dbd

d8888b. d8888b. d8888b. 88 8D 88 8D 88 8D 88 88 88oooY' 88 88 88 88 88b. 88 88 88 .8D 88 8D 88 .8D Y8888D' Y8888P' Y8888D' Durandal's Backdoor Copyright C 2013 Kyle Barnthouse [email protected] dbd は GNU GPL のもとで配布されています Mipsbe バイナリは Darkerego によって追加されました https://github.com/darkerego...

AES-Killer

AES Killer Burpsuite プラグイン AES 暗号化トラフィックをオンザフライで復号化する Burpsuite プラグイン 必要条件 Burpsuite テスト済み環境 Burpsuite 2021.4 Windows 10 Ubuntu & PopOS 機能 IProxyListener はリクエストを復号化し、レスポンスを暗号化します。また、IHttpListener はリクエストを暗号化し、レスポンスを復号化します。 Burp は Repeater、Intruder、Scanner...

CVE-2026-11119-Padding-Oracle-Attack-on-CBC-Mode-Encryption

CVE-2026-11119 – CBCモード暗号化に対するパディングオラクル攻撃 プログラムコード（Python） root@kitploit: paddingoracleserver.py - Server that returns padding error from flask import Flask, request from Crypto.Cipher import AES from Crypto.Util.Padding import pad, unpad import os key = os.urandom16 app = Flaskname...

meesho-android-improper-encryption-cve-2026-5682

🔐 概念実証: Meesho Androidアプリ – 安全でない暗号実装（完全性のないAES-CBC + 脆弱な鍵導出） 著者: Soyam Arya（別名 honestcorrupt） 発見日: 2026年3月 影響を受けるアプリ: Meesho Androidアプリ（com.meesho.supply） ステータス: 検証中 カテゴリ: 不十分な暗号化 / データ完全性の欠陥 🎯 概要 このレポートは、Meesho Androidアプリケーションにおける暗号化の脆弱性を文書化したもので、機密データが完全性保護なしのAES/CBC/PKCS5Padding...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt RXGK 페이지 캐시 변조를 통한 Linux 커널 로컬 권한 상승 "DirtyDecrypt" — 2026년 "Dirty" 계열 익스플로잇의 일부 📖 개요 DirtyDecrypt CVE-2026-31635는 Linux 커널의 rxrpc 서브시스템특히 rxgk 구성 요소에서 발생하는 로컬 권한 상승 취약점입니다. 이 취약점은 AES-CBC 복호화 과정에서 Copy-on-WriteCOW 검사 누락 을 남용하여, 권한이 없는 사용자가 페이지 캐시를 변조하고 임의 파일 쓰기 를...

CVE-2026-82645 AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token

AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Liverestreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...

CVE-2026-82645

AVideo (commit e01e41ecc and earlier) is vulnerable to unauthenticated stream credential disclosure via the getLiveKey.json.php endpoint. Supplying a forged token parameter bypasses both the access gate and ownership check, returning any user's stream_key and stream_url — credentials for external...

libqcow

libqcow は QEMU Copy-On-Write QCOW イメージファイル形式にアクセスするためのライブラリです。 プロジェクト情報: ステータス: alpha ライセンス: LGPL-3.0-or-later 読み取り専用で対応している QCOW 形式: バージョン 1 バージョン 2 バージョン 3 対応している QCOW 形式の機能: zlib DEFLATE 圧縮 AES-CBC 128ビット暗号化 バッキングファイル 差分イメージ 非対応の QCOW 形式の機能: LUKS 暗号化 データファイル イメージ内スナップショット 作業中: ファイル API...

CVE-2025-30156

CVE-2025-30156 affects the Ceph distributed storage platform in versions prior to 20.2.4 (Tentacle) and 19.2.6 . The CephX authentication protocol encrypts tickets with AES-128-CBC using a hard-coded IV and no message authentication, making it vulnerable to the same class of unauthenticated-encry...

CVE-2025-30156 Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

CVE-2025-30156 Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

CVE-2026-47842

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...

CVE-2026-47842

Spring Security 's AesBytesEncryptor deterministically encrypts data with AES/CBC when the two-argument constructor is used or a null IV generator is passed with CBC mode, resulting in a null (all-zero) initialization vector . This causes identical plaintexts to always produce identical ciphertex...

CVE-2026-47842 Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation...

CVE-2026-14969

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

DEBIAN-CVE-2026-14969

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

AZL-92186 CVE-2026-14969 affecting package 389-ds-base 3.1.1-11

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

UBUNTU-CVE-2026-14969

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext block...

CVE-2026-11347

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors IVs for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can...