec for security concerns.)

In scalar context, evaluating a filehandle in angle brackets yields the next line from that file (the newline, if any, included), or "undef" at end-of-file or on error. When $/ is set to "undef" (sometimes known as file-slurp mode) and the file is empty, it returns '' the first time, followed by "undef" subsequently.

Ordinarily you must assign the returned value to a variable, but there is one situation where an automatic assignment happens. If and only if the input symbol is the only thing inside the conditional of a "while" statement (even if disguised as a "for(;;)" loop), the value is automatically assigned to the global variable $_ , destroying whatever was there previously. (This may seem like an odd thing to you, but you'll use the construct in almost every Perl script you write.) The $_ variable is not implicitly localized. You'll have to put a "local $_;" before the loop if you want that to happen.

The following lines are equivalent:

This also behaves similarly, but assigns to a lexical variable instead of to $_ :

In these loop constructs, the assigned value (whether assignment is automatic or explicit) is then tested to see whether it is defined. The defined test avoids problems where the line has a string value that would be treated as false by Perl; for example a "" or a "0" with no trailing newline. If you really mean for such values to terminate the loop, they should be tested for explicitly:

In other boolean contexts, "< FILEHANDLE >" without an explicit "defined" test or comparison elicits a warning if the "use warnings" pragma or the -w command-line switch (the $^W variable) is in effect.

The filehandles STDIN, STDOUT, and STDERR are predefined. (The filehandles "stdin" , "stdout" , and "stderr" will also work except in packages, where they would be interpreted as local identifiers rather than global.) Additional filehandles may be created with the "open()" function, amongst others. See perlopentut and ``open'' in perlfunc for details on this.

If a "< FILEHANDLE >" is used in a context that is looking for a list, a list comprising all input lines is returned, one line per list element. It's easy to grow to a rather large data space this way, so use with care.

"< FILEHANDLE >" may also be spelled "readline(* FILEHANDLE )" . See ``readline'' in perlfunc.

The null filehandle "<>" is special: it can be used to emulate the behavior of sed and awk , and any other Unix filter program that takes a list of filenames, doing the same to each line of input from all of them. Input from "<>" comes either from standard input, or from each file listed on the command line. Here's how it works: the first time "<>" is evaluated, the @ARGV array is checked, and if it is empty, $ARGV[0] is set to "-" , which when opened gives you standard input. The @ARGV array is then processed as a list of filenames. The loop

is equivalent to the following Perl-like pseudo code:

except that it isn't so cumbersome to say, and will actually work. It really does shift the @ARGV array and put the current filename into the $ARGV variable. It also uses filehandle ARGV internally. "<>" is just a synonym for "<ARGV>" , which is magical. (The pseudo code above doesn't work because it treats "<ARGV>" as non-magical.)

Since the null filehandle uses the two argument form of ``open'' in perlfunc it interprets special characters, so if you have a script like this:

and call it with "perl dangerous.pl 'rm -rfv *|'" , it actually opens a pipe, executes the "rm" command and reads "rm" 's output from that pipe. If you want all items in @ARGV to be interpreted as file names, you can use the module "ARGV::readonly" from CPAN, or use the double bracket:

Using double angle brackets inside of a while causes the open to use the three argument form (with the second argument being "<" ), so all arguments in "ARGV" are treated as literal filenames (including "-" ). (Note that for convenience, if you use "<<>>" and if @ARGV is empty, it will still read from the standard input.)

You can modify @ARGV before the first "<>" as long as the array ends up containing the list of filenames you really want. Line numbers ( $. ) continue as though the input were one big happy file. See the example in ``eof'' in perlfunc for how to reset line numbers on each file.

If you want to set @ARGV to your own list of files, go right ahead. This sets @ARGV to all plain text files if no @ARGV was given:

You can even set them to pipe commands. For example, this automatically filters compressed arguments through gzip :

If you want to pass switches into your script, you can use one of the "Getopts" modules or put a loop on the front like this:

The "<>" symbol will return "undef" for end-of-file only once. If you call it again after this, it will assume you are processing another @ARGV list, and if you haven't set @ARGV , will read input from STDIN.

If what the angle brackets contain is a simple scalar variable (for example, $foo ), then that variable contains the name of the filehandle to input from, or its typeglob, or a reference to the same. For example:

If what's within the angle brackets is neither a filehandle nor a simple scalar variable containing a filehandle name, typeglob, or typeglob reference, it is interpreted as a filename pattern to be globbed, and either a list of filenames or the next filename in the list is returned, depending on context. This distinction is determined on syntactic grounds alone. That means "<$x>" is always a "readline()" from an indirect handle, but "<$hash{key}>" is always a "glob()" . That's because $x is a simple scalar variable, but $hash{key} is not---it's a hash element. Even "<$x >" (note the extra space) is treated as "glob("$x ")" , not "readline($x)" .

One level of double-quote interpretation is done first, but you can't say "<$foo>" because that's an indirect filehandle as explained in the previous paragraph. (In older versions of Perl, programmers would insert curly brackets to force interpretation as a filename glob: "<${foo}>" . These days, it's considered cleaner to call the internal function directly as "glob($foo)" , which is probably the right way to have done it in the first place.) For example:

is roughly equivalent to:

except that the globbing is actually done internally using the standard "File::Glob" extension. Of course, the shortest way to do the above is:

A (file)glob evaluates its (embedded) argument only when it is starting a new list. All values must be read before it will start over. In list context, this isn't important because you automatically get them all anyway. However, in scalar context the operator returns the next value each time it's called, or "undef" when the list has run out. As with filehandle reads, an automatic "defined" is generated when the glob occurs in the test part of a "while" , because legal glob returns (for example, a file called 0 ) would otherwise terminate the loop. Again, "undef" is returned only once. So if you're expecting a single value from a glob, it is much better to say

because the latter will alternate between returning a filename and returning false.

If you're trying to do variable interpolation, it's definitely better to use the "glob()" function, because the older notation can cause people to become confused with the indirect filehandle notation.

Constant Folding

and this all reduces to one string internally. Likewise, if you say

the compiler precomputes the number which that expression represents so that the interpreter won't have to.

Bitwise String Operators

If the operands to a binary bitwise op are strings of different sizes, | and ^ ops act as though the shorter operand had additional zero bits on the right, while the & op acts as though the longer operand were truncated to the length of the shorter. The granularity for such extension or truncation is one or more bytes.

If you are intending to manipulate bitstrings, be certain that you're supplying bitstrings: If an operand is a number, that will imply a numeric bitwise operation. You may explicitly show which type of operation you intend by using "" or "0+" , as in the examples below.

This somewhat unpredictable behavior can be avoided with the experimental ``bitwise'' feature, new in Perl 5.22. You can enable it via "use feature 'bitwise'" . By default, it will warn unless the "experimental::bitwise" warnings category has been disabled. ( "use experimental 'bitwise'" will enable the feature and disable the warning.) Under this feature, the four standard bitwise operators ( "~ | & ^" ) are always numeric. Adding a dot after each operator ( "~. |. &. ^." ) forces it to treat its operands as strings:

The assignment variants of these operators ( "&= |= ^= &.= |.= ^.=" ) behave likewise under the feature.

The behavior of these operators is problematic (and subject to change) if either or both of the strings are encoded in UTF-8 (see ``Byte and Character Semantics'' in perlunicode.

See ``vec'' in perlfunc for information on how to manipulate individual bits in a bit vector.

Integer Arithmetic

you may tell the compiler to use integer operations (see integer for a detailed explanation) from here to the end of the enclosing BLOCK. An inner BLOCK may countermand this by saying

which lasts until the end of that BLOCK. Note that this doesn't mean everything is an integer, merely that Perl will use integer operations for arithmetic, comparison, and bitwise operators. For example, even under "use integer" , if you take the sqrt (2) , you'll still get 1.4142135623731 or so.

Used on numbers, the bitwise operators ( "&" "|" "^" "~" "<<" ">>" ) always produce integral results. (But see also ``Bitwise String Operators''.) However, "use integer" still has meaning for them. By default, their results are interpreted as unsigned integers, but if "use integer" is in effect, their results are interpreted as signed integers. For example, "~0" usually evaluates to a large integral value. However, "use integer; ~0" is "-1" on two's-complement machines.

Floating-point Arithmetic

While "use integer" provides integer-only arithmetic, there is no analogous mechanism to provide automatic rounding or truncation to a certain number of decimal places. For rounding to a certain number of digits, "sprintf()" or "printf()" is usually the easiest route. See perlfaq4.

Floating-point numbers are only approximations to what a mathematician would call real numbers. There are infinitely more reals than floats, so some corners must be cut. For example:

Testing for exact floating-point equality or inequality is not a good idea. Here's a (relatively expensive) work-around to compare whether two floating-point numbers are equal to a particular number of decimal places. See Knuth, volume II, for a more robust treatment of this topic.

The POSIX module (part of the standard perl distribution) implements "ceil()" , "floor()" , and other mathematical and trigonometric functions. The "Math::Complex" module (part of the standard perl distribution) defines mathematical functions that work on both the reals and the imaginary numbers. "Math::Complex" is not as efficient as POSIX, but POSIX can't work with complex numbers.

Rounding in financial applications can have serious implications, and the rounding method used should be specified precisely. In these cases, it probably pays not to trust whichever system rounding is being used by Perl, but to instead implement the rounding function you need yourself.

Bigger Numbers

Or with rationals:

Several modules let you calculate with unlimited or fixed precision (bound only by memory and CPU time). There are also some non-standard modules that provide faster implementations via external C libraries.

Here is a short, but incomplete summary:

Choose wisely.

TRANSLATIONS

Last searched.

  • colorgccrc (5)
  • tao_nsadd (1)
  • pfm_regmask_set (3)
  • Trf_MDStart (3)
  • mh-alias (5)
  • tapconvert (1)
  • setfilecon (3)

Perl Programming/Operators

  • 1 Introduction
  • 2.1.1 Binary
  • 2.1.2 Unary
  • 2.2 Assignment
  • 2.3 Comparison
  • 2.4.1 Conditionals
  • 2.4.2 Partial evaluation
  • 2.5 Bitwise
  • 2.7 Comparing strings
  • 2.8 File Test
  • 2.10 Precedence
  • 2.11 The smart match operator
  • 2.12.1 The doubledollar
  • 2.12.2 The arrow operator

Introduction

Perl's set of operators borrows extensively from the C programming language . Perl expands on this by infusing new operators for string functions ( .= , x , eq , ne , etc.). C by contrast delegates its subset of Perl functionality to a library strings.h , and ctype.h , and includes no such functionality by default compilation. Perl also includes a highly flexible Regex engine inspired by Sed with improvements to standard POSIX regexes, most notably the support of Unicode.

The operators

Most arithmetic operators are binary operators; this means they take two arguments. Unary operators only take one argument. Arithmetic operators are very simple and often transparent.

All the basic arithmetic operators, addition ( + ), subtraction ( - ), multiplication ( * ), and division ( / ), and the modulus operator % exist. Modulus returns the remainder of a division ( / ) operation.

The exponentiation operator is ** . It allows you to raise one value to the power of another. If you raise to a fraction you will get the root of the number. In this example the second result when raised to the power of 2 should return 2 ( (2**(1/2))**2 = 2 ).

The function sqrt is provided for finding a square root. Other fractional powers (i.e., (1/5), (2/13), (7/5), and similar) are suitably found using the ** operator.

The auto-decrement ( -- ), and auto-increment ( ++ ) operators are unary operators. They alter the scalar variable they operate on by one logical unit. On numbers, they add or subtract one. On letters and strings, only the auto-increment shift one up in the alphabet, with the added ability to roll-over. Operators that come in post- and pre- varieties can be used two ways. The first way returns the value of the variable before it was altered, and the second way returns the value of the variable after it was altered.

The basic assignment operator is = that sets the value on the left side to be equal to the value on the right side. It also returns the value. Thus you can do things like $a = 5 + ($b = 6) , which will set $b to a value of 6 and $a to a value of 11 (5 + 6). Why you would want to do this is another question.

The assignment update operators from C, += , -= , etc. work in perl. Perl expands on this basic idea to encompass most of the binary operators in perl.

operator name
add assign, plus-equals
subtract assign, minus-equals
multiply assign
divide assign
modulo assign
exponent assign
concatenate assign
repeat assign
logical AND assign
logical OR assign
bitwise AND assign
bitwise OR assign
bitwise XOR assign
bitwise string AND assign
bitwise string OR assign
bitwise string XOR assign
left shift assign
right shift assign
defined OR assign

Perl uses different operators to compare numbers and strings. This is done, because in most cases, Perl will happily stringify numbers and numify strings. In most cases this helps, and is consistent with Perl's DWIM Do-What-I-Mean theme. Unfortunately, one place this often does not help, is comparison.

name numeric string
equal
not equal
less than
greater than
less or equal
greater or equal
compare

Perl has two sets of logical operators, just like the comparison operators, however not for the same reason.

The first set (sometimes referred to as the C-style logical operators, because they are borrowed from C) is && , || , and ! . They mean logical AND, OR, and NOT respectively. The second set is and , or , and not .

The only difference between these two sets is the precedence they take (See Precedence ). The symbolic operators take a much higher precedence than the textual.

Conditionals

Most of the time, you will be using logical operators in conditionals.

In this case, you could safely substitute and for && and the conditional would still work as expected. However, this is not always the case.

This, however, is completely different.

Most people prefer to use C-style logical operators and use brackets to enforce clarity rather than using a combination of textual and C-style operators (when possible), which can be very confusing at times.

Partial evaluation

Partial evaluation (or "short circuiting") is the property of logical operators that the second expression is only evaluated, if it needs to be.

This also works with logical OR statements. If the first expression evaluates as true, the second is never evaluated, because the conditional is automatically true.

This becomes useful in a case like this:

Here, if the foo() subroutine returns false, "foo() failed\n" is printed. However, if it returns true, "foo() failed\n" is not printed, because the second expression ( print "foo() failed\n" ) does not need to be evaluated.

These operators perform the same operation as the logical operators, but instead of being performed on the true/false value of the entire expressions, it is done on the individual respective bits of their values.

  • & (bitwise AND)
  • | (bitwise OR)
  • ^ (bitwise XOR)
  • ~ (bitwise NOT)

The left and right shift operators move the bits of the left operand (e.g. $a in the case of $a << $b) left or right a number of times equal to the right operand ($b). Each move to the right or left effectively halves or doubles the number, except where bits are shifted off the left or right sides. For example, $number << 3 returns $number multiplied by 8 (2**3).

  • << (left shift)
  • >> (right shift)

The string concatenation operator is . , not + that some other languages use.

There is a repeat operator for strings ( x ) that repeats a string a given number of times.

Comparing strings

To compare strings, use eq and ne instead of == or != respectively. You can also look for a substring with substr() , or pattern-match with regular expressions.

The range operator (..) returns a list of items in the range between two items; the items can be characters or numbers. The type of character is determined by the first operand; the code:

Outputs (Newlines added for readability):

Note that the case is defined by the first operand, and that the 1..'a' and (10..-10) operations return empty list.

Precedence is a concept that will be familiar to anyone who has studied algebra or coded in C/C++. Each operator has its place in a hierarchy of operators, and are executed in order. The precedence of perl operators is strict and should be overridden with parentheses, both when you are knowingly going against precedence and when you aren't sure of the order of precedence. For a complete listing of the order, check perlop .

The smart match operator

The smart match operator ~~ is new in perl 5.10. To use it, you'll need to explicitly say that you're writing code for perl 5.10 or newer. Its opposite operator ǃ~ matches smartly an inequality:

The smart match operator is versatile and fast (often faster than the equivalent comparison without ǃ~ or ~~ ). See smart matching in detail for the comparisons it can do. ~~ is also used in the given/when switch statement new in 5.10, which will be covered elsewhere.

Dereferencing

The doubledollar.

A variable, previously referenced with the reference operator can be dereferenced by using a doubledollar symbol prefix:

The arrow operator

If the left hand operand of the arrow operator is an array or hash reference, or a subroutine that produces one, the arrow operator produces a look up of the element or hash:

perl defined or assignment operator

  • Book:Perl Programming

Navigation menu

The Effective Perler

Effective Perl Programming – write better, more idiomatic Perl

Set default values with the defined-or operator.

[ This is a mid-week bonus Item since it’s so short ]

Prior to Perl 5.10, you had to be a bit careful checking a Perl variable before you set a default value. An uninitialized value and a defined but false value both acted the same in the logical || short-circuit operator. The Perl idiom to set a default value looks like this:

That’s the binary-assignment equivalent of an expression where you type out the variable twice:

However, some of the false values might be perfectly valid and meaningful. If there are no rabbits in the hutch, you don’t want to replace that actual value, which just happens to be false, with the default:

The undef value, however, is actually the absence of value. It’s the absence of meaningful value. Replacing that with a default is reasonable:

To get around this, you don’t use the short-circuit operator. Instead, you can use the conditional operator, typing out the variable name three times:

You’ll mostly likely use this when you’re processing the command-line options or subroutine arguments:

That’s a bit messy, so Perl 5.10 introduces the defined-or operator, // . Instead of testing for truth, it tests for defined-ness. If its lefthand value is defined, even if it’s false (i.e. 0 , '0' , or the empty string), that’s what it returns, short-circuiting the righthand side. This works just fine, not replacing the 0 value that’s in $rabbits already:

You can now reduce this back to the binary-assignment idiom:

Now your subroutine paramter defaults look a bit neater:

This isn’t one of the Perl 5.10 features that you have to explicitly enable ( Item 2: Enable new Perl features when you need them ). As long as you are using Perl 5.10 or later it’s already available to you. However, you should still specify the Perl version ( Item 83. Limit your distributions to the right platforms. ).

4 thoughts on “Set default values with the defined-or operator.”

You mention that

To get around this, you don’t use the short-circuit operator. Instead, you can use the conditional operator, typing out the variable name three times: $value = defined $value ? $value : 'some default';

As long as you’re not using // , wouldn’t you write that rather

Yes, you could also use a postfix conditional.

Iosif, what would happen if $value was defined? The conditional brian displays handles setting the value either way; you would have to write an assignment first and then your check for definedness, resulting in more code and slightly less understandable at first sight.

In Iosif’s example, the variable keeps the value if already had if it is defined. In the example he quotes, I assigned the same value back to the same variable. At the end both do the same thing, but I was making a larger point. Even in his streamlined example, he has to type the variable name twice.

Comments are closed.

perl defined or assignment operator

An operator is the element affecting operands in a Perl expression and causes Perl to execute an operation on one of more operands. In the expression $a + 5 , $a and 5 are the operands and + is the operation causing the addition operation.

Perl programming can be accomplished by directly executing Perl commands at the shell prompt or by storing them in a text file with the .pl extension, and then executing it as a Perl script via perl file.pl .

Perl supports many operator types. Following is a list of frequently used operators.

Arithmetic Operators

Manipulate numeric scalar values.

  • + Addition - Adds the operand values from either side of the operator
  • - Subtraction - Subtracts the right operand from the left operand
  • - Negation - When taking a single operand (unary), it calculates the negative value
  • * Multiplication - Multiplies the operand values from either side of the operator
  • / Division - Divides the left operand by the right operand
  • % Modulus - Divides the left operand by the right operand and returns remainder
  • ** Exponent - Calculates the left operand to the power of the right operand

Comparison Operators

Used to compare two scalar string or scalar numeric values. Comparison or relational operators are discussed in the Conditional Decisions section of this tutorial. Please review them in that section.

Assignment Operators

Used to assign scalar or array data to a data structure.

  • = Simple assignment - assigns values from right side operands and operators to left side operand
  • += Addition and assign - add right operand to left operand and assign to left operand
  • -= Substract and assign - substract right operand from left operand and assign to left operand
  • *= Multiply and assign - multiply right operand by left operand and assign to left operand
  • /= Divide and assign - divide left operand by right operand and assign to left operand
  • %= Modulus and assign - divide left operand by right operand and assign remainder to left operand
  • **= Exponent and assign - calculates the left operand to the power of the right operand and assign to left operand
  • ++ Autoincrement - increases unary operand value by one. E.g. $x++ or ++$x gives 11
  • -- Autodecrement - decreases unary operand value by one. E.g. $x-- or --$x gives 9

Note that $x++ is considered post-autoincrement , and ++$x is considered pre-autoincrement :

  • $a = $x++ will assign $a with 10 and $x with 11 (autoincrement $x after assigning value to $a )
  • $a = ++$x will assign $x with 11 then assign $a with 11 (autoincrement $x before assigning value to $a )

Similarly with -- (autodecrement):

  • $a = $x-- will assign $a with 10 and $x with 0 (autodecrement $x after assigning value to $a )
  • $a = --$x will assign $x with 9 then assign $a with 9 (autodecrement $x before assigning value to $a )

Bitwise Operators

Manipulate numeric scalar values at the bit level.

Bitwise operators treat numeric operands as binary numbers and perform bit by bit operations. Scalars can be assigned with decimal, binary (with prefix 0b ) or hexadecimal (with prefix 0x ).

  • & AND - bitwise AND of the operand values from either side of the operator e.g. $b & $mask gives 0b1001
  • | OR - bitwise OR of the operand values from either side of the operator e.g. $b | $mask gives 0b1111
  • ^ XOR - bitwise XOR of the operand values from either side of the operator e.g. $b & $mask gives 0b1001
  • ~ NOT - bitwise INVERT (unary operator) inverts each bit of the left operand e.g. ~$b give 0b10100110
  • << SHIFT LEFT - bitwise SHIFT LEFT the left operand, right operand times e.g. $b << 1 give 0b101001100
  • >> SHIFT RIGHT - bitwise SHIFT RIGHT the left operand, right operand times e.g. $b >> 1 give 0b01010011

Logical Operators

Evaluate logical relations between operands.

Logical operators calculate a logical value - TRUE or FALSE, per the values of their operands.

  • and Logical AND operator - return TRUE if both the operands are true, otherwise FALSE
  • && Logical AND operator - return TRUE if both the operands are true, otherwise FALSE
  • or Logical OR operator - return TRUE if either one of the operands is true, otherwise FALSE
  • || Logical OR operator - return TRUE if either one of the operands is true, otherwise FALSE
  • xor Logical XOR operator - return TRUE if one of the operands is true and the other is false, otherwise FALSE
  • not Logical NOT operator (unary operator)- return TRUE if the operand is false, otherwise FALSE
  • ! Logical NOT operator (unary operator)- return TRUE if the operand is false, otherwise FALSE

String Operators

Manipulate string scalar values.

  • . String concatenation operator - concatenate the left and right operands e.g. $a . $b gives "world hello"
  • x String repetition operator - return the left operand repeated the number of times specified by the right operator. E.g. $b x 3 gives "hellohellohello"

Miscellaneous Operators

  • .. The range operator - returns an array of values reflecting the sequential range beteen the two operands. For numeric operands, the values are incremented by 1 from the left operand to the right operand. For letters (lowercase or uppercase), the values are incremented in alphabetical order.

Follow these instructions and print the result after each step.

  • Assign scalar $a to a starting value of 5. Print value of $a .
  • Add 6 to the previous result. Print the new result.
  • Multiply the previous result by 2. Print the new result.
  • Autoincrement the previous result. Print the new result.
  • Substract 9 from the previous result. Print the new result.
  • Divide the previous result by 7. Print the new result.

perl defined or assignment operator

Coding for Kids is an online interactive tutorial that teaches your kids how to code while playing!

Receive a 50% discount code by using the promo code:

Start now and play the first chapter for free, without signing up.

perl defined or assignment operator

Perl Cookbook by

Get full access to Perl Cookbook and 60K+ other titles, with a free 10-day trial of O'Reilly.

There are also live events, courses curated by job role, and more.

Establishing a Default Value

You would like to give a default value to a scalar variable, but only if it doesn’t already have one. It often happens that you want a hard-coded default value for a variable that can be overridden from the command-line or through an environment variable.

Use the || or ||= operator, which work on both strings and numbers:

If 0 or "0" are valid values for your variables, use defined instead:

The big difference between the two techniques ( defined and || ) is what they test: definedness versus truth. Three defined values are still false in the world of Perl: 0 , "0" , and "" . If your variable already held one of those, and you wanted to keep that value, a || wouldn’t work. You’d have to use the clumsier tests with defined instead. It’s often convenient to arrange for your program to care only about true or false values, not defined or undefined ones.

Rather than being restricted in its return values to a mere 1 or as in most other languages, Perl’s || operator has a much more interesting property: It returns its first operand (the left-hand side) if that operand is true; otherwise it returns its second operand. The && operator also returns the last evaluated expression, but is less often used for this property. These operators don’t care whether their operands are strings, numbers, or references—any scalar will do. They just return the first one that makes the whole expression true or false. This doesn’t affect the Boolean sense of the return value, but it does make the operators more convenient to use.

This property lets you provide a default value to a variable, function, or longer expression in case the first part doesn’t pan out. Here’s an example of || , which would set $foo to be the contents of either $bar or, if $bar is false, " DEFAULT VALUE “:

Here’s another example, which sets $dir to be either the first argument to the program or " /tmp " if no argument was given.

We can do this without altering @ARGV :

If 0 is a valid value for $ARGV[0] , we can’t use || because it evaluates as false even though it’s a value we want to accept. We must resort to the ternary (“hook”) operator:

We can also write this as follows, although with slightly different semantics:

This checks the number of elements in @ARGV . Using the hook operator as a condition in a ?: statement evaluates @ARGV in scalar context. It’s only false when there are elements, in which case we use "/tmp" . In all other cases (when the user gives an argument), we use the first argument.

The following line increments a value in %count , using as the key either $shell or, if $shell is false, "/bin/sh" .

You may chain several alternatives together as we have in the following example. The first expression that returns a true value will be used.

The && operator works analogously: It returns its first operand if that operand is false; otherwise, it returns the second one. Because there aren’t as many interesting false values as there are true ones, this property isn’t used much. One use is demonstrated in Recipe 13.11 or 14.11.

The ||= assignment operator looks odd, but it works exactly like the other binary assignment operators. For nearly all Perl’s binary operators, $VAR OP= VALUE means $VAR = $VAR OP VALUE ; for example, $a += $b is the same as $a = $a + $b . So ||= is used to set a variable when that variable is itself still false. Since the || check is a simple Boolean one—testing for truth—it doesn’t care about undefined values even under -w .

Here’s an example of ||= that sets $starting_point to " Greenwich " unless it is already set. Again, we assume $starting_point won’t have the value 0 or " 0 “, or that if it does, it’s okay to change it.

You can’t use or in place of || in assignments because or ’s precedence is too low. $a = $b or $c is equivalent to ($a = $b) or $c . This will always assign $b to $a , which is not the behavior you want.

Don’t extend this curious use of || and ||= from scalars to arrays and hashes. It doesn’t work because the operators put their left operand into scalar context. Instead, you must do something like this:

The || operator in perlop (1) or Chapter 2 of Programming Perl ; the defined and exists functions in perlfunc (1) and Chapter 3 of Programming Perl

Get Perl Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Don’t leave empty-handed

Get Mark Richards’s Software Architecture Patterns ebook to better understand how to design components—and how they should interact.

It’s yours, free.

Cover of Software Architecture Patterns

Check it out now on O’Reilly

Dive in for free with a 10-day trial of the O’Reilly learning platform—then explore all the other resources our members count on to build skills and solve problems every day.

perl defined or assignment operator

perl defined or assignment operator

Perl Operators

A perl operator is a series of symbols used as syntax. An operator is a sort of function and its operands are arguments.

Operator Precedence

Perl precedence acts like BODMAS in Mathematics. Addition and Subtraction always comes after the Multiplication and Division.

For example,

Here, answer will be 2 with BODMAS rule. (6 / 3 = 2) will be calculated first, then the quotient 2 will be multiplied by the 5, followed by subtraction and addition.

Operator Precedence Table

Operators Description
++, -- Auto-increment, Auto-decrement
-, ~, ! Operators having one operand
** Exponentiation
=~, !~ Pattern matching operators
*, /, %, x Multiplication, Divisor, Remainder, Repetition
+, -, . Addition, Subtraction, Concatenation
<<, >> Shifting operators
-e, -r File status operators
<, <=, >, >=, lt, le, gt, ge Inequality comparison operators
==, !=, <=>, eq, nq, cmp Equality comparison operators
& Bitwise AND
|, ^ Bitwise OR and XOR
&& Logical AND
|| Logical OR
. . List range operators
? and : Conditional operators
=, +=, -=, *= Assignment operators
, Comma operator
not low precedence logical NOT
and low precedence logical AND
or, xor low precedence logical OR and XOR

Operator Associativity

The associativity of an operator helps you to decide whether to evaluate an equation from (left to right) or (right to left).

The order of operation is very important. Sometimes it is same from both the sides but sometimes it produces drastic difference.

The answer for this question is same in any order either from left or right.

3 ∗∗ 2 ∗∗ 3

The answer for this question will be (9 ∗∗ 3) from left and (3 ∗∗ 8) from right. Both the answers have a lot of difference.

Associativity Table

Operators Description
++, -- Order of direction is not applicable here
-, ~, ! Right-to-Left
** Right-to-Left
=~, !~ Left-to-Right
*, /, %, x Left-to-Right
+, -, . Left-to-Right
<<, >> Left-to-Right
-e, -r Order of direction is not applicable here
<, <=, >, >=, lt, le, gt, ge Left-to-Right
==, !=, <=>, eq, ne, cmp Left-to-Right
& Left-to-Right
|, ^ Left-to-Right
&& Left-to-Right
|| Left-to-Right
.. Left-to-Right
? and : Right-to-Left
=, +=, -=, *= Right-to-Left
, Left-to-Right
not Left-to-Right
and Left-to-Right
or, xor Left-to-Right

The arity of an operator can be defined as the number of operands on which it operates.

A nullary operator operates on zero operand, a unary operator operates on one operand, a binary operator operates on two operands and a listary operator operates on list of operands.

Arithmetic operators are usually left associative. Here, (3 + 3) evaluates first and then goes to the second (-) operator.

Operator fixity can be defined as its position relative to its operands.

Here, + operator appears in between the operands 3 and 2

Here, ! and - operator appears before the operands $a and 3.

Here, ++ operator appears after the operands $x.

perl defined or assignment operator

perlop - Perl expressions: operators, precedence, string literals

DESCRIPTION

In Perl, the operator determines what operation is performed, independent of the type of the operands. For example $x + $y is always a numeric addition, and if $x or $y do not contain numbers, an attempt is made to convert them to numbers first.

This is in contrast to many other dynamic languages, where the operation is determined by the type of the first argument. It also means that Perl has two versions of some operators, one for numeric and one for string comparison. For example $x == $y compares two numbers for equality, and $x eq $y compares two strings.

There are a few exceptions though: x can be either string repetition or list repetition, depending on the type of the left operand, and & , | , ^ and ~ can be either string or numeric bit operations.

Operator Precedence and Associativity

Operator precedence and associativity work in Perl more or less like they do in mathematics.

Operator precedence means some operators group more tightly than others. For example, in 2 + 4 * 5 , the multiplication has higher precedence, so 4 * 5 is grouped together as the right-hand operand of the addition, rather than 2 + 4 being grouped together as the left-hand operand of the multiplication. It is as if the expression were written 2 + (4 * 5) , not (2 + 4) * 5 . So the expression yields 2 + 20 == 22 , rather than 6 * 5 == 30 .

Operator associativity defines what happens if a sequence of the same operators is used one after another: usually that they will be grouped at the left or the right. For example, in 9 - 3 - 2 , subtraction is left associative, so 9 - 3 is grouped together as the left-hand operand of the second subtraction, rather than 3 - 2 being grouped together as the right-hand operand of the first subtraction. It is as if the expression were written (9 - 3) - 2 , not 9 - (3 - 2) . So the expression yields 6 - 2 == 4 , rather than 9 - 1 == 8 .

For simple operators that evaluate all their operands and then combine the values in some way, precedence and associativity (and parentheses) imply some ordering requirements on those combining operations. For example, in 2 + 4 * 5 , the grouping implied by precedence means that the multiplication of 4 and 5 must be performed before the addition of 2 and 20, simply because the result of that multiplication is required as one of the operands of the addition. But the order of operations is not fully determined by this: in 2 * 2 + 4 * 5 both multiplications must be performed before the addition, but the grouping does not say anything about the order in which the two multiplications are performed. In fact Perl has a general rule that the operands of an operator are evaluated in left-to-right order. A few operators such as &&= have special evaluation rules that can result in an operand not being evaluated at all; in general, the top-level operator in an expression has control of operand evaluation.

Some comparison operators, as their associativity, chain with some operators of the same precedence (but never with operators of different precedence). This chaining means that each comparison is performed on the two arguments surrounding it, with each interior argument taking part in two comparisons, and the comparison results are implicitly ANDed. Thus "$x < $y <= $z" behaves exactly like "$x < $y && $y <= $z" , assuming that "$y" is as simple a scalar as it looks. The ANDing short-circuits just like "&&" does, stopping the sequence of comparisons as soon as one yields false.

In a chained comparison, each argument expression is evaluated at most once, even if it takes part in two comparisons, but the result of the evaluation is fetched for each comparison. (It is not evaluated at all if the short-circuiting means that it's not required for any comparisons.) This matters if the computation of an interior argument is expensive or non-deterministic. For example,

is not entirely like

but instead closer to

in that the subroutine is only called once. However, it's not exactly like this latter code either, because the chained comparison doesn't actually involve any temporary variable (named or otherwise): there is no assignment. This doesn't make much difference where the expression is a call to an ordinary subroutine, but matters more with an lvalue subroutine, or if the argument expression yields some unusual kind of scalar by other means. For example, if the argument expression yields a tied scalar, then the expression is evaluated to produce that scalar at most once, but the value of that scalar may be fetched up to twice, once for each comparison in which it is actually used.

In this example, the expression is evaluated only once, and the tied scalar (the result of the expression) is fetched for each comparison that uses it.

In the next example, the expression is evaluated only once, and the tied scalar is fetched once as part of the operation within the expression. The result of that operation is fetched for each comparison, which normally doesn't matter unless that expression result is also magical due to operator overloading.

Some operators are instead non-associative, meaning that it is a syntax error to use a sequence of those operators of the same precedence. For example, "$x .. $y .. $z" is an error.

Perl operators have the following associativity and precedence, listed from highest precedence to lowest. Operators borrowed from C keep the same precedence relationship with each other, even where C's precedence is slightly screwy. (This makes learning Perl easier for C folks.) With very few exceptions, these all operate on scalar values only, not array values.

In the following sections, these operators are covered in detail, in the same order in which they appear in the table above.

Many operators can be overloaded for objects. See overload .

Terms and List Operators (Leftward)

A TERM has the highest precedence in Perl. They include variables, quote and quote-like operators, any expression in parentheses, and any function whose arguments are parenthesized. Actually, there aren't really functions in this sense, just list operators and unary operators behaving as functions because you put parentheses around the arguments. These are all documented in perlfunc .

If any list operator ( print() , etc.) or any unary operator ( chdir() , etc.) is followed by a left parenthesis as the next token, the operator and arguments within parentheses are taken to be of highest precedence, just like a normal function call.

In the absence of parentheses, the precedence of list operators such as print , sort , or chmod is either very high or very low depending on whether you are looking at the left side or the right side of the operator. For example, in

the commas on the right of the sort are evaluated before the sort , but the commas on the left are evaluated after. In other words, list operators tend to gobble up all arguments that follow, and then act like a simple TERM with regard to the preceding expression. Be careful with parentheses:

Also note that

probably doesn't do what you expect at first glance. The parentheses enclose the argument list for print which is evaluated (printing the result of $foo & 255 ). Then one is added to the return value of print (usually 1). The result is something like this:

To do what you meant properly, you must write:

See "Named Unary Operators" for more discussion of this.

Also parsed as terms are the do {} and eval {} constructs, as well as subroutine and method calls, and the anonymous constructors [] and {} .

See also "Quote and Quote-like Operators" toward the end of this section, as well as "I/O Operators" .

The Arrow Operator

" -> " is an infix dereference operator, just as it is in C and C++. If the right side is either a [...] , {...} , or a (...) subscript, then the left side must be either a hard or symbolic reference to an array, a hash, or a subroutine respectively. (Or technically speaking, a location capable of holding a hard reference, if it's an array or hash reference being used for assignment.) See perlreftut and perlref .

Otherwise, the right side is a method name or a simple scalar variable containing either the method name or a subroutine reference, and (if it is a method name) the left side must be either an object (a blessed reference) or a class name (that is, a package name). See perlobj .

The dereferencing cases (as opposed to method-calling cases) are somewhat extended by the postderef feature. For the details of that feature, consult "Postfix Dereference Syntax" in perlref .

Auto-increment and Auto-decrement

"++" and "--" work as in C. That is, if placed before a variable, they increment or decrement the variable by one before returning the value, and if placed after, increment or decrement after returning the value.

Note that just as in C, Perl doesn't define when the variable is incremented or decremented. You just know it will be done sometime before or after the value is returned. This also means that modifying a variable twice in the same statement will lead to undefined behavior. Avoid statements like:

Perl will not guarantee what the result of the above statements is.

