CheeseTools - Self-developed Tools For Lateral Movement/Code Execution

This repository has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them. CheeseExec Command Exec / Lateral movement via PsExec-like functionality. Must be running in the context of a...

wolfssl

This repository is an implementation of the wolfSSL library, a cryptographic library for secure communication. The library is designed to be used with various platforms, including Arduino, and provides a range of cryptographic functions for secure data transmission. The repository contains a...

OpenSSH 6.2 <= 6.3 Permissions, Privileges, and Access Controls Vulnerability

A memory corruption vulnerability exists in the post-authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, a...

What is encryption? And why it matters in a VPN

Encryption is a term used to describe the methods that hide the true meaning of messages using code, especially to prevent unauthorized access to the information in the messages. Not all users of virtual private networks VPN care about encryption, but many are interested and benefit from strong...

DoraCMS Encryption Problem Vulnerability

DoraCMS is based on Nodejs+eggjs+mongodb written a content management system . An encryption issue vulnerability exists in DoraCMS 2.1.1 and earlier versions. The vulnerability arises because the program does not use AES-CBC encryption with random salts or IVs, which makes user-encrypted password...

CVE-2020-18220

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks...

Design/Logic Flaw

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks...

CVE-2020-18220

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks...

CVE-2020-18220

DoraCMS v2.1.1 and earlier uses AES-CBC without a random salt/IV for password encryption, exposing passwords to dictionary attacks. The issue is documented across multiple sources (CVE-2020-18220) and indicates weak encoding rather than a broader vulnerability. Affected component is the password-...

DoraCMS 加密问题漏洞

DoraCMS is based on Nodejs+eggjs+mongodb written a content management system . An encryption issue vulnerability exists in DoraCMS 2.1.1 and earlier versions. The vulnerability arises because the program does not use AES-CBC encryption with random salts or IVs, which makes user-encrypted password...

RUSTSEC-2021-0059 `aesni` has been merged into the `aes` crate

Please use the aes crate going forward. The new repository location is at: AES-NI is now autodetected at runtime on i686/x86-64 platforms. If AES-NI is not present, the aes crate will fallback to a constant-time portable software implementation. To prevent this fallback and have absence of AES-NI...

`aes-ctr` has been merged into the `aes` crate

Please use the aes crate going forward. The new repository location is at: The aes crate now has an optional ctr feature which autodetects SIMD features on i686/x86-64 targets and uses them if available, or otherwise falls back to the implementation in the ctr crate. If you would prefer not to ha...

`aesni` has been merged into the `aes` crate

Please use the aes crate going forward. The new repository location is at: AES-NI is now autodetected at runtime on i686/x86-64 platforms. If AES-NI is not present, the aes crate will fallback to a constant-time portable software implementation. To prevent this fallback and have absence of AES-NI...

`aes-soft` has been merged into the `aes` crate

Please use the aes crate going forward. The new repository location is at: AES-NI is now autodetected at runtime on i686/x86-64 platforms. If AES-NI is not present, the aes crate will fallback to a constant-time portable software implementation. To force the use of a constant-time portable...

actinium226-librespot (0.4.3), actinium226-librespot-connect (0.4.3) +51 more potentially affected by unknown CVE via aes-ctr (>=0.6.0, <=0.99.99)

aes-ctr CARGO version =0.6.0, =0.4.3-updated, =0.5.0, =0.1.0, =0.2.0, =0.1.0, =0.40.0, =0.40.0, =0.40.0, =0.40.0, =0.1.0, =0.1.0, =0.6.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0061...

actinium226-librespot (0.4.3), actinium226-librespot-connect (0.4.3) +928 more potentially affected by unknown CVE via aesni (>=0.9.0, <=0.10.0)

aesni CARGO version =0.9.0, =0.4.3-updated, =0.1.3, =0.1.0, =0.3.0, =0.3.0-alpha.1, =0.5.1, =0.0.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0059...

RUSTSEC-2021-0060 `aes-soft` has been merged into the `aes` crate

Please use the aes crate going forward. The new repository location is at: AES-NI is now autodetected at runtime on i686/x86-64 platforms. If AES-NI is not present, the aes crate will fallback to a constant-time portable software implementation. To force the use of a constant-time portable...

actinium226-librespot (0.4.3), actinium226-librespot-connect (0.4.3) +943 more potentially affected by unknown CVE via aes-soft (0.6.4)

aes-soft CARGO version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aes-soft and may be impacted: - actinium226-librespot 0.4.3 - actinium226-librespot-connect 0.4.3 - actinium226-librespot-playback =0.4.3-updated, =0.1.3, =0.1.0, =0.3.0,...

RUSTSEC-2021-0061 `aes-ctr` has been merged into the `aes` crate

Please use the aes crate going forward. The new repository location is at: The aes crate now has an optional ctr feature which autodetects SIMD features on i686/x86-64 targets and uses them if available, or otherwise falls back to the implementation in the ctr crate. If you would prefer not to ha...

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

Impact AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown. But a possibly observable difference in timing when padding error would occur while...