pwnage24mtk

pwnage24mtk Exploit de certificado para dispositivos MTK.Hay una falla lógica en el proceso de verificación de certificados de MTK.Similar a CVE-2023-20696. Parcheado. CVE-2023-20696 CVE-2025-20730 Hay algunos problemas sobre la detección de arquitectura.Necesitan ser corregidos cuando tenga...

universal-flutter-ssl-pinning

universal-flutter-ssl-pinning Ingeniería inversa de libflutter.so con PyGhidra para localizar la función de verificación del certificado SSL, luego genera scripts de omisión listos para usar tanto para Frida como para Renef. Cómo funciona 1. PyGhidra carga libflutter.so sin interfaz gráfica y...

ibmsecurity

IBM Sample Code Este repositorio contiene código Python para gestionar IBM Security Appliances mediante sus respectivas API REST. El appliance ISAM es el que tiene el código más maduro. El código para el appliance ISDS está en desarrollo. El código para el appliance ISVG es nuevo probado solo con...

CVE-2026-86247

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...

CVE-2026-86247 Apache Tomcat Native: Client certificate requirements can be down-graded

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...

EUVD-2026-85270

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...

sslnuke

sslnuke -- SSL without verification isn't secure! We have all heard over and over that SSL without verification is not secure. If an SSL connection is not verified with a cached certificate, it can easily be hijacked by any attacker. So in 2013, one would think we had totally done away with this...

Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass

IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecate...

poc-CVE-2026-0073

PoC de CVE-2026-0073 Omisión de Autenticación TLS de ADB Inalámbrico Este directorio contiene un proof of concept en Python para CVE-2026-0073. El script se genera mediante técnicas de generación de código asistidas por IA. Resumen CVE-2026-0073 es un problema de lógica en la verificación de...

ROS-20260921-73-0030

The vulnerability in curl is related to incorrect verification of certificate authenticity. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

The vulnerability of FortiOS operating systems and FortiProxy proxy servers related to improper verification of certificate authenticity allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to improper verification of certificate authenticity. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and...

nogotofail

nogotofail Nogotofail 是一个网络安全测试工具，旨在以灵活、可扩展且强大的方式帮助开发者和安全研究人员发现并修复设备及应用程序中弱的 TLS/SSL 连接和敏感的明文流量。它包含对常见 SSL 证书验证问题、HTTPS 和 TLS/SSL 库漏洞、SSL 和 STARTTLS 剥离问题、明文问题等的测试。 设计 Nogotofail 由一个路径上的网络 MiTM 和可选的要测试设备上的客户端组成。有关 nogotofail 的概述和设计目标，请参见 docs/design.md。 依赖项 Nogotofail 仅依赖 Python 2.7 和...

p5-ssl-tools

Colección de Herramientas SSL Este repositorio contiene varias herramientas, destinadas a depurar o analizar problemas relacionados con SSL/TLS. Análisis del estado de TLS analyze-ssl.pl comprueba el soporte de varias versiones de SSL/TLS comprueba qué cifrados son compatibles verifica el...

poc-CVE-2026-0073

PoC CVE-2026-0073 Omisión de Autenticación TLS de ADB Inalámbrico Este directorio contiene una prueba de concepto en Python para CVE-2026-0073. El script se genera mediante técnicas de generación de código asistidas por IA. Resumen CVE-2026-0073 es un problema de lógica en la verificación de...

Astra Linux – Vulnerability in requests

Requests is an HTTP library. Prior to version 2.32.0, when making requests through a Requests Session, if the first request was made with verify=False to disable certificate verification, all subsequent requests to the same host would continue to ignore certificate verification, regardless of...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

Astra Linux – Vulnerability in Twisted

In words.protocols.jabber.xmlstream in Twisted through version 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to intercept connections...

Astra Linux – Vulnerability in curl

When performing multi-threaded LDAPS transfers LDAP over TLS with libcurl, changing TLS options in one thread will inadvertently change them globally, and thus may also affect other concurrently running transfers. Disabling certificate verification for a specific transfer can unintentionally...

Astra Linux – Vulnerability in PostgresSQL 11

A man-in-the-middle attacker can inject false responses to the client’s first few queries, despite the use of SSL certificate verification and encryption...

Astra Linux – Vulnerability in LibreOffice

A vulnerability in certificate validation in LibreOffice’s “LibreOfficeKit” mode disables TLS certificate verification. LibreOfficeKit can be used to access LibreOffice functionality through C/C++. Typically, this is used by third-party components to reuse LibreOffice as a library for converting,...