The auto-increment operator has a little extra builtin magic to it. If you increment a variable that is numeric, or that has ever been used in a numeric context, you get a normal increment. If, however, the variable has been used in only string contexts since it was set, and has a value that is not the empty string and matches the pattern /^[a-zA-Z]*[0-9]*\z/ , the increment is done as a string, preserving each character within its range, with carry:

undef is always treated as numeric, and in particular is changed to 0 before incrementing (so that a post-increment of an undef value will return 0 rather than undef ).

The auto-decrement operator is not magical.

Exponentiation

Binary "**" is the exponentiation operator. It binds even more tightly than unary minus, so -2**4 is -(2**4) , not (-2)**4 . (This is implemented using C's pow(3) function, which actually works on doubles internally.)

Note that certain exponentiation expressions are ill-defined: these include 0**0 , 1**Inf , and Inf**0 . Do not expect any particular results from these special cases, the results are platform-dependent.

Symbolic Unary Operators

Unary "!" performs logical negation, that is, "not". See also not for a lower precedence version of this.

Unary "-" performs arithmetic negation if the operand is numeric, including any string that looks like a number. If the operand is an identifier, a string consisting of a minus sign concatenated with the identifier is returned. Otherwise, if the string starts with a plus or minus, a string starting with the opposite sign is returned. One effect of these rules is that -bareword is equivalent to the string "-bareword" . If, however, the string begins with a non-alphabetic character (excluding "+" or "-" ), Perl will attempt to convert the string to a numeric, and the arithmetic negation is performed. If the string cannot be cleanly converted to a numeric, Perl will give the warning Argument "the string" isn't numeric in negation (-) at ... .

Unary "~" performs bitwise negation, that is, 1's complement. For example, 0666 & ~027 is 0640. (See also "Integer Arithmetic" and "Bitwise String Operators" .) Note that the width of the result is platform-dependent: ~0 is 32 bits wide on a 32-bit platform, but 64 bits wide on a 64-bit platform, so if you are expecting a certain bit width, remember to use the "&" operator to mask off the excess bits.

Starting in Perl 5.28, it is a fatal error to try to complement a string containing a character with an ordinal value above 255.

If the "bitwise" feature is enabled via use feature 'bitwise' or use v5.28 , then unary "~" always treats its argument as a number, and an alternate form of the operator, "~." , always treats its argument as a string. So ~0 and ~"0" will both give 2**32-1 on 32-bit platforms, whereas ~.0 and ~."0" will both yield "\xff" . Until Perl 5.28, this feature produced a warning in the "experimental::bitwise" category.

Unary "+" has no effect whatsoever, even on strings. It is useful syntactically for separating a function name from a parenthesized expression that would otherwise be interpreted as the complete list of function arguments. (See examples above under "Terms and List Operators (Leftward)" .)

Unary "\" creates references. If its operand is a single sigilled thing, it creates a reference to that object. If its operand is a parenthesised list, then it creates references to the things mentioned in the list. Otherwise it puts its operand in list context, and creates a list of references to the scalars in the list provided by the operand. See perlreftut and perlref . Do not confuse this behavior with the behavior of backslash within a string, although both forms do convey the notion of protecting the next thing from interpolation.

Binding Operators

Binary "=~" binds a scalar expression to a pattern match. Certain operations search or modify the string $_ by default. This operator makes that kind of operation work on some other string. The right argument is a search pattern, substitution, or transliteration. The left argument is what is supposed to be searched, substituted, or transliterated instead of the default $_ . When used in scalar context, the return value generally indicates the success of the operation. The exceptions are substitution ( s/// ) and transliteration ( y/// ) with the /r (non-destructive) option, which cause the r eturn value to be the result of the substitution. Behavior in list context depends on the particular operator. See "Regexp Quote-Like Operators" for details and perlretut for examples using these operators.

If the right argument is an expression rather than a search pattern, substitution, or transliteration, it is interpreted as a search pattern at run time. Note that this means that its contents will be interpolated twice, so

is not ok, as the regex engine will end up trying to compile the pattern \ , which it will consider a syntax error.

Binary "!~" is just like "=~" except the return value is negated in the logical sense.

Binary "!~" with a non-destructive substitution ( s///r ) or transliteration ( y///r ) is a syntax error.

Multiplicative Operators

Binary "*" multiplies two numbers.

Binary "/" divides two numbers.

Binary "%" is the modulo operator, which computes the division remainder of its first argument with respect to its second argument. Given integer operands $m and $n : If $n is positive, then $m % $n is $m minus the largest multiple of $n less than or equal to $m . If $n is negative, then $m % $n is $m minus the smallest multiple of $n that is not less than $m (that is, the result will be less than or equal to zero). If the operands $m and $n are floating point values and the absolute value of $n (that is abs($n) ) is less than (UV_MAX + 1) , only the integer portion of $m and $n will be used in the operation (Note: here UV_MAX means the maximum of the unsigned integer type). If the absolute value of the right operand ( abs($n) ) is greater than or equal to (UV_MAX + 1) , "%" computes the floating-point remainder $r in the equation ($r = $m - $i*$n) where $i is a certain integer that makes $r have the same sign as the right operand $n ( not as the left operand $m like C function fmod() ) and the absolute value less than that of $n . Note that when use integer is in scope, "%" gives you direct access to the modulo operator as implemented by your C compiler. This operator is not as well defined for negative operands, but it will execute faster.

Binary x is the repetition operator. In scalar context, or if the left operand is neither enclosed in parentheses nor a qw// list, it performs a string repetition. In that case it supplies scalar context to the left operand, and returns a string consisting of the left operand string repeated the number of times specified by the right operand. If the x is in list context, and the left operand is either enclosed in parentheses or a qw// list, it performs a list repetition. In that case it supplies list context to the left operand, and returns a list consisting of the left operand list repeated the number of times specified by the right operand. If the right operand is zero or negative (raising a warning on negative), it returns an empty string or an empty list, depending on the context.

Additive Operators

Binary "+" returns the sum of two numbers.

Binary "-" returns the difference of two numbers.

Binary "." concatenates two strings.

Shift Operators

Binary "<<" returns the value of its left argument shifted left by the number of bits specified by the right argument. Arguments should be integers. (See also "Integer Arithmetic" .)

Binary ">>" returns the value of its left argument shifted right by the number of bits specified by the right argument. Arguments should be integers. (See also "Integer Arithmetic" .)

If use integer (see "Integer Arithmetic" ) is in force then signed C integers are used ( arithmetic shift ), otherwise unsigned C integers are used ( logical shift ), even for negative shiftees. In arithmetic right shift the sign bit is replicated on the left, in logical shift zero bits come in from the left.

Either way, the implementation isn't going to generate results larger than the size of the integer type Perl was built with (32 bits or 64 bits).

Shifting by negative number of bits means the reverse shift: left shift becomes right shift, right shift becomes left shift. This is unlike in C, where negative shift is undefined.

Shifting by more bits than the size of the integers means most of the time zero (all bits fall off), except that under use integer right overshifting a negative shiftee results in -1. This is unlike in C, where shifting by too many bits is undefined. A common C behavior is "shift by modulo wordbits", so that for example

but that is completely accidental.

If you get tired of being subject to your platform's native integers, the use bigint pragma neatly sidesteps the issue altogether:

Named Unary Operators

The various named unary operators are treated as functions with one argument, with optional parentheses.

If any list operator ( print() , etc.) or any unary operator ( chdir() , etc.) is followed by a left parenthesis as the next token, the operator and arguments within parentheses are taken to be of highest precedence, just like a normal function call. For example, because named unary operators are higher precedence than || :

but, because "*" is higher precedence than named operators:

Regarding precedence, the filetest operators, like -f , -M , etc. are treated like named unary operators, but they don't follow this functional parenthesis rule. That means, for example, that -f($file).".bak" is equivalent to -f "$file.bak" .

See also "Terms and List Operators (Leftward)" .

Relational Operators

Perl operators that return true or false generally return values that can be safely used as numbers. For example, the relational operators in this section and the equality operators in the next one return 1 for true and a special version of the defined empty string, "" , which counts as a zero but is exempt from warnings about improper numeric conversions, just as "0 but true" is.

Binary "<" returns true if the left argument is numerically less than the right argument.

Binary ">" returns true if the left argument is numerically greater than the right argument.

Binary "<=" returns true if the left argument is numerically less than or equal to the right argument.

Binary ">=" returns true if the left argument is numerically greater than or equal to the right argument.

Binary "lt" returns true if the left argument is stringwise less than the right argument.

Binary "gt" returns true if the left argument is stringwise greater than the right argument.

Binary "le" returns true if the left argument is stringwise less than or equal to the right argument.

Binary "ge" returns true if the left argument is stringwise greater than or equal to the right argument.

A sequence of relational operators, such as "$x < $y <= $z" , performs chained comparisons, in the manner described above in the section "Operator Precedence and Associativity" . Beware that they do not chain with equality operators, which have lower precedence.

Equality Operators

Binary "==" returns true if the left argument is numerically equal to the right argument.

Binary "!=" returns true if the left argument is numerically not equal to the right argument.

Binary "eq" returns true if the left argument is stringwise equal to the right argument.

Binary "ne" returns true if the left argument is stringwise not equal to the right argument.

A sequence of the above equality operators, such as "$x == $y == $z" , performs chained comparisons, in the manner described above in the section "Operator Precedence and Associativity" . Beware that they do not chain with relational operators, which have higher precedence.

Binary "<=>" returns -1, 0, or 1 depending on whether the left argument is numerically less than, equal to, or greater than the right argument. If your platform supports NaN 's (not-a-numbers) as numeric values, using them with "<=>" returns undef. NaN is not "<" , "==" , ">" , "<=" or ">=" anything (even NaN ), so those 5 return false. NaN != NaN returns true, as does NaN != anything else . If your platform doesn't support NaN 's then NaN is just a string with numeric value 0.

(Note that the bigint , bigrat , and bignum pragmas all support "NaN" .)

Binary "cmp" returns -1, 0, or 1 depending on whether the left argument is stringwise less than, equal to, or greater than the right argument.

Here we can see the difference between <=> and cmp,

(likewise between gt and >, lt and <, etc.)

Binary "~~" does a smartmatch between its arguments. Smart matching is described in the next section.

The two-sided ordering operators "<=>" and "cmp" , and the smartmatch operator "~~" , are non-associative with respect to each other and with respect to the equality operators of the same precedence.

"lt" , "le" , "ge" , "gt" and "cmp" use the collation (sort) order specified by the current LC_COLLATE locale if a use locale form that includes collation is in effect. See perllocale . Do not mix these with Unicode, only use them with legacy 8-bit locale encodings. The standard Unicode::Collate and Unicode::Collate::Locale modules offer much more powerful solutions to collation issues.

For case-insensitive comparisons, look at the "fc" in perlfunc case-folding function, available in Perl v5.16 or later:

Class Instance Operator

Binary isa evaluates to true when the left argument is an object instance of the class (or a subclass derived from that class) given by the right argument. If the left argument is not defined, not a blessed object instance, nor does not derive from the class given by the right argument, the operator evaluates as false. The right argument may give the class either as a bareword or a scalar expression that yields a string class name:

This feature is available from Perl 5.31.6 onwards when enabled by use feature 'isa' . This feature is enabled automatically by a use v5.36 (or higher) declaration in the current scope.

Smartmatch Operator

First available in Perl 5.10.1 (the 5.10.0 version behaved differently), binary ~~ does a "smartmatch" between its arguments. This is mostly used implicitly in the when construct described in perlsyn , although not all when clauses call the smartmatch operator. Unique among all of Perl's operators, the smartmatch operator can recurse. The smartmatch operator is experimental and its behavior is subject to change.

It is also unique in that all other Perl operators impose a context (usually string or numeric context) on their operands, autoconverting those operands to those imposed contexts. In contrast, smartmatch infers contexts from the actual types of its operands and uses that type information to select a suitable comparison mechanism.

The ~~ operator compares its operands "polymorphically", determining how to compare them according to their actual types (numeric, string, array, hash, etc.). Like the equality operators with which it shares the same precedence, ~~ returns 1 for true and "" for false. It is often best read aloud as "in", "inside of", or "is contained in", because the left operand is often looked for inside the right operand. That makes the order of the operands to the smartmatch operand often opposite that of the regular match operator. In other words, the "smaller" thing is usually placed in the left operand and the larger one in the right.

The behavior of a smartmatch depends on what type of things its arguments are, as determined by the following table. The first row of the table whose types apply determines the smartmatch behavior. Because what actually happens is mostly determined by the type of the second operand, the table is sorted on the right operand instead of on the left.

The smartmatch implicitly dereferences any non-blessed hash or array reference, so the HASH and ARRAY entries apply in those cases. For blessed references, the Object entries apply. Smartmatches involving hashes only consider hash keys, never hash values.

The "like" code entry is not always an exact rendition. For example, the smartmatch operator short-circuits whenever possible, but grep does not. Also, grep in scalar context returns the number of matches, but ~~ returns only true or false.

Unlike most operators, the smartmatch operator knows to treat undef specially:

Each operand is considered in a modified scalar context, the modification being that array and hash variables are passed by reference to the operator, which implicitly dereferences them. Both elements of each pair are the same:

Two arrays smartmatch if each element in the first array smartmatches (that is, is "in") the corresponding element in the second array, recursively.

Because the smartmatch operator recurses on nested arrays, this will still report that "red" is in the array.

If two arrays smartmatch each other, then they are deep copies of each others' values, as this example reports:

If you were to set $b[3] = 4 , then instead of reporting that "a and b are deep copies of each other", it now reports that "b smartmatches in a" . That's because the corresponding position in @a contains an array that (eventually) has a 4 in it.

Smartmatching one hash against another reports whether both contain the same keys, no more and no less. This could be used to see whether two records have the same field names, without caring what values those fields might have. For example:

However, this only does what you mean if $init_fields is indeed a hash reference. The condition $init_fields ~~ $REQUIRED_FIELDS also allows the strings "name" , "rank" , "serial_num" as well as any array reference that contains "name" or "rank" or "serial_num" anywhere to pass through.

The smartmatch operator is most often used as the implicit operator of a when clause. See the section on "Switch Statements" in perlsyn .

Smartmatching of Objects

To avoid relying on an object's underlying representation, if the smartmatch's right operand is an object that doesn't overload ~~ , it raises the exception " Smartmatching a non-overloaded object breaks encapsulation ". That's because one has no business digging around to see whether something is "in" an object. These are all illegal on objects without a ~~ overload:

However, you can change the way an object is smartmatched by overloading the ~~ operator. This is allowed to extend the usual smartmatch semantics. For objects that do have an ~~ overload, see overload .

Using an object as the left operand is allowed, although not very useful. Smartmatching rules take precedence over overloading, so even if the object in the left operand has smartmatch overloading, this will be ignored. A left operand that is a non-overloaded object falls back on a string or numeric comparison of whatever the ref operator returns. That means that

does not invoke the overload method with X as an argument. Instead the above table is consulted as normal, and based on the type of X , overloading may or may not be invoked. For simple strings or numbers, "in" becomes equivalent to this:

For example, this reports that the handle smells IOish (but please don't really do this!):

That's because it treats $fh as a string like "IO::Handle=GLOB(0x8039e0)" , then pattern matches against that.

Bitwise And

Binary "&" returns its operands ANDed together bit by bit. Although no warning is currently raised, the result is not well defined when this operation is performed on operands that aren't either numbers (see "Integer Arithmetic" ) nor bitstrings (see "Bitwise String Operators" ).

Note that "&" has lower priority than relational operators, so for example the parentheses are essential in a test like

If the "bitwise" feature is enabled via use feature 'bitwise' or use v5.28 , then this operator always treats its operands as numbers. Before Perl 5.28 this feature produced a warning in the "experimental::bitwise" category.

Bitwise Or and Exclusive Or

Binary "|" returns its operands ORed together bit by bit.

Binary "^" returns its operands XORed together bit by bit.

Although no warning is currently raised, the results are not well defined when these operations are performed on operands that aren't either numbers (see "Integer Arithmetic" ) nor bitstrings (see "Bitwise String Operators" ).

Note that "|" and "^" have lower priority than relational operators, so for example the parentheses are essential in a test like

If the "bitwise" feature is enabled via use feature 'bitwise' or use v5.28 , then this operator always treats its operands as numbers. Before Perl 5.28. this feature produced a warning in the "experimental::bitwise" category.

C-style Logical And

Binary "&&" performs a short-circuit logical AND operation. That is, if the left operand is false, the right operand is not even evaluated. Scalar or list context propagates down to the right operand if it is evaluated.

C-style Logical Or

Binary "||" performs a short-circuit logical OR operation. That is, if the left operand is true, the right operand is not even evaluated. Scalar or list context propagates down to the right operand if it is evaluated.

C-style Logical Xor

Binary "^^" performs a logical XOR operation. Both operands are evaluated and the result is true only if exactly one of the operands is true. Scalar or list context propagates down to the right operand.

Logical Defined-Or

Although it has no direct equivalent in C, Perl's // operator is related to its C-style "or". In fact, it's exactly the same as || , except that it tests the left hand side's definedness instead of its truth. Thus, EXPR1 // EXPR2 returns the value of EXPR1 if it's defined, otherwise, the value of EXPR2 is returned. ( EXPR1 is evaluated in scalar context, EXPR2 in the context of // itself). Usually, this is the same result as defined(EXPR1) ? EXPR1 : EXPR2 (except that the ternary-operator form can be used as a lvalue, while EXPR1 // EXPR2 cannot). This is very useful for providing default values for variables. If you actually want to test if at least one of $x and $y is defined, use defined($x // $y) .

The || , // and && operators return the last value evaluated (unlike C's || and && , which return 0 or 1). Thus, a reasonably portable way to find out the home directory might be:

In particular, this means that you shouldn't use this for selecting between two aggregates for assignment:

As alternatives to && and || when used for control flow, Perl provides the and and or operators (see below). The short-circuit behavior is identical. The precedence of "and" and "or" is much lower, however, so that you can safely use them after a list operator without the need for parentheses:

With the C-style operators that would have been written like this:

It would be even more readable to write that this way:

Using "or" for assignment is unlikely to do what you want; see below.

Range Operators

Binary ".." is the range operator, which is really two different operators depending on the context. In list context, it returns a list of values counting (up by ones) from the left value to the right value. If the left value is greater than the right value then it returns the empty list. The range operator is useful for writing foreach (1..10) loops and for doing slice operations on arrays. In the current implementation, no temporary array is created when the range operator is used as the expression in foreach loops, but older versions of Perl might burn a lot of memory when you write something like this:

The range operator also works on strings, using the magical auto-increment, see below.

In scalar context, ".." returns a boolean value. The operator is bistable, like a flip-flop, and emulates the line-range (comma) operator of sed , awk , and various editors. Each ".." operator maintains its own boolean state, even across calls to a subroutine that contains it. It is false as long as its left operand is false. Once the left operand is true, the range operator stays true until the right operand is true, AFTER which the range operator becomes false again. It doesn't become false till the next time the range operator is evaluated. It can test the right operand and become false on the same evaluation it became true (as in awk ), but it still returns true once. If you don't want it to test the right operand until the next evaluation, as in sed , just use three dots ( "..." ) instead of two. In all other regards, "..." behaves just like ".." does.

The right operand is not evaluated while the operator is in the "false" state, and the left operand is not evaluated while the operator is in the "true" state. The precedence is a little lower than || and &&. The value returned is either the empty string for false, or a sequence number (beginning with 1) for true. The sequence number is reset for each range encountered. The final sequence number in a range has the string "E0" appended to it, which doesn't affect its numeric value, but gives you something to search for if you want to exclude the endpoint. You can exclude the beginning point by waiting for the sequence number to be greater than 1.

If either operand of scalar ".." is a constant expression, that operand is considered true if it is equal ( == ) to the current input line number (the $. variable).

To be pedantic, the comparison is actually int(EXPR) == int(EXPR) , but that is only an issue if you use a floating point expression; when implicitly using $. as described in the previous paragraph, the comparison is int(EXPR) == int($.) which is only an issue when $. is set to a floating point value and you are not reading from a file. Furthermore, "span" .. "spat" or 2.18 .. 3.14 will not do what you want in scalar context because each of the operands are evaluated using their integer representation.

As a scalar operator:

Here's a simple example to illustrate the difference between the two range operators:

This program will print only the line containing "Bar". If the range operator is changed to ... , it will also print the "Baz" line.

And now some examples as a list operator:

Because each operand is evaluated in integer form, 2.18 .. 3.14 will return two elements in list context.

The range operator in list context can make use of the magical auto-increment algorithm if both operands are strings, subject to the following rules:

With one exception (below), if both strings look like numbers to Perl, the magic increment will not be applied, and the strings will be treated as numbers (more specifically, integers) instead.

For example, "-2".."2" is the same as -2..2 , and "2.18".."3.14" produces 2, 3 .

The exception to the above rule is when the left-hand string begins with 0 and is longer than one character, in this case the magic increment will be applied, even though strings like "01" would normally look like a number to Perl.

For example, "01".."04" produces "01", "02", "03", "04" , and "00".."-1" produces "00" through "99" - this may seem surprising, but see the following rules for why it works this way. To get dates with leading zeros, you can say:

If you want to force strings to be interpreted as numbers, you could say

Note: In Perl versions 5.30 and below, any string on the left-hand side beginning with "0" , including the string "0" itself, would cause the magic string increment behavior. This means that on these Perl versions, "0".."-1" would produce "0" through "99" , which was inconsistent with 0..-1 , which produces the empty list. This also means that "0".."9" now produces a list of integers instead of a list of strings.

If the initial value specified isn't part of a magical increment sequence (that is, a non-empty string matching /^[a-zA-Z]*[0-9]*\z/ ), only the initial value will be returned.

For example, "ax".."az" produces "ax", "ay", "az" , but "*x".."az" produces only "*x" .

For other initial values that are strings that do follow the rules of the magical increment, the corresponding sequence will be returned.

For example, you can say

to get all normal letters of the English alphabet, or

to get a hexadecimal digit.

If the final value specified is not in the sequence that the magical increment would produce, the sequence goes until the next value would be longer than the final value specified. If the length of the final string is shorter than the first, the empty list is returned.

For example, "a".."--" is the same as "a".."zz" , "0".."xx" produces "0" through "99" , and "aaa".."--" returns the empty list.

As of Perl 5.26, the list-context range operator on strings works as expected in the scope of "use feature 'unicode_strings" . In previous versions, and outside the scope of that feature, it exhibits "The "Unicode Bug"" in perlunicode : its behavior depends on the internal encoding of the range endpoint.

Because the magical increment only works on non-empty strings matching /^[a-zA-Z]*[0-9]*\z/ , the following will only return an alpha:

To get the 25 traditional lowercase Greek letters, including both sigmas, you could use this instead:

However, because there are many other lowercase Greek characters than just those, to match lowercase Greek characters in a regular expression, you could use the pattern /(?:(?=\p{Greek})\p{Lower})+/ (or the experimental feature /(?[ \p{Greek} & \p{Lower} ])+/ ).

Conditional Operator

Ternary "?:" is the conditional operator, just as in C. It works much like an if-then-else. If the argument before the ? is true, the argument before the : is returned, otherwise the argument after the : is returned. For example:

Scalar or list context propagates downward into the 2nd or 3rd argument, whichever is selected.

The operator may be assigned to if both the 2nd and 3rd arguments are legal lvalues (meaning that you can assign to them):

Because this operator produces an assignable result, using assignments without parentheses will get you in trouble. For example, this:

Really means this:

Rather than this:

That should probably be written more simply as:

Assignment Operators

"=" is the ordinary assignment operator.

Assignment operators work as in C. That is,

is equivalent to

although without duplicating any side effects that dereferencing the lvalue might trigger, such as from tie() . Other assignment operators work similarly. The following are recognized:

Although these are grouped by family, they all have the precedence of assignment. These combined assignment operators can only operate on scalars, whereas the ordinary assignment operator can assign to arrays, hashes, lists and even references. (See "Context" and "List value constructors" in perldata , and "Assigning to References" in perlref .)

Unlike in C, the scalar assignment operator produces a valid lvalue. Modifying an assignment is equivalent to doing the assignment and then modifying the variable that was assigned to. This is useful for modifying a copy of something, like this:

Although as of 5.14, that can be also be accomplished this way:

Similarly, a list assignment in list context produces the list of lvalues assigned to, and a list assignment in scalar context returns the number of elements produced by the expression on the right hand side of the assignment.

The three dotted bitwise assignment operators ( &.= |.= ^.= ) are new in Perl 5.22. See "Bitwise String Operators" .

Comma Operator

Binary "," is the comma operator. In scalar context it evaluates its left argument, throws that value away, then evaluates its right argument and returns that value. This is just like C's comma operator.

In list context, it's just the list argument separator, and inserts both its arguments into the list. These arguments are also evaluated from left to right.

The => operator (sometimes pronounced "fat comma") is a synonym for the comma except that it causes a word on its left to be interpreted as a string if it begins with a letter or underscore and is composed only of letters, digits and underscores. This includes operands that might otherwise be interpreted as operators, constants, single number v-strings or function calls. If in doubt about this behavior, the left operand can be quoted explicitly.

Otherwise, the => operator behaves exactly as the comma operator or list argument separator, according to context.

For example:

is equivalent to:

It is NOT :

The => operator is helpful in documenting the correspondence between keys and values in hashes, and other paired elements in lists.

The special quoting behavior ignores precedence, and hence may apply to part of the left operand:

That example prints something like "1314363215shiftbbb" , because the => implicitly quotes the shift immediately on its left, ignoring the fact that time.shift is the entire left operand.

List Operators (Rightward)

On the right side of a list operator, the comma has very low precedence, such that it controls all comma-separated expressions found there. The only operators with lower precedence are the logical operators "and" , "or" , and "not" , which may be used to evaluate calls to list operators without the need for parentheses:

However, some people find that code harder to read than writing it with parentheses:

in which case you might as well just use the more customary "||" operator:

See also discussion of list operators in "Terms and List Operators (Leftward)" .

Logical Not

Unary "not" returns the logical negation of the expression to its right. It's the equivalent of "!" except for the very low precedence.

Logical And

Binary "and" returns the logical conjunction of the two surrounding expressions. It's equivalent to && except for the very low precedence. This means that it short-circuits: the right expression is evaluated only if the left expression is true.

Logical or and Exclusive Or

Binary "or" returns the logical disjunction of the two surrounding expressions. It's equivalent to || except for the very low precedence. This makes it useful for control flow:

This means that it short-circuits: the right expression is evaluated only if the left expression is false. Due to its precedence, you must be careful to avoid using it as replacement for the || operator. It usually works out better for flow control than in assignments:

However, when it's a list-context assignment and you're trying to use || for control flow, you probably need "or" so that the assignment takes higher precedence.

Then again, you could always use parentheses.

Binary "xor" returns the exclusive-OR of the two surrounding expressions. It cannot short-circuit (of course).

There is no low precedence operator for defined-OR.

C Operators Missing From Perl

Here is what C has that Perl doesn't:

Address-of operator. (But see the "\" operator for taking a reference.)

Dereference-address operator. (Perl's prefix dereferencing operators are typed: $ , @ , % , and & .)

Type-casting operator.

Quote and Quote-like Operators

While we usually think of quotes as literal values, in Perl they function as operators, providing various kinds of interpolating and pattern matching capabilities. Perl provides customary quote characters for these behaviors, but also provides a way for you to choose your quote character for any of them. In the following table, a {} represents any pair of delimiters you choose.

Non-bracketing delimiters use the same character fore and aft, but the four sorts of ASCII brackets (round, angle, square, curly) all nest, which means that

is the same as

Note, however, that this does not always work for quoting Perl code:

is a syntax error. The Text::Balanced module (standard as of v5.8, and from CPAN before then) is able to do this properly.

If the extra_paired_delimiters feature is enabled, then Perl will additionally recognise a variety of Unicode characters as being paired. For a full list, see the "List of Extra Paired Delimiters" at the end of this document.

There can (and in some cases, must) be whitespace between the operator and the quoting characters, except when # is being used as the quoting character. q#foo# is parsed as the string foo , while q #foo# is the operator q followed by a comment. Its argument will be taken from the next line. This allows you to write:

The cases where whitespace must be used are when the quoting character is a word character (meaning it matches /\w/ ):

The following escape sequences are available in constructs that interpolate, and in transliterations whose delimiters aren't single quotes ( "'" ). In all the ones with braces, any number of blanks and/or tabs adjoining and within the braces are allowed (and ignored).

Note that any escape sequence using braces inside interpolated constructs may have optional blanks (tab or space characters) adjoining with and inside of the braces, as illustrated above by the second \x{ } example.

The result is the character specified by the hexadecimal number between the braces. See "[8]" below for details on which character.

Blanks (tab or space characters) may separate the number from either or both of the braces.

Otherwise, only hexadecimal digits are valid between the braces. If an invalid character is encountered, a warning will be issued and the invalid character and all subsequent characters (valid or invalid) within the braces will be discarded.

If there are no valid digits between the braces, the generated character is the NULL character ( \x{00} ). However, an explicit empty brace ( \x{} ) will not cause a warning (currently).

The result is the character specified by the hexadecimal number in the range 0x00 to 0xFF. See "[8]" below for details on which character.

Only hexadecimal digits are valid following \x . When \x is followed by fewer than two valid digits, any valid digits will be zero-padded. This means that \x7 will be interpreted as \x07 , and a lone "\x" will be interpreted as \x00 . Except at the end of a string, having fewer than two valid digits will result in a warning. Note that although the warning says the illegal character is ignored, it is only ignored as part of the escape and will still be used as the subsequent character in the string. For example:

The result is the Unicode character or character sequence given by name . See charnames .

\N{U+ hexadecimal number } means the Unicode character whose Unicode code point is hexadecimal number .

The character following \c is mapped to some other character as shown in the table:

In other words, it's the character whose code point has had 64 xor'd with its uppercase. \c? is DELETE on ASCII platforms because ord("?") ^ 64 is 127, and \c@ is NULL because the ord of "@" is 64, so xor'ing 64 itself produces 0.

Also, \c\ X yields chr(28) . " X " for any X , but cannot come at the end of a string, because the backslash would be parsed as escaping the end quote.

On ASCII platforms, the resulting characters from the list above are the complete set of ASCII controls. This isn't the case on EBCDIC platforms; see "OPERATOR DIFFERENCES" in perlebcdic for a full discussion of the differences between these for ASCII versus EBCDIC platforms.

Use of any other character following the "c" besides those listed above is discouraged, and as of Perl v5.20, the only characters actually allowed are the printable ASCII ones, minus the left brace "{" . What happens for any of the allowed other characters is that the value is derived by xor'ing with the seventh bit, which is 64, and a warning raised if enabled. Using the non-allowed characters generates a fatal error.

To get platform independent controls, you can use \N{...} .

The result is the character specified by the octal number between the braces. See "[8]" below for details on which character.

Otherwise, if a character that isn't an octal digit is encountered, a warning is raised, and the value is based on the octal digits before it, discarding it and all following characters up to the closing brace. It is a fatal error if there are no octal digits at all.

The result is the character specified by the three-digit octal number in the range 000 to 777 (but best to not use above 077, see next paragraph). See "[8]" below for details on which character.

Some contexts allow 2 or even 1 digit, but any usage without exactly three digits, the first being a zero, may give unintended results. (For example, in a regular expression it may be confused with a backreference; see "Octal escapes" in perlrebackslash .) Starting in Perl 5.14, you may use \o{} instead, which avoids all these problems. Otherwise, it is best to use this construct only for ordinals \077 and below, remembering to pad to the left with zeros to make three digits. For larger ordinals, either use \o{} , or convert to something else, such as to hex and use \N{U+} (which is portable between platforms with different character sets) or \x{} instead.

Several constructs above specify a character by a number. That number gives the character's position in the character set encoding (indexed from 0). This is called synonymously its ordinal, code position, or code point. Perl works on platforms that have a native encoding currently of either ASCII/Latin1 or EBCDIC, each of which allow specification of 256 characters. In general, if the number is 255 (0xFF, 0377) or below, Perl interprets this in the platform's native encoding. If the number is 256 (0x100, 0400) or above, Perl interprets it as a Unicode code point and the result is the corresponding Unicode character. For example \x{50} and \o{120} both are the number 80 in decimal, which is less than 256, so the number is interpreted in the native character set encoding. In ASCII the character in the 80th position (indexed from 0) is the letter "P" , and in EBCDIC it is the ampersand symbol "&" . \x{100} and \o{400} are both 256 in decimal, so the number is interpreted as a Unicode code point no matter what the native encoding is. The name of the character in the 256th position (indexed by 0) in Unicode is LATIN CAPITAL LETTER A WITH MACRON .

An exception to the above rule is that \N{U+ hex number } is always interpreted as a Unicode code point, so that \N{U+0050} is "P" even on EBCDIC platforms.

NOTE : Unlike C and other languages, Perl has no \v escape sequence for the vertical tab (VT, which is 11 in both ASCII and EBCDIC), but you may use \N{VT} , \ck , \N{U+0b} , or \x0b . ( \v does have meaning in regular expression patterns in Perl, see perlre .)

The following escape sequences are available in constructs that interpolate, but not in transliterations.

See "quotemeta" in perlfunc for the exact definition of characters that are quoted by \Q .

\L , \U , \F , and \Q can stack, in which case you need one \E for each. For example:

If a use locale form that includes LC_CTYPE is in effect (see perllocale ), the case map used by \l , \L , \u , and \U is taken from the current locale. If Unicode (for example, \N{} or code points of 0x100 or beyond) is being used, the case map used by \l , \L , \u , and \U is as defined by Unicode. That means that case-mapping a single character can sometimes produce a sequence of several characters. Under use locale , \F produces the same results as \L for all locales but a UTF-8 one, where it instead uses the Unicode definition.

All systems use the virtual "\n" to represent a line terminator, called a "newline". There is no such thing as an unvarying, physical newline character. It is only an illusion that the operating system, device drivers, C libraries, and Perl all conspire to preserve. Not all systems read "\r" as ASCII CR and "\n" as ASCII LF. For example, on the ancient Macs (pre-MacOS X) of yesteryear, these used to be reversed, and on systems without a line terminator, printing "\n" might emit no actual data. In general, use "\n" when you mean a "newline" for your system, but use the literal ASCII when you need an exact character. For example, most networking protocols expect and prefer a CR+LF ( "\015\012" or "\cM\cJ" ) for line terminators, and although they often accept just "\012" , they seldom tolerate just "\015" . If you get in the habit of using "\n" for networking, you may be burned some day.

For constructs that do interpolate, variables beginning with " $ " or " @ " are interpolated. Subscripted variables such as $a[3] or $href->{key}[0] are also interpolated, as are array and hash slices. But method calls such as $obj->meth are not.

Interpolating an array or slice interpolates the elements in order, separated by the value of $" , so is equivalent to interpolating join $", @array . "Punctuation" arrays such as @* are usually interpolated only if the name is enclosed in braces @{*} , but the arrays @_ , @+ , and @- are interpolated even without braces.

For double-quoted strings, the quoting from \Q is applied after interpolation and escapes are processed.

For the pattern of regex operators ( qr// , m// and s/// ), the quoting from \Q is applied after interpolation is processed, but before escapes are processed. This allows the pattern to match literally (except for $ and @ ). For example, the following matches:

Because $ or @ trigger interpolation, you'll need to use something like /\Quser\E\@\Qhost/ to match them literally.

Patterns are subject to an additional level of interpretation as a regular expression. This is done as a second pass, after variables are interpolated, so that regular expressions may be incorporated into the pattern from the variables. If this is not what you want, use \Q to interpolate a variable literally.

Apart from the behavior described above, Perl does not expand multiple levels of interpolation. In particular, contrary to the expectations of shell programmers, back-quotes do NOT interpolate within double quotes, nor do single quotes impede evaluation of variables when used within double quotes.

Regexp Quote-Like Operators

Here are the quote-like operators that apply to pattern matching and related activities.

This operator quotes (and possibly compiles) its STRING as a regular expression. STRING is interpolated the same way as PATTERN in m/ PATTERN / . If "'" is used as the delimiter, no variable interpolation is done. Returns a Perl value which may be used instead of the corresponding / STRING /msixpodualn expression. The returned value is a normalized version of the original pattern. It magically differs from a string containing the same characters: ref(qr/x/) returns "Regexp"; however, dereferencing it is not well defined (you currently get the normalized version of the original pattern, but this may change).

For example,

The result may be used as a subpattern in a match:

Since Perl may compile the pattern at the moment of execution of the qr() operator, using qr() may have speed advantages in some situations, notably if the result of qr() is used standalone:

Precompilation of the pattern into an internal representation at the moment of qr() avoids the need to recompile the pattern every time a match /$pat/ is attempted. (Perl has many other internal optimizations, but none would be triggered in the above example if we did not use qr() operator.)

Options (specified by the following modifiers) are:

If a precompiled pattern is embedded in a larger pattern then the effect of "msixpluadn" will be propagated appropriately. The effect that the /o modifier has is not propagated, being restricted to those patterns explicitly using it.

