wibu-codemeter-analysis

WIBU CodeMeter DLL の暗号解析 WIBU-Systems CodeMeter 保護に関する独立したセキュリティ調査 責任ある情報開示 ベンダー通知日: 2025年12月24日 開示期間: 90日 公開日: 2026年3月24日 対象: WibuBz32.dll の解析のみ 概要 WIBU CodeMeter ランタイムライブラリの解析により、カスタム PE セクションに AES-256 暗号化と一致しない特性が明らかになった。 主な発見: 指標| 期待値 AES-256| 観測値| 偏差 ---|---|---|--- シャノンエントロピー| ≥7.9 bits/byt...

meshtastic-cve-2025-52464-poc

Meshtastic CVE-2025-52464 개념 증명 개요 이 프로젝트는 Meshtastic 펌웨어 버전 2.5.02.6.10 에 영향을 미치는 취약점인 CVE-2025-52464 를 시연하는 소프트웨어 전용 개념 증명입니다. 이 구현은 취약한 펌웨어의 암호화 동작을 재현하며, 중복되거나 낮은 엔트로피의 암호화 키가 어떻게 공격자가 암호화된 직접 메시지DM를 복호화할 수 있게 하는지 보여줍니다. 또한 펌웨어 버전 2.6.11 에서 도입된 패치 동작을 시연하는데, 여기서는 올바른 키 생성과 낮은 엔트로피 키 탐지를 통해 공격...

CVE-2022-25012

CVE-2022-25012 Argus Surveillance DVR v4.0은 취약한 비밀번호 암호화를 사용합니다. 컴파일 gcc pocland.c -o pocland 사용 예시 ./pocland B4A1ECB4F539C48C7357F641C9C49083 참조 CVE-2022-25012 더 많은 PoC는 다음에서 확인 가능: pocland...

cve-2026-20833-rc4-kerberos

CVE-2026-20833 — Kerberos RC4 강화 이 저장소는 Active Directory 환경 에서 Kerberos의 RC4 점진적 폐지 와 관련된 기술 문서 , PowerShell 스크립트 , Power BI 대시보드 , 그리고 공식 Microsoft 참조 자료 를 통합하여 제공합니다. 이는 CVE-2026-20833 을 해결하기 위한 Microsoft의 보안 변경 사항의 일부입니다. 목표는 조직이 다음을 지원하도록 돕는 것입니다: 보안 감사 RC4 사용 탐지 수정 계획 2026년 Kerberos RC4 적용 단...

CACredDecoder

C-Ark Credential Decoder Exploit tool for CVE-2021-31796 C-Ark 자격 증명 파일 디코딩 도구 제작: Aaron Mizrachi - https://twitter.com/unmanarc/ Enrique Vaamonde - https://twitter.com/ejvm 최초 릴리스: 2/Sep/2019 공개: 11/Oct/2021 참고 자료...

CVE-2026-18397: Improper Verification of Cryptographic Signature

This vulnerability enables unauthenticated remote code execution RCE on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an...

CVE-2026-94456 Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

CVE-2026-86241 liufee FeehiCMS Cookie Validation main-local.php hard-coded key

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

CVE-2026-16693 IBM i is Affected By Cryptographic Algorithm Weakness in DCM []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys...

CVE-2026-16693

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by a cryptographic weakness in Digital Certificate Manager (DCM) (5770-SS1 Option 34). The vulnerability stems from hardcoded cryptographic constants used to obfuscate encryption keys, classified as CWE-327 (Use of a Broken or Risky Cryptographic...

Security Bulletin: IBM i is Affected By Cryptographic Algorithm Weakness in DCM [CVE-2026-16693]

Summary IBM i is vulnerable to allowing an authenticated attacker to obtain sensitive information CVE-2026-16693 in Digital Certificate Manager DCM as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16693 DESCRIPTION: IBM i could allow a remote authenticated...

CVE-2025-36271 IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to Cryptographic Weakness in IBM Liberty Server ( CVE-2020-36732)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the cryptographic weakness vulnerability Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an intege...

SUSE-SU-2026:3834-1 Security update for librest0_7

This update for librest07 fixes the following issue: - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399...

Security update for librest0_7

This update for librest07 fixes the following issue: CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

Summary IBM Integrated Analytics System includes Magneto as an internal resource manager component. CVE-2025-36271 affects the resmgr.py module in Magneto, where a predictable salt value is used in cryptographic operations. The use of a predictable salt weakens the effectiveness of hashing and...

PT-2026-82235

Name of the Vulnerable Software and Affected Versions TP-Link Kasa affected versions not specified Description Multiple smart home devices have insufficient cryptographic protections in the local device communication protocol. An attacker on the same network can intercept, replay, or forge locall...

CVE-2026-79084

Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Security update for librest

This update for librest fixes the following issue: CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...