The /a , /d , /l , and /u modifiers (added in Perl 5.14) control the character set rules, but /a is the only one you are likely to want to specify explicitly; the other three are selected automatically by various pragmas.

See perlre for additional information on valid syntax for STRING , and for a detailed look at the semantics of regular expressions. In particular, all modifiers except the largely obsolete /o are further explained in "Modifiers" in perlre . /o is described in the next section.

Searches a string for a pattern match, and in scalar context returns true if it succeeds, false if it fails. If no string is specified via the =~ or !~ operator, the $_ string is searched. (The string specified with =~ need not be an lvalue--it may be the result of an expression evaluation, but remember the =~ binds rather tightly.) See also perlre .

Options are as described in qr// above; in addition, the following match process modifiers are available:

If "/" is the delimiter then the initial m is optional. With the m you can use any pair of non-whitespace (ASCII) characters as delimiters. This is particularly useful for matching path names that contain "/" , to avoid LTS (leaning toothpick syndrome). If "?" is the delimiter, then a match-only-once rule applies, described in m? PATTERN ? below. If "'" (single quote) is the delimiter, no variable interpolation is performed on the PATTERN . When using a delimiter character valid in an identifier, whitespace is required after the m .

PATTERN may contain variables, which will be interpolated every time the pattern search is evaluated, except for when the delimiter is a single quote. (Note that $( , $) , and $| are not interpolated because they look like end-of-string tests.) Perl will not recompile the pattern unless an interpolated variable that it contains changes. You can force Perl to skip the test and never recompile by adding a /o (which stands for "once") after the trailing delimiter. Once upon a time, Perl would recompile regular expressions unnecessarily, and this modifier was useful to tell it not to do so, in the interests of speed. But now, the only reasons to use /o are one of:

The variables are thousands of characters long and you know that they don't change, and you need to wring out the last little bit of speed by having Perl skip testing for that. (There is a maintenance penalty for doing this, as mentioning /o constitutes a promise that you won't change the variables in the pattern. If you do change them, Perl won't even notice.)

you want the pattern to use the initial values of the variables regardless of whether they change or not. (But there are saner ways of accomplishing this than using /o .)

If the pattern contains embedded code, such as

then perl will recompile each time, even though the pattern string hasn't changed, to ensure that the current value of $x is seen each time. Use /o if you want to avoid this.

The bottom line is that using /o is almost never a good idea.

If the PATTERN evaluates to the empty string, the last successfully matched regular expression in the current dynamic scope is used instead (see also "Scoping Rules of Regex Variables" in perlvar ). In this case, only the g and c flags on the empty pattern are honored; the other flags are taken from the original pattern. If no match has previously succeeded, this will (silently) act instead as a genuine empty pattern (which will always match). Using a user supplied string as a pattern has the risk that if the string is empty that it triggers the "last successful match" behavior, which can be very confusing. In such cases you are recommended to replace m/$pattern/ with m/(?:$pattern)/ to avoid this behavior.

The last successful pattern may be accessed as a variable via ${^LAST_SUCCESSFUL_PATTERN} . Matching against it, or the empty pattern should have the same effect, with the exception that when there is no last successful pattern the empty pattern will silently match, whereas using the ${^LAST_SUCCESSFUL_PATTERN} variable will produce undefined warnings (if warnings are enabled). You can check defined(${^LAST_SUCCESSFUL_PATTERN}) to test if there is a "last successful match" in the current scope.

Note that it's possible to confuse Perl into thinking // (the empty regex) is really // (the defined-or operator). Perl is usually pretty good about this, but some pathological cases might trigger this, such as $x/// (is that ($x) / (//) or $x // / ?) and print $fh // ( print $fh(// or print($fh // ?). In all of these examples, Perl will assume you meant defined-or. If you meant the empty regex, just use parentheses or spaces to disambiguate, or even prefix the empty regex with an m (so // becomes m// ).

If the /g option is not used, m// in list context returns a list consisting of the subexpressions matched by the parentheses in the pattern, that is, ( $1 , $2 , $3 ...) (Note that here $1 etc. are also set). When there are no parentheses in the pattern, the return value is the list (1) for success. With or without parentheses, an empty list is returned upon failure.

This last example splits $foo into the first two words and the remainder of the line, and assigns those three fields to $F1 , $F2 , and $Etc . The conditional is true if any variables were assigned; that is, if the pattern matched.

The /g modifier specifies global pattern matching--that is, matching as many times as possible within the string. How it behaves depends on the context. In list context, it returns a list of the substrings matched by any capturing parentheses in the regular expression. If there are no parentheses, it returns a list of all the matched strings, as if there were parentheses around the whole pattern.

In scalar context, each execution of m//g finds the next match, returning true if it matches, and false if there is no further match. The position after the last match can be read or set using the pos() function; see "pos" in perlfunc . A failed match normally resets the search position to the beginning of the string, but you can avoid that by adding the /c modifier (for example, m//gc ). Modifying the target string also resets the search position.

You can intermix m//g matches with m/\G.../g , where \G is a zero-width assertion that matches the exact position where the previous m//g , if any, left off. Without the /g modifier, the \G assertion still anchors at pos() as it was at the start of the operation (see "pos" in perlfunc ), but the match is of course only attempted once. Using \G without /g on a target string that has not previously had a /g match applied to it is the same as using the \A assertion to match the beginning of the string. Note also that, currently, \G is only properly supported when anchored at the very beginning of the pattern.

Here's another way to check for sentences in a paragraph:

Here's how to use m//gc with \G :

The last example should print:

Notice that the final match matched q instead of p , which a match without the \G anchor would have done. Also note that the final match did not update pos . pos is only updated on a /g match. If the final match did indeed match p , it's a good bet that you're running an ancient (pre-5.6.0) version of Perl.

A useful idiom for lex -like scanners is /\G.../gc . You can combine several regexps like this to process a string part-by-part, doing different actions depending on which regexp matched. Each regexp tries to match where the previous one leaves off.

Here is the output (split into several lines):

This is just like the m/ PATTERN / search, except that it matches only once between calls to the reset() operator. This is a useful optimization when you want to see only the first occurrence of something in each file of a set of files, for instance. Only m?? patterns local to the current package are reset.

Another example switched the first "latin1" encoding it finds to "utf8" in a pod file:

The match-once behavior is controlled by the match delimiter being ? ; with any other delimiter this is the normal m// operator.

In the past, the leading m in m? PATTERN ? was optional, but omitting it would produce a deprecation warning. As of v5.22.0, omitting it produces a syntax error. If you encounter this construct in older code, you can just add m .

Searches a string for a pattern, and if found, replaces that pattern with the replacement text and returns the number of substitutions made. Otherwise it returns false (a value that is both an empty string ( "" ) and numeric zero ( 0 ) as described in "Relational Operators" ).

If the /r (non-destructive) option is used then it runs the substitution on a copy of the string and instead of returning the number of substitutions, it returns the copy whether or not a substitution occurred. The original string is never changed when /r is used. The copy will always be a plain string, even if the input is an object or a tied variable.

If no string is specified via the =~ or !~ operator, the $_ variable is searched and modified. Unless the /r option is used, the string specified must be a scalar variable, an array element, a hash element, or an assignment to one of those; that is, some sort of scalar lvalue.

If the delimiter chosen is a single quote, no variable interpolation is done on either the PATTERN or the REPLACEMENT . Otherwise, if the PATTERN contains a $ that looks like a variable rather than an end-of-string test, the variable will be interpolated into the pattern at run-time. If you want the pattern compiled only once the first time the variable is interpolated, use the /o option. If the pattern evaluates to the empty string, the last successfully executed regular expression is used instead. See perlre for further explanation on these.

Options are as with m// with the addition of the following replacement specific options:

Any non-whitespace delimiter may replace the slashes. Add space after the s when using a character allowed in identifiers. If single quotes are used, no interpretation is done on the replacement string (the /e modifier overrides this, however). Note that Perl treats backticks as normal delimiters; the replacement text is not evaluated as a command. If the PATTERN is delimited by bracketing quotes, the REPLACEMENT has its own pair of quotes, which may or may not be bracketing quotes, for example, s(foo)(bar) or s<foo>/bar/ . A /e will cause the replacement portion to be treated as a full-fledged Perl expression and evaluated right then and there. It is, however, syntax checked at compile-time. A second e modifier will cause the replacement portion to be eval ed before being run as a Perl expression.

Note the use of $ instead of \ in the last example. Unlike sed , we use the \< digit > form only in the left hand side. Anywhere else it's $< digit >.

Occasionally, you can't use just a /g to get all the changes to occur that you might want. Here are two common cases:

While s/// accepts the /c flag, it has no effect beyond producing a warning if warnings are enabled.

Quote-Like Operators

A single-quoted, literal string. A backslash represents a backslash unless followed by the delimiter or another backslash, in which case the delimiter or backslash is interpolated.

A double-quoted, interpolated string.

A string which is (possibly) interpolated and then executed as a system command, via /bin/sh or its equivalent if required. Shell wildcards, pipes, and redirections will be honored. Similarly to system , if the string contains no shell metacharacters then it will executed directly. The collected standard output of the command is returned; standard error is unaffected. In scalar context, it comes back as a single (potentially multi-line) string, or undef if the shell (or command) could not be started. In list context, returns a list of lines (however you've defined lines with $/ or $INPUT_RECORD_SEPARATOR ), or an empty list if the shell (or command) could not be started.

Because backticks do not affect standard error, use shell file descriptor syntax (assuming the shell supports this) if you care to address this. To capture a command's STDERR and STDOUT together:

To capture a command's STDOUT but discard its STDERR:

To capture a command's STDERR but discard its STDOUT (ordering is important here):

To exchange a command's STDOUT and STDERR in order to capture the STDERR but leave its STDOUT to come out the old STDERR:

To read both a command's STDOUT and its STDERR separately, it's easiest to redirect them separately to files, and then read from those files when the program is done:

The STDIN filehandle used by the command is inherited from Perl's STDIN. For example:

will print the sorted contents of the file named "stuff" .

Using single-quote as a delimiter protects the command from Perl's double-quote interpolation, passing it on to the shell instead:

How that string gets evaluated is entirely subject to the command interpreter on your system. On most platforms, you will have to protect shell metacharacters if you want them treated literally. This is in practice difficult to do, as it's unclear how to escape which characters. See perlsec for a clean and safe example of a manual fork() and exec() to emulate backticks safely.

On some platforms (notably DOS-like ones), the shell may not be capable of dealing with multiline commands, so putting newlines in the string may not get you what you want. You may be able to evaluate multiple commands in a single line by separating them with the command separator character, if your shell supports that (for example, ; on many Unix shells and & on the Windows NT cmd shell).

Perl will attempt to flush all files opened for output before starting the child process, but this may not be supported on some platforms (see perlport ). To be safe, you may need to set $| ( $AUTOFLUSH in English ) or call the autoflush() method of IO::Handle on any open handles.

Beware that some command shells may place restrictions on the length of the command line. You must ensure your strings don't exceed this limit after any necessary interpolations. See the platform-specific release notes for more details about your particular environment.

Using this operator can lead to programs that are difficult to port, because the shell commands called vary between systems, and may in fact not be present at all. As one example, the type command under the POSIX shell is very different from the type command under DOS. That doesn't mean you should go out of your way to avoid backticks when they're the right way to get something done. Perl was made to be a glue language, and one of the things it glues together is commands. Just understand what you're getting yourself into.

Like system , backticks put the child process exit code in $? . If you'd like to manually inspect failure, you can check all possible failure modes by inspecting $? like this:

Use the open pragma to control the I/O layers used when reading the output of the command, for example:

qx// can also be called like a function with "readpipe" in perlfunc .

See "I/O Operators" for more discussion.

Evaluates to a list of the words extracted out of STRING , using embedded whitespace as the word delimiters. It can be understood as being roughly equivalent to:

the differences being that it only splits on ASCII whitespace, generates a real list at compile time, and in scalar context it returns the last element in the list. So this expression:

is semantically equivalent to the list:

Some frequently seen examples:

A common mistake is to try to separate the words with commas or to put comments into a multi-line qw -string. For this reason, the use warnings pragma and the -w switch (that is, the $^W variable) produces warnings if the STRING contains the "," or the "#" character.

Transliterates all occurrences of the characters found (or not found if the /c modifier is specified) in the search list with the positionally corresponding character in the replacement list, possibly deleting some, depending on the modifiers specified. It returns the number of characters replaced or deleted. If no string is specified via the =~ or !~ operator, the $_ string is transliterated.

For sed devotees, y is provided as a synonym for tr .

If the /r (non-destructive) option is present, a new copy of the string is made and its characters transliterated, and this copy is returned no matter whether it was modified or not: the original string is always left unchanged. The new copy is always a plain string, even if the input string is an object or a tied variable.

Unless the /r option is used, the string specified with =~ must be a scalar variable, an array element, a hash element, or an assignment to one of those; in other words, an lvalue.

The characters delimitting SEARCHLIST and REPLACEMENTLIST can be any printable character, not just forward slashes. If they are single quotes ( tr' SEARCHLIST ' REPLACEMENTLIST ' ), the only interpolation is removal of \ from pairs of \\ ; so hyphens are interpreted literally rather than specifying a character range.

Otherwise, a character range may be specified with a hyphen, so tr/A-J/0-9/ does the same replacement as tr/ACEGIBDFHJ/0246813579/ .

If the SEARCHLIST is delimited by bracketing quotes, the REPLACEMENTLIST must have its own pair of quotes, which may or may not be bracketing quotes; for example, tr(aeiouy)(yuoiea) or tr[+\-*/]"ABCD" . This final example shows a way to visually clarify what is going on for people who are more familiar with regular expression patterns than with tr , and who may think forward slash delimiters imply that tr is more like a regular expression pattern than it actually is. (Another option might be to use tr[...][...] .)

tr isn't fully like bracketed character classes, just (significantly) more like them than it is to full patterns. For example, characters appearing more than once in either list behave differently here than in patterns, and tr lists do not allow backslashed character classes such as \d or \pL , nor variable interpolation, so "$" and "@" are always treated as literals.

The allowed elements are literals plus \' (meaning a single quote). If the delimiters aren't single quotes, also allowed are any of the escape sequences accepted in double-quoted strings. Escape sequence details are in the table near the beginning of this section .

A hyphen at the beginning or end, or preceded by a backslash is also always considered a literal. Precede a delimiter character with a backslash to allow it.

The tr operator is not equivalent to the tr(1) utility. tr[a-z][A-Z] will uppercase the 26 letters "a" through "z", but for case changing not confined to ASCII, use lc , uc , lcfirst , ucfirst (all documented in perlfunc ), or the substitution operator s/ PATTERN / REPLACEMENT / (with \U , \u , \L , and \l string-interpolation escapes in the REPLACEMENT portion).

Most ranges are unportable between character sets, but certain ones signal Perl to do special handling to make them portable. There are two classes of portable ranges. The first are any subsets of the ranges A-Z , a-z , and 0-9 , when expressed as literal characters.

capitalizes the letters "h" , "i" , "j" , and "k" and nothing else, no matter what the platform's character set is. In contrast, all of

do the same capitalizations as the previous example when run on ASCII platforms, but something completely different on EBCDIC ones.

The second class of portable ranges is invoked when one or both of the range's end points are expressed as \N{...}

removes from $string all the platform's characters which are equivalent to any of Unicode U+0020, U+0021, ... U+007D, U+007E. This is a portable range, and has the same effect on every platform it is run on. In this example, these are the ASCII printable characters. So after this is run, $string has only controls and characters which have no ASCII equivalents.

But, even for portable ranges, it is not generally obvious what is included without having to look things up in the manual. A sound principle is to use only ranges that both begin from, and end at, either ASCII alphabetics of equal case ( b-e , B-E ), or digits ( 1-4 ). Anything else is unclear (and unportable unless \N{...} is used). If in doubt, spell out the character sets in full.

If the /d modifier is specified, any characters specified by SEARCHLIST not found in REPLACEMENTLIST are deleted. (Note that this is slightly more flexible than the behavior of some tr programs, which delete anything they find in the SEARCHLIST , period.)

If the /s modifier is specified, sequences of characters, all in a row, that were transliterated to the same character are squashed down to a single instance of that character.

If the /d modifier is used, the REPLACEMENTLIST is always interpreted exactly as specified. Otherwise, if the REPLACEMENTLIST is shorter than the SEARCHLIST , the final character, if any, is replicated until it is long enough. There won't be a final character if and only if the REPLACEMENTLIST is empty, in which case REPLACEMENTLIST is copied from SEARCHLIST . An empty REPLACEMENTLIST is useful for counting characters in a class, or for squashing character sequences in a class.

If the /c modifier is specified, the characters to be transliterated are the ones NOT in SEARCHLIST , that is, it is complemented. If /d and/or /s are also specified, they apply to the complemented SEARCHLIST . Recall, that if REPLACEMENTLIST is empty (except under /d ) a copy of SEARCHLIST is used instead. That copy is made after complementing under /c . SEARCHLIST is sorted by code point order after complementing, and any REPLACEMENTLIST is applied to that sorted result. This means that under /c , the order of the characters specified in SEARCHLIST is irrelevant. This can lead to different results on EBCDIC systems if REPLACEMENTLIST contains more than one character, hence it is generally non-portable to use /c with such a REPLACEMENTLIST .

Another way of describing the operation is this: If /c is specified, the SEARCHLIST is sorted by code point order, then complemented. If REPLACEMENTLIST is empty and /d is not specified, REPLACEMENTLIST is replaced by a copy of SEARCHLIST (as modified under /c ), and these potentially modified lists are used as the basis for what follows. Any character in the target string that isn't in SEARCHLIST is passed through unchanged. Every other character in the target string is replaced by the character in REPLACEMENTLIST that positionally corresponds to its mate in SEARCHLIST , except that under /s , the 2nd and following characters are squeezed out in a sequence of characters in a row that all translate to the same character. If SEARCHLIST is longer than REPLACEMENTLIST , characters in the target string that match a character in SEARCHLIST that doesn't have a correspondence in REPLACEMENTLIST are either deleted from the target string if /d is specified; or replaced by the final character in REPLACEMENTLIST if /d isn't specified.

Some examples:

If multiple transliterations are given for a character, only the first one is used:

will transliterate any A to X.

Because the transliteration table is built at compile time, neither the SEARCHLIST nor the REPLACEMENTLIST are subjected to double quote interpolation. That means that if you want to use variables, you must use an eval() :

A line-oriented form of quoting is based on the shell "here-document" syntax. Following a << you specify a string to terminate the quoted material, and all lines following the current line down to the terminating string are the value of the item.

Prefixing the terminating string with a ~ specifies that you want to use "Indented Here-docs" (see below).

The terminating string may be either an identifier (a word), or some quoted text. An unquoted identifier works like double quotes. There may not be a space between the << and the identifier, unless the identifier is explicitly quoted. The terminating string must appear by itself (unquoted and with no surrounding whitespace) on the terminating line.

If the terminating string is quoted, the type of quotes used determine the treatment of the text.

Double quotes indicate that the text will be interpolated using exactly the same rules as normal double quoted strings.

Single quotes indicate the text is to be treated literally with no interpolation of its content. This is similar to single quoted strings except that backslashes have no special meaning, with \\ being treated as two backslashes and not one as they would in every other quoting construct.

Just as in the shell, a backslashed bareword following the << means the same thing as a single-quoted string does:

This is the only form of quoting in perl where there is no need to worry about escaping content, something that code generators can and do make good use of.

The content of the here doc is treated just as it would be if the string were embedded in backticks. Thus the content is interpolated as though it were double quoted and then executed via the shell, with the results of the execution returned.

The here-doc modifier ~ allows you to indent your here-docs to make the code more readable:

This will print...

...with no leading whitespace.

The line containing the delimiter that marks the end of the here-doc determines the indentation template for the whole thing. Compilation croaks if any non-empty line inside the here-doc does not begin with the precise indentation of the terminating line. (An empty line consists of the single character "\n".) For example, suppose the terminating line begins with a tab character followed by 4 space characters. Every non-empty line in the here-doc must begin with a tab followed by 4 spaces. They are stripped from each line, and any leading white space remaining on a line serves as the indentation for that line. Currently, only the TAB and SPACE characters are treated as whitespace for this purpose. Tabs and spaces may be mixed, but are matched exactly; tabs remain tabs and are not expanded.

Additional beginning whitespace (beyond what preceded the delimiter) will be preserved:

Finally, the modifier may be used with all of the forms mentioned above:

And whitespace may be used between the ~ and quoted delimiters:

It is possible to stack multiple here-docs in a row:

Just don't forget that you have to put a semicolon on the end to finish the statement, as Perl doesn't know you're not going to try to do this:

If you want to remove the line terminator from your here-docs, use chomp() .

If you want your here-docs to be indented with the rest of the code, use the <<~FOO construct described under "Indented Here-docs" :

If you use a here-doc within a delimited construct, such as in s///eg , the quoted material must still come on the line following the <<FOO marker, which means it may be inside the delimited construct:

It works this way as of Perl 5.18. Historically, it was inconsistent, and you would have to write

outside of string evals.

Additionally, quoting rules for the end-of-string identifier are unrelated to Perl's quoting rules. q() , qq() , and the like are not supported in place of '' and "" , and the only interpolation is for backslashing the quoting character:

Finally, quoted strings cannot span multiple lines. The general rule is that the identifier must be a string literal. Stick with that, and you should be safe.

Gory details of parsing quoted constructs

When presented with something that might have several different interpretations, Perl uses the DWIM (that's "Do What I Mean") principle to pick the most probable interpretation. This strategy is so successful that Perl programmers often do not suspect the ambivalence of what they write. But from time to time, Perl's notions differ substantially from what the author honestly meant.

This section hopes to clarify how Perl handles quoted constructs. Although the most common reason to learn this is to unravel labyrinthine regular expressions, because the initial steps of parsing are the same for all quoting operators, they are all discussed together.

The most important Perl parsing rule is the first one discussed below: when processing a quoted construct, Perl first finds the end of that construct, then interprets its contents. If you understand this rule, you may skip the rest of this section on the first reading. The other rules are likely to contradict the user's expectations much less frequently than this first one.

Some passes discussed below are performed concurrently, but because their results are the same, we consider them individually. For different quoting constructs, Perl performs different numbers of passes, from one to four, but these passes are always performed in the same order.

The first pass is finding the end of the quoted construct. This results in saving to a safe location a copy of the text (between the starting and ending delimiters), normalized as necessary to avoid needing to know what the original delimiters were.

If the construct is a here-doc, the ending delimiter is a line that has a terminating string as the content. Therefore <<EOF is terminated by EOF immediately followed by "\n" and starting from the first column of the terminating line. When searching for the terminating line of a here-doc, nothing is skipped. In other words, lines after the here-doc syntax are compared with the terminating string line by line.

For the constructs except here-docs, single characters are used as starting and ending delimiters. If the starting delimiter is an opening punctuation (that is ( , [ , { , or < ), the ending delimiter is the corresponding closing punctuation (that is ) , ] , } , or > ). If the starting delimiter is an unpaired character like / or a closing punctuation, the ending delimiter is the same as the starting delimiter. Therefore a / terminates a qq// construct, while a ] terminates both qq[] and qq]] constructs.

When searching for single-character delimiters, escaped delimiters and \\ are skipped. For example, while searching for terminating / , combinations of \\ and \/ are skipped. If the delimiters are bracketing, nested pairs are also skipped. For example, while searching for a closing ] paired with the opening [ , combinations of \\ , \] , and \[ are all skipped, and nested [ and ] are skipped as well. However, when backslashes are used as the delimiters (like qq\\ and tr\\\ ), nothing is skipped. During the search for the end, backslashes that escape delimiters or other backslashes are removed (exactly speaking, they are not copied to the safe location).

For constructs with three-part delimiters ( s/// , y/// , and tr/// ), the search is repeated once more. If the first delimiter is not an opening punctuation, the three delimiters must be the same, such as s!!! and tr))) , in which case the second delimiter terminates the left part and starts the right part at once. If the left part is delimited by bracketing punctuation (that is () , [] , {} , or <> ), the right part needs another pair of delimiters such as s(){} and tr[]// . In these cases, whitespace and comments are allowed between the two parts, although the comment must follow at least one whitespace character; otherwise a character expected as the start of the comment may be regarded as the starting delimiter of the right part.

During this search no attention is paid to the semantics of the construct. Thus:

do not form legal quoted expressions. The quoted part ends on the first " and / , and the rest happens to be a syntax error. Because the slash that terminated m// was followed by a SPACE , the example above is not m//x , but rather m// with no /x modifier. So the embedded # is interpreted as a literal # .

Also no attention is paid to \c\ (multichar control char syntax) during this search. Thus the second \ in qq/\c\/ is interpreted as a part of \/ , and the following / is not recognized as a delimiter. Instead, use \034 or \x1c at the end of quoted constructs.

The next step is interpolation in the text obtained, which is now delimiter-independent. There are multiple cases.

No interpolation is performed. Note that the combination \\ is left intact, since escaped delimiters are not available for here-docs.

No interpolation is performed at this stage. Any backslashed sequences including \\ are treated at the stage of "Parsing regular expressions" .

The only interpolation is removal of \ from pairs of \\ . Therefore "-" in tr''' and y''' is treated literally as a hyphen and no character range is available. \1 in the replacement of s''' does not work as $1 .

No variable interpolation occurs. String modifying combinations for case and quoting such as \Q , \U , and \E are not recognized. The other escape sequences such as \200 and \t and backslashed characters such as \\ and \- are converted to appropriate literals. The character "-" is treated specially and therefore \- is treated as a literal "-" .

\Q , \U , \u , \L , \l , \F (possibly paired with \E ) are converted to corresponding Perl constructs. Thus, "$foo\Qbaz$bar" is converted to $foo . (quotemeta("baz" . $bar)) internally. The other escape sequences such as \200 and \t and backslashed characters such as \\ and \- are replaced with appropriate expansions.

Let it be stressed that whatever falls between \Q and \E is interpolated in the usual way. Something like "\Q\\E" has no \E inside. Instead, it has \Q , \\ , and E , so the result is the same as for "\\\\E" . As a general rule, backslashes between \Q and \E may lead to counterintuitive results. So, "\Q\t\E" is converted to quotemeta("\t") , which is the same as "\\\t" (since TAB is not alphanumeric). Note also that:

may be closer to the conjectural intention of the writer of "\Q\t\E" .

Interpolated scalars and arrays are converted internally to the join and "." catenation operations. Thus, "$foo XXX '@arr'" becomes:

All operations above are performed simultaneously, left to right.

Because the result of "\Q STRING \E" has all metacharacters quoted, there is no way to insert a literal $ or @ inside a \Q\E pair. If protected by \ , $ will be quoted to become "\\\$" ; if not, it is interpreted as the start of an interpolated scalar.

Note also that the interpolation code needs to make a decision on where the interpolated scalar ends. For instance, whether "a $x -> {c}" really means:

Most of the time, the longest possible text that does not include spaces between components and which contains matching braces or brackets. because the outcome may be determined by voting based on heuristic estimators, the result is not strictly predictable. Fortunately, it's usually correct for ambiguous cases.

Processing of \Q , \U , \u , \L , \l , \F and interpolation happens as with qq// constructs.

It is at this step that \1 is begrudgingly converted to $1 in the replacement text of s/// , in order to correct the incorrigible sed hackers who haven't picked up the saner idiom yet. A warning is emitted if the use warnings pragma or the -w command-line flag (that is, the $^W variable) was set.

Processing of \Q , \U , \u , \L , \l , \F , \E , and interpolation happens (almost) as with qq// constructs.

Processing of \N{...} is also done here, and compiled into an intermediate form for the regex compiler. (This is because, as mentioned below, the regex compilation may be done at execution time, and \N{...} is a compile-time construct.)

However any other combinations of \ followed by a character are not substituted but only skipped, in order to parse them as regular expressions at the following step. As \c is skipped at this step, @ of \c@ in RE is possibly treated as an array symbol (for example @foo ), even though the same text in qq// gives interpolation of \c@ .

Code blocks such as (?{BLOCK}) are handled by temporarily passing control back to the perl parser, in a similar way that an interpolated array subscript expression such as "foo$array[1+f("[xyz")]bar" would be.

Moreover, inside (?{BLOCK}) , (?# comment ) , and a # -comment in a /x -regular expression, no processing is performed whatsoever. This is the first step at which the presence of the /x modifier is relevant.

Interpolation in patterns has several quirks: $| , $( , $) , @+ and @- are not interpolated, and constructs $var[SOMETHING] are voted (by several different estimators) to be either an array element or $var followed by an RE alternative. This is where the notation ${arr[$bar]} comes handy: /${arr[0-9]}/ is interpreted as array element -9 , not as a regular expression from the variable $arr followed by a digit, which would be the interpretation of /$arr[0-9]/ . Since voting among different estimators may occur, the result is not predictable.

The lack of processing of \\ creates specific restrictions on the post-processed text. If the delimiter is / , one cannot get the combination \/ into the result of this step. / will finish the regular expression, \/ will be stripped to / on the previous step, and \\/ will be left as is. Because / is equivalent to \/ inside a regular expression, this does not matter unless the delimiter happens to be character special to the RE engine, such as in s*foo*bar* , m[foo] , or m?foo? ; or an alphanumeric char, as in:

In the RE above, which is intentionally obfuscated for illustration, the delimiter is m , the modifier is mx , and after delimiter-removal the RE is the same as for m/ ^ a \s* b /mx . There's more than one reason you're encouraged to restrict your delimiters to non-alphanumeric, non-whitespace choices.

This step is the last one for all constructs except regular expressions, which are processed further.

Previous steps were performed during the compilation of Perl code, but this one happens at run time, although it may be optimized to be calculated at compile time if appropriate. After preprocessing described above, and possibly after evaluation if concatenation, joining, casing translation, or metaquoting are involved, the resulting string is passed to the RE engine for compilation.

Whatever happens in the RE engine might be better discussed in perlre , but for the sake of continuity, we shall do so here.

This is another step where the presence of the /x modifier is relevant. The RE engine scans the string from left to right and converts it into a finite automaton.

Backslashed characters are either replaced with corresponding literal strings (as with \{ ), or else they generate special nodes in the finite automaton (as with \b ). Characters special to the RE engine (such as | ) generate corresponding nodes or groups of nodes. (?#...) comments are ignored. All the rest is either converted to literal strings to match, or else is ignored (as is whitespace and # -style comments if /x is present).

Parsing of the bracketed character class construct, [...] , is rather different than the rule used for the rest of the pattern. The terminator of this construct is found using the same rules as for finding the terminator of a {} -delimited construct, the only exception being that ] immediately following [ is treated as though preceded by a backslash.

The terminator of runtime (?{...}) is found by temporarily switching control to the perl parser, which should stop at the point where the logically balancing terminating } is found.

It is possible to inspect both the string given to RE engine and the resulting finite automaton. See the arguments debug / debugcolor in the use re pragma, as well as Perl's -Dr command-line switch documented in "Command Switches" in perlrun .

This step is listed for completeness only. Since it does not change semantics, details of this step are not documented and are subject to change without notice. This step is performed over the finite automaton that was generated during the previous pass.

It is at this stage that split() silently optimizes /^/ to mean /^/m .

I/O Operators

There are several I/O operators you should know about.

A string enclosed by backticks (grave accents) first undergoes double-quote interpolation. It is then interpreted as an external command, and the output of that command is the value of the backtick string, like in a shell. In scalar context, a single string consisting of all output is returned. In list context, a list of values is returned, one per line of output. (You can set $/ to use a different line terminator.) The command is executed each time the pseudo-literal is evaluated. The status value of the command is returned in $? (see perlvar for the interpretation of $? ). Unlike in csh , no translation is done on the return data--newlines remain newlines. Unlike in any of the shells, single quotes do not hide variable names in the command from interpretation. To pass a literal dollar-sign through to the shell you need to hide it with a backslash. The generalized form of backticks is qx// , or you can call the "readpipe" in perlfunc function. (Because backticks always undergo shell expansion as well, see perlsec for security concerns.)

In scalar context, evaluating a filehandle in angle brackets yields the next line from that file (the newline, if any, included), or undef at end-of-file or on error. When $/ is set to undef (sometimes known as file-slurp mode) and the file is empty, it returns '' the first time, followed by undef subsequently.

Ordinarily you must assign the returned value to a variable, but there is one situation where an automatic assignment happens. If and only if the input symbol is the only thing inside the conditional of a while statement (even if disguised as a for(;;) loop), the value is automatically assigned to the global variable $_ , destroying whatever was there previously. (This may seem like an odd thing to you, but you'll use the construct in almost every Perl script you write.) The $_ variable is not implicitly localized. You'll have to put a local $_; before the loop if you want that to happen. Furthermore, if the input symbol or an explicit assignment of the input symbol to a scalar is used as a while / for condition, then the condition actually tests for definedness of the expression's value, not for its regular truth value.

Thus the following lines are equivalent:

This also behaves similarly, but assigns to a lexical variable instead of to $_ :

In these loop constructs, the assigned value (whether assignment is automatic or explicit) is then tested to see whether it is defined. The defined test avoids problems where the line has a string value that would be treated as false by Perl; for example a "" or a "0" with no trailing newline. If you really mean for such values to terminate the loop, they should be tested for explicitly:

In other boolean contexts, < FILEHANDLE > without an explicit defined test or comparison elicits a warning if the use warnings pragma or the -w command-line switch (the $^W variable) is in effect.

The filehandles STDIN, STDOUT, and STDERR are predefined. (The filehandles stdin , stdout , and stderr will also work except in packages, where they would be interpreted as local identifiers rather than global.) Additional filehandles may be created with the open() function, amongst others. See perlopentut and "open" in perlfunc for details on this.

If a < FILEHANDLE > is used in a context that is looking for a list, a list comprising all input lines is returned, one line per list element. It's easy to grow to a rather large data space this way, so use with care.

< FILEHANDLE > may also be spelled readline(* FILEHANDLE ) . See "readline" in perlfunc .

The null filehandle <> (sometimes called the diamond operator) is special: it can be used to emulate the behavior of sed and awk , and any other Unix filter program that takes a list of filenames, doing the same to each line of input from all of them. Input from <> comes either from standard input, or from each file listed on the command line. Here's how it works: the first time <> is evaluated, the @ARGV array is checked, and if it is empty, $ARGV[0] is set to "-" , which when opened gives you standard input. The @ARGV array is then processed as a list of filenames. The loop

is equivalent to the following Perl-like pseudo code:

except that it isn't so cumbersome to say, and will actually work. It really does shift the @ARGV array and put the current filename into the $ARGV variable. It also uses filehandle ARGV internally. <> is just a synonym for <ARGV> , which is magical. (The pseudo code above doesn't work because it treats <ARGV> as non-magical.)

Since the null filehandle uses the two argument form of "open" in perlfunc it interprets special characters, so if you have a script like this:

and call it with perl dangerous.pl 'rm -rfv *|' , it actually opens a pipe, executes the rm command and reads rm 's output from that pipe. If you want all items in @ARGV to be interpreted as file names, you can use the module ARGV::readonly from CPAN, or use the double diamond bracket:

Using double angle brackets inside of a while causes the open to use the three argument form (with the second argument being < ), so all arguments in ARGV are treated as literal filenames (including "-" ). (Note that for convenience, if you use <<>> and if @ARGV is empty, it will still read from the standard input.)

You can modify @ARGV before the first <> as long as the array ends up containing the list of filenames you really want. Line numbers ( $. ) continue as though the input were one big happy file. See the example in "eof" in perlfunc for how to reset line numbers on each file.

If you want to set @ARGV to your own list of files, go right ahead. This sets @ARGV to all plain text files if no @ARGV was given:

You can even set them to pipe commands. For example, this automatically filters compressed arguments through gzip :

If you want to pass switches into your script, you can use one of the Getopts modules or put a loop on the front like this:

The <> symbol will return undef for end-of-file only once. If you call it again after this, it will assume you are processing another @ARGV list, and if you haven't set @ARGV , will read input from STDIN.

If what the angle brackets contain is a simple scalar variable (for example, $foo ), then that variable contains the name of the filehandle to input from, or its typeglob, or a reference to the same. For example:

If what's within the angle brackets is neither a filehandle nor a simple scalar variable containing a filehandle name, typeglob, or typeglob reference, it is interpreted as a filename pattern to be globbed, and either a list of filenames or the next filename in the list is returned, depending on context. This distinction is determined on syntactic grounds alone. That means <$x> is always a readline() from an indirect handle, but <$hash{key}> is always a glob() . That's because $x is a simple scalar variable, but $hash{key} is not--it's a hash element. Even <$x > (note the extra space) is treated as glob("$x ") , not readline($x) .

One level of double-quote interpretation is done first, but you can't say <$foo> because that's an indirect filehandle as explained in the previous paragraph. (In older versions of Perl, programmers would insert curly brackets to force interpretation as a filename glob: <${foo}> . These days, it's considered cleaner to call the internal function directly as glob($foo) , which is probably the right way to have done it in the first place.) For example:

is roughly equivalent to:

except that the globbing is actually done internally using the standard File::Glob extension. Of course, the shortest way to do the above is:

A (file)glob evaluates its (embedded) argument only when it is starting a new list. All values must be read before it will start over. In list context, this isn't important because you automatically get them all anyway. However, in scalar context the operator returns the next value each time it's called, or undef when the list has run out. As with filehandle reads, an automatic defined is generated when the glob occurs in the test part of a while , because legal glob returns (for example, a file called 0 ) would otherwise terminate the loop. Again, undef is returned only once. So if you're expecting a single value from a glob, it is much better to say

because the latter will alternate between returning a filename and returning false.

If you're trying to do variable interpolation, it's definitely better to use the glob() function, because the older notation can cause people to become confused with the indirect filehandle notation.

If an angle-bracket-based globbing expression is used as the condition of a while or for loop, then it will be implicitly assigned to $_ . If either a globbing expression or an explicit assignment of a globbing expression to a scalar is used as a while / for condition, then the condition actually tests for definedness of the expression's value, not for its regular truth value.

Constant Folding

Like C, Perl does a certain amount of expression evaluation at compile time whenever it determines that all arguments to an operator are static and have no side effects. In particular, string concatenation happens at compile time between literals that don't do variable substitution. Backslash interpolation also happens at compile time. You can say

and this all reduces to one string internally. Likewise, if you say

the compiler precomputes the number which that expression represents so that the interpreter won't have to.

Perl doesn't officially have a no-op operator, but the bare constants 0 and 1 are special-cased not to produce a warning in void context, so you can for example safely do

Bitwise String Operators

Bitstrings of any size may be manipulated by the bitwise operators ( ~ | & ^ ).

If the operands to a binary bitwise op are strings of different sizes, | and ^ ops act as though the shorter operand had additional zero bits on the right, while the & op acts as though the longer operand were truncated to the length of the shorter. The granularity for such extension or truncation is one or more bytes.

If you are intending to manipulate bitstrings, be certain that you're supplying bitstrings: If an operand is a number, that will imply a numeric bitwise operation. You may explicitly show which type of operation you intend by using "" or 0+ , as in the examples below.

This somewhat unpredictable behavior can be avoided with the "bitwise" feature, new in Perl 5.22. You can enable it via use feature 'bitwise' or use v5.28 . Before Perl 5.28, it used to emit a warning in the "experimental::bitwise" category. Under this feature, the four standard bitwise operators ( ~ | & ^ ) are always numeric. Adding a dot after each operator ( ~. |. &. ^. ) forces it to treat its operands as strings:

The assignment variants of these operators ( &= |= ^= &.= |.= ^.= ) behave likewise under the feature.

It is a fatal error if an operand contains a character whose ordinal value is above 0xFF, and hence not expressible except in UTF-8. The operation is performed on a non-UTF-8 copy for other operands encoded in UTF-8. See "Byte and Character Semantics" in perlunicode .

See "vec" in perlfunc for information on how to manipulate individual bits in a bit vector.

Integer Arithmetic

By default, Perl assumes that it must do most of its arithmetic in floating point. But by saying

you may tell the compiler to use integer operations (see integer for a detailed explanation) from here to the end of the enclosing BLOCK. An inner BLOCK may countermand this by saying

which lasts until the end of that BLOCK. Note that this doesn't mean everything is an integer, merely that Perl will use integer operations for arithmetic, comparison, and bitwise operators. For example, even under use integer , if you take the sqrt(2) , you'll still get 1.4142135623731 or so.

Used on numbers, the bitwise operators ( & | ^ ~ << >> ) always produce integral results. (But see also "Bitwise String Operators" .) However, use integer still has meaning for them. By default, their results are interpreted as unsigned integers, but if use integer is in effect, their results are interpreted as signed integers. For example, ~0 usually evaluates to a large integral value. However, use integer; ~0 is -1 on two's-complement machines.

Floating-point Arithmetic

While use integer provides integer-only arithmetic, there is no analogous mechanism to provide automatic rounding or truncation to a certain number of decimal places. For rounding to a certain number of digits, sprintf() or printf() is usually the easiest route. See perlfaq4 .

Floating-point numbers are only approximations to what a mathematician would call real numbers. There are infinitely more reals than floats, so some corners must be cut. For example:

Testing for exact floating-point equality or inequality is not a good idea. Here's a (relatively expensive) work-around to compare whether two floating-point numbers are equal to a particular number of decimal places. See Knuth, volume II, for a more robust treatment of this topic.

The POSIX module (part of the standard perl distribution) implements ceil() , floor() , and other mathematical and trigonometric functions. The Math::Complex module (part of the standard perl distribution) defines mathematical functions that work on both the reals and the imaginary numbers. Math::Complex is not as efficient as POSIX, but POSIX can't work with complex numbers.

Rounding in financial applications can have serious implications, and the rounding method used should be specified precisely. In these cases, it probably pays not to trust whichever system rounding is being used by Perl, but to instead implement the rounding function you need yourself.

Bigger Numbers

The standard Math::BigInt , Math::BigRat , and Math::BigFloat modules, along with the bignum , bigint , and bigrat pragmas, provide variable-precision arithmetic and overloaded operators, although they're currently pretty slow. At the cost of some space and considerable speed, they avoid the normal pitfalls associated with limited-precision representations.

Or with rationals:

Several modules let you calculate with unlimited or fixed precision (bound only by memory and CPU time). There are also some non-standard modules that provide faster implementations via external C libraries.

Here is a short, but incomplete summary:

Choose wisely.

List of Extra Paired Delimiters

The complete list of accepted paired delimiters as of Unicode 14.0 is:

Module Install Instructions

To install less, copy and paste the appropriate command in to your terminal.

For more information on module installation, please visit the detailed CPAN module installation guide .

Keyboard Shortcuts

Global
Focus search bar
Bring up this help dialog
GitHub
Go to pull requests
go to github issues (only if github is preferred repository)
POD
Go to author
Go to changes
Go to issues
Go to dist
Go to repository/SCM
Go to source
Go to file browse
Search terms
(e.g. )
(e.g. )
(e.g. )
(e.g. )

Popular Articles

  • Perl Empty Array (Jan 05, 2024)
  • Perl Change Directory (Jan 05, 2024)
  • Perl Backticks (Jan 05, 2024)
  • Perl Vs Bash (Jan 05, 2024)
  • Perl Or Operator (Jan 05, 2024)

Perl or Operator

Switch to English

Table of Contents

Introduction

Explanation of the 'or' operator in perl, examples of the 'or' operator in perl, tips and tricks, common errors and how to avoid them.

  • Perl is a versatile and powerful programming language, used extensively in web development, system administration, bioinformatics, and many other areas. One of the fundamental aspects of Perl and indeed, any programming language is its ability to perform logical operations. In Perl, the 'or' operator holds a special place. This operator allows developers to test multiple conditions and execute code based on the result. This article will explore the Perl 'or' operator in detail, providing examples and tips to help you avoid common pitfalls.
  • In Perl, the 'or' operator is a logical operator that is used to perform logical OR operations. It returns true if either or both of the conditions being compared are true. If neither of the conditions is true, the operator will return false. Here is the basic syntax: perl condition1 or condition2 In this syntax, if condition1 is false, then Perl will evaluate condition2. If condition2 is true, then the whole expression is true. If both conditions are false, then the whole expression is false.
  • Let's look at a simple example to understand how the 'or' operator works in Perl: perl my $x = 10; my $y = 20; if ($x == 10 or $y == 30) { print "The condition is true\n"; } else { print "The condition is false\n"; } In this example, the 'or' operator is used to check two conditions. The first condition is whether $x is equal to 10 and the second condition is whether $y is equal to 30. Even though the second condition is false, the entire expression is true because the first condition is true, and so "The condition is true" is printed.
  • Understanding the 'or' operator is crucial for efficient Perl programming. Here are some tips and tricks that can help you: - Remember that the 'or' operator in Perl is a short-circuit operator. This means it evaluates the left-hand side first. If the left-hand side is true, it does not bother evaluating the right-hand side because the overall result will be true regardless. - Use parentheses to ensure the correct order of operations. Although 'or' has a low precedence, it can still be a good idea to use parentheses to make your intentions clear. - The 'or' operator can be used to provide default values. For example: perl my $value = $input or "default"; In this code, if $input is false (which in Perl can mean undefined, zero, or the empty string), then $value is set to "default".
  • One common mistake when using the 'or' operator in Perl is misunderstanding its precedence. The 'or' operator has lower precedence than many other Perl operators, which means it is often evaluated last. This can lead to unexpected results if you're not careful. For example, consider the following code: perl my $value = $input or "default"; You might expect this to assign the value of $input to $value, or "default" if $input is false. But because the assignment operator (=) has higher precedence than 'or', this will actually assign the value of $input to $value, and then evaluate $value or "default", which doesn't do anything useful. To avoid this, use parentheses: perl my $value = ($input or "default"); In conclusion, the 'or' operator in Perl is a powerful tool, but like any tool, it must be used correctly. By understanding how it works and being aware of common pitfalls, you can use the 'or' operator to write more efficient and effective Perl code.

Home » Perl Operators

Perl Operators

Summary : in this tutorial, you’ll learn about Perl operators including numeric operators, string operators, and logical operators.

Numeric operators

Perl provides numeric operators to help you operate on numbers including arithmetic, Boolean and bitwise operations. Let’s examine the different kinds of operators in more detail.

Arithmetic operators

Perl arithmetic operators deal with basic math such as adding, subtracting, multiplying, diving, etc. To add (+ ) or subtract (-) numbers, you would do something as follows:

To multiply or divide numbers, you use divide (/) and multiply (*) operators as follows:

When you combine adding, subtracting, multiplying, and dividing operators together, Perl will perform the calculation in an order, which is known as operator precedence.

The multiply and divide operators have higher precedence than add and subtract operators, therefore, Perl performs multiplying and dividing before adding and subtracting. See the following example:

Perl performs 20/2 and 5*2 first, therefore you will get 10 + 10 – 10 = 10.

You can use brackets () to force Perl to perform calculations based on the precedence you want as shown in the following example:

To raise one number to the power of another number, you use the exponentiation operator (**) e.g., 2**3 = 2 * 2 * 2. The following example demonstrates the exponentiation operators:

To get the remainder of the division of one number by another, you use the modulo operator (%).

It is handy to use the modulo operator (%) to check if a number is odd or even by dividing it by 2 to get the remainder. If the remainder is zero, the number is even, otherwise, the number is odd. See the following example:

Bitwise Operators

Bitwise operators allow you to operate on numbers one bit at a time. Think of a number as a series of bits e.g., 125 can be represented in binary form as 1111101 . Perl provides all basic bitwise operators including and (&), or (|), exclusive or (^) , not (~) operators, shift right (>>), and shift left (<<) operators.

The bitwise operators perform from right to left. In other words, bitwise operators perform from the rightmost bit to the leftmost bit.

The following example demonstrates all bitwise operators:

If you are not familiar with bitwise operations, we are highly recommended you check out bitwise operations on Wikipedia .

Comparison operators for numbers

Perl provides all comparison operators for numbers as listed in the following table:

EqualityOperators
Equal==
Not Equal!=
Comparison<=>
Less than<
Greater than>
Less than or equal<=
Greater than or equal>=

All the operators in the table above are obvious except the number comparison operator  <=> which is also known as spaceship operator.

The number comparison operator is often used in sorting numbers. See the code below:

The number operator returns:

  • 1 if $a is greater than $b
  • 0 if $a and $b are equal
  • -1 if $a is lower than $b

Take a look at the following example:

String operators

String comparison operators.

Perl provides the corresponding comparison operators for strings. Let’s take a look a the table below:

EqualityOperators
Equaleq
Not Equalne
Comparisoncmp
Less thanlt
Greater thangt
Less than or equalle
Greater than or equalge

String concatenation operators

Perl provides the concatenation ( . ) and repetition ( x ) operators that allow you to manipulate strings. Let’s take a look at the concatenation operator (.) first:

The concatenation operator (.) combines two strings together.

A string can be repeated with the repetition ( x ) operator:

The chomp() operator

The chomp() operator (or function ) removes the last character in a string and returns a number of characters that were removed. The chomp() operator is very useful when dealing with the user’s input because it helps you remove the new line character \n from the string that the user entered.

The <STDIN> is used to get input from users.

Logical operators

Logical operators are often used in control statements such as if , while ,  given, etc.,   to control the flow of the program. The following are logical operators in Perl:

  • $a && $b performs the logic AND of two variables or expressions. The logical && operator checks if both variables or expressions are true.
  • $a || $b performs the logic OR of two variables or expressions. The logical || operator checks whether a variable or expression is true.
  • !$a performs the logic NOT of the variable or expression. The logic ! operator inverts the value of the following variable or expression. In the other words, it converts true to false or false to true .

You will learn how to use logical operators in conditional statements such as  if ,  while  and  given .

In this tutorial, you’ve learned some basic Perl operators. These operators are very important so make sure that you get familiar with them.

perl defined or assignment operator

Perl Tutorial

  • Introduction to Perl
  • Installation and Environment Setup
  • Syntax of a Perl Program
  • Hello World Program in Perl
  • Perl vs C/C++
  • Perl vs Java
  • Perl vs Python

Fundamentals

  • Modes of Writing a Perl Code
  • Boolean Values
  • Variables and its Types
  • Scope of Variables
  • Modules in Perl
  • Packages in Perl
  • Number and its Types
  • Directories with CRUD operations

Input and Output

  • Use of print() and say() in Perl
  • Perl | print operator
  • Use of STDIN for Input

Control Flow

  • Decision Making
  • Perl given-when Statement
  • Perl goto operator
  • next operator
  • redo operator
  • last in loop

Arrays and Lists

  • Array Slices
  • Getting the Number of Elements of an Array
  • Reverse an array
  • Sorting of Arrays
  • Useful Array functions
  • Arrays (push, pop, shift, unshift)
  • Implementing a Stack
  • List and its Types
  • List Functions
  • Introduction to Hash
  • Working of a Hash
  • Hash Operations
  • Sorting a Hash
  • Multidimensional Hashes
  • Hash in Scalar and List Context
  • Useful Hash functions
  • Comparing Scalars
  • scalar keyword
  • Quoted, Interpolated and Escaped Strings
  • Multi-line Strings | Here Document
  • Sorting mixed Strings in Perl
  • String Operators
  • Useful String Operators
  • String functions (length, lc, uc, index, rindex)
  • Useful String functions
  • Automatic String to Number Conversion or Casting
  • Count the frequency of words in text
  • Removing leading and trailing white spaces (trim)

Object Oriented Programming in Perl

  • Introduction to OOPs
  • Constructors and Destructors
  • Method Overriding
  • Inheritance
  • Polymorphism
  • Encapsulation

Subroutines

  • Subroutines or Functions
  • Function Signature in Perl
  • Passing Complex Parameters to a Subroutine
  • Mutable and Immutable parameters
  • Multiple Subroutines
  • Use of return() Function
  • Pass By Reference
  • Recursion in Perl
  • Regular Expressions
  • Operators in Regular Expression
  • Regex Character Classes
  • Special Character Classes in Regular Expressions
  • Quantifiers in Regular Expression
  • Backtracking in Regular Expression
  • ‘e’ modifier in Regex
  • ‘ee’ Modifier in Regex
  • pos() function in Regex
  • Regex Cheat Sheet
  • Searching in a File using regex

File Handling

  • File Handling Introduction
  • Opening and Reading a File
  • Writing to a File
  • Appending to a File
  • Reading a CSV File
  • File Test Operators
  • File Locking
  • Use of Slurp Module
  • Useful File-handling functions

Context Sensitivity

  • Scalar Context Sensitivity
  • List Context Sensitivity
  • STDIN in Scalar and List Context
  • CGI Programming
  • File Upload in CGI
  • GET vs POST in CGI
  • Breakpoints of a Debugger
  • Exiting from a Script
  • Creating Excel Files
  • Reading Excel Files
  • Number Guessing Game using Perl
  • Database management using DBI
  • Accessing a Directory using File Globbing
  • Use of Hash bang or Shebang line
  • Useful Math functions

Operators in Perl

Perl offers a rich set of operators for various operations, including arithmetic, comparison, logical operations, and more. This tutorial will walk you through the major operators in Perl and how to use them.

1. Arithmetic Operators

These are used for mathematical operations:

  • + : Addition
  • - : Subtraction
  • * : Multiplication
  • / : Division
  • % : Modulus (remainder after division)
  • ** : Exponentiation

2. Comparison Operators

Used for numeric comparison:

  • == : Equal to
  • != : Not equal to
  • < : Less than
  • > : Greater than
  • <= : Less than or equal to
  • >= : Greater than or equal to

For string comparison:

  • eq : Equal to
  • ne : Not equal to
  • lt : Less than
  • gt : Greater than
  • le : Less than or equal to
  • ge : Greater than or equal to

3. Logical Operators

  • && : Logical AND
  • || : Logical OR
  • ! : Logical NOT
  • and : Low precedence logical AND
  • or : Low precedence logical OR
  • not : Low precedence logical NOT

4. Assignment Operators

  • += : Add and assign
  • -= : Subtract and assign
  • *= : Multiply and assign
  • /= : Divide and assign
  • %= : Modulus and assign

5. Bitwise Operators

  • & : Bitwise AND
  • | : Bitwise OR
  • ^ : Bitwise XOR
  • ~ : Bitwise NOT
  • << : Left shift
  • >> : Right shift

6. String Operators

  • . : Concatenate strings
  • x : Repeat string

7. Range Operator

  • .. : Creates a range of values.

8. Conditional Operator

  • ? : : Ternary conditional operator

9. File Test Operators

These are unary operators that test attributes of a file:

  • -e : File exists
  • -z : File is empty
  • -s : File size (returns size or undef if doesn't exist)
  • -r : File is readable
  • -w : File is writable
  • -x : File is executable
  • -f : Regular file (not a directory or device file)
  • -d : Directory ... and many more.

10. Special Operators

  • .. : Flip-flop operator in scalar context.
  • <> : Diamond operator to read from file or standard input.

Perl's operator set is diverse and flexible, providing tools for a variety of operations, from basic arithmetic to file tests. Familiarity with these operators is key to writing efficient and readable Perl code.

Arithmetic operators in Perl:

  • Description: Arithmetic operators perform mathematical operations on numbers.
  • Example Code: my $sum = 5 + 3; # Addition my $difference = 7 - 2; # Subtraction my $product = 4 * 6; # Multiplication my $quotient = 10 / 2; # Division my $remainder = 17 % 4; # Modulus

Comparison operators in Perl:

  • Description: Comparison operators compare values and return a Boolean result.
  • Example Code: my $result1 = (10 == 5); # Equal to my $result2 = (7 != 3); # Not equal to my $result3 = (8 > 6); # Greater than my $result4 = (4 < 9); # Less than my $result5 = (12 >= 10); # Greater than or equal to my $result6 = (2 <= 5); # Less than or equal to

Logical operators in Perl:

  • Description: Logical operators perform Boolean operations on values.
  • Example Code: my $and_result = ($condition1 && $condition2); # Logical AND my $or_result = ($condition1 || $condition2); # Logical OR my $not_result = !($condition); # Logical NOT

Bitwise operators in Perl:

  • Description: Bitwise operators perform operations at the bit level.
  • Example Code: my $bitwise_and = $num1 & $num2; # Bitwise AND my $bitwise_or = $num1 | $num2; # Bitwise OR my $bitwise_xor = $num1 ^ $num2; # Bitwise XOR my $bitwise_not = ~$num; # Bitwise NOT

String operators in Perl:

  • Description: String operators perform operations on strings.
  • Example Code: my $concatenation = $str1 . $str2; # String concatenation my $repetition = $str x 3; # String repetition

Assignment operators in Perl:

  • Description: Assignment operators assign values to variables.
  • Example Code: my $num = 10; $num += 5; # Addition assignment (equivalent to $num = $num + 5) $num -= 3; # Subtraction assignment $num *= 2; # Multiplication assignment $num /= 4; # Division assignment

Ternary operator in Perl:

  • Description: The ternary operator provides a concise way to write conditional expressions.
  • Example Code: my $result = ($condition) ? "True" : "False";

Precedence of operators in Perl:

  • Description: Operators in Perl have a specific precedence, determining the order of evaluation.
  • Example Code: my $result = 2 + 3 * 4; # Precedence: Multiplication has higher precedence than addition

Overloading operators in Perl:

  • Description: Perl allows overloading certain operators for custom classes.
  • Example Code: package MyNumber; use overload '+' => \&add_numbers; sub new { my ($class, $value) = @_; return bless { value => $value }, $class; } sub add_numbers { my ($self, $other, $swap) = @_; return $swap ? $other + $self->{value} : $self->{value} + $other; } my $num1 = MyNumber->new(5); my $num2 = MyNumber->new(3); my $result = $num1 + $num2;

perl defined or assignment operator

  • Onsite training

3,000,000+ delegates

15,000+ clients

1,000+ locations

  • KnowledgePass
  • Log a ticket

01344203999 Available 24/7

Perl Operator: A Comprehensive Overview

Discover this blog to explore an in-depth analysis of Perl Operator. This blog will also cover different types, including arithmetic, string, logical, and bitwise operators, explaining their syntax and usage. This blog also emphasises their role in controlling program flow and manipulating data, highlighting best practices for efficient coding in Perl.

stars

Exclusive 40% OFF

Training Outcomes Within Your Budget!

We ensure quality, budget-alignment, and timely delivery by our expert instructors.

Share this Resource

  • Object Oriented Programming (OOPs) Course
  • Elixir Programming Language Training
  • D Programming Language Training
  • Clojure Programming Language Training
  • Rust Course

course

Perl is a versatile scripting language that offers a rich set of operators and essential tools for programmers to manipulate data and control program flow. Perl Operators are categorised into various types, such as arithmetic for mathematical operations, string operators for text manipulation, logical operators for decision-making, and more. Each type is unique, allowing for addition, concatenation, comparison, and condition evaluation.   

Understanding these operators is crucial for effective Perl programming, as they are fundamental in constructing expressions and enabling complex functionalities. Do you want to learn more about these Operators? Read this blog to learn more about Perl Operators and explore these powerful Operators and how they are used. 

Table of Contents 

1) What is Perl Operator? 

2) Arithmetic Operators 

3) Equality Operators 

4) Assignment Operators 

5) Bitwise Operators 

6) Logical Operators 

7) Conclusion 

What is a Perl Operator? 

Understanding Perl Operators is essential for any programmer working with the language. They allow for executing complex operations and control structures, rendering Perl an effective tool for various applications, from web development to system administration.   

In Perl, an Operator is a key element for executing specific operations on operands, which can be values or variables. These Operators are integral to forming expressions in Perl, enabling data manipulation and dictating program logic flow. The richness and variety of operators in Perl make it a versatile language suitable for various programming tasks.   

Operators in Perl are categorised into several types, each with its unique role. Arithmetic Operators, for instance, are used for basic mathematical operations like addition, subtraction, multiplication, and division. 

These are fundamental for any calculations within the program. String operators, on the other hand, are designed specifically for string manipulation, allowing for operations like concatenation, repetition, and string comparison. 

  

Basic Perl Programming Training

Arithmetic Operators 

Arithmetic operators, including Perl, are fundamental in any programming language as they allow for basic mathematical operations within the code. These operators enable the manipulation of numerical values, forming the backbone of many computational tasks. In Perl, arithmetic operators are intuitive and follow conventional mathematical notation, making them accessible to both beginners and experienced programmers.   

a)  Addition (+): The most basic arithmetic operator is addition, represented by the plus sign (+). It is used to add two or more numbers. For example, ‘$sum = $a + $b’; will add the values of ‘$a’ and ‘$b’ and store the result in ‘$sum’. 

my $a = 5; 

my $b = 3; 

my $sum = $a + $b;  

# $sum is 8 

b) Subtraction (-): The subtraction operator, denoted by a minus sign (-), subtracts one number from another. For instance, ‘$difference = $a - $b’; will subtract ‘$b’ from ‘$a’ 

my $a = 10; 

my $b = 4; 

my $difference = $a - $b;  

# $difference is 6 

c) Multiplication (*): Represented by an asterisk (*), the multiplication operator is used to multiply two numbers. ‘$product = $a * $b’; multiplies ‘$a’ and ‘$b’. 

my $a = 7; 

my $b = 6; 

my $product = $a * $b; 

# $product is 42 

d) Division (/): The division operator, symbolised by a forward slash (/), divides one number by another. ‘$quotient = $a / $b’; will divide ‘$a’ by ‘$b’. 

my $a = 20; 

my $b = 5; 

my $quotient = $a / $b;  

# $quotient is 4 

e) Modulus (%): The modulus operator, represented by a percent sign (%), is used to find the remainder of a division operation. ‘$remainder = $a % $b’; will give the remainder when ‘$a’ is divided by ‘$b’. 

my $remainder = $a % $b;  

# $remainder is 1 

f) Exponentiation (): Perl also supports exponentiation (raising a number to the power of another number) using the double asterisk operator (). ‘$power = $a ** $b’; will raise ‘$a’ to the power of ‘$b’. 

my $a = 2; 

my $power = $a ** $b;  

# $power is 8 

g) Auto-increment (++) and Auto-decrement (--): Perl provides two very useful arithmetic operators: auto-increment (++) and auto-decrement (--). The auto-increment operator increases a number's value by one, while the auto-decrement operator decreases it by one. These operators can be used both as pre- and post-operators. 

my $value = 5; 

$value++; # $value is now 6 

$value--; # $value is back to 5 

h) Assignment with Arithmetic Operators: Perl combines assignment with arithmetic operators, enabling shorthand operations. For example, $a += $b; is equivalent to $a = $a + $b;. 

$a += 5; # $a is now 15 

$a *= 2; # $a is now 30 

Equality Operators 

In Perl, Equality Operators are essential for comparing values, a fundamental aspect of programming that allows for decision-making based on conditions. These operators test for equality or inequality, yielding Boolean values (true or false). Understanding equality operators is crucial for controlling program flow through conditional statements like ‘if’, ‘unless’, ‘while’, and others. 

Types of Equality Operators in Perl: 

Perl distinguishes between two types of equality comparisons: numeric and string. This distinction is crucial because Perl is a context-sensitive language, meaning it treats the same data differently based on the context. 

a) Numeric Equality Operators 

1) Equal (==): This operator checks if two numbers are equal. If they are, it returns true; otherwise, it returns false. 

if ($a == $b) { 

    print "a and b are equal"; 

2) Not equal (!=): It tests whether two numbers are not equal. If they are different, it returns true. 

if ($a != $b) { 

    print "a and b are not equal"; 

b) String Equality Operators 

1.    Equal (eq): This operator checks whether two strings are identical. It's essential to use eq instead of == when comparing strings. 

if ($string1 eq $string2) { 

    print "The strings are equal"; 

2.    Not equal (ne): It checks if two strings are different. 

if ($string1 ne $string2) { 

    print "The strings are not equal"; 

Assignment Operators 

Assignment operators in programming languages like Perl are fundamental components that simplify assigning values to variables. They are not just limited to the basic assignment but also include a range of compound assignment operators that combine arithmetic, string, and other operations with the assignment. Understanding these operators is crucial for writing concise and efficient code. 

a)  Basic Assignment Operator 

1) Equals (=): The most basic assignment operator is the equals sign (=). It assigns the value on its right to the variable on its left.  

my $a = 5;  # Assigns 5 to $a 

b) Compound Assignment Operators: 

Perl enhances the functionality of the basic assignment operator with compound assignment operators, which combine an operation with the assignment.   

1)  Addition Assignment (+=): Adds the right operand to the left operand and assigns the result to the left operand. 

 $a += 3;  # Equivalent to $a = $a + 3 

2) Subtraction Assignment (-=): Subtracts the right operand from the left operand and assigns the result to the left operand. 

 $a -= 2;  # Equivalent to $a = $a - 2 

3) Multiplication Assignment (*=): Multiplies the left operand by the right operand and assigns the result to the left operand. 

 $a *= 4;  # Equivalent to $a = $a * 4 

4) Division Assignment (/=): Divides the left operand by the right operand and assigns the result to the left operand. 

 $a /= 2;  # Equivalent to $a = $a / 2 

5) Modulus Assignment (%=): Applies modulus operation and assigns the result to the left operand. 

 $a %= 3;  # Equivalent to $a = $a % 3 

6) Exponentiation Assignment (**=): Raises the left operand to the power of the right operand and assigns the result back. 

 $a **= 2;  # Equivalent to $a = $a ** 2 

7) String Concatenation Assignment (.=): Appends the right string operand to the left string operand.  

my $str = "Hello"; 

$str .= " World";  # $str now is "Hello World" 

8) Bitwise AND Assignment (&=), Bitwise OR Assignment (|=), and Bitwise XOR Assignment (^=): These perform the corresponding bitwise operation and assign the result to the left operand. 

$a &= $b;  # Bitwise AND 

$a |= $b;  # Bitwise OR 

$a ^= $b;  # Bitwise XOR 

Bitwise Operators 

Bitwise Operators are a category of operators in programming languages, such as Perl, that perform operations at the bit level on numeric values. These operators treat their operands as sequences of 32 or 64 bits (depending on the platform) and operate on them bit by bit.  

Understanding bitwise operators is essential for tasks involving low-level data manipulation, such as working with binary data, flags, and masks.  

Types of Bitwise Operators: 

1) AND (&): The bitwise AND operator compares each bit of its first operand to the corresponding bit of its second operand. If both bits are 1, it sets the bit in the result to 1; otherwise, it is 0. 

 $result = $a & $b;  # Bitwise AND of $a and $b 

2) OR (|): This operator compares each bit of its first operand to the corresponding bit of its second operand. If either bit is 1, it sets the result bit to 1. 

 $result = $a | $b;  # Bitwise OR of $a and $b 

3) XOR (^): The bitwise XOR (exclusive OR) operator compares each bit of its first operand to the corresponding bit of its second operand. If the bits are different, it sets the result bit to 1. 

 $result = $a ^ $b;  # Bitwise XOR of $a and $b 

4) NOT (~): The bitwise NOT operator inverts all the bits of its operand. 

 $result = ~$a;  # Bitwise NOT of $a 

5) Left Shift ( This operator shifts all bits of its first operand to the left by the number of places specified in the second operand. New bits on the right are filled with zeros. 

 $result = $a << $shift;  # Left shift $a by $shift bits 

6) Right Shift (>>): It shifts all bits of its first operand to the right. The behaviour for the leftmost bits depends on the number type and whether it's signed or unsigned. 

 $result = $a >> $shift;  # Right shift $a by $shift bits 

Become an expert in different Programming Languages – sign up now with our course on Programming Training !  

Logical Operators 

Logical operators in Perl are crucial for constructing logical expressions, which are fundamental to controlling program flow through conditional statements like ‘if’, ‘while’, and ‘unless’. These operators evaluate expressions and return Boolean values (true or false) based on the logic they implement. The primary logical operators in Perl are ‘and’, ‘or’, ‘not’, ‘&&’, ‘||’, and ‘!’.   

Types of Logical Operators: 

1) AND (&& and ‘and’): This operator returns true if both operands are true. The difference between ‘&’ and ‘and’ is their precedence, with && having a higher precedence. 

 if ($a && $b) { 

    # Executes if both $a and $b are true 

2) OR (|| and or): The OR operator returns true if either of its operands is true. Similar to AND, ‘||’ has a higher precedence than ‘or’.  

if ($a || $b) { 

    # Executes if either $a or $b is true 

3) NOT (! and not): NOT is a unary operator that inverts the truth value of its operand. ! has a higher precedence than not. 

 if (!$a) { 

    # Executes if $a is not true (i.e., false) 

Do you want to learn more about Perl Programming Language? Register now for our Basic Perl Programming Training !  

Conclusion 

Perl Operators are fundamental tools that greatly enhance the language's power and flexibility. They enable efficient data manipulation, logical decision-making, and control over program flow. Mastering these operators, from arithmetic to logical, is crucial for effective Perl scripting, allowing for concise and powerful code in various applications. 

Learn the concept of data reshaping with R Programming – join now for our R Programming Course !  

Frequently Asked Questions

The most commonly used Perl operators are:  

a) Arithmetic Operators (+, -, *, /, %) for basic mathematical operations. 

b) String Operators (. for concatenation, x for repetition) for string manipulation. 

c) Logical Operators (&&, ||, !) for evaluating Boolean expressions and controlling program flow.   

Perl uses different operators for numeric and string comparison. For numeric comparison, it uses ‘==’ (equal), ‘!=’ (not equal), ‘ ’ (greater than), etc. For string comparison, it uses ‘eq’ (equal), ‘ne’ (not equal), ‘lt’ (less than), ‘gt’ (greater than), etc. This distinction ensures accurate comparisons based on the data type. 

Yes, Perl operators can be combined to form complex expressions. For instance, arithmetic operators can be used with assignment operators (like +=, *=) for compound assignments. Logical operators can be used to combine multiple conditions in control structures. However, it's important to remember operator precedence and use parentheses for clarity when needed. 

The Knowledge Academy takes global learning to new heights, offering over 30,000 online courses across 490+ locations in 220 countries. This expansive reach ensures accessibility and convenience for learners worldwide.   

Alongside our diverse Online Course Catalogue, encompassing 17 major categories, we go the extra mile by providing a plethora of free educational Online Resources like News updates, Blogs , videos, webinars, and interview questions. Tailoring learning experiences further, professionals can maximise value with customisable Course Bundles of TKA .  

The Knowledge Academy’s Knowledge Pass , a prepaid voucher, adds another layer of flexibility, allowing course bookings over a 12-month period. Join us on a journey where education knows no bounds.   

The Knowledge Academy offers various Programming courses , including Basic Perl Programming Training, PHP Course, and R Programming Course. These courses cater to different skill levels, providing comprehensive insights into Programming Languages .  

Our Programming blogs covers a range of topics related to Perl, offering valuable resources, best practices, and industry insights. Whether you are a beginner or looking to advance your Programming skills, The Knowledge Academy's diverse courses and informative blogs have you covered. 

Upcoming Programming & DevOps Resources Batches & Dates

Thu 29th Aug 2024

Thu 28th Nov 2024

Get A Quote

WHO WILL BE FUNDING THE COURSE?

My employer

By submitting your details you agree to be contacted in order to respond to your enquiry

  • Business Analysis
  • Lean Six Sigma Certification

Share this course

Our biggest spring sale.

red-star

We cannot process your enquiry without contacting you, please tick to confirm your consent to us for contacting you about your enquiry.

By submitting your details you agree to be contacted in order to respond to your enquiry.

We may not have the course you’re looking for. If you enquire or give us a call on 01344203999 and speak to our training experts, we may still be able to help with your training requirements.

Or select from our popular topics

  • ITIL® Certification
  • Scrum Certification
  • Change Management Certification
  • Business Analysis Courses
  • Microsoft Azure Certification
  • Microsoft Excel Courses
  • Microsoft Project
  • Explore more courses

Press esc to close

Fill out your  contact details  below and our training experts will be in touch.

Fill out your   contact details   below

Thank you for your enquiry!

One of our training experts will be in touch shortly to go over your training requirements.

Back to Course Information

Fill out your contact details below so we can get in touch with you regarding your training requirements.

* WHO WILL BE FUNDING THE COURSE?

Preferred Contact Method

No preference

Back to course information

Fill out your  training details  below

Fill out your training details below so we have a better idea of what your training requirements are.

HOW MANY DELEGATES NEED TRAINING?

HOW DO YOU WANT THE COURSE DELIVERED?

Online Instructor-led

Online Self-paced

WHEN WOULD YOU LIKE TO TAKE THIS COURSE?

Next 2 - 4 months

WHAT IS YOUR REASON FOR ENQUIRING?

Looking for some information

Looking for a discount

I want to book but have questions

One of our training experts will be in touch shortly to go overy your training requirements.

Your privacy & cookies!

Like many websites we use cookies. We care about your data and experience, so to give you the best possible experience using our site, we store a very limited amount of your data. Continuing to use this site or clicking “Accept & close” means that you agree to our use of cookies. Learn more about our privacy policy and cookie policy cookie policy .

We use cookies that are essential for our site to work. Please visit our cookie policy for more information. To accept all cookies click 'Accept & close'.

Assignment Operators

Get introduced to the functionality of the assignment and the combined assignment operator in this lesson.

Basic assignment

  • Explanation
  • Combined assignment
  • Difference between = and == operator

Perl allows you to do the basic arithmetic assignment by using the = operator.

Create a free account to access the full course.

By signing up, you agree to Educative's Terms of Service and Privacy Policy

  • DESCRIPTION
  • New __CLASS__ Keyword
  • :reader attribute for field variables
  • Permit a space in -M command-line option
  • Restrictions to use VERSION declarations
  • New builtin::inf and builtin::nan functions (experimental)
  • New ^^ logical xor operator
  • try/catch feature is no longer experimental
  • for iterating over multiple values at a time is no longer experimental
  • builtin module is no longer experimental
  • The :5.40 feature bundle adds try
  • use v5.40; imports builtin functions
  • CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode property
  • CVE-2023-47039 - Perl for Windows binary hijacking vulnerability
  • reset EXPR now calls set-magic on scalars
  • Calling the import method of an unknown package produces a warning
  • return no longer allows an indirect object
  • Class barewords no longer resolved as file handles in method calls under no feature "bareword_filehandles"
  • Deprecations
  • Performance Enhancements
  • New Modules and Pragmata
  • Updated Modules and Pragmata
  • perlhacktips
  • New Warnings
  • Changes to Existing Diagnostics
  • Configuration and Compilation
  • New Platforms
  • Platform-Specific Notes
  • Internal Changes
  • Selected Bug Fixes
  • Known Problems
  • Errata From Previous Releases
  • Acknowledgements
  • Reporting Bugs
  • Give Thanks

perldelta - what is new for perl v5.40.0

# DESCRIPTION

This document describes differences between the 5.38.0 release and the 5.40.0 release.

# Core Enhancements

# new __class__ keyword.

When using the new class feature, code inside a method, ADJUST block or field initializer expression is now permitted to use the new __CLASS__ keyword. This yields a class name, similar to __PACKAGE__ , but whereas that gives the compile-time package that the code appears in, the __CLASS__ keyword is aware of the actual run-time class that the object instance is a member of. This makes it useful for method dispatch on that class, especially during constructors, where access to $self is not permitted.

For more information, see "__CLASS__" in perlfunc .

# :reader attribute for field variables

When using the class feature, field variables can now take a :reader attribute. This requests that an accessor method be automatically created that simply returns the value of the field variable from the given instance.

Is equivalent to

An alternative name can also be provided:

For more detail, see ":reader" in perlclass .

# Permit a space in -M command-line option

When processing command-line options, perl now allows a space between the -M switch and the name of the module after it.

This matches the existing behaviour of the -I option.

# Restrictions to use VERSION declarations

In Perl 5.36, a deprecation warning was added when downgrading a use VERSION declaration from one above version 5.11, to below. This has now been made a fatal error.

Additionally, it is now a fatal error to issue a subsequent use VERSION declaration when another is in scope, when either version is 5.39 or above. This is to avoid complications surrounding imported lexical functions from builtin . A deprecation warning has also been added for any other subsequent use VERSION declaration below version 5.39, to warn that it will no longer be permitted in Perl version 5.44.

# New builtin::inf and builtin::nan functions (experimental)

Two new functions, inf and nan , have been added to the builtin namespace. These act like constants that yield the floating-point infinity and Not-a-Number value respectively.

# New ^^ logical xor operator

Perl has always had three low-precedence logical operators and , or and xor , as well as three high-precedence bitwise versions & , ^ and | . Until this release, while the medium-precedence logical operators of && and || were also present, there was no exclusive-or equivalent. This release of Perl adds the final ^^ operator, completing the set.

# try / catch feature is no longer experimental

Prior to this release, the try / catch feature for handling errors was considered experimental. Introduced in Perl version 5.34.0, this is now considered a stable language feature and its use no longer prints a warning. It still must be enabled with the 'try' feature .

See "Try Catch Exception Handling" in perlsyn .

# for iterating over multiple values at a time is no longer experimental

Prior to this release, iterating over multiple values at a time with for was considered experimental. Introduced in Perl version 5.36.0, this is now considered a stable language feature and its use no longer prints a warning. See "Compound Statements" in perlsyn .

# builtin module is no longer experimental

Prior to this release, the builtin module and all of its functions were considered experimental. Introduced in Perl version 5.36.0, this module is now considered stable its use no longer prints a warning. However, several of its functions are still considered experimental.

# The :5.40 feature bundle adds try

The latest version feature bundle now contains the recently-stablized feature try . As this feature bundle is used by the -E commandline switch, these are immediately available in -E scripts.

# use v5.40; imports builtin functions

In addition to importing a feature bundle, use v5.40; (or later versions) imports the corresponding builtin version bundle .

# CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode property

This vulnerability was reported directly to the Perl security team by Nathan Mills [email protected] .

A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one-byte attacker controlled buffer overflow in a heap allocated buffer.

# CVE-2023-47039 - Perl for Windows binary hijacking vulnerability

This vulnerability was reported to the Intel Product Security Incident Response Team (PSIRT) by GitHub user ycdxsb https://github.com/ycdxsb/WindowsPrivilegeEscalation . PSIRT then reported it to the Perl security team.

Perl for Windows relies on the system path environment variable to find the shell ( cmd.exe ). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory.

An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData . By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

# Incompatible Changes

# reset expr now calls set-magic on scalars.

Previously reset EXPR did not call set magic when clearing scalar variables. This meant that changes did not propagate to the underlying internal state where needed, such as for $^W , and did not result in an exception where the underlying magic would normally throw an exception, such as for $1 .

This means code that had no effect before may now actually have an effect, including possibly throwing an exception.

reset EXPR already called set magic when modifying arrays and hashes.

This has no effect on plain reset used to reset one-match searches as with m?pattern? .

[ GH #20763 ]

# Calling the import method of an unknown package produces a warning

Historically, it has been possible to call the import or unimport method of any class, including ones which have not been defined, with an argument and not experience an error. For instance, this code will not throw an error in Perl 5.38:

However, as of Perl 5.39.1 this is deprecated and will issue a warning. Note that calling these methods with no arguments continues to silently succeed and do nothing. For instance,

will continue to not throw an error. This is because every class implicitly inherits from the class UNIVERSAL which now defines an import method. In older perls there was no such method defined, and instead the method calls for import and unimport were special cased to not throw errors if there was no such method defined.

This change has been added because it makes it easier to detect case typos in use statements when running on case-insensitive file systems. For instance, on Windows or other platforms with case-insensitive file systems on older perls the following code

would silently do nothing as the module is actually called strict.pm , not STRICT.pm , so it would be loaded but its import method would never be called. It will also detect cases where a user passes an argument when using a package that does not provide its own import, for instance most "pure" class definitions do not define an import method.

# return no longer allows an indirect object

The return operator syntax now rejects indirect objects. In most cases this would compile and even run, but wasn't documented and could produce confusing results, for example:

[ GH #21716 ]

# Class barewords no longer resolved as file handles in method calls under no feature "bareword_filehandles"

Under no feature "bareword_filehandles" bareword file handles continued to be resolved in method calls:

This has been fixed, so the:

will attempt to resolve FH as a class, typically resulting in a runtime error.

The standard file handles such as STDOUT continue to be resolved as a handle:

Note that once perl resolves a bareword name as a class it will continue to do so:

[ GH #19426 ]

# Deprecations

Using goto to jump from an outer scope into an inner scope is deprecated and will be removed completely in Perl 5.42. [ GH #21601 ]

# Performance Enhancements

The negation OPs have been modified to support the generic TARGMY optimization. [ GH #21442 ]

# Modules and Pragmata

# new modules and pragmata.

Term::Table 0.018 has been added to the Perl core.

This module is a dependency of Test2::Suite .

Test2::Suite 0.000162 has been added to the Perl core.

This distribution contains a comprehensive set of test tools for writing unit tests. It is the successor to Test::More and similar modules. Its inclusion in the Perl core means that CPAN module tests can be written using this suite of tools without extra dependencies.

# Updated Modules and Pragmata

Archive::Tar has been upgraded from version 2.40 to 3.02_001.

attributes has been upgraded from version 0.35 to 0.36.

autodie has been upgraded from version 2.36 to 2.37.

B has been upgraded from version 1.88 to 1.89.

B::Deparse has been upgraded from version 1.74 to 1.76.

Benchmark has been upgraded from version 1.24 to 1.25.

bignum has been upgraded from version 0.66 to 0.67.

builtin has been upgraded from version 0.008 to 0.014.

builtin now accepts a version bundle as an input argument, requesting it to import all of the functions that are considered a stable part of the module at the given Perl version. For example:

Added the load_module() builtin function as per PPC 0006 .

bytes has been upgraded from version 1.08 to 1.09.

Compress::Raw::Bzip2 has been upgraded from version 2.204_001 to 2.212.

Compress::Raw::Zlib has been upgraded from version 2.204_001 to 2.212.

CPAN::Meta::Requirements has been upgraded from version 2.140 to 2.143.

Data::Dumper has been upgraded from version 2.188 to 2.189.

DB_File has been upgraded from version 1.858 to 1.859.

Devel::Peek has been upgraded from version 1.33 to 1.34.

Devel::PPPort has been upgraded from version 3.71 to 3.72.

diagnostics has been upgraded from version 1.39 to 1.40.

DynaLoader has been upgraded from version 1.54 to 1.56.

Encode has been upgraded from version 3.19 to 3.21.

Errno has been upgraded from version 1.37 to 1.38.

The osvers and archname baked into the module to ensure Errno is loaded by the perl that built it are now more comprehensively escaped. [ GH #21135 ]

experimental has been upgraded from version 0.031 to 0.032.

Exporter has been upgraded from version 5.77 to 5.78.

ExtUtils::CBuilder has been upgraded from version 0.280238 to 0.280240.

ExtUtils::Manifest has been upgraded from version 1.73 to 1.75.

ExtUtils::Miniperl has been upgraded from version 1.13 to 1.14.

Fcntl has been upgraded from version 1.15 to 1.18.

The old module documentation stub has been greatly expanded and revised.

Adds support for the O_TMPFILE flag on Linux.

feature has been upgraded from version 1.82 to 1.89.

It now documents the :all feature bundle, and suggests a reason why you may not wish to use it.

fields has been upgraded from version 2.24 to 2.25.

File::Compare has been upgraded from version 1.1007 to 1.1008.

File::Find has been upgraded from version 1.43 to 1.44.

File::Glob has been upgraded from version 1.40 to 1.42.

File::Spec has been upgraded from version 3.89 to 3.90.

File::stat has been upgraded from version 1.13 to 1.14.

FindBin has been upgraded from version 1.53 to 1.54.

Getopt::Long has been upgraded from version 2.54 to 2.57.

Getopt::Std has been upgraded from version 1.13 to 1.14.

Documentation and test improvements only; no change in functionality.

Hash::Util has been upgraded from version 0.30 to 0.32.

Hash::Util::FieldHash has been upgraded from version 1.26 to 1.27.

HTTP::Tiny has been upgraded from version 0.086 to 0.088.

I18N::Langinfo has been upgraded from version 0.22 to 0.24.

It now handles the additional locale categories that Linux defines beyond those in the POSIX Standard.

This fixes what is returned for the ALT_DIGITS item, which has never before worked properly in Perl.

IO has been upgraded from version 1.52 to 1.55.

Fixed IO::Handle/blocking on Windows, which has been non-functional since IO 1.32. [ GH #17455 ]

IO-Compress has been upgraded from version 2.204 to 2.212.

IO::Socket::IP has been upgraded from version 0.41_01 to 0.42.

IO::Zlib has been upgraded from version 1.14 to 1.15.

locale has been upgraded from version 1.10 to 1.12.

Math::BigInt has been upgraded from version 1.999837 to 2.003002.

Math::BigInt::FastCalc has been upgraded from version 0.5013 to 0.5018.

Module::CoreList has been upgraded from version 5.20230520 to 5.20240609.

Module::Metadata has been upgraded from version 1.000037 to 1.000038.

mro has been upgraded from version 1.28 to 1.29.

NDBM_File has been upgraded from version 1.16 to 1.17.

Opcode has been upgraded from version 1.64 to 1.65.

perl5db.pl has been upgraded from version 1.77 to 1.78.

Made parsing of the l command arguments saner. [ GH #21350 ]

perlfaq has been upgraded from version 5.20210520 to 5.20240218.

PerlIO::encoding has been upgraded from version 0.30 to 0.31.

PerlIO::scalar has been upgraded from version 0.31 to 0.32.

PerlIO::via has been upgraded from version 0.18 to 0.19.

Pod::Checker has been upgraded from version 1.75 to 1.77.

Pod::Html has been upgraded from version 1.34 to 1.35.

Pod::Simple has been upgraded from version 3.43 to 3.45.

podlators has been upgraded from version 5.01 to 5.01_02.

POSIX has been upgraded from version 2.13 to 2.20.

The mktime function now works correctly on 32-bit platforms even if the platform's time_t type is larger than 32 bits. [ GH #21551 ]

The T_SIGNO and T_FD typemap entries have been fixed so they work with any variable name, rather than just the hardcoded sig and fd .

The mappings for Mode_t , pid_t , Uid_t , Gid_t and Time_t have been updated to be integer types; previously they were NV floating-point.

Adjusted the signbit() on NaN test to handle the unusual bit pattern returned for NaN by Oracle Developer Studio's compiler. [ GH #21533 ]

re has been upgraded from version 0.44 to 0.47.

Safe has been upgraded from version 2.44 to 2.46.

SelfLoader has been upgraded from version 1.26 to 1.27.

Socket has been upgraded from version 2.036 to 2.038.

strict has been upgraded from version 1.12 to 1.13.

Test::Harness has been upgraded from version 3.44 to 3.48.

Test::Simple has been upgraded from version 1.302194 to 1.302199.

Text::Tabs has been upgraded from version 2021.0814 to 2024.001.

Text::Wrap has been upgraded from version 2021.0814 to 2024.001.

threads has been upgraded from version 2.36 to 2.40.

An internal error has been made slightly more verbose ( Out of memory in perl:threads:ithread_create ).

threads::shared has been upgraded from version 1.68 to 1.69.

Tie::File has been upgraded from version 1.07 to 1.09.

Old compatibility code for perl 5.005 that was no longer functional has been removed.

Time::gmtime has been upgraded from version 1.04 to 1.05.

Time::HiRes has been upgraded from version 1.9775 to 1.9777.

Time::Local has been upgraded from version 1.30 to 1.35.

Time::localtime has been upgraded from version 1.03 to 1.04.

Time::tm has been upgraded from version 1.00 to 1.01.

UNIVERSAL has been upgraded from version 1.15 to 1.17.

User::grent has been upgraded from version 1.04 to 1.05.

User::pwent has been upgraded from version 1.02 to 1.03.

version has been upgraded from version 0.9929 to 0.9930.

warnings has been upgraded from version 1.65 to 1.69.

XS::APItest has been upgraded from version 1.32 to 1.36.

XS::Typemap has been upgraded from version 0.19 to 0.20.

# Documentation

# changes to existing documentation.

We have attempted to update the documentation to reflect the changes listed in this document. If you find any we have missed, open an issue at https://github.com/Perl/perl5/issues .

Additionally, the following selected changes have been made:

Corrected the documentation for Perl_form , form_nocontext , and vform , which claimed that any later call to one of them will destroy the previous returns from any. This hasn't been true since 5.6.0, except it does remain true if these are called during global destruction. With that caveat, the return of each of these is a fresh string in a temporary that will automatically be freed by a call to " FREETMPS " in perlapi or at at places such as statement boundaries.

Several internal functions now have documentation - the various newSUB functions, newANONLIST() , newANONHASH() , newSVREF() and similar.

# perlclass

Added a list of known bugs in the experimental class feature.

The documentation for local , my , our , and state , has been updated to include examples and descriptions of their effects within a statement.

A new section has been added which describes the experimental reference-counted argument stack build option ( PERL_RC_STACK ).

Extensive guidance has been added for interfacing with the standard C library, including many more functions to avoid, and how to cope with locales and threads.

# perlhacktips

Document we can't use compound literals or array designators due to C++ compatibility. [ GH #21073 ]

Document new functions sv_mark_arenas() and sv_sweep_arenas() (which only exist on DEBUGGING builds)

Added brief documentation for some tools useful when developing perl itself on Windows or Cygwin.

Removed indirect object syntax in Dumpvalue example

Removed statement suggesting /p is a no-op.

Documented ref assignment in list context (as part of the refaliasing feature)

The section on the empty pattern // has been amended to mention that the current dynamic scope is used to find the last successful match.

The -S file test has been meaningful on Win32 since 5.37.6

The -l file test is now meaningful on Win32

Some strange behaviour with . at the end of names under Windows has been documented

Added documentation for an alternative to ${^CAPTURE}

# Diagnostics

The following additions or changes have been made to diagnostic output, including warnings and fatal error messages. For the complete list of diagnostic messages, see perldiag .

# New Diagnostics

# new errors.

Cannot use __CLASS__ outside of a method or field initializer expression

(F) A __CLASS__ expression yields the class name of the object instance executing the current method, and therefore it can only be placed inside an actual method (or method-like expression, such as a field initializer expression).

get_layers: unknown argument '%s'

(F) You called PerlIO::get_layers() with an unknown argument. Legal arguments are provided in key/value pairs, with the keys being one of input , output or detail , followed by a boolean.

UNIVERSAL does not export anything

(F) You asked UNIVERSAL to export something, but UNIVERSAL is the base class for all classes and contains no exportable symbols.

Builtin version bundle "%s" is not supported by Perl

(F) You attempted to use builtin :ver for a version number that is either older than 5.39 (when the ability was added), or newer than the current perl version.

Invalid version bundle "%s"

(F) A version number that is used to specify an import bundle during a use builtin ... statement must be formatted as :MAJOR.MINOR with an optional third component, which is ignored. Each component must be a number of 1 to 3 digits. No other characters are permitted. The value that was specified does not conform to these rules.

Missing comma after first argument to return

(F) While certain operators allow you to specify a filehandle or an "indirect object" before the argument list, return isn't one of them.

Out of memory during vec in lvalue context

(F) An attempt was made to extend a string beyond the largest possible memory allocation by assigning to vec() called with a large second argument.

(This case used to throw a generic Out of memory! error.)

Cannot create an object of incomplete class "%s"

(F) An attempt was made to create an object of a class where the start of the class definition has been seen, but the class has not been completed.

This can happen for a failed eval, or if you attempt to create an object at compile time before the class is complete:

Previously perl would assert or crash. [ GH #22159 ]

# New Warnings

Forked open '%s' not meaningful in <>

(S inplace) You had |- or -| in @ARGV and tried to use <> to read from it.

Previously this would fork and produce a confusing error message. [ GH #21176 ]

Attempt to call undefined %s method with arguments ("%s"%s) via package "%s" (Perhaps you forgot to load the package?)

(D deprecated::missing_import_called_with_args) You called the import() or unimport() method of a class that has no import method defined in its inheritance graph, and passed an argument to the method. This is very often the sign of a misspelled package name in a use or require statement that has silently succeeded due to a case insensitive file system.

Another common reason this may happen is when mistakenly attempting to import or unimport a symbol from a class definition or package which does not use Exporter or otherwise define its own import or unimport method.

# Changes to Existing Diagnostics

Name "%s::%s" used only once: possible typo

This warning now honors being marked as fatal. [ GH #13814 ]

Out of memory in perl:%s

There used to be several places in the perl core that would print a generic Out of memory! message and abort when memory allocation failed, giving no indication which program it was that ran out of memory. These have been modified to include the word perl and the general area of the allocation failure, e.g. Out of memory in perl:util:safesysrealloc . [ GH #21672 ]

Possible precedence issue with control flow operator (%s)

This warning now mentions the name of the control flow operator that triggered the diagnostic (e.g. return , exit , die , etc).

It also covers more cases: Previously, the warning was only triggered if a low-precedence logical operator (like and , or , xor ) was involved. Now it is also shown for misleading code like this:

Use of uninitialized value%s

This warning is now slightly more accurate in cases involving length , pop , shift , or splice :

That is, the warning no longer implies that $x was used directly as an operand of == , which it wasn't.

This is more accurate because there never was an undef within @xs as the warning implied. (The warning for pop works analogously.)

That is, in cases where splice returns undef , it no longer unconditionally blames its first argument. This was misleading because splice can return undef even if none of its arguments contain undef .

[ GH #21930 ]

Old package separator "'" deprecated

Prevent this warning appearing spuriously when checking the heuristic for the You need to quote "%s" warning.

[ GH #22145 ]

# Configuration and Compilation

microperl , long broken and of unclear present purpose, has been removed as promised in Perl 5.18 .

Fix here-doc used for code to probe LC_ALL syntax for disparate locales introduced in 5.39.2. [ GH #21451 ]

You can now separately enable high water mark checks for non-DEBUGGING or disable them for DEBUGGING builds with -Accflags=-DPERL_USE_HWM or -Accflags=-DPERL_NO_HWM respectively. The default remains the same. [ GH #16607 ]

Tests were added and changed to reflect the other additions and changes in this release. Furthermore, these significant changes were made:

Update nm output parsing for Darwin in t/porting/libperl.t to handle changes in the output of nm on Darwin. [ GH #21117 ]

t/op/magic.t would fail when ps was the BusyBox implementation, since that doesn't support the -p flag and otherwise ignores a process id on the command-line. This caused TEST failures on BusyBox systems such as Alpine Linux. [ GH #17542 ]

porting/globvar.t now uses the more portable nm -P ... to fetch the names defined in an object file. The parsing of the names found in the object is now separated from processing them to handle the duplication between local and global definitions on AIX. [ GH #21637 ]

A test was added to lib/locale_threads.t that extensively stress tests locale handling. It turns out that the libc implementations on various platforms have bugs in this regard, including Linux, Windows, *BSD derivatives including Darwin, and others. Experimental versions of this test have been used in the past few years to find bugs in the Perl implementation and in those platforms, as well as to develop workarounds in the Perl implementation, where feasible, for the platform bugs. Multiple bug report tickets have been filed against platforms, and some have been fixed. The test checks that platforms that purport to support thread-safe locale handling actually do so (and that perl works properly on those that do; The read-only variable ${^SAFE_LOCALES} is set to 1 if perl thinks the platform can handle this, whatever the platform's documentation says).

Also tested for is if the various locale categories can indeed be set independently to disparate locales. (An example of where you might want to do this is if you are a Western Canadian living and working in Holland. You likely will want to have the LC_MONETARY locale be set to where you are living, but have the other parts of your locale retain your native English values. Later, as you get a bit more comfortable with Dutch, and in order to communicate better with your colleagues, you might want to change LC_TIME and LC_NUMERIC to Dutch, while leaving LC_CTYPE and LC_COLLATE set to English indefinitely.)

The test t/porting/libperl.t will no longer run in maint releases. This test is sensitive to changes in the output of nm on various platforms, and tarballs aren't updated as we update this test in blead. [ GH #21677 ]

# Platform Support

# new platforms.

Out of the box support for Serenity OS was added.

# Platform-Specific Notes

Eliminated several header build warnings under MSVC with /W4 to reduce noise for embedders. [ GH #21031 ]

Work around a bug in most 32-bit Mingw builds, where the generated code, including the code in the gcc support library, assumes 16-byte stack alignment, which 32-bit Windows does not preserve. [ GH #21313 ]

Enable copysign , signbit , acosh , asinh , atanh , exp2 , tgamma in the bundled configuration used for MSVC. [ GH #21610 ]

The build process no longer supports Visual Studio 2013. This was failing to build at a very basic level and there have been no reports of such failures. [ GH #21624 ]

The hints file has been updated to handle the Intel oneAPI DPC++/C++ compiler.

Don't set MACOSX_DEPLOYMENT_TARGET when building on OS X 10.5. [ GH #21367 ]

Fixed the configure "installation prefix" prompt to accept a string rather than yes/no.

Fixed compilation by defining proper value for perl_lc_all_category_positions_init .

Increased buffer size when reading config_H.SH to fix compilation under clang.

Due to an apparent code generation bug, the default optimization level for the Oracle Developer Studio (formerly Sun Workshop) compiler is now -xO1 . [ GH #21535 ]

# Internal Changes

PERL_RC_STACK build option added.

This new build option is highly experimental and is not enabled by default. Perl can be built with it by using the Configure option -Accflags='-DPERL_RC_STACK' .

It makes the argument stack bump the reference count of SVs pushed onto it. It is mostly functional, but currently slow and incomplete.

It is intended in the long term that this build option will become the default option, and then finally the only option; but this will be many releases away.

In particular, there is currently no support within XS code for using these new features. So under this build option, all XS functions are called via a backwards-compatibility wrapper which slows down such calls.

In future releases, better support for XS code is intended to be added. It is expected that straightforward XS code will eventually be able to make use of a reference-counted stack without modification, with any heavy lifting being handled by the XS compiler ( xsubpp ) and the macros which it outputs. But code which implements PP() functions will eventually have to be modified to use a new PP API: rpp_foo() rather than PUSHs() etc. But this new API is not yet stable, nor has it yet been back-ported via Devel::PPPort .

See perlguts for more details.

A new API function has been added that simplifies C (or XS) code that creates LISTOP optree fragments. newLISTOPn() is a variadic function that takes a NULL -terminated list of child op pointers, and constructs a new checked LISTOP to contain them all. This is simpler than creating a new plain OP_LIST , adding each child individually, and finally calling op_convert_list() in most code fragments.

The eval_sv() API now accepts the G_USEHINTS flag, which uses the hints such as strict and features from PL_curcop instead of the default, which is to use default hints, e.g. no use vX.XX; , no strict, default features.

Beware if you use this flag in XS code: your evaluated code will need to support whatever strictness or features are in effect at the point your XS function is called.

[ GH #21415 ]

PERL_VERSION_LE has been fixed to properly check for "less than or equal" rather than "less than".

dAX , dITEMS and hence dXSARGS now declare AX and items as Stack_off_t rather than SSize_t . This reverts back to compatibility with pre-64-bit stack support for default builds of perl where Stack_off_t is I32 . [ GH #21782 ]

A new function is now available to XS code, "sv_langinfo" in perlapi . This provides the same information as the existing "Perl_langinfo8" in perlapi , but returns an SV instead of a char * , so that programmers don't have to concern themselves with the UTF-8ness of the result. This new function is now the preferred interface for XS code to the nl_langinfo(3) libc function. From Perl space, this information continues to be provided by the I18N::Langinfo module.

glibc has an undocumented equivalent function to querylocale(), which our experience indicates is reliable. When this is function is used, it removes the need for perl to keep its own records, hence is more efficient and guaranteed to be accurate. Use of this function can be disabled by defining the NO_NL_LOCALE_NAME build option

# Selected Bug Fixes

The delimiter SYRIAC COLON SKEWED LEFT/RIGHT pair has been removed from the ones recognized by the extra_paired_delimiters feature. (See "Quote and Quote-like Operators" in perlop .) This is because those characters are normally written right-to-left, and this could be visually confusing [ GH #22228 ]. The change was actually to forbid any right-to-left delimiters, but this pair is the only current instance that meets this criterion. By policy, this change means that the extra_paired_delimiters feature cannot be considered to have been stable long enough for its experimental status to be removed.

use 5.36; or later didn't enable the post parse reporting of Name "%s::%s" used only once: possible typo warnings when enabling warnings. [ GH #21271 ]

Fix a crash or assertion when cleaning up a closure that refers to an outside our sub. [ GH #21067 ]

Fixed a number of issues where I32 was used as a string offset or size rather than SSize_t or STRLEN / size_t [ GH #21012 ]

~$str when $str was more than 2GB in size would do nothing or produce an incomplete result.

String repeat, $str x $count , didn't handle $str over 2GB in size, throwing an error. Now such strings are repeated.

Complex substitution after the 2GB point in a string could access incorrect or invalid offsets in the string.

sv_utf8_decode() would truncate the SVs pos() value. This wasn't visible via utf8::decode().

When compiling a constant folded hash key, the length was truncated when creating the shared SV. Since hash keys over 2GB are not supported, throw a compilation error instead.

msgrcv() incorrectly called get magic on the buffer SV and failed to call set magic on completion. [ GH #21012 ]

msgrcv() used the size parameter to resize the buffer before validating it. [ GH #21012 ]

Inheriting from a class that was hierarchically an ancestor of the new class, eg. class A::B :isa(A) { ... } , would not attempt to load the parent class. [ GH #21332 ]

Declared references can now be used with state variables. [ GH #21351 ]

Trailing elements in an unshift ed and resized array will now always be initialized. [ GH #21265 ]

Make use 5.036 respect the -X flag

perl's -X flag disables all warnings globally, but «use 5.036» didn't respect that until now. [ GH #21431 ]

Fixed an OP leak when an error was produced for initializer for a class field. [ GH #20812 ]

Fixed a leak of the return value when smartmatching against a code reference.

Fixed a slowdown in repeated substitution replacements using special variables, such as s/....x$1/g . It actually makes all string concatenations involving such "magic" variables less slow, but the slowdown was more noticeable on repeated substitutions due to extra memory usage that was only freed after the last iteration. The slowdown started in perl 5.28.0 - which generally sped up string concatenation but slowed down when using special variables. [ GH #21360 ]

Lexical names from the enclosing scope in a lexical sub or closure weren't visible to code executed by calling eval EXPR; from the DB package. This was introduced in 5.18 in an attempt to prevent subs from retaining a reference to their outer scope, but this broke the special behaviour of eval EXPR; in package DB.

This incidentally fixed a TODO test for B::Deparse . [ GH #19370 ]

Optionally support an argument stack over 2**32 entries on 64-bit platforms. This requires 32GB of memory just for the argument stack pointers itself, so you will require a significantly more memory to take advantage of this.

To enable this add -Accflags=-DPERL_STACK_OFFSET_SSIZET or equivalent to the Configure command-line.

[ GH #20917 ] [ GH #21523 ]

Fixed various problems with join() where modifications to the separator could be handled inconsistently, or could access released memory. Changes to the separator from magic or overloading for values in the LIST no longer have an effect on the resulting joined string. [ GH #21458 ]

Don't clear the integer flag IOK from lines in the @{"_<$sourcefile"} array when a dbstate op is removed for that line. This was broken when fixing [ GH #19198 ]. [ GH #21564 ]

Many bug fixes have been made for using locales under threads and in embedded perls. And workarounds for libc bugs have been added. As a result thread-safe locale handling is now the default under OpenBSD, and MingW when compiled with UCRT.

However, testing has shown that Darwin's implementation of thread-safe locale handling has bugs. So now Perl doesn't attempt to use the thread-safe operations when compiled on Darwin.

As before, you can check to see if your program is running with thread-safe locales by checking if the value of ${^SAFE_LOCALES} is 1.

Various bugs have been fixed when perl is configured with -Accflags=-DNO_LOCALE_NUMERIC or any other locale category (or categories).

Not all locale categories need be set to the same locale. Perl now works around bugs in the libc implementations of locale handling on some platforms that previously could result in mojibake.

LC_ALL is represented in one of two ways when not all locale categories are set to the same locale. On some platforms, such as Linux and Windows, the representation is of the form of a series of 'category=locale-name' pairs. On other platforms, such as *BSD, the representation is positional like name1 / name2 / ... . name1 is always for a particular category as defined by the platform, as are the other names. The sequence that separates the names (the / above) also varies by platform. Previously, perl had problems with platforms that used the positional notation. This is now fixed.

A bug has been fixed in the regexp engine with an optimisation that applies to the + quantifier where it was followed by a (*SKIP) pattern.

[ GH #21534 ]

The tmps (mortal) stack now grows exponentially. Previously it grew linearly, so if it was growing incrementally, such as through many calls to sv_2mortal(), on a system where realloc() is O(size), the performance would be O(n*n). With exponential grows this changes to amortized O(n). [ GH #21654 ]

Lexical subs now have a new stub in the pad for each recursive call into the containing function. This fixes two problems:

If the lexical sub called the containing function, a "Can't undef active subroutine" error would be thrown. For example:

[ GH #18606 ]

If the lexical sub was called from a recursive call into the containing function, this would overwrite the bindings to the closed over variables in the lexical sub, so calls into the lexical sub from the outer recursive call would have access to the variables from the inner recursive call:

[ GH #21987 ]

prepare_export_lexical() was separately saving PL_comppad and PL_curpad , this could result in PL_curpad being restored to a no longer valid value, resulting in a panic when importing lexicals in some cases. [ GH #21981 ]

A string eval() operation in the scope of a use VERSION declaration would sometimes emit spurious "Downgrading a use VERSION declaration" warnings due to an inconsistency in the way the version number was stored. This is now fixed. [ GH #22121 ]

# Known Problems

perlivp is missing streamzip on Windows

The streamzip utility does not get installed on Windows but should get installed.

# Errata From Previous Releases

perl5300delta has been updated to include the removal of the arybase module that happened at the same time as the removal of $[ .

# Reporting Bugs

If you find what you think is a bug, you might check the perl bug database at https://github.com/Perl/perl5/issues . There may also be information at https://www.perl.org/ , the Perl Home Page.

If you believe you have an unreported bug, please open an issue at https://github.com/Perl/perl5/issues . Be sure to trim your bug down to a tiny but sufficient test case.

If the bug you are reporting has security implications which make it inappropriate to send to a public issue tracker, then see "SECURITY VULNERABILITY CONTACT INFORMATION" in perlsec for details of how to report the issue.

# Give Thanks

If you wish to thank the Perl 5 Porters for the work we had done in Perl 5, you can do so by running the perlthanks program:

This will send an email to the Perl 5 Porters list with your show of thanks.

The Changes file for an explanation of how to view exhaustive details on what changed.

The INSTALL file for how to build Perl.

The README file for general stuff.

The Artistic and Copying files for copyright information.

Perldoc Browser is maintained by Dan Book ( DBOOK ). Please contact him via the GitHub issue tracker or email regarding any issues with the site itself, search, or rendering of documentation.

The Perl documentation is maintained by the Perl 5 Porters in the development of Perl. Please contact them via the Perl issue tracker , the mailing list , or IRC to report any issues with the contents or format of the documentation.

  • C++ Data Types
  • C++ Input/Output
  • C++ Pointers
  • C++ Interview Questions
  • C++ Programs
  • C++ Cheatsheet
  • C++ Projects
  • C++ Exception Handling
  • C++ Memory Management
  • What are the Operators that Can be and Cannot be Overloaded in C++?
  • How to Overload the (+) Plus Operator in C++?
  • Rules for operator overloading
  • How to Overload the Function Call Operator () in C++?
  • Add given timestamps by overloading + operator in C++ Time Class
  • Typecast Operator Overloading in C++
  • Overloading Subscript or array index operator [] in C++
  • Overloading stream insertion (<>) operators in C++
  • Increment (++) and Decrement (--) Operator Overloading in C++
  • Overloading Relational Operators in C++
  • Overloading New and Delete operator in c++
  • Overloading the Comma Operator
  • Overloading of function-call operator in C++
  • How to Overload the Less-Than (<) Operator in C++?
  • Types of Operator Overloading in C++
  • C++ | Operator Overloading | Question 2
  • How to Overload the Multiplication Operator in C++?
  • C++ | Operator Overloading | Question 9
  • C++ | Operator Overloading | Question 4

What Are the Basic Rules and Idioms for Operator Overloading in C++?

In C++, operator overloading is a form of compile-time polymorphism where an operator is redefined to provide a special meaning beyond its typical operation. It allows developers to use traditional operators with user-defined types (or classes). In this article, we will learn the basic rules and idioms that one should remember for operator overloading in C++.

Rules and Idioms for Operator Overloading in C++

Following are the fundamental rules and idioms that should be followed when overloading operators in C++:

1. Overload only Built-in Operators

In C++, only existing built-in operators can be overloaded. We cannot create a new operator or rename existing ones, hence if any operator is not present in C++ that operator cannot be overloaded using operator overloading.

2. Do not Change Arity of Operators

Do not alter the number of operands an operator can take. For example any binary operator like “==” will always take two operands only we cannot change the arity of operator being overloaded. An attempt to overload it with a different number of operands would be invalid.

3. Precedence and Associativity of Operators cannot be Changed

Even after the operator is overloaded, its precedence order and associativity remains same and cannot be changed. We cannot change these properties through operator overloading.

4. Some Operators That Cannot Be Overloaded

In C++, we have certain operators that cannot be overloaded. This is done to maintain the original functionality of those operators to ensure the consistency and predictability of the language’s syntax and semantics. Therefore, C++ standard disallow overloading of these specific operators. These operators include:

  • Scope Resolution Operator (::)
  • Member Access Operator (.)
  • Member Access through Pointer to Member Operator (.*)
  • Ternary Conditional Operator (?:)

5. Overloaded Operators Cannot Have Default Parameters 

While overloading operators never pass default parameters except for the function call operator (), overloaded operators cannot hold default parameters.

6. Overloading of && and || Operators Lose Short-Circuit Evaluation 

When we overload the logical operators && and ||, they lose their short-circuit evaluation property so avoid doing so and handle such overloading properly.

7. Overloading the Assignment Operator 

While overloading the assignment operator always members that it should return a reference to *this and must be a member function.

In Conclusion, operator overloading can definitely make our C++ code cleaner and intuitive, but only if used properly. By following the above rules and idioms we can make sure that operator that we have overloaded behaves in a way that’s consistent, understandable, and useful. Always remember, the main goal of operator overloading is to make our code easier to read and write, not to confuse or trick other programmers.

Please Login to comment...

Similar reads.

  • C++-Operator Overloading
  • CPP Examples

Improve your Coding Skills with Practice

 alt=

What kind of Experience do you want to share?

U.S. flag

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Free Cyber Services #protect2024 Secure Our World Shields Up Report A Cyber Issue

Vulnerability Summary for the Week of June 3, 2024

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the  National Institute of Standards and Technology  (NIST)  National Vulnerability Database  (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Vulnerabilities are based on the  Common Vulnerabilities and Exposures  (CVE) vulnerability naming standard and are organized according to severity, determined by the  Common Vulnerability Scoring System  (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High : vulnerabilities with a CVSS base score of 7.0–10.0
  • Medium : vulnerabilities with a CVSS base score of 4.0–6.9
  • Low : vulnerabilities with a CVSS base score of 0.0–3.9

Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.  

High Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource & Patch Info
8theme--XStore Core
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue affects XStore Core: from n/a through 5.3.8.2024-06-04
8theme--XStore
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8.2024-06-04
ABB, Busch-Jaeger--2.4! Display 55, SD/U12.55.11-825
 
FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System2024-06-05
ABB, Busch-Jaeger--2.4! Display 55, SD/U12.55.11-825
 
Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System2024-06-05
BdThemes--Element Pack Pro
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a through 7.7.4.2024-06-04
BestWebSoft--Contact Form to DB by BestWebSoft
 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2.2024-06-08
Bitdefender--GravityZone Console On-Premise
 
A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise.2024-06-06
bobbysmith007--WP-DB-Table-Editor
 
The WP-DB-Table-Editor plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to lack of a default capability requirement on the 'dbte_render' function in all versions up to, and including, 1.8.4. This makes it possible for authenticated attackers, with contributor access and above, to modify database tables that the theme has been configured to use the plugin to edit.2024-06-04

chainguard-dev--apko
 
apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.2024-06-03

Chanjet--Smooth T+system
 
A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5. This issue affects some unknown processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the argument KeyID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-267185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-06-05



chrisbadgett--LifterLMS WordPress LMS for eLearning
 
The LifterLMS - WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-06-05

Cisco--Cisco Unified Contact Center Enterprise
 
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.2024-06-05
Code for Recovery--12 Step Meeting List
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Code for Recovery 12 Step Meeting List allows Reflected XSS.This issue affects 12 Step Meeting List: from n/a through 3.14.33.2024-06-08
Code Parrots--Easy Forms for Mailchimp
 
Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.2024-06-04
Codeer Limited--Bricks Builder
 
Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.2024-06-04




codelessthemes--Cowidgets Elementor Addons
 
The Cowidgets - Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'item_style' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.2024-06-06






CodePeople--WP Time Slots Booking Form
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Stored XSS.This issue affects WP Time Slots Booking Form: from n/a through 1.2.10.2024-06-08
CODESYS--CODESYS Control for BeagleBone SL
 
An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.2024-06-04

CODESYS--CODESYS Control Win (SL)
 
A local attacker with low privileges can read and modify any users files and cause a DoS in the working directory of the affected products due to exposure of resource to wrong sphere. 2024-06-04

Dell--CPG BIOS
 
Dell BIOS contains a missing support for integrity check vulnerability. An attacker with physical access to the system could potentially bypass security mechanisms to run arbitrary code on the system.2024-06-07
Dell--PowerScale OneFS
 
Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability. An adjacent network unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure of network traffic and denial of service.2024-06-04
denoland--deno
 
An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage. It is recommended to upgrade to Deno 1.44.1 and if your private registry ever serves tarballs at a different domain to rotate your registry credentials.2024-06-06


dexta--Dextaz Ping
 
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in dexta Dextaz Ping allows Command Injection.This issue affects Dextaz Ping: from n/a through 0.65.2024-06-04
DigiWin--EasyFlow .NET
 
DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database records.2024-06-03
directus--directus
 
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2.2024-06-03

envoyproxy--envoy
 
Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.2024-06-04
envoyproxy--envoy
 
Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash.2024-06-04
evmos--evmos
 
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that is using the contract address as the sender parameter in an ICS20 transfer using the ICS20 precompile. This is in essence the "infinite money glitch" allowing contracts to double the supply of Evmos after each transaction.The issue has been patched in versions >=V18.1.0.2024-06-06

expresstech--Quiz and Survey Master (QSM) Easy Quiz and Survey Maker
 
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-06-07

Fahad Mahmood--WP Docs
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Reflected XSS.This issue affects WP Docs: from n/a through 2.1.3.2024-06-08
Foliovision--FV Flowplayer Video Player
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.2024-06-03
Fortinet--FortiWebManager
 
An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.2024-06-03
Fortinet--FortiWebManager
 
An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.2024-06-03
Fortinet--FortiWebManager
 
An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.2024-06-03
gelform--Social Link Pages: link-in-bio landing pages for your social media profiles
 
The Social Link Pages: link-in-bio landing pages for your social media profiles plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the import_link_pages() function in all versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to inject arbitrary pages and malicious web scripts.2024-06-04

GiveWP--GiveWP
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GiveWP allows Reflected XSS.This issue affects GiveWP: from n/a through 3.12.0.2024-06-08
Grafana--OnCall
 
Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery (SSRF) vulnerability in the webhook functionallity. This issue was fixed in version 1.5.22024-06-05
HCL Software--Domino Server
 
The Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicking it.2024-06-06
IBM--Engineering Requirements Management DOORS Next
 
IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 268758.2024-06-06

icegram--Email Subscribers by Icegram Express Email Marketing, Newsletters, Automation for WordPress & WooCommerce
 
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'hash' parameter in all versions up to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-06-05

idccms -- idccms
 
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=add2024-06-04
idccms -- idccms
 
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany_deal.php?mudi=del2024-06-04
idccms -- idccms
 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close2024-06-04
idccms -- idccms
 
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close2024-06-04
ifm--moneo appliance QVA200
 
An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.2024-06-03
itsourcecode--Bakery Online Ordering System
 
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modules/product/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-267414 is the identifier assigned to this vulnerability.2024-06-07



itsourcecode--Online Discussion Forum
 
A vulnerability was found in itsourcecode Online Discussion Forum 1.0. It has been rated as critical. This issue affects some unknown processing of the file register_me.php. The manipulation of the argument eaddress leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267407.2024-06-07



jupyter-server--jupyter_server
 
The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This vulnerability is fixed in 2.14.1.2024-06-06

kanboard--kanboard
 
Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.2024-06-06

litonice13--Master Addons Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
 
The Master Addons - Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Navigation Menu widget of the plugin's Mega Menu extension in all versions up to, and including, 2.0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07

LJ Apps--WP TripAdvisor Review Slider
 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LJ Apps WP TripAdvisor Review Slider allows Blind SQL Injection.This issue affects WP TripAdvisor Review Slider: from n/a through 12.6.2024-06-03
Loopus--WP Visitors Tracker
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3.2024-06-08
lvaudore--The Moneytizer
 
The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.5.20. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.2024-06-06

lvaudore--The Moneytizer
 
The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.5.20. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-06-06

misskey-dev--misskey
 
Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.2024-06-03

MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user's system when interacted with.2024-06-04
MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user's system when interacted with.2024-06-04
MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user's system when interacted with.2024-06-04
MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user's system when interacted with.2024-06-04
MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user's system when interacted with.2024-06-04
MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user's system when interacted with.2024-06-04
MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user's system when interacted with.2024-06-04
MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user's system when interacted with.2024-06-04
MLflow--MLflow
 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user's system when run.2024-06-04
MLflow--MLflow
 
Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user's system when run.2024-06-04
n/a--Clash
 
A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability.2024-06-07



n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 2200, Exynos 1480, Exynos 2400. It lacks a check for the validation of native handles, which can result in code execution.2024-06-07
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper reference count checking, which can result in a UAF (Use-After-Free) vulnerability.2024-06-07
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper memory deallocation checking, which can result in a UAF (Use-After-Free) vulnerability.2024-06-07
Netgsm--Netgsm
 
Missing Authorization vulnerability in Netgsm.This issue affects Netgsm: from n/a through 2.9.16.2024-06-04
open-telemetry--opentelemetry-collector
 
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.2024-06-05



phoeniixx--Social Login Lite For WooCommerce
 
The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.6.0. This is due to insufficient verification on the user being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.2024-06-04

pimcore--pimcore
 
Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.2024-06-04


pokornydavid--Frontend Registration Contact Form 7
 
The Frontend Registration - Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient restriction on the '_cf7frr_' post meta. This makes it possible for authenticated attackers, with editor-level access and above, to modify the default user role in the registration form settings.2024-06-04

PORTY Smart Tech Technology Joint Stock Company--PowerBank Application
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allows Retrieve Embedded Sensitive Data.This issue affects PowerBank Application: before 2.02.2024-06-05
PowerPack--PowerPack Pro for Elementor
 
The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with administrator set as the default role and then register as an administrator.2024-06-08

qodeinteractive--Qi Addons For Elementor
 
The Qi Addons For Elementor plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include remote files on the server, resulting in code execution. Please note that this requires an attacker to create a non-existent directory or target an instance where file_exists won't return false with a non-existent directory in the path, in order to successfully exploit.2024-06-07

Qualcomm, Inc.--Snapdragon
 
Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Memory corruption in Hypervisor when platform information mentioned is not aligned.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Information disclosure in Video while parsing mp2 clip with invalid section length.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.2024-06-03
realmag777--Active Products Tables for WooCommerce
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce allows Reflected XSS.This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.3.2024-06-08
Red Hat--Logging Subsystem for Red Hat OpenShift
 
A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.2024-06-05



Red Hat--Red Hat Build of Keycloak
 
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.2024-06-03










Red Hat--Red Hat Enterprise Linux 8
 
A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.2024-06-06






Repute Infosystems--ARMember
 
Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.2024-06-04
RLDD--Auto Coupons for WooCommerce
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RLDD Auto Coupons for WooCommerce allows Reflected XSS.This issue affects Auto Coupons for WooCommerce: from n/a through 3.0.14.2024-06-08
Samsung Mobile--Samsung Mobile Devices
 
Improper access control vulnerability in SmartManagerCN prior to SMR Jun-2024 Release 1 allows local attackers to launch privileged activities.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Heap out-of-bound write vulnerability in parsing grid image header in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to execute arbitrary code.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Heap out-of-bound write vulnerability in parsing grid image in libsavscmn.so prior to SMR June-2024 Release 1 allows local attackers to execute arbitrary code.2024-06-04
Select-Themes--Stockholm Core
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm Core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through 2.4.1.2024-06-04
Select-Themes--Stockholm
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through 9.6.2024-06-04
Select-Themes--Stockholm
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through 9.6.2024-06-04
Skops-dev--Skops
 
Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded.2024-06-04
softaculous--FileOrganizer Manage WordPress and Website Files
 
The FileOrganizer - Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.2024-06-07


solarwinds -- solarwinds_platform
 
The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability.  2024-06-04

solarwinds -- solarwinds_platform
 
The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.2024-06-04

SolarWinds --SolarWinds Serv-U 
 
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.2024-06-06
sonalsinha21--SKT Addons for Elementor
 
The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Age Gate and Creative Slider widgets in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-08

Summar Software--Mentor Employee Portal
 
Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35. This vulnerability could allow an attacker to execute arbitrary code, by injecting a malicious payload into the "ViewState" field.2024-06-06
Sysaid--SysAid
 
SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2024-06-06
Sysaid--SysAid
 
SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2024-06-06
Tainacan.org--Tainacan
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tainacan.Org Tainacan allows Reflected XSS.This issue affects Tainacan: from n/a through 0.21.3.2024-06-03
Team Heateor--Heateor Social Login
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Cross-Site Scripting (XSS).This issue affects Heateor Social Login: from n/a through 1.1.32.2024-06-08
Themeisle--Visualizer
 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.This issue affects Visualizer: from n/a through 3.11.1.2024-06-08
themeum--Tutor LMS eLearning and online course solution
 
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the 'course_id' parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-06-07


ThimPress--Eduma
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThimPress Eduma allows Reflected XSS.This issue affects Eduma: from n/a through 5.4.7.2024-06-08
Tribulant--Newsletters
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.This issue affects Newsletters: from n/a through 4.9.5.2024-06-08
unitecms--Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
 
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the 'data[addonID]' parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-06-06



Unlimited Elements--Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
 
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Code Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.66.2024-06-04
userproplugin -- userpro
 
Improper Privilege Management vulnerability in DeluxeThemes Userpro allows Privilege Escalation.This issue affects Userpro: from n/a through 5.1.8.2024-06-04
vanyukov--Market Exporter
 
The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path traversal to delete arbitrary files on the server.2024-06-07


viz-rs--nano-id
 
nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0.2024-06-04

Wow-Company--Easy Digital Downloads Recent Purchases
 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads - Recent Purchases allows PHP Remote File Inclusion.This issue affects Easy Digital Downloads - Recent Purchases: from n/a through 1.0.2.2024-06-04
wpase--Admin and Site Enhancements (ASE)
 
Improper Authentication vulnerability in wpase Admin and Site Enhancements (ASE) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Admin and Site Enhancements (ASE): from n/a through 5.7.1.2024-06-04
wpdevart--Responsive Image Gallery, Gallery Album
 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.2024-06-08
WPMobile.App--WPMobile.App
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMobile.App allows Reflected XSS.This issue affects WPMobile.App: from n/a through 11.41.2024-06-08
wshberlin--Startklar Elementor Addons
 
The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory.2024-06-06

XforWooCommerce--XforWooCommerce
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in XforWooCommerce allows PHP Local File Inclusion.This issue affects XforWooCommerce: from n/a through 2.0.2.2024-06-04
xootix--Login/Signup Popup ( Inline Form + Woocommerce )
 
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.2024-06-06


Yannick Lefebvre--Link Library
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6.3.2024-06-08
YdataAI--ydata-profiling
 
Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded.2024-06-04
YdataAI--ydata-profiling
 
A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser.2024-06-04
YdataAI--ydata-profiling
 
Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded.2024-06-04

Back to top

Medium Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource & Patch Info
10up--ElasticPress
 
Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress.This issue affects ElasticPress: from n/a through 5.1.0.2024-06-08
10up--Restricted Site Access
 
Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.2024-06-04
10Web Form Builder Team--Form Maker by 10Web
 
Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20.2024-06-04
10web--Photo Gallery by 10Web Mobile-Friendly Image Gallery
 
The Photo Gallery by 10Web - Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'svg' parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Photo Gallery can be extended to contributors on pro versions of the plugin.2024-06-07



10web--Photo Gallery by 10Web Mobile-Friendly Image Gallery
 
The Photo Gallery by 10Web - Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) the contents of arbitrary files on the server, which can contain sensitive information, and to cut (delete) arbitrary directories, including the root WordPress directory. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery edit permissions to lower level users, which might make this exploitable by users as low as contributors.2024-06-07





A WP Life--Contact Form Widget
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Contact Form Widget.This issue affects Contact Form Widget: from n/a through 1.3.9.2024-06-03
AccessAlly--PopupAlly
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.2024-06-03
adamskaat--Countdown, Coming Soon, Maintenance Countdown & Clock
 
The Countdown, Coming Soon, Maintenance - Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modify the status of countdowns.2024-06-06




Analytify--Analytify
 
Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.2.3.2024-06-08
apollo13themes--Rife Free
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in apollo13themes Rife Free allows Stored XSS.This issue affects Rife Free: from n/a through 2.4.19.2024-06-08
argoproj--argo-cd
 
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.2024-06-06

argoproj--argo-cd
 
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It's possible for authenticated users to enumerate clusters by name by inspecting error messages. It's also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.2024-06-06

ARI Soft--ARI Stream Quiz
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2.2024-06-04
artbees--SellKit Funnel builder and checkout optimizer for WooCommerce to sell more, faster
 
The SellKit - Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06



Automattic--ChaosTheory
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic ChaosTheory allows Stored XSS.This issue affects ChaosTheory: from n/a through 1.3.2024-06-03
awordpresslife--Formula
 
The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in the 'quality_customizer_notify_dismiss_action' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-06-08


awordpresslife--Formula
 
The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in the 'ti_customizer_notify_dismiss_recommended_plugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-06-08


bdthemes--Prime Slider Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)
 
The Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the Pacific widget in all versions up to, and including, 3.14.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07



Benoit Mercusot--Simple Popup Manager
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Benoit Mercusot Simple Popup Manager allows Stored XSS.This issue affects Simple Popup Manager: from n/a through 1.3.5.2024-06-03
BetterAddons--Better Elementor Addons
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BetterAddons Better Elementor Addons allows PHP Local File Inclusion.This issue affects Better Elementor Addons: from n/a through 1.4.1.2024-06-04
BeyondTrust--BeyondInsight
 
Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forgery vulnerability.2024-06-04
BeyondTrust--BeyondInsight
 
Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames.2024-06-04
biplob018--Image Hover Effects for Elementor with Lightbox and Flipbox
 
The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id', 'oxi_addons_f_title_tag', and 'content_description_tag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06



Born05--CraftCMS Plugin - Two-Factor Authentication
 
The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.2024-06-06


Brainstorm Force--Spectra
 
Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: from n/a through 2.3.0.2024-06-03
Brainstorm Force--Spectra
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affects Spectra: from n/a through 2.3.0.2024-06-03
Brainstorm Force--Spectra
 
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Brainstorm Force Spectra allows Content Spoofing, Phishing.This issue affects Spectra: from n/a through 2.3.0.2024-06-03
brainstormforce--Cards for Beaver Builder
 
The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Cards widget in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-08



brainstormforce--SureTriggers Connect All Your Plugins, Apps, Tools & Automate Everything!
 
The SureTriggers - Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Trigger Link shortcode in all versions up to, and including, 1.0.47 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-04


brizy -- brizy-page_builder
 
The Brizy - Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05


brizy -- brizy-page_builder
 
The Brizy - Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05

brizy -- brizy-page_builder
 
The Brizy - Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and including, 2.4.41 due to insufficient input sanitization performed only on the client side and insufficient output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05

brizy -- brizy-page_builder
 
The Brizy - Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05


Bryan Hadaway--Site Favicon
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bryan Hadaway Site Favicon allows Stored XSS.This issue affects Site Favicon: from n/a through 0.2.2024-06-03
Canonical Ltd.--Netplan
 
netplan leaks the private key of wireguard to local users. A security fix will be released soon.2024-06-07


cartpauj--Cartpauj Register Captcha
 
: Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.2024-06-04
CeiKay--Tooltip CK
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CeiKay Tooltip CK tooltip-ck allows Stored XSS.This issue affects Tooltip CK: from n/a through 2.2.15.2024-06-08
Ciprian Popescu--Block for Font Awesome
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ciprian Popescu Block for Font Awesome allows Stored XSS.This issue affects Block for Font Awesome: from n/a through 1.4.4.2024-06-08
Cisco--Cisco Unified Contact Center Enterprise
 
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.2024-06-05
claudiosanches--Claudio Sanches Checkout Cielo for WooCommerce
 
The Claudio Sanches - Checkout Cielo for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient payment validation in the update_order_status() function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the status of orders to paid bypassing payment.2024-06-04

Codection--Import and export users and customers
 
Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.2024-06-08
codeless -- cowidgets_-_elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Codeless Cowidgets - Elementor Addons allows Stored XSS.This issue affects Cowidgets - Elementor Addons: from n/a through 1.1.1.2024-06-04
codelessthemes--Cowidgets Elementor Addons
 
The Cowidgets - Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_tag' parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-04


codename065--Download Manager
 
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to, and including, 3.2.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05

CodePeople, paypaldev--CP Contact Form with Paypal
 
Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Paypal: from n/a through 1.3.34.2024-06-03
CodePeople--Calculated Fields Form
 
Missing Authorization vulnerability in CodePeople Calculated Fields Form allows Functionality Misuse.This issue affects Calculated Fields Form: from n/a through 1.1.120.2024-06-03
CodePeople--Contact Form Email
 
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.2024-06-04
CodePeople--Contact Form Email
 
Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31.2024-06-04
CodePeople--CP Multi View Event Calendar
 
Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Functionality Misuse.This issue affects CP Multi View Event Calendar: from n/a through 1.4.10.2024-06-03
CodePeople--Search in Place
 
Missing Authorization vulnerability in CodePeople Search in Place allows Functionality Misuse.This issue affects Search in Place: from n/a through 1.0.104.2024-06-03
Creative Motion, Will Bontrager Software, LLC--Woody ad snippets
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Creative Motion, Will Bontrager Software, LLC Woody ad snippets allows Stored XSS.This issue affects Woody ad snippets: from n/a through 2.4.10.2024-06-08
CreativeThemes--Blocksy Companion
 
Server-Side Request Forgery (SSRF) vulnerability in CreativeThemes Blocksy Companion.This issue affects Blocksy Companion: from n/a through 2.0.42.2024-06-03
creativethemeshq--Blocksy
 
The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-06-05

CRM Perks.--Integration for Contact Form 7 and Constant Contact
 
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through 1.1.5.2024-06-03
cyberchimps--Responsive Addons Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.
 
The Responsive Addons - Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05



CyberChimps--Responsive
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive allows Stored XSS.This issue affects Responsive: from n/a through 5.0.3.2024-06-04
cyclonetheme--Elegant Blocks
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in cyclonetheme Elegant Blocks allows Stored XSS.This issue affects Elegant Blocks: from n/a through 1.7.2024-06-03
dain--snappy
 
iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.2024-06-03
Devnath verma--WP Captcha
 
Improper Restriction of Excessive Authentication Attempts vulnerability in Devnath verma WP Captcha allows Functionality Bypass.This issue affects WP Captcha: from n/a through 2.0.0.2024-06-04
dextorlobo--Custom Dash
 
The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-06-06

dfactory--Download Attachments
 
The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-04

Dulldusk--PHP File Manager
 
Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fm_current_dir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.2024-06-06
duongancol--Boostify Header Footer Builder for Elementor
 
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' parameter in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05




duongancol--Boostify Header Footer Builder for Elementor
 
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_bhf_post function in all versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages or posts with arbitrary content.2024-06-06

El tiempo--Weather Widget Pro
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in El tiempo Weather Widget Pro allows Stored XSS.This issue affects Weather Widget Pro: from n/a through 1.1.40.2024-06-08
elearningfreak -- insert_or_embed_articulate_content
 
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page.2024-06-04
EmailGPT--EmailGPT
 
The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts. When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond by providing the requested data. This vulnerability can be exploited by any individual with access to the service.2024-06-05
Enea Overclokk--Stellissimo Text Box
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Enea Overclokk Stellissimo Text Box allows Stored XSS.This issue affects Stellissimo Text Box: from n/a through 1.1.4.2024-06-08
envothemes--Envo Extra
 
The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_css_id' parameter within the Button widget in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07



envoyproxy--envoy
 
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.2024-06-04
envoyproxy--envoy
 
Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.2024-06-04
envoyproxy--envoy
 
Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by integer underflow in the `QuicStreamSequencerBuffer::PeekRegion()` implementation.2024-06-04
envoyproxy--envoy
 
Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can crash Envoy. An attacker can exploit this vulnerability by sending a request without `FIN`, then a `RESET_STREAM` frame, and then after receiving the response, closing the connection.2024-06-04
envoyproxy--envoy
 
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.2024-06-04
Essential Addons--Essential Addons for Elementor Pro
 
The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eael_lightbox_open_btn_icon' parameter within the Lightbox & Modal widget in all versions up to, and including, 5.8.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07

evmos--evmos
 
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`. This affects 18.1.0 and earlier.2024-06-06
extendthemes--Colibri Page Builder
 
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07

extendthemes--Colibri Page Builder
 
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06


Fahad Mahmood--WP Docs
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Stored XSS.This issue affects WP Docs: from n/a through 2.1.3.2024-06-08
Fastly--Fastly
 
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.2024-06-03
FeedbackWP--Rate my Post WP Rating System
 
Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post - WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post - WP Rating System: from n/a through 3.4.2.2024-06-04
flowdee--EasyAzon Amazon Associates Affiliate Plugin
 
The EasyAzon - Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'easyazon-cloaking-locale' parameter in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-06-06

Forge12 Interactive GmbH--Captcha/Honeypot for Contact Form 7
 
Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality Bypass.This issue affects Captcha/Honeypot for Contact Form 7: from n/a through 1.11.3.2024-06-04
Fortinet--FortiAuthenticator
 
A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to redirect users to an arbitrary website via a crafted URL.2024-06-03
Fortinet--FortiPortal
 
A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests.2024-06-03
Fortinet--FortiSOAR
 
An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses.2024-06-03
Fortinet--FortiWebManager
 
An improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6.3.0 and 6.2.3 through 6.2.4 and 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI.2024-06-05
Fortinet--FortiWeb
 
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.2024-06-03
Fortinet--FortiWeb
 
Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version 6.3.23 and below may allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests.2024-06-03
freephp-1--Nafeza Prayer Time
 
The Nafeza Prayer Time plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-06-04

g5theme--Essential Real Estate
 
The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-04

g5theme--Essential Real Estate
 
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachments.2024-06-04

GeneratePress--GP Premium
 
The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-06-05

getbrave -- brave
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brave Brave Popup Builder allows Stored XSS.This issue affects Brave Popup Builder: from n/a through 0.6.8.2024-06-04
getformwork--formwork
 
Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.2024-06-07


gn_themes--WP Shortcodes Plugin Shortcodes Ultimate
 
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05


GregRoss--Just Writing Statistics
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GregRoss Just Writing Statistics allows Stored XSS.This issue affects Just Writing Statistics: from n/a through 4.5.2024-06-03
gVectors Team--wpDiscuz
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in gVectors Team wpDiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.18.2024-06-08
gVectors Team--wpDiscuz
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects wpDiscuz: from n/a through 7.6.10.2024-06-04
Hans van Eijsden,niwreg--ImageMagick Sharpen Resized Images
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hans van Eijsden,niwreg ImageMagick Sharpen Resized Images allows Stored XSS.This issue affects ImageMagick Sharpen Resized Images: from n/a through 1.1.7.2024-06-03
HasThemes--HT Feed
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes HT Feed allows Stored XSS.This issue affects HT Feed: from n/a through 1.2.8.2024-06-08
HasThemes--ShopLentor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes ShopLentor allows Stored XSS.This issue affects ShopLentor: from n/a through 2.8.7.2024-06-03
HCL Software--Connections Docs
 
HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. This may lead to credentials disclosure and possibly launch additional attacks.2024-06-08
horearadu--Materialis Companion
 
The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06


horearadu--One Page Express Companion
 
The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in all versions up to, and including, 1.6.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07

ibabar--WordPress prettyPhoto
 
The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

IBM--i
 
IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can be used by a malicious actor to gather information about SST users that can be targeted in further attacks. IBM X-Force ID: 287538.2024-06-07

IBM--System Storage DS8900F
 
IBM System Storage DS8900F 89.22.19.0, 89.30.68.0, 89.32.40.0, 89.33.48.0, 89.40.83.0, and 89.40.93.0 could allow a remote user to create an LDAP connection with a valid username and empty password to establish an anonymous connection.   IBM X-Force ID: 279518.2024-06-06

Icegram--Icegram
 
Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.2024-06-08
IdoPesok--zsa
 
zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on `0.3.3`.2024-06-07

ILLID--Advanced Woo Labels
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels allows Cross-Site Scripting (XSS).This issue affects Advanced Woo Labels: from n/a through 1.93.2024-06-08
IP2Location--Download IP2Location Country Blocker
 
Authentication Bypass by Spoofing vulnerability in IP2Location Download IP2Location Country Blocker allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Download IP2Location Country Blocker: from n/a through 2.29.1.2024-06-04
ishanverma--Authorize.net Payment Gateway For WooCommerce
 
The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment.2024-06-04

itsourcecode--Bakery Online Ordering System
 
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument txtsearch leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267091.2024-06-04



itsourcecode--Bakery Online Ordering System
 
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file report/index.php. The manipulation of the argument procduct leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267092.2024-06-05



itsourcecode--Online Discussion Forum
 
A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267408.2024-06-07



J.N. Breetvelt a.k.a. OpaJaap--WP Photo Album Plus
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.2024-06-04
j0hnsmith--Testimonials Widget
 
The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

Jewel Theme--Master Addons for Elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.5.9.2024-06-08
Jewel Theme--Master Addons for Elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.6.0.2024-06-08
johnnash1975--Easy Social Like Box Popup Sidebar Widget
 
The Easy Social Like Box - Popup - Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardoza_facebook_like_box' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

JumpDEMAND Inc.--ActiveDEMAND
 
Cross-Site Request Forgery (CSRF) vulnerability in JumpDEMAND Inc. ActiveDEMAND.This issue affects ActiveDEMAND: from n/a through 0.2.43.2024-06-03
Kharim Tomlinson--WP Next Post Navi
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kharim Tomlinson WP Next Post Navi allows Stored XSS.This issue affects WP Next Post Navi: from n/a through 1.8.3.2024-06-03
Kognetiks--Kognetiks Chatbot for WordPress
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kognetiks Kognetiks Chatbot for WordPress allows Stored XSS.This issue affects Kognetiks Chatbot for WordPress: from n/a through 1.9.8.2024-06-08
LabVantage--LIMS
 
A vulnerability classified as critical was found in LabVantage LIMS 2017. This vulnerability affects unknown code of the file /labvantage/rc?command=page&page=SampleList&_iframename=list of the component POST Request Handler. The manipulation of the argument param1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-267454 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-06-08



Lester GaMerZ Chan--WP-PostRatings
 
Improper Control of Interaction Frequency vulnerability in Lester 'GaMerZ' Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.2024-06-04
litonice13--Master Addons Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
 
The Master Addons - Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.2024-06-07

Lukman Nakib--Debug Log Manger Tool
 
Insertion of Sensitive Information into Log File vulnerability in Lukman Nakib Debug Log - Manger Tool.This issue affects Debug Log - Manger Tool: from n/a through 1.4.5.2024-06-03
MagniGenie--RestroPress
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagniGenie RestroPress allows Stored XSS.This issue affects RestroPress: from n/a through 3.1.2.1.2024-06-08
Marketing Fire, LLC--Widget Options - Extended
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0.2024-06-08

melapress--Admin Notices Manager
 
The Admin Notices Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_ajax_call() function in all versions up to, and including, 1.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve a list of registered user emails.2024-06-04

Menno Luitjes--Foyer
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Menno Luitjes Foyer allows Code Injection.This issue affects Foyer: from n/a through 1.7.5.2024-06-04
Mervin Praison--Praison SEO WordPress
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mervin Praison Praison SEO WordPress allows Stored XSS.This issue affects Praison SEO WordPress: from n/a through 4.0.15.2024-06-03
metagauss--ProfileGrid User Profiles, Groups and Communities
 
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_dismissible_notice and pm_wizard_update_group_icon functions in all versions up to, and including, 5.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options to the value '1' or change group icons.2024-06-05



Metagauss--RegistrationMagic
 
Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.2.5.0.2024-06-04
Metagauss--RegistrationMagic
 
Improper Control of Interaction Frequency vulnerability in Metagauss RegistrationMagic allows Functionality Misuse.This issue affects RegistrationMagic: from n/a through 5.2.5.0.2024-06-04
miniorange--Malware Scanner
 
Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Malware Scanner: from n/a through 4.7.1.2024-06-04
MongoDB Inc--PyMongo
 
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.2024-06-05
moveaddons--Move Addons for Elementor
 
Missing Authorization vulnerability in moveaddons Move Addons for Elementor.This issue affects Move Addons for Elementor: from n/a through 1.2.9.2024-06-04
mpntod--Rotating Tweets (Twitter widget and shortcode)
 
The Rotating Tweets (Twitter widget and shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's' 'rotatingtweets' in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

N/A--Church Admin
 
Server-Side Request Forgery (SSRF) vulnerability in Church Admin.This issue affects Church Admin: from n/a through 4.3.6.2024-06-03
N/A--KiviCare
 
Authorization Bypass Through User-Controlled Key vulnerability in KiviCare.This issue affects KiviCare: from n/a through 3.6.2.2024-06-08
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_params(), there is no input validation check on hal_req->num_config_discovery_attr coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is no input validation check on hal_req->service_specific_info_len coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_params(), there is no input validation check on disc_attr->infrastructure_ssid_len coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_params(), there is no input validation check on disc_attr->mesh_id_len coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_publish_get_nl_params(), there is no input validation check on hal_req->service_specific_info_len coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is no input validation check on hal_req->sdea_service_specific_info_len coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_nl_params(), there is no input validation check on hal_req->rx_match_filter_len coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_get_security_info_nl(), there is no input validation check on sec_info->key_info.body.pmk_info.pmk_len coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_cert(), there is no input validation check on len coming from userspace, which can lead to a heap over-read.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_nl_params(), there is no input validation check on hal_req->num_intf_addr_present coming from userspace, which can lead to a heap overwrite.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_set_delayed_wakeup_type(), there is no input validation check on a length of ioctl_args->args[i] coming from userspace, which can lead to a heap over-read.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_ut(), there is no input validation check on len coming from userspace, which can lead to a heap over-read.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame(), there is no input validation check on len coming from userspace, which can lead to a heap over-read.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor EExynos 2200, Exynos 1480, Exynos 2400. It lacks a check for the validation of native handles, which can result in an Out-of-Bounds Write.2024-06-07
n/a--n/a
 
Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information (such as hotel invoice content with PII), and potentially create unauthorized room keys, by entering a guest-search quote character and then accessing the underlying Windows OS.2024-06-06

n/a--n/a
 
An issue was discovered in Samsung Mobile Processor, Automotive Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. The baseband software does not properly check format types specified by the RRC. This can lead to a lack of encryption.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 2200, 1280, 1380, 1330, 2400, 9110, W920, W930, Modem 5123, Modem 5300, and Auto T5123. The baseband software does not properly check states specified by the RRC (Radio Resource Control) module. This can lead to disclosure of sensitive information.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 2200, 1280, 1380, 1330, 2400, 9110, W920, W930, Modem 5123, Modem 5300, and Auto T5123. The baseband software does not properly check states specified by the RRC (Radio Resource Control) Reconfiguration message. This can lead to disclosure of sensitive information.2024-06-04
N/A--RT Easy Builder Advanced addons for Elementor
 
Missing Authorization vulnerability in RT Easy Builder - Advanced addons for Elementor.This issue affects RT Easy Builder - Advanced addons for Elementor: from n/a through 2.0.2024-06-04
nalam-1--Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
 
The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id' parameter in all versions up to, and including, 1.1.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06


nayrathemes--Clever Fox
 
The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and including, 25.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07

nayrathemes--Clever Fox
 
The Clever Fox - One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clever-fox-activate-theme' function in all versions up to, and including, 25.2.0. This makes it possible for authenticated attackers, with subscriber access and above, to modify the active theme, including to an invalid value which can take down the site.2024-06-07


ndijkstra--Mollie Forms
 
The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incorrect nonce validation on the duplicateForm() function. This makes it possible for unauthenticated attackers to duplicate forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-06-05

Netentsec--NS-ASG Application Security Gateway
 
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /admin/config_MT.php?action=delete. The manipulation of the argument Mid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266847. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-06-03



Netentsec--NS-ASG Application Security Gateway
 
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. This vulnerability affects unknown code of the file /protocol/iscuser/uploadiscuser.php of the component JSON Content Handler. The manipulation of the argument messagecontent leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266848. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-06-03



netty--netty-incubator-codec-ohttp
 
netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which would allow an attacker to cause the sequence number to overflow and thus the nonce to repeat.2024-06-04

Nitin Rathod--WP Forms Puzzle Captcha
 
Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.2024-06-04
oslabs-beta--SkyScraper
 
SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, leading to potential vulnerabilities for the user's temporary credentials and data. This affects version 1.0.0.2024-06-07
OTRS AG--OTRS
 
The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts. This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.2024-06-06
pandaboxwp--WP jQuery Lightbox
 
The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07




pdfcrowd -- save_as_pdf_plugin
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.3.2024-06-04
Peregrine themes--Bloglo
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Peregrine themes Bloglo allows Stored XSS.This issue affects Bloglo: from n/a through 1.1.3.2024-06-08
pickplugins--Gutenberg Blocks, Page Builder ComboBlocks
 
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute in blocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07

pickplugins--Gutenberg Blocks, Page Builder ComboBlocks
 
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07

PickPlugins--Tabs & Accordion
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue affects Tabs & Accordion: from n/a through 1.3.10.2024-06-04
PINPOINT.WORLD--Pinpoint Booking System
 
External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4.2024-06-04
Plechev Andrey--WP-Recall
 
Cross-Site Request Forgery (CSRF) vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.6.2024-06-08
Pluggabl LLC--Booster Elite for WooCommerce
 
Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.3.2024-06-04
Pluggabl LLC--Booster for WooCommerce
 
Improper Authentication vulnerability in Pluggabl LLC Booster for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster for WooCommerce: from n/a through 7.1.2.2024-06-04
pluginever--WP Content Pilot Autoblogging & Affiliate Marketing Plugin
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot - Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot - Autoblogging & Affiliate Marketing Plugin: from n/a through 1.3.3.2024-06-04
pluginkollektiv--Antispam Bee
 
Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3.2024-06-04
Podlove--Podlove Web Player
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through 5.7.3.2024-06-08
Popup Maker--Popup Maker WP
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Popup Maker Popup Maker WP allows Stored XSS.This issue affects Popup Maker WP: from n/a through 1.2.8.2024-06-03
POSIMYTH--The Plus Addons for Elementor Page Builder Lite
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.5.4.2024-06-08
PropertyHive--PropertyHive
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.13.2024-06-08
ptz0n--Google CSE
 
The Google CSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-06-06

Pure Chat by Ruby--Pure Chat
 
Cross-Site Request Forgery (CSRF) vulnerability in Pure Chat by Ruby Pure Chat.This issue affects Pure Chat: from n/a through 2.22.2024-06-05
purvabathe--Simple Image Popup Shortcode
 
The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sips_popup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

qodeinteractive--Qi Addons For Elementor
 
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06



qodeinteractive--Qi Blocks
 
The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

Qualcomm, Inc.--Snapdragon
 
Information disclosure while handling T2LM Action Frame in WLAN Host.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.2024-06-03
Qualcomm, Inc.--Snapdragon
 
Memory corruption when more scan frequency list or channels are sent from the user space.2024-06-03
Qualcomm, Inc.--Snapdragon
 
transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.2024-06-03
quomodosoft--ElementsReady Addons for Elementor
 
The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id' parameter in all versions up to, and including, 6.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

RadiusTheme--The Post Grid
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RadiusTheme The Post Grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.7.1.2024-06-08
rails--rails
 
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.2024-06-04

rails--rails
 
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.2024-06-04

Red Hat--Red Hat Satellite 6
 
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.2024-06-05

Red Hat--Red Hat Satellite 6
 
A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections.2024-06-05

restrict--Restrict for Elementor
 
The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.6 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract potentially sensitive data from post content.2024-06-06

Revolution Slider--Slider Revolution
 
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up to, and including, 6.7.11 due to insufficient input sanitization and output escaping on the user supplied 'class', 'id', and 'title' attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation of this vulnerability requires an Administrator to give Slider Creation privileges to Author-level users.2024-06-04

Revolution Slider--Slider Revolution
 
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping on the user supplied Elementor 'wrapperid' and 'zindex' display attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-04

rubengc--GamiPress Link
 
The GamiPress - Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05

rustaurius--Five Star Restaurant Menu and Food Ordering
 
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'add_section', 'add_menu', 'add_menu_item', and 'add_menu_page' functions in all versions up to, and including, 2.4.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create menu sections, menus, food items, and new menu pages.2024-06-05





Samsung Mobile--GalaxyBudsManager PC
 
Arbitrary directory creation in GalaxyBudsManager PC prior to version 2.1.240315.51 allows attacker to create arbitrary directory.2024-06-04
Samsung Mobile--Samsung Live Wallpaper PC 
 
Arbitrary directory creation in Samsung Live Wallpaper PC prior to version 3.3.8.0 allows attacker to create arbitrary directory.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Improper input validation in libsheifdecadapter.so prior to SMR Jun-2024 Release 1 allows local attackers to lead to memory corruption.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Stack-based buffer overflow vulnerability in bootloader prior to SMR Jun-2024 Release 1 allows physical attackers to overwrite memory.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attackers lead to potential arbitrary code execution.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Incorrect use of privileged API vulnerability in registerBatteryStatsCallback in BatteryStatsService prior to SMR Jun-2024 Release 1 allows local attackers to use privileged API.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Incorrect use of privileged API vulnerability in getSemBatteryUsageStats in BatteryStatsService prior to SMR Jun-2024 Release 1 allows local attackers to use privileged API.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to make a call without proper permission.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Improper input validation vulnerability in caminfo driver prior to SMR Jun-2024 Release 1 allows local privileged attackers to write out-of-bounds memory.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Improper caller verification vulnerability in SemClipboard prior to SMR June-2024 Release 1 allows local attackers to access arbitrary files.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Improper input validation vulnerability in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to write out-of-bounds memory.2024-06-04
Samsung Mobile--Samsung Mobile Devices
 
Out-of-bounds read vulnerability in bootloader prior to SMR June-2024 Release 1 allows physical attackers to arbitrary data access.2024-06-04
satollo--Newsletter Send awesome emails from WordPress
 
The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05

sendinblue -- newsletter\,_smtp\,_email_marketing_and_subscribe
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue allows Reflected XSS.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.77.2024-06-04
Sensei--Sensei Pro (WC Paid Courses)
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sensei Sensei Pro (WC Paid Courses) allows Stored XSS.This issue affects Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.2024-06-08
shafayat-alam--Gutenberg Blocks and Page Layouts Attire Blocks
 
The Gutenberg Blocks and Page Layouts - Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable_fe_assets function in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with subscriber access or above, to change the plugin's settings. Additionally, no nonce check is performed resulting in a CSRF vulnerability.2024-06-05

shrinitech--Fluid Notification Bar
 
The Fluid Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-06-04

silabs.com--Gecko SDK
 
A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection List (RPL) from RAM to NVM before powering down, resulting in the ability to replay unsaved messages. Note that as of June 2024, the Gecko SDK was renamed to the Simplicity SDK, and the versioning scheme was changed from Gecko SDK vX.Y.Z to Simplicity SDK YYYY.MM.Patch#.2024-06-06

SinaExtra--Sina Extension for Elementor
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SinaExtra Sina Extension for Elementor allows PHP Local File Inclusion.This issue affects Sina Extension for Elementor: from n/a through 3.5.1.2024-06-04
SinaExtra--Sina Extension for Elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SinaExtra Sina Extension for Elementor allows Stored XSS.This issue affects Sina Extension for Elementor: from n/a through 3.5.3.2024-06-08
SoftLab--Integrate Google Drive
 
Broken Authentication vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.93.2024-06-04
solarwinds -- solarwinds_platform
 
The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability.2024-06-04

Spiffy Plugins--Spiffy Calendar
 
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.2024-06-04
spiffyplugins -- wp_flow_plus
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus allows Stored XSS.This issue affects WP Flow Plus: from n/a through 5.2.2.2024-06-04
StarCitizenTools--mediawiki-skins-Citizen
 
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.2024-06-03




sulu--SuluFormBundle
 
The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3.2024-06-06

Synology--Camera Firmware
 
A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. This allows remote attackers to conduct denial-of-service attacks via unspecified vectors. This attack only affects the login service which will automatically restart. The following models with Synology Camera Firmware versions before 1.1.1-0383 may be affected: BC500 and TC500.2024-06-04
tagDiv--tagDiv Composer
 
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: The vulnerable code in this plugin is specifically tied to the tagDiv Newspaper theme. If another theme is installed (e.g., NewsMag), this code may not be present.2024-06-04

Tainacan.org--Tainacan
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tainacan.Org Tainacan allows Stored XSS.This issue affects Tainacan: from n/a through 0.21.3.2024-06-03
takanakui--WP Mobile Menu The Mobile-Friendly Responsive Menu
 
The WP Mobile Menu - The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07

Team Heateor--Heateor Social Login
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Stored XSS.This issue affects Heateor Social Login: from n/a through 1.1.32.2024-06-08
TemplatesNext--TemplatesNext OnePager
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TemplatesNext TemplatesNext OnePager allows Stored XSS.This issue affects TemplatesNext OnePager: from n/a through 1.3.3.2024-06-08
Theme Freesia--Event
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Event allows Stored XSS.This issue affects Event: from n/a through 1.2.2.2024-06-08
Theme Freesia--Idyllic
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Idyllic allows Stored XSS.This issue affects Idyllic: from n/a through 1.1.8.2024-06-08
Theme Freesia--Pixgraphy
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Pixgraphy allows Stored XSS.This issue affects Pixgraphy: from n/a through 1.3.8.2024-06-08
themefarmer--WooCommerce Tools
 
The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules.2024-06-07


themefusecom--Brizy Page Builder
 
The Brizy - Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redirect URL in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied error messages. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05

Themeisle--Otter Blocks PRO
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11.2024-06-08
themekraft -- buddyforms
 
The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.2024-06-05

themesflat -- themesflat_addons_for_elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesflat Themesflat Addons For Elementor allows Stored XSS.This issue affects Themesflat Addons For Elementor: from n/a through 2.1.2.2024-06-04
themesflat--Themesflat Addons For Elementor
 
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

themesflat--Themesflat Addons For Elementor
 
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TF Group Image, TF Nav Menu, TF Posts, TF Woo Product Grid, TF Accordion, and TF Image Box widgets in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06








themesflat--Themesflat Addons For Elementor
 
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

themesflat--Themesflat Addons For Elementor
 
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06

themeum--Tutor LMS eLearning and online course solution
 
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.2024-06-07


thimpress--LearnPress WordPress LMS Plugin
 
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of get_items_permissions_check function. This makes it possible for unauthenticated attackers to extract basic information about website users, including their emails2024-06-05

Tips and Tricks HQ--Stripe Payments
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79.2024-06-04
TNB Mobile Solutions--Cockpit Software
 
Inclusion of Sensitive Information in Source Code vulnerability in TNB Mobile Solutions Cockpit Software allows Retrieve Embedded Sensitive Data.This issue affects Cockpit Software: before v0.251.1.2024-06-05
tobiasbg--TablePress Tables in WordPress made easy
 
The TablePress - Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via the get_files_to_import() function. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Due to the complex nature of protecting against DNS rebind attacks in WordPress software, we settled on the developer simply restricting the usage of the URL import functionality to just administrators. While this is not optimal, we feel this poses a minimal risk to most site owners and ideally WordPress core would correct this issue in wp_safe_remote_get() and other functions.2024-06-07




Tomas Cordero--Safety Exit
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit allows Stored XSS.This issue affects Safety Exit: from n/a through 1.7.0.2024-06-03
UAPP GROUP--Testimonial Carousel For Elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UAPP GROUP Testimonial Carousel For Elementor allows Stored XSS.This issue affects Testimonial Carousel For Elementor: from n/a through 10.1.1.2024-06-08
Unlimited Elements--Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
 
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.109.2024-06-05
victorfreitas--WPUpper Share Buttons
 
The WPUpper Share Buttons plugin for WordPress is vulnerable to unauthorized access of data when preparing sharing links for posts and pages in all versions up to, and including, 3.43. This makes it possible for unauthenticated attackers to obtain the contents of password protected posts and pages.2024-06-04

VideoWhisper--Picture Gallery
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VideoWhisper Picture Gallery allows Stored XSS.This issue affects Picture Gallery: from n/a through 1.5.11.2024-06-04
visualcomposer -- visual_composer_website_builder
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in visualcomposer.Com Visual Composer Website Builder allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through 45.8.0.2024-06-04
Volkswagen Group Charging GmbH - Elli, EVBox--ID Charger Connect & Pro
 
An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and then has full access as the user would have. However, an attacker will not have developer or admin rights. If the implementation of the JWT-library is wrongly configured to accept "none"-algorithms, the server will pass insecure JWT. A local, unauthenticated attacker can exploit this vulnerability to bypass the authentication mechanism.2024-06-06
vollstart -- event_tickets_with_ticket_scanner
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saso Nikolov Event Tickets with Ticket Scanner allows Reflected XSS.This issue affects Event Tickets with Ticket Scanner: from n/a through 2.3.1.2024-06-04
Vsourz Digital--Responsive Slick Slider WordPress
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Injection.This issue affects Responsive Slick Slider WordPress: from n/a through 1.4.2024-06-04
wbcomdesigns--Wbcom Designs Custom Font Uploader
 
The Wbcom Designs - Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cfu_delete_customfont' function in all versions up to, and including, 2.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete any custom font.2024-06-06


wcmp--MultiVendorX Marketplace WooCommerce MultiVendor Marketplace Solution
 
The MultiVendorX Marketplace - WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hover_animation' parameter in all versions up to, and including, 4.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06



web-audimex -- audimexee
 
Cross Site Scripting vulnerability in audimex audimexEE v.15.1.2 and fixed in 15.1.3.9 allows a remote attacker to execute arbitrary code via the service, method, widget_type, request_id, payload parameters.2024-06-04
WebFactory Ltd--Captcha Code
 
Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9.2024-06-04
webfactory--Minimal Coming Soon Coming Soon Page
 
The Minimal Coming Soon - Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin.2024-06-08








webfactory--WP Force SSL & HTTPS SSL Redirect
 
The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.2024-06-08



webfactory--WP Reset Most Advanced WordPress Reset Tool
 
The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting.2024-06-08

Webliberty--Simple Spoiler
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webliberty Simple Spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through 1.2.2024-06-03
westerndeal--CF7 Google Sheets Connector
 
The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings, including WP_DEBUG, WP_DEBUG_LOG, SCRIPT_DEBUG, and SAVEQUERIES.2024-06-08


westguard--WS Form LITE Drag & Drop Contact Form Builder for WordPress
 
The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.2024-06-07


willnorris--Open Graph
 
The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_description' function. This makes it possible for unauthenticated attackers to extract sensitive data including partial content of password-protected blog posts.2024-06-06


wordpresschef--Salon Booking System
 
The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.2024-06-08








Wow-Company--Woocommerce Recent Purchases
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wow-Company Woocommerce - Recent Purchases allows PHP Local File Inclusion.This issue affects Woocommerce - Recent Purchases: from n/a through 1.0.1.2024-06-04
WP Darko--Responsive Tabs
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affects Responsive Tabs: from n/a before 4.0.6.2024-06-04
WP Discussion Board--Discussion Board
 
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cross-Site Scripting (XSS).This issue affects Discussion Board: from n/a through 2.4.8.2024-06-04
WP Hait--Post Grid Elementor Addon
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Hait Post Grid Elementor Addon allows Stored XSS.This issue affects Post Grid Elementor Addon: from n/a through 2.0.16.2024-06-03
WP Moose--Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Moose Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor allows Stored XSS.This issue affects Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor: from n/a through 1.3.9.2024-06-08
wpbean--WPB Elementor Addons
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpbean WPB Elementor Addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through 1.0.9.2024-06-03
WPBlockArt--BlockArt Blocks
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPBlockArt BlockArt Blocks allows Stored XSS.This issue affects BlockArt Blocks: from n/a through 2.1.5.2024-06-08
wpchill--Strong Testimonials
 
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views.2024-06-07

WPDeveloper--Essential Addons for Elementor
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 5.9.15.2024-06-03
wpdevteam--EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor
 
The EmbedPress - Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's EmbedPress PDF widget in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05


wpdevteam--Essential Addons for Elementor Best Elementor Templates, Widgets, Kits & WooCommerce Builders
 
The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06


wpecommerce--Recurring PayPal Donations
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations allows Stored XSS.This issue affects Recurring PayPal Donations: from n/a through 1.7.2024-06-08
WPManageNinja LLC--Ninja Tables
 
Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9.2024-06-03
WPMU DEV--Branda
 
Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.2024-06-04
WPMU DEV--Defender Security
 
Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.2024-06-04
wponlinesupport--Album and Image Gallery plus Lightbox
 
The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.2024-06-06


WPPlugins WordPress Security Plugins--Hide My WP Ghost
 
Improper Restriction of Excessive Authentication Attempts vulnerability in WPPlugins - WordPress Security Plugins Hide My WP Ghost allows Functionality Bypass.This issue affects Hide My WP Ghost: from n/a through 5.0.25.2024-06-04
wppool--WP Dark Mode WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing
 
The WP Dark Mode - WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.2024-06-06


wppost--WP-Recall Registration, Profile, Commerce & More
 
The WP-Recall - Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_payment' function in all versions up to, and including, 16.26.6. This makes it possible for unauthenticated attackers to delete arbitrary payments.2024-06-06

wproyal--Royal Elementor Addons and Templates
 
The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_list' parameter in versions up to, and including, 1.3.976 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07


wproyal--Royal Elementor Addons and Templates
 
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_upload_mimes' function in versions up to, and including, 1.3.976 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-07


wpvivid -- wpvivid_backup_for_mainwp
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPvivid Team WPvivid Backup for MainWP allows Reflected XSS.This issue affects WPvivid Backup for MainWP: from n/a through 0.9.32.2024-06-04
wpweaver--Weaver Xtreme Theme Support
 
The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and including, 6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-05

wpxpo--Post Grid Gutenberg Blocks and WordPress Blog Plugin PostX
 
The Post Grid Gutenberg Blocks and WordPress Blog Plugin - PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the filterMobileText parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-08



Xabier Miranda--WP Back Button
 
Cross Site Scripting (XSS) vulnerability in Xabier Miranda WP Back Button allows Stored XSS.This issue affects WP Back Button: from n/a through 1.1.3.2024-06-03
xootix--Login/Signup Popup ( Inline Form + Woocommerce )
 
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'export_settings' function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary options on affected sites.2024-06-06


YITH--YITH Custom Login
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YITH YITH Custom Login allows Stored XSS.This issue affects YITH Custom Login: from n/a through 1.7.0.2024-06-08
YITH--YITH WooCommerce Tab Manager
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YITH YITH WooCommerce Tab Manager allows Stored XSS.This issue affects YITH WooCommerce Tab Manager: from n/a through 1.35.0.2024-06-08
YITH--YITH WooCommerce Wishlist
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 3.32.0.2024-06-03
yonifre--Maspik Spam blacklist
 
Authentication Bypass by Spoofing vulnerability in yonifre Maspik - Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik - Spam blacklist: from n/a through 0.10.3.2024-06-04
zhuyi--BuddyPress Members Only
 
The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.5 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content.2024-06-06

zootemplate--Clever Addons for Elementor
 
The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-06-06



 

ninjateam--GDPR CCPA Compliance & Cookie Consent Banner
 

The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update page content, send arbitrary emails and inject malicious web scripts.2024-06-07

Low Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource & Patch Info
All In One WP Security & Firewall Team--All In One WP Security & Firewall
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4.2024-06-04
Born05--CraftCMS Plugin - Two-Factor Authentication
 
The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.2024-06-06


David Vongries--Ultimate Dashboard
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Vongries Ultimate Dashboard allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ultimate Dashboard: from n/a through 3.7.10.2024-06-04
Event Espresso--Event Espresso 4 Decaf
 
Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf allows Functionality Misuse.This issue affects Event Espresso 4 Decaf: from n/a through 4.10.44.Decaf.2024-06-03
evmos--evmos
 
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.2024-06-06

Florent Maillefaud--WP Maintenance
 
Authentication Bypass by Spoofing vulnerability in WP Maintenance allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Maintenance: from n/a through 6.1.3.2024-06-04
LWS--LWS Hide Login
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in LWS LWS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LWS Hide Login: from n/a through 2.1.8.2024-06-04
n/a--Likeshop
 
A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin of the component Merchandise Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-267449 was assigned to this vulnerability.2024-06-08


n/a--n/a
 
An issue was discovered in Samsung Mobile Processor, Automotive Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 2200, 1280, 1380, 1330, Modem 5123, Modem 5300, and Auto T5123. The baseband software does not properly check replay protection specified by the NAS (Non-Access-Stratum) module. This can lead to denial of service.2024-06-05
n/a--n/a
 
An issue was discovered in Samsung Mobile Processor, Automotive Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 2200, 1280, 1380, 1330, Modem 5123, Modem 5300, and Auto T5123. The baseband software does not properly check format types specified by the NAS (Non-Access-Stratum) module. This can lead to bypass of authentication.2024-06-05
Webcraftic--Hide login page
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Webcraftic Hide login page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hide login page: from n/a through 1.1.9.2024-06-04
WpDevArt--Booking calendar, Appointment Booking System
 
External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.2024-06-03
wpdevart--Coming soon and Maintenance mode
 
Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.2024-06-04
WPServeur, NicolasKulka, wpformation--WPS Hide Login
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPServeur, NicolasKulka, wpformation WPS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPS Hide Login: from n/a through 1.9.11.2024-06-04

Severity Not Yet Assigned

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource & Patch Info
A10--Thunder ADC
 
A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability. The specific flaw exists within the CsrRequestView class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of a10user. Was ZDI-CAN-22517.2024-06-06not yet calculated

A10--Thunder ADC
 
A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the installer. The issue results from incorrect permissions on a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-22754.2024-06-06not yet calculated

Apache Software Foundation--Apache OFBiz
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.2024-06-04not yet calculated



Arm Ltd--Bifrost GPU Kernel Driver
 
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.2024-06-07not yet calculated
berriai--berriai/litellm
 
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where `os.remove(file.filename)` is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.2024-06-06not yet calculated
berriai--berriai/litellm
 
A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system. This vulnerability requires a valid Google KMS configuration file to be exploitable. Specifically, by setting the `UI_LOGO_PATH` variable to a remote server address in the `get_image` function, an attacker can write a malicious Google KMS configuration file to the `cached_logo.jpg` file. This file can then be used to execute arbitrary code by assigning malicious code to the `SAVE_CONFIG_TO_DB` environment variable, leading to full system control. The vulnerability is contingent upon the use of the Google KMS feature.2024-06-06not yet calculated
berriai--berriai/litellm
 
A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.2024-06-06not yet calculated
berriai--berriai/litellm
 
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated `api_key` parameter directly into the query, making it susceptible to SQL Injection if the `api_key` contains malicious data. This issue affects the latest version of the repository. Successful exploitation of this vulnerability could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS).2024-06-06not yet calculated
Canonical Ltd.--Apport
 
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.2024-06-03not yet calculated


Canonical Ltd.--Apport
 
Apport can be tricked into connecting to arbitrary sockets as the root user2024-06-03not yet calculated

Canonical Ltd.--Apport
 
~/.config/apport/settings parsing is vulnerable to "billion laughs" attack2024-06-04not yet calculated

Canonical Ltd.--Apport
 
is_closing_session() allows users to fill up apport.log2024-06-04not yet calculated

Canonical Ltd.--Apport
 
is_closing_session() allows users to create arbitrary tcp dbus connections2024-06-04not yet calculated

Canonical Ltd.--Apport
 
is_closing_session() allows users to consume RAM in the Apport process2024-06-04not yet calculated

Canonical Ltd.--Apport
 
Apport does not disable python crash handler before entering chroot2024-06-04not yet calculated

Canonical Ltd.--Apport
 
Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing2024-06-04not yet calculated

Canonical Ltd.--subiquity
 
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions2024-06-03not yet calculated



Chromium--libvpx
 
There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond2024-06-03not yet calculated
CodePeople--Music Store - WordPress eCommerce
 
SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Information stored in the database may be obtained or altered by the attacker.2024-06-07not yet calculated


deepjavalibrary--deepjavalibrary/djl
 
A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manipulate file paths within tar archives to overwrite arbitrary files on the target system. Exploitation of this vulnerability could lead to remote code execution, privilege escalation, data theft or manipulation, and denial of service. The vulnerability is due to improper validation of file paths during the extraction of tar files, as demonstrated in multiple occurrences within the library's codebase, including but not limited to the files_util.py and extract_imagenet.py scripts.2024-06-06not yet calculated

EMTA Grup--PDKS
 
Improper Access Control vulnerability in EMTA Grup PDKS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDKS: before 20240603.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-06-03not yet calculated
Fortra--Tripwire Enterprise
 
An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.2024-06-03not yet calculated
gaizhenbiao--gaizhenbiao/chuanhuchatgpt
 
The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the `web_assets` folder. However, the outdated version of gradio it employs is susceptible to path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended restrictions and access sensitive files, such as `config.json`, which contains API keys. The issue affects the latest version of chuanhuchatgpt prior to the fixed version released on 20240305.2024-06-06not yet calculated

gaizhenbiao--gaizhenbiao/chuanhuchatgpt
 
A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model, allowing for the injection and execution of malicious JavaScript code within the context of a user's browser. This vulnerability can lead to the execution of arbitrary JavaScript code in the context of other users' browsers, potentially resulting in the hijacking of victims' browsers.2024-06-06not yet calculated
gaizhenbiao--gaizhenbiao/chuanhuchatgpt
 
In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 20240121, there exists a vulnerability due to improper access control mechanisms. This flaw allows an authenticated attacker to bypass intended access restrictions and read the `history` files of other users, potentially leading to unauthorized access to sensitive information. The vulnerability is present in the application's handling of access control for the `history` path, where no adequate mechanism is in place to prevent an authenticated user from accessing another user's chat history files. This issue poses a significant risk as it could allow attackers to obtain sensitive information from the chat history of other users.2024-06-06not yet calculated
gaizhenbiao--gaizhenbiao/chuanhuchatgpt
 
An improper access control vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically in version 20240410. This vulnerability allows any user on the server to access the chat history of any other user without requiring any form of interaction between the users. Exploitation of this vulnerability could lead to data breaches, including the exposure of sensitive personal details, financial data, or confidential conversations. Additionally, it could facilitate identity theft and manipulation or fraud through the unauthorized access to users' chat histories. This issue is due to insufficient access control mechanisms in the application's handling of chat history data.2024-06-04not yet calculated
gaizhenbiao--gaizhenbiao/chuanhuchatgpt
 
A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is present in version 20240310 of the software, where passwords are compared using the '=' operator in Python. This method of comparison allows an attacker to guess passwords based on the timing of each character's comparison. The issue arises from the code segment that checks a password for a particular username, which can lead to the exposure of sensitive information to an unauthorized actor. An attacker exploiting this vulnerability could potentially guess user passwords, compromising the security of the system.2024-06-06not yet calculated
gaizhenbiao--gaizhenbiao/chuanhuchatgpt
 
gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` endpoint. Specifically, the `handle_file_upload` function does not sanitize or validate the file extension or content type of uploaded files, allowing attackers to upload files with arbitrary extensions, including HTML files containing XSS payloads and Python files. This vulnerability, present in the latest version as of 20240310, could lead to stored XSS attacks and potentially result in remote code execution (RCE) on the server hosting the application.2024-06-06not yet calculated
Go standard library--archive/zip
 
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.2024-06-05not yet calculated



Go standard library--net/netip
 
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.2024-06-05not yet calculated



Google--Omaha
 
Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)2024-06-07not yet calculated
Google--Omaha
 
Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: High)2024-06-07not yet calculated
gradio-app--gradio-app/gradio
 
A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/[email protected]'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.2024-06-04not yet calculated

gradio-app--gradio-app/gradio
 
The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper authorization. The vulnerability arises from the workflow's explicit checkout and execution of code from a fork, which is unsafe as it allows the running of untrusted code in an environment with access to push to the base repository and access secrets. This flaw could lead to the exfiltration of sensitive secrets such as GITHUB_TOKEN, HF_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID, COMMENT_TOKEN, AWSACCESSKEYID, AWSSECRETKEY, and VERCEL_TOKEN. The vulnerability is present in the workflow file located at https://github.com/gradio-app/gradio/blob/72f4ca88ab569aae47941b3fb0609e57f2e13a27/.github/workflows/deploy-website.yml.2024-06-04not yet calculated
gradio-app--gradio-app/gradio
 
A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.2024-06-06not yet calculated
gradio-app--gradio-app/gradio
 
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gradio/components/json_component.py`, where a user-controlled string is parsed as JSON. If the parsed JSON object contains a `path` key, the specified file is moved to a temporary directory, making it possible to retrieve it later via the `/file=..` endpoint. This issue is due to the `processing_utils.move_files_to_cache()` function traversing any object passed to it, looking for a dictionary with a `path` key, and then copying the specified file to a temporary directory. The vulnerability can be exploited by an attacker to read files on the remote system, posing a significant security risk.2024-06-06not yet calculated

GStreamer--GStreamer
 
GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of tile list data within AV1-encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22873.2024-06-07not yet calculated

h2oai--h2oai/h2o-3
 
In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.2024-06-06not yet calculated
imartinez--imartinez/privategpt
 
A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically, by manipulating the 'path' parameter in a file upload request, an attacker can cause the application to make arbitrary requests to internal services, including the AWS metadata endpoint. This issue could lead to the exposure of internal servers and sensitive data.2024-06-06not yet calculated
Japan System Techniques Co., Ltd.--UNIVERSAL PASSPORT RX
 
Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.2024-06-03not yet calculated

Japan System Techniques Co., Ltd.--UNIVERSAL PASSPORT RX
 
Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker with an administrative privilege to execute an arbitrary script on the web browser of the user who is using the product.2024-06-03not yet calculated

Johnson Controls--Software House CCURE 9000
 
Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions2024-06-06not yet calculated

Johnson Controls--Software House iSTAR Pro, ICU
 
Under certain circumstances communications between the ICU tool and an iSTAR Pro door controller is susceptible to Machine-in-the-Middle attacks which could impact door control and configuration.2024-06-06not yet calculated

Kofax--Power PDF
 
Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22092.2024-06-06not yet calculated
Kofax--Power PDF
 
Kofax Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22917.2024-06-06not yet calculated
Kofax--Power PDF
 
Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22918.2024-06-06not yet calculated
Kofax--Power PDF
 
Kofax Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22919.2024-06-06not yet calculated
Kofax--Power PDF
 
Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TGA files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22920.2024-06-06not yet calculated
Kofax--Power PDF
 
Kofax Power PDF PDF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22921.2024-06-06not yet calculated
Kofax--Power PDF
 
Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22930.2024-06-06not yet calculated
Kofax--Power PDF
 
Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects in AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22933.2024-06-06not yet calculated
kubeflow--kubeflow/kubeflow
 
kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption.2024-06-06not yet calculated
langchain-ai--langchain-ai/langchain
 
A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.2024-06-06not yet calculated
langchain-ai--langchain-ai/langchain
 
A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This flaw enables attackers to execute port scans, access local services, and in some scenarios, read instance metadata from cloud environments. The vulnerability is particularly concerning as it can be exploited to abuse the Web Explorer server as a proxy for web attacks on third parties and interact with servers in the local network, including reading their response data. This could potentially lead to arbitrary code execution, depending on the nature of the local services. The vulnerability is limited to GET requests, as POST requests are not possible, but the impact on confidentiality, integrity, and availability is significant due to the potential for stolen credentials and state-changing interactions with internal APIs.2024-06-06not yet calculated
libaom--libaom
 
Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.2024-06-05not yet calculated
lightning-ai--lightning-ai/pytorch-lightning
 
A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Delta` objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default.2024-06-06not yet calculated
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drm_event to the size of the structure that's actually used. The length of the drm_event was set to the parent structure instead of to the drm_vmw_event_fence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.2024-06-03not yet calculated







Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Fix two locking issues with thermal zone debug With the current thermal zone locking arrangement in the debugfs code, user space can open the "mitigations" file for a thermal zone before the zone's debugfs pointer is set which will result in a NULL pointer dereference in tze_seq_start(). Moreover, thermal_debug_tz_remove() is not called under the thermal zone lock, so it can run in parallel with the other functions accessing the thermal zone's struct thermal_debugfs object. Then, it may clear tz->debugfs after one of those functions has checked it and the struct thermal_debugfs object may be freed prematurely. To address the first problem, pass a pointer to the thermal zone's struct thermal_debugfs object to debugfs_create_file() in thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(), tze_seq_stop(), and tze_seq_show() retrieve it from s->private instead of a pointer to the thermal zone object. This will ensure that tz_debugfs will be valid across the "mitigations" file accesses until thermal_debugfs_remove_id() called by thermal_debug_tz_remove() removes that file. To address the second problem, use tz->lock in thermal_debug_tz_remove() around the tz->debugfs value check (in case the same thermal zone is removed at the same time in two different threads) and its reset to NULL. Cc :6.8+ <[email protected]> # 6.8+2024-06-03not yet calculated

Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs Currently the driver uses local_bh_disable()/local_bh_enable() in its IRQ handler to avoid triggering net_rx_action() softirq on exit from netif_rx(). The net_rx_action() could trigger this driver .start_xmit callback, which is protected by the same lock as the IRQ handler, so calling the .start_xmit from netif_rx() from the IRQ handler critical section protected by the lock could lead to an attempt to claim the already claimed lock, and a hang. The local_bh_disable()/local_bh_enable() approach works only in case the IRQ handler is protected by a spinlock, but does not work if the IRQ handler is protected by mutex, i.e. this works for KS8851 with Parallel bus interface, but not for KS8851 with SPI bus interface. Remove the BH manipulation and instead of calling netif_rx() inside the IRQ handler code protected by the lock, queue all the received SKBs in the IRQ handler into a queue first, and once the IRQ handler exits the critical section protected by the lock, dequeue all the queued SKBs and push them all into netif_rx(). At this point, it is safe to trigger the net_rx_action() softirq, since the netif_rx() call is outside of the lock that protects the IRQ handler.2024-06-03not yet calculated



Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they default to the root inode's permission if they were never set by the user. If the user sets the permissions, then a flag is set and the permissions are saved via the inode (for tracefs files) or an internal attribute field (for eventfs). But if a remount happens that specify the permissions, all the files that were not changed by the user gets updated, but the ones that were are not. If the user were to remount the file system with a given permission, then all files and directories within that file system should be updated. This can cause security issues if a file's permission was updated but the admin forgot about it. They could incorrectly think that remounting with permissions set would update all files, but miss some. For example: # cd /sys/kernel/tracing # chgrp 1002 current_tracer # ls -l [..] -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer -rw-r----- 1 root root 0 May 1 21:25 dynamic_events -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info -r--r----- 1 root root 0 May 1 21:25 enabled_functions Where current_tracer now has group "lkp". # mount -o remount,gid=1001 . # ls -l -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions Everything changed but the "current_tracer". Add a new link list that keeps track of all the tracefs_inodes which has the permission flags that tell if the file/dir should use the root inode's permission or not. Then on remount, clear all the flags so that the default behavior of using the root inode's permission is done for all files and directories.2024-06-03not yet calculated


Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: fs/9p: only translate RWX permissions for plain 9P2000 Garbage in plain 9P2000's perm bits is allowed through, which causes it to be able to set (among others) the suid bit. This was presumably not the intent since the unix extended bits are handled explicitly and conditionally on .u.2024-06-03not yet calculated







Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM The IPI buffer location is read from the firmware that we load to the System Companion Processor, and it's not granted that both the SRAM (L2TCM) size that is defined in the devicetree node is large enough for that, and while this is especially true for multi-core SCP, it's still useful to check on single-core variants as well. Failing to perform this check may make this driver perform R/W operations out of the L2TCM boundary, resulting (at best) in a kernel panic. To fix that, check that the IPI buffer fits, otherwise return a failure and refuse to boot the relevant SCP core (or the SCP at all, if this is single core).2024-06-08not yet calculated





Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: erofs: reliably distinguish block based and fscache mode When erofs_kill_sb() is called in block dev based mode, s_bdev may not have been initialised yet, and if CONFIG_EROFS_FS_ONDEMAND is enabled, it will be mistaken for fscache mode, and then attempt to free an anon_dev that has never been allocated, triggering the following warning: ============================================ ida_free called for id=0 which is not allocated. WARNING: CPU: 14 PID: 926 at lib/idr.c:525 ida_free+0x134/0x140 Modules linked in: CPU: 14 PID: 926 Comm: mount Not tainted 6.9.0-rc3-dirty #630 RIP: 0010:ida_free+0x134/0x140 Call Trace: <TASK> erofs_kill_sb+0x81/0x90 deactivate_locked_super+0x35/0x80 get_tree_bdev+0x136/0x1e0 vfs_get_tree+0x2c/0xf0 do_new_mount+0x190/0x2f0 [...] ============================================ Now when erofs_kill_sb() is called, erofs_sb_info must have been initialised, so use sbi->fsid to distinguish between the two modes.2024-06-08not yet calculated


Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2_key_encode() 'scratch' is never freed. Fix this by calling kfree() in the success, and in the error case.2024-06-08not yet calculated





Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---2024-06-08not yet calculated



Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix division by zero in setup_dsc_config When slice_height is 0, the division by slice_height in the calculation of the number of slices will cause a division by zero driver crash. This leaves the kernel in a state that requires a reboot. This patch adds a check to avoid the division by zero. The stack trace below is for the 6.8.4 Kernel. I reproduced the issue on a Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor connected via Thunderbolt. The amdgpu driver crashed with this exception when I rebooted the system with the monitor connected. kernel: ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447) kernel: ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? exc_divide_error (arch/x86/kernel/traps.c:194 (discriminator 2)) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? asm_exc_divide_error (./arch/x86/include/asm/idtentry.h:548) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: dc_dsc_compute_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1109) amdgpu After applying this patch, the driver no longer crashes when the monitor is connected and the system is rebooted. I believe this is the same issue reported for 3113.2024-06-08not yet calculated





Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Use request_module_nowait This appears to work around a deadlock regression that came in with the LED merge in 6.9. The deadlock happens on my system with 24 iwlwifi radios, so maybe it something like all worker threads are busy and some work that needs to complete cannot complete. [also remove unnecessary "load_module" var and now-wrong comment]2024-06-08not yet calculated

lunary-ai--lunary-ai/lunary
 
An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.2024-06-06not yet calculated

lunary-ai--lunary-ai/lunary
 
In lunary-ai/lunary version v1.2.13, an improper authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information.2024-06-08not yet calculated

lunary-ai--lunary-ai/lunary
 
An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts. Affected versions include 1.2.2 up to but not including 1.2.25. The vulnerability allows unauthorized users to update prompt details due to insufficient access control checks. This issue was addressed and fixed in version 1.2.25.2024-06-06not yet calculated

lunary-ai--lunary-ai/lunary
 
In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.2024-06-06not yet calculated

lunary-ai--lunary-ai/lunary
 
An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability allows unauthorized users to view, update, or delete any dataset_prompt or dataset_prompt_variation within any dataset or project. The issue stems from improper access control checks in the dataset management endpoints, where direct references to object IDs are not adequately secured against unauthorized access. This vulnerability was fixed in version 1.2.25.2024-06-06not yet calculated

lunary-ai--lunary-ai/lunary
 
A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.2024-06-06not yet calculated

lunary-ai--lunary-ai/lunary
 
An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.2024-06-06not yet calculated

lunary-ai--lunary-ai/lunary
 
An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequately verify the ownership of the prompt ID. This issue was fixed in version 1.2.25.2024-06-06not yet calculated

lunary-ai--lunary-ai/lunary
 
In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the `GET /v1/users/me/org` endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the `recovery_token` attribute in the users object returned by the API.2024-06-06not yet calculated
lunary-ai--lunary-ai/lunary
 
In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission check in the `GET /v1/users/me/org` endpoint. The platform's role definitions restrict the `Prompt Editor` role to prompt management and project viewing/listing capabilities, explicitly excluding access to user information. However, the endpoint fails to enforce this restriction, allowing users with the `Prompt Editor` role to access the full list of users in the organization. This vulnerability allows unauthorized access to sensitive user information, violating the intended access controls.2024-06-06not yet calculated
lunary-ai--lunary-ai/lunary
 
In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the backend's handling of the reset password process, where the token, once used, is not discarded or invalidated, enabling its reuse. This vulnerability could lead to unauthorized account access if an attacker obtains the recovery token.2024-06-06not yet calculated
lunary-ai--lunary-ai/lunary
 
A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint '/auth/saml/tto/download-idp-xml'. The vulnerability arises due to the application's failure to validate user-supplied URLs before using them in server-side requests. An attacker can exploit this vulnerability by sending a specially crafted request to the affected endpoint, allowing them to make unauthorized requests to internal or external resources. This could lead to the disclosure of sensitive information, service disruption, or further attacks against the network infrastructure. The issue affects the latest version of the application as of the report.2024-06-06not yet calculated
lunary-ai--lunary-ai/lunary
 
A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint `/auth/saml/${org?.id}/metadata` of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the `orgId` parameter supplied by the user before incorporating it into the generated response. Specifically, the endpoint generates XML responses for SAML metadata, where the `orgId` parameter is directly embedded into the XML structure without proper sanitization or validation. This flaw allows an attacker to inject arbitrary JavaScript code into the generated SAML metadata page, leading to potential theft of user cookies or authentication tokens.2024-06-06not yet calculated
Luxion--KeyShot Viewer
 
Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22449.2024-06-06not yet calculated
Luxion--KeyShot Viewer
 
Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22515.2024-06-06not yet calculated
Luxion--KeyShot Viewer
 
Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22514.2024-06-06not yet calculated

Luxion--KeyShot Viewer
 
Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22266.2024-06-06not yet calculated

Luxion--KeyShot Viewer
 
Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22267.2024-06-06not yet calculated

Luxion--KeyShot
 
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22738.2024-06-06not yet calculated

man-group--man-group/dtale
 
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.2024-06-06not yet calculated
MediaTek, Inc.--MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6878, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6990, MT8673, MT8675, MT8765, MT8766, MT8768, MT8771, MT8786, MT8791T, MT8792, MT8797, MT8798
 
In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to remote information disclosure, when weak encryption algorithm is used, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00942482; Issue ID: MSV-1469.2024-06-03not yet calculated
MediaTek, Inc.--MT6298, MT6813, MT6815, MT6835, MT6878, MT6879, MT6895, MT6895T, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6986, MT6986D, MT6990, MT6991, MT8673, MT8675, MT8771, MT8791T, MT8792, MT8797, MT8798
 
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is no needed for exploitation. Patch ID: MOLY01270721; Issue ID: MSV-1479.2024-06-03not yet calculated
MediaTek, Inc.--MT6298, MT6813, MT6815, MT6835, MT6878, MT6879, MT6895, MT6895T, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6986, MT6986D, MT6990, MT6991, MT8673, MT8792, MT8798
 
In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is no needed for exploitation. Patch ID: MOLY01267281; Issue ID: MSV-1477.2024-06-03not yet calculated
MediaTek, Inc.--MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6983, MT6985, MT6989, MT8666, MT8667, MT8673, MT8676
 
In dmc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08668110; Issue ID: MSV-1333.2024-06-03not yet calculated
MediaTek, Inc.--MT6768, MT6781, MT6835, MT6853, MT6855, MT6877, MT6879, MT6885, MT6886, MT6893, MT6983, MT6985, MT6989
 
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08698617; Issue ID: MSV-1394.2024-06-03not yet calculated
MediaTek, Inc.--MT6813, MT6815, MT6835, MT6878, MT6897, MT6899, MT6986, MT6986D, MT6991, MT8792
 
In modem, there is a possible out of bounds write due to improper input invalidation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01267285; Issue ID: MSV-1462.2024-06-03not yet calculated
MediaTek, Inc.--MT6833, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8675, MT8771, MT8791T, MT8797
 
In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01286330; Issue ID: MSV-1430.2024-06-03not yet calculated
MediaTek, Inc.--MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8185, MT8675, MT8786, MT8789
 
In eemgpu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08713302; Issue ID: MSV-1393.2024-06-03not yet calculated
MediaTek, Inc.--MT6890, MT6990, MT7622
 
In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00364733; Issue ID: MSV-1331.2024-06-03not yet calculated
MediaTek, Inc.--MT6890, MT6990, MT7622
 
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00364732; Issue ID: MSV-1332.2024-06-03not yet calculated
MediaTek, Inc.--MT6890, MT7622
 
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00367704; Issue ID: MSV-1411.2024-06-03not yet calculated
mintplex-labs--mintplex-labs/anything-llm
 
An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specific namespaces, without requiring any authorization or permissions. The issue affects all versions up to and including the latest version, with a fix introduced in version 1.0.0. Exploitation of this vulnerability can lead to complete data loss of document embeddings across all workspaces, rendering workspace chats and embeddable chat widgets non-functional. Additionally, attackers can list all namespaces, potentially exposing private workspace names.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at the `/api/request-token` endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks without prior knowledge of the username. Once the password is known, attackers can conduct blind attacks to ascertain the full username, significantly compromising system security.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the `POST /api/system/update-env` endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them into the application UI as external links with custom icons. Specifically, the application does not prevent the inclusion of 'javascript:' protocol payloads in URLs, which can be exploited by a user with manager role to execute arbitrary JavaScript code in the context of another user's session. This flaw can be leveraged to steal the admin's authorization token by crafting malicious URLs that, when clicked by the admin, send the token to an attacker-controlled server. The attacker can then use this token to perform unauthorized actions, escalate privileges to admin, or directly take over the admin account. The vulnerability is triggered when the malicious link is opened in a new tab using either the CTRL + left mouse button click or the mouse scroll wheel click, or in some non-updated versions of modern browsers, by directly clicking on the link.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by hosting a malicious website and using it to perform actions such as internal port scanning, accessing internal web applications not exposed externally, and interacting with the Collector API. This interaction can lead to unauthorized actions such as arbitrary file deletion and limited Local File Inclusion (LFI), including accessing NGINX access logs which may contain sensitive information.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint `/workspace/:slug/thread/:threadSlug/update`. Specifically, the application fails to validate or check user input before passing it to the `workspace_thread` Prisma model for execution. This oversight allows attackers to craft a Prisma relation query operation that manipulates the `users` model to change a user's role to admin. Successful exploitation grants attackers the highest level of user privileges, enabling them to see and perform all actions within the system.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilities are present in the `/request-token`, `/workspace/:slug/thread/:threadSlug/update`, `/system/remove-logo`, `/system/logo`, and collector's `/process` endpoints. These issues are due to the application's failure to properly validate user input before passing it to `prisma` functions and other critical operations. Affected versions include the latest version prior to 1.0.0.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS) condition. Specifically, the server can be shut down by sending an invalid upload request. An attacker with the ability to upload documents can exploit this vulnerability to cause a DOS condition by manipulating the upload request.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.2024-06-06not yet calculated

mintplex-labs--mintplex-labs/anything-llm
 
A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intended to restrict access to intranet IP addresses and protocols. Despite efforts to filter out intranet IP addresses starting with 192, 172, 10, and 127 through regular expressions and limit access protocols to HTTP and HTTPS, attackers can still bypass these restrictions using alternative representations of IP addresses and accessing other ports running on localhost. This vulnerability enables attackers to access any asset on the internal network, attack web services on the internal network, scan hosts on the internal network, and potentially access AWS metadata endpoints. The vulnerability is due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.2024-06-05not yet calculated
mlflow--mlflow/mlflow
 
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a dataset from a source URL with an HTTP scheme, the filename extracted from the `Content-Disposition` header or the URL path is used to generate the final file path without proper sanitization. This flaw enables an attacker to control the file path fully by utilizing path traversal or absolute path techniques, such as '../../tmp/poc.txt' or '/tmp/poc.txt', leading to arbitrary file write. Exploiting this vulnerability could allow a malicious user to execute commands on the vulnerable machine, potentially gaining access to data and model information. The issue is fixed in version 2.9.0.2024-06-06not yet calculated

mlflow--mlflow/mlflow
 
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.2024-06-06not yet calculated

mlflow--mlflow/mlflow
 
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.2024-06-06not yet calculated
n/a--n/a
 
Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service menu, because there is a hard-coded service code.2024-06-07not yet calculated
n/a--n/a
 
Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to gain root privileges.2024-06-07not yet calculated
n/a--n/a
 
Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd. An attacker could exploit this to extract files and obtain sensitive information.2024-06-07not yet calculated
n/a--n/a
 
Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. A remote attacker could use this key to gain root privileges.2024-06-07not yet calculated
n/a--n/a
 
dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.2024-06-06not yet calculated

n/a--n/a
 
An issue was discovered in Samsung Mobile Processor, Automotive Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. The baseband software does not properly check states specified by the RRC. This can lead to disclosure of sensitive information.2024-06-05not yet calculated
n/a--n/a
 
A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controller JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access token could be used to takeover another user's account and read her/his chat messages.2024-06-03not yet calculated
n/a--n/a
 
An issue in obgm and Libcoap v.a3ed466 allows a remote attacker to cause a denial of service via thecoap_context_t function in the src/coap_threadsafe.c:297:3 component.2024-06-06not yet calculated
n/a--n/a
 
Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 221019) is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code. Exploiting the vulnerability requires authentication.2024-06-03not yet calculated
n/a--n/a
 
Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 through 1.4.1230, and 1.0.516 through 1.3.0115 has Incorrect Access Control. This is fixed in 1.8.2014, 1.7.4212, 1.6.3212, 1.5.31212, 1.4.3212, and 1.3.3212.2024-06-06not yet calculated
n/a--n/a
 
dnspod-sr 0dfbd37 is vulnerable to buffer overflow.2024-06-06not yet calculated
n/a--n/a
 
dnspod-sr 0dfbd37 contains a SEGV.2024-06-06not yet calculated
n/a--n/a
 
robdns commit d76d2e6 was discovered to contain a heap overflow via the component block->filename at /src/zonefile-insertion.c.2024-06-06not yet calculated
n/a--n/a
 
robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c.2024-06-06not yet calculated
n/a--n/a
 
robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c.2024-06-06not yet calculated
n/a--n/a
 
smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c.2024-06-06not yet calculated
n/a--n/a
 
smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c.2024-06-06not yet calculated
n/a--n/a
 
Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbar_manage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.2024-06-07not yet calculated

n/a--n/a
 
Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries. This can be exploited by unauthenticated attackers to carry out Blind SQL Injection attacks.2024-06-07not yet calculated

n/a--n/a
 
Incorrect access control in the fingerprint authentication mechanism of Phone Cleaner: Boost & Clean v2.2.0 allows attackers to bypass fingerprint authentication due to the use of a deprecated API.2024-06-03not yet calculated
n/a--n/a
 
Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass fingerprint authentication due to the use of a deprecated API.2024-06-03not yet calculated

n/a--n/a
 
The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the "DNSBomb" issue.2024-06-06not yet calculated









n/a--n/a
 
A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.2024-06-03not yet calculated
n/a--n/a
 
Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.2024-06-05not yet calculated


n/a--n/a
 
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node parameters.2024-06-06not yet calculated
n/a--n/a
 
A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process.2024-06-03not yet calculated
n/a--n/a
 
Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access.2024-06-03not yet calculated


n/a--n/a
 
Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=.2024-06-03not yet calculated
n/a--n/a
 
Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php.2024-06-03not yet calculated
n/a--n/a
 
Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers to execute arbitrary commands with root privileges.2024-06-04not yet calculated
n/a--n/a
 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType_deal.php?mudi=add&nohrefStr=close2024-06-05not yet calculated
n/a--n/a
 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=del2024-06-05not yet calculated
n/a--n/a
 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add.2024-06-05not yet calculated
n/a--n/a
 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del2024-06-05not yet calculated
n/a--n/a
 
Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries.2024-06-07not yet calculated
n/a--n/a
 
LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.2024-06-03not yet calculated
n/a--n/a
 
LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.2024-06-04not yet calculated
n/a--n/a
 
TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action vlan_setting with a sufficiently long dns1 or dns 2 key.2024-06-03not yet calculated
n/a--n/a
 
TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wizard_ipv6 with a sufficiently long reboot_type key.2024-06-03not yet calculated
n/a--n/a
 
Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting negative values into the oneflow.zeros/ones parameter.2024-06-06not yet calculated
n/a--n/a
 
An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.tensordot.2024-06-06not yet calculated
n/a--n/a
 
Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the dim parameter.2024-06-06not yet calculated
n/a--n/a
 
OneFlow-Inc. Oneflow v0.9.1 does not display an error or warning when the oneflow.eye parameter is floating.2024-06-06not yet calculated
n/a--n/a
 
An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same dimension operation is performed.2024-06-06not yet calculated
n/a--n/a
 
Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the oneflow.full parameter.2024-06-06not yet calculated
n/a--n/a
 
An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index as a negative number exceeds the range of size.2024-06-06not yet calculated
n/a--n/a
 
An issue in the oneflow.scatter_nd parameter OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index parameter exceeds the range of shape.2024-06-06not yet calculated
n/a--n/a
 
An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.dot.2024-06-06not yet calculated
n/a--n/a
 
An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the oneflow.index_select parameter.2024-06-06not yet calculated
n/a--n/a
 
A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php.2024-06-07not yet calculated
n/a--n/a
 
An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.2024-06-06not yet calculated
n/a--n/a
 
A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page.2024-06-06not yet calculated
n/a--n/a
 
Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php.2024-06-06not yet calculated
n/a--n/a
 
TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.2024-06-03not yet calculated
n/a--n/a
 
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function.2024-06-03not yet calculated
n/a--n/a
 
An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface via unspecified vectors.2024-06-07not yet calculated
n/a--n/a
 
Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensitive communications between the router and connected devices.2024-06-07not yet calculated
n/a--n/a
 
An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to defined security standards.2024-06-07not yet calculated
n/a--n/a
 
Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.2024-06-07not yet calculated
n/a--n/a
 
An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's pin.2024-06-07not yet calculated
n/a--n/a
 
Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to access URLs and directories embedded within the firmware via unspecified vectors.2024-06-06not yet calculated
n/a--n/a
 
A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php.2024-06-04not yet calculated
n/a--n/a
 
A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.php.2024-06-04not yet calculated
n/a--n/a
 
An arbitrary file upload vulnerability in the image upload function of aimeos-core v2024.04 allows attackers to execute arbitrary code via uploading a crafted PHP file.2024-06-07not yet calculated




n/a--n/a
 
The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.2024-06-06not yet calculated
n/a--n/a
 
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.2024-06-07not yet calculated
n/a--n/a
 
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.2024-06-05not yet calculated
n/a--n/a
 
Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.2024-06-04not yet calculated
n/a--n/a
 
An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.2024-06-04not yet calculated
n/a--n/a
 
Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication.2024-06-03not yet calculated

n/a--n/a
 
The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.2024-06-03not yet calculated


n/a--n/a
 
An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.2024-06-04not yet calculated
n/a--n/a
 
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.2024-06-07not yet calculated


n/a--n/a
 
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.2024-06-07not yet calculated


n/a--n/a
 
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.2024-06-07not yet calculated


n/a--n/a
 
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.2024-06-07not yet calculated
n/a--n/a
 
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.2024-06-08not yet calculated


n/a--n/a
 
fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo.2024-06-08not yet calculated


NETGEAR--ProSAFE Network Management System
 
NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the UpLoadServlet class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22724.2024-06-06not yet calculated
onnx--onnx/onnx
 
A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file.2024-06-06not yet calculated
parisneo--parisneo/lollms-webui
 
parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult.2024-06-06not yet calculated
parisneo--parisneo/lollms-webui
 
A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without their consent, potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exploited to perform a stored cross-site scripting (XSS) attack, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 9.3.2024-06-06not yet calculated

parisneo--parisneo/lollms-webui
 
A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises from the application's handling of the `/execute_code` endpoint, which is intended to be blocked from external access by default. However, attackers can exploit the `/update_setting` endpoint, which lacks proper access control, to modify the `host` configuration at runtime. By changing the `host` setting to an attacker-controlled value, the restriction on the `/execute_code` endpoint can be bypassed, leading to remote code execution. This vulnerability is due to improper neutralization of special elements used in an OS command (`Improper Neutralization of Special Elements used in an OS Command`).2024-06-06not yet calculated
parisneo--parisneo/lollms-webui
 
parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute arbitrary code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the application's handling of the 'discussion_db_name' and 'pdf_latex_path' parameters, which do not properly validate file paths, allowing for directory traversal. This vulnerability can also lead to further file exposure and other attack vectors by manipulating the 'discussion_db_name' parameter.2024-06-06not yet calculated
parisneo--parisneo/lollms-webui
 
A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of adequate sanitization of user-supplied input in the 'del_preset' endpoint, where the application fails to prevent the use of absolute paths or directory traversal sequences ('..'). As a result, an attacker can send a specially crafted request to the 'del_preset' endpoint to delete files outside of the intended directory.2024-06-06not yet calculated
parisneo--parisneo/lollms-webui
 
A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_files_server.py` and `lollms_core/lollms/security.py` files. Due to inadequate validation of file paths between Windows and Linux environments using `Path(path).is_absolute()`, attackers can exploit this flaw to read any file on the system. This issue affects the latest version of LoLLMs running on the Windows platform. The vulnerability is triggered when an attacker sends a specially crafted request to the `/user_infos/{path:path}` endpoint, allowing the reading of arbitrary files, as demonstrated with the `win.ini` file. The issue has been addressed in version 9.5 of the software.2024-06-06not yet calculated

parisneo--parisneo/lollms-webui
 
A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_personal_path")` endpoint in `./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py`. The vulnerability arises due to insufficient sanitization of user-supplied input for the `path` parameter, allowing an attacker to specify arbitrary file system paths. This flaw enables direct arbitrary file uploads, leakage of `personal_data`, and overwriting of configurations in `lollms-webui`->`configs` by exploiting the same named directory in `personal_data`. The issue affects the latest version of the application and is fixed in version 9.4. Successful exploitation could lead to sensitive information disclosure, unauthorized file uploads, and potentially remote code execution by overwriting critical configuration files.2024-06-06not yet calculated

parisneo--parisneo/lollms-webui
 
A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vulnerability arises from the improper limitation of a pathname to a restricted directory in the 'process_folder' function within 'lollms-webui/zoos/personalities_zoo/cyber_security/codeguard/scripts/processor.py'. Specifically, the function fails to properly sanitize user-supplied input for the 'code_folder_path', allowing an attacker to specify arbitrary paths using '../' or absolute paths. This flaw leads to arbitrary file read and overwrite capabilities in specified directories without limitations, posing a significant risk of sensitive information disclosure and unauthorized file manipulation.2024-06-06not yet calculated

parisneo--parisneo/lollms-webui
 
A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.2024-06-06not yet calculated
parisneo--parisneo/lollms-webui
 
A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_webpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs, including those that target internal resources such as 'localhost' or '127.0.0.1'. This flaw enables attackers to make unauthorized requests to internal or external systems, potentially leading to access to sensitive data, service disruption, network integrity compromise, business logic manipulation, and abuse of third-party resources. The issue is critical and requires immediate attention to maintain the application's security and integrity.2024-06-06not yet calculated
parisneo--parisneo/lollms
 
A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6.2024-06-06not yet calculated

parisneo--parisneo/lollms
 
A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse beyond the intended directory and read any file on the Windows system. Specifically, the application fails to adequately sanitize file paths containing backslashes (`\`), which can be exploited to access the root directory and read, or even delete, sensitive files. This issue was discovered in the context of the `/user_infos` endpoint, where a crafted request using backslashes to reference a file (e.g., `\windows\win.ini`) could result in unauthorized file access. The impact of this vulnerability includes the potential for attackers to access sensitive information such as environment variables, database files, and configuration files, which could lead to further compromise of the system.2024-06-06not yet calculated

ProjectDiscovery--Interactsh
 
Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymous login.2024-06-05not yet calculated

pytorch--pytorch/pytorch
 
A vulnerability in the PyTorch's torch.distributed.rpc framework, specifically in versions prior to 2.2.2, allows for remote code execution (RCE). The framework, which is used in distributed training scenarios, does not properly verify the functions being called during RPC (Remote Procedure Call) operations. This oversight permits attackers to execute arbitrary commands by leveraging built-in Python functions such as eval during multi-cpu RPC communication. The vulnerability arises from the lack of restriction on function calls when a worker node serializes and sends a PythonUDF (User Defined Function) to the master node, which then deserializes and executes the function without validation. This flaw can be exploited to compromise master nodes initiating distributed training, potentially leading to the theft of sensitive AI-related data.2024-06-06not yet calculated
qdrant--qdrant/qdrant
 
qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This vulnerability allows for the reading and writing of arbitrary files on the server, which could potentially lead to a full takeover of the system. The issue is fixed in version v1.9.0.2024-06-03not yet calculated

scikit-learn--scikit-learn/scikit-learn
 
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.2024-06-06not yet calculated

SEH Computertechnik--utnserver Pro
 
Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS)..This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.2024-06-04not yet calculated
SEH Computertechnik--utnserver Pro
 
Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command injection.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.2024-06-04not yet calculated
SEH Computertechnik--utnserver Pro
 
An uncontrolled resource consumption of file descriptors in SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 allows DoS via HTTP.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.2024-06-04not yet calculated
significant-gravitas--significant-gravitas/autogpt
 
A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.2024-06-06not yet calculated

significant-gravitas--significant-gravitas/autogpt
 
An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability arises from the improper neutralization of special elements used in an OS command within the `_speech` method of the MacOSTTS class. Specifically, the use of `os.system` to execute the `say` command with user-supplied text allows for arbitrary code execution if an attacker can inject shell commands. This issue is triggered when the AutoGPT instance is run with the `--speak` option enabled and configured with `TEXT_TO_SPEECH_PROVIDER=macos`, reflecting back a shell injection snippet. The impact of this vulnerability is the potential execution of arbitrary code on the instance running AutoGPT. The issue was addressed in version 5.1.0.2024-06-06not yet calculated

significant-gravitas--significant-gravitas/autogpt
 
AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command ('OS Command Injection') due to a flaw in its shell command validation function. Specifically, the vulnerability exists in versions v0.5.0 up to but not including 5.1.0. The issue arises from the application's method of validating shell commands against an allowlist or denylist, where it only checks the first word of the command. This allows an attacker to bypass the intended restrictions by crafting commands that are executed despite not being on the allowlist or by including malicious commands not present in the denylist. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary shell commands.2024-06-06not yet calculated

Sonos--Era 100
 
Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SMB2 messages. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before reading from memory. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-22336.2024-06-06not yet calculated
Sonos--Era 100
 
Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SMB2 messages. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22384.2024-06-06not yet calculated
Sonos--Era 100
 
Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SMB2 messages. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-22428.2024-06-06not yet calculated
Sonos--Era 100
 
Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SMB2 messages. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22459.2024-06-06not yet calculated
stangirard--stangirard/quivr
 
A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal networks. The vulnerability is present in the crawl endpoint where the 'url' parameter can be manipulated to send HTTP requests to arbitrary URLs, thereby facilitating SSRF attacks. The affected code is located in the backend/routes/crawl_routes.py file, specifically within the crawl_endpoint function. This issue could allow attackers to interact with internal services that are accessible from the server hosting the application.2024-06-06not yet calculated
Unknown--ARForms - Premium WordPress Form Builder Plugin
 
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form2024-06-07not yet calculated
Unknown--ARForms - Premium WordPress Form Builder Plugin
 
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)2024-06-07not yet calculated
Unknown--buddyboss-platform
 
The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included in the request2024-06-04not yet calculated
Unknown--buddyboss-platform
 
The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request2024-06-05not yet calculated
Unknown--FS Product Inquiry
 
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users2024-06-04not yet calculated
Unknown--FS Product Inquiry
 
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks2024-06-04not yet calculated
Unknown--Gutenberg Blocks with AI by Kadence WP 
 
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks2024-06-04not yet calculated
Unknown--Insert or Embed Articulate Content into WordPress
 
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files2024-06-04not yet calculated
Unknown--Logo Slider 
 
The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks2024-06-07not yet calculated
Unknown--Simple Ajax Chat 
 
The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)2024-06-04not yet calculated
Unknown--The Events Calendar
 
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.2024-06-04not yet calculated
Unknown--WP Backpack
 
The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)2024-06-07not yet calculated
Unknown--WP Stacker
 
The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack2024-06-07not yet calculated
Unknown--wp-eMember
 
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.2024-06-04not yet calculated
zenml-io--zenml-io/zenml
 
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.2024-06-06not yet calculated

zenml-io--zenml-io/zenml
 
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.2024-06-06not yet calculated

zenml-io--zenml-io/zenml
 
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.2024-06-06not yet calculated

zenml-io--zenml-io/zenml
 
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.2024-06-06not yet calculated

zenml-io--zenml-io/zenml
 
A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. The issue was addressed in version 0.56.3.2024-06-06not yet calculated

zenml-io--zenml-io/zenml
 
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.2024-06-08not yet calculated

Please share your thoughts

We recently updated our anonymous product survey ; we’d welcome your feedback.

  • Stack Overflow Public questions & answers
  • Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
  • Talent Build your employer brand
  • Advertising Reach developers & technologists worldwide
  • Labs The future of collective knowledge sharing
  • About the company

Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Get early access and see previews of new features.

Scalar vs List Assignment Operator

Please help me understand the following snippets:

  • my $count = @array;
  • my @copy = @array;
  • my ($first) = @array;
  • (my $copy = $str) =~ s/\\/\\\\/g;
  • my ($x) = f() or die;
  • my $count = () = f();
  • print($x = $y);
  • print(@x = @y);
  • assignment-operator

ikegami's user avatar

  • could you add an explicit question? there isn't one –  ysth Feb 7, 2019 at 1:39
  • my ($first) = @array –  mob Feb 7, 2019 at 4:17
  • @ysth, Technically, there are 8 questions. But feel free to rewrite. –  ikegami Feb 7, 2019 at 4:27
  • @mob, Of course! Added –  ikegami Feb 7, 2019 at 4:44

[ This answer is also found in table format here . ]

The symbol = is compiled into one of two assignment operators:

  • A list assignment operator ( aassign ) is used if the left-hand side (LHS) of a = is some kind of aggregate.
  • A scalar assignment operator ( sassign ) is used otherwise.

The following are considered to be aggregates:

  • Any expression in parentheses (e.g. (...) )
  • An array (e.g. @array )
  • An array slice (e.g. @array[...] )
  • A hash (e.g. %hash )
  • A hash slice (e.g. @hash{...} )
  • Any of the above preceded by my , our or local

There are two differences between the operators.

Context of Operands

The two operators differ in the context in which their operands are evaluated.

The scalar assignment evaluates both of its operands in scalar context.

The list assignment evaluates both of its operands in list context.

Value(s) Returned

The two operators differ in what they return.

The scalar assignment ...

... in scalar context evaluates to its LHS as an lvalue.

... in list context evaluates to its LHS as an lvalue.

The list assignment ...

... in scalar context evaluates to the number of scalars returned by its RHS.

... in list context evaluates to the scalars returned by its LHS as lvalues.

  • change to say just array or hash or array or hash slice, to be inclusive of the postderef syntax –  ysth Feb 7, 2019 at 1:37
  • @ysth, Ah yes, those didn't exists when this was originally written –  ikegami Feb 7, 2019 at 4:30

Your Answer

Reminder: Answers generated by artificial intelligence tools are not allowed on Stack Overflow. Learn more

Sign up or log in

Post as a guest.

Required, but never shown

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy .

Not the answer you're looking for? Browse other questions tagged perl assignment-operator or ask your own question .

  • Featured on Meta
  • The 2024 Developer Survey Is Live
  • The return of Staging Ground to Stack Overflow
  • The [tax] tag is being burninated
  • Policy: Generative AI (e.g., ChatGPT) is banned

Hot Network Questions

  • Why does Mars have a jagged light curve?
  • Finding the volume of a weird figure
  • Does it make sense for giants to use clubs or swords when fighting non-giants?
  • TikZ - how to draw ticks on circle perpendicularly with ellipses around?
  • Has there ever been arms supply with restrictions attached prior to the current war in Ukraine?
  • Latex: Want to Use marathi font and English font
  • Why are ETFs so bad at tracking Japanese indices?
  • Structure that holds the twin-engine on an aircraft
  • Geometry Nodes - Fill Quadrilaterals That Intersect
  • Thought experiment regarding gravity
  • Can you cite parts of a case if the core issues in the case were later overruled?
  • Are there statements so self-evident that writing a proof for them is meaningless? Is this an example of one?
  • Do reflective warning triangles blow away in wind storms?
  • Does presenting at a conference mean having being accepted at it?
  • Found possible instance of plagiarism in joint review paper and PhD thesis of high profile collaborator, what to do?
  • Should I ask for authorship or ignore?
  • Is a doctor's diagnosis in clinical notes, made without a confirmatory test, admissible evidence in an assault case in California?
  • How big can a chicken get?
  • Commutativity of the wreath product
  • Ubuntu Terminal with alternating colours for each line
  • Why aren't tightly stitched commercial pcbs more common?
  • Can we downgrade edition from SQL Server 2016 Enterprise to Standard when we have compression feature enabled?
  • Have any countries managed to reduce immigration by a significant margin in the absence of economic problems?
  • Having friends who are talented is great, but it can also be ___ at times

perl defined or assignment operator

IMAGES

  1. Perl Operator Types

    perl defined or assignment operator

  2. Perl 101

    perl defined or assignment operator

  3. Perl OR

    perl defined or assignment operator

  4. How to use the OR operator "||" and && "//" in Perl // TUTORIAL

    perl defined or assignment operator

  5. Learn about Operators in Perl Programming

    perl defined or assignment operator

  6. Assignment Operators in C

    perl defined or assignment operator

VIDEO

  1. ঈদের ছুটিতে কক্সবাজারে ভ্রমণপিপাসুদের উপচে পড়া ভিড়

  2. Perl Programming

  3. Beginner Perl Maven tutorial 4.2

  4. Core

  5. Perl Tutorial 16

  6. Python Vs Perl Programming

COMMENTS

  1. perlop

    These combined assignment operators can only operate on scalars, whereas the ordinary assignment operator can assign to arrays, hashes, lists and even references. ... There is no low precedence operator for defined-OR. # C Operators Missing From Perl . Here is what C has that Perl doesn't: # unary & Address-of operator. (But see the ...

  2. operators

    If any list operator (print(), etc.) or any unary operator (chdir(), etc.) is followed by a left parenthesis as the next token, the operator and arguments within parentheses are taken to be of highest precedence, just like a normal function call. For example, because named unary operators have higher precedence than ||:

  3. Use the logical-or and defined-or operators to provide default

    Defined-or. Since version 5.10.0 Perl has has had the defined-or operator ('//'). This will check if the variable is defined, and if it is not, Perl will execute the code on the right-side of the operator. We can use it to simplify our subroutine code:

  4. man perlop (1): Perl operators and precedence

    Operator precedence and associativity work in Perl more or less like they do in mathematics. Operator precedence means some operators are evaluated before others. For example, in "2 + 4 * 5", the multiplication has higher precedence so "4 * 5" is evaluated first yielding "2 + 20 == 22" and not "6 * 5 == 30" .

  5. Perl Programming/Operators

    Perl's set of operators borrows extensively from the C programming language. ... The assignment update operators from C, +=, -=, etc. work in perl. Perl expands on this basic idea to encompass most of the binary operators in perl. ... Note that the case is defined by the first operand, and that the 1..'a' and (10..-10) operations return empty list.

  6. Set default values with the defined-or operator

    That's a bit messy, so Perl 5.10 introduces the defined-or operator, //. Instead of testing for truth, it tests for defined-ness. Instead of testing for truth, it tests for defined-ness. If its lefthand value is defined, even if it's false (i.e. 0 , '0' , or the empty string), that's what it returns, short-circuiting the righthand side.

  7. Operators

    Comparison or relational operators are discussed in the Conditional Decisions section of this tutorial. Please review them in that section. Assignment Operators. Used to assign scalar or array data to a data structure. Operators: = Simple assignment - assigns values from right side operands and operators to left side operand

  8. perlop

    Perl operators have the following associativity and precedence, listed from highest precedence to lowest. ... the scalar assignment operator produces a valid lvalue. Modifying an assignment is equivalent to doing the assignment and then modifying the variable that was assigned to. ... The defined test avoids problems where line has a string ...

  9. Establishing a Default Value

    The ||= assignment operator looks odd, but it works exactly like the other binary assignment operators. For nearly all Perl's binary operators ... The || operator in perlop (1) or Chapter 2 of Programming Perl; the defined and exists functions in perlfunc(1) and Chapter 3 of Programming Perl. Get Perl Cookbook now with the O'Reilly learning ...

  10. Perl Operators

    A perl operator is a series of symbols used as syntax. An operator is a sort of function and its operands are arguments. ... Conditional operators =, +=, -=, *= Assignment operators, Comma operator: not: low precedence logical NOT: and: low precedence logical AND: or, xor: ... The arity of an operator can be defined as the number of operands on ...

  11. perlop

    Operator precedence and associativity work in Perl more or less like they do in mathematics. Operator precedence means some operators are evaluated before others. For example, in "2 + 4 * 5", the. multiplication has higher precedence so "4 * 5" is evaluated first yielding "2 + 20 == 22" and not "6 * 5 ==. 30".

  12. Perl Operators

    An operator is a character that represents an action, for example + is an arithmetic operator that represents addition. Operators in perl are categorised as following types: 1) Basic Arithmetic Operators. 2) Assignment Operators. 3) Auto-increment and Auto-decrement Operators. 4) Logical Operators.

  13. perlop

    These combined assignment operators can only operate on scalars, whereas the ordinary assignment operator can assign to arrays, hashes, lists and even references. ... There is no low precedence operator for defined-OR. C Operators Missing From Perl . Here is what C has that Perl doesn't: unary & Address-of operator. (But see the "\" operator ...

  14. Understanding the 'or' Operator in Perl: A Comprehensive Guide

    This article will explore the Perl 'or' operator in detail, providing examples and tips to help you avoid common pitfalls. Explanation of the 'or' Operator in Perl; In Perl, the 'or' operator is a logical operator that is used to perform logical OR operations. It returns true if either or both of the conditions being compared are true.

  15. Perl Operators

    Numeric operators. Perl provides numeric operators to help you operate on numbers including arithmetic, Boolean and bitwise operations. Let's examine the different kinds of operators in more detail. Arithmetic operators. Perl arithmetic operators deal with basic math such as adding, subtracting, multiplying, diving, etc. To add (+ ) or ...

  16. Operators in Perl

    Perl's operator set is diverse and flexible, providing tools for a variety of operations, from basic arithmetic to file tests. Familiarity with these operators is key to writing efficient and readable Perl code.

  17. What is //= in Perl?

    It is documented in the Perl operators (perldoc perlop) in two places (tersely under the assignment operators section, and in full in the section on 'logical defined-or'). It was added in Perl 5.10.0.

  18. Perl Operator: A Comprehensive Guide

    Assignment Operators . Assignment operators in programming languages like Perl are fundamental components that simplify assigning values to variables. They are not just limited to the basic assignment but also include a range of compound assignment operators that combine arithmetic, string, and other operations with the assignment.

  19. Assignment Operators

    Assignment Operators. Get introduced to the functionality of the assignment and the combined assignment operator in this lesson. We'll cover the following. Basic assignment. Example. Explanation. Combined assignment. Example. Difference between = and == operator.

  20. perldelta

    New builtin::inf and builtin::nan functions (experimental) New ^^ logical xor operator. try/catch feature is no longer experimental. for iterating over multiple values at a time is no longer experimental. builtin module is no longer experimental. The :5.40 feature bundle adds try. use v5.40; imports builtin functions. Security.

  21. How does the assignment operator (=) in Perl work internally?

    @Praveenkumar It is only a way to open a file and make $. defined. You'll notice that I also added a file name to the end. You'll notice that I also added a file name to the end. - TLP

  22. What Are the Basic Rules and Idioms for Operator ...

    Rules and Idioms for Operator Overloading in C++. Following are the fundamental rules and idioms that should be followed when overloading operators in C++: 1. Overload only Built-in Operators. In C++, only existing built-in operators can be overloaded. We cannot create a new operator or rename existing ones, hence if any operator is not present ...

  23. Vulnerability Summary for the Week of June 3, 2024

    The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts.

  24. perl

    7. [ This answer is also found in table format here.] The symbol = is compiled into one of two assignment operators: A list assignment operator ( aassign) is used if the left-hand side (LHS) of a = is some kind of aggregate. A scalar assignment operator ( sassign) is used otherwise. The following are considered to be aggregates: