HiveV5_file_decryptor

HiveV5 파일 복호화 PoC 소개 지난 몇 달간 수행된 작업은 Hive v5-5.2의 악성 파일 암호화 메커니즘을 밝혀내기 위해 필요했습니다. 작업은 두 부분으로 나뉘었습니다. 1. 키스트림 복호화 2. 복호화된 키스트림을 이용한 파일 복호화 훌륭하신 @rivitna 님께 이 몇 달간의 작업에 대한 지원, 대화, 조언에 감사드립니다! rivitna의 github에는 Hive 랜섬웨어 등에 관한 유용한 정보가 가득하니 꼭 확인해 보시기 바랍니다. 이 readme에서는 파일 복호화 알고리즘에 대한 몇 가지 정보를 찾을 수 있으...

BumbleCrypt

BumbleCrypt Bumblebee에서 영감을 받은 Crypter 배경 BumbleCrypt는 Bumblebee의 crypter에서 영감을 받았습니다. Bumblebee의 경우, 메인 Bumblebee DLL이 메모리에 로드되어 다음과 같은 방식으로 실행됩니다: Heap에 페이로드를 복호화하여 기록합니다 NtOpenFile, NtCreateSection, NtMapViewOfSection 세 가지 NtApi를 후킹합니다 LoadLibraryW"gdiplus.dll"를 호출합니다. LoadLibrary가 라이브러리를 로드할 ...

Icedid-file-decryptor

IcedID 복호화 도구 IcedID 감염과 관련된 license.dat 파일을 정적으로 복호화하는 스크립트입니다. 또한 언패킹된 IcedID 샘플의 .data 섹션도 복호화합니다. 참고 사항: 스크립트는 PE 파일 또는 license.dat 파일이 주어졌는지 자동으로 감지합니다. PE 파일이 제공된 경우, 해당 파일이 먼저 언패킹되었다고 가정합니다. 복호화에 성공하면 원시 덤프가 output.bin에 기록됩니다. 또한 빠른 문자열 검색이 수행되며, 탐지된 문자열은 파일에 기록됩니다. 언패킹된 PE가 제공된 경우 C2가 화면에...

RHEL 10 : cjose (RHSA-2026:73129)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73129 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: cjose: Heap buffer overflow in AES Key Wr...

RHEL 9 : cjose (RHSA-2026:73128)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73128 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: cjose: Heap buffer overflow in AES Key Wra...

RHEL 9 : cjose (RHSA-2026:73018)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:73018 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: cjose: Heap buffer overflow in AES Key Wra...

Amazon Linux 2023 : cjose, cjose-devel (ALAS2023-2026-3130)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3130 advisory. OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithm...

CVE-2026-84971

A flaw was found in MONGOCRYPT. Improper handling of an unexpected value size in the decryption path of the client-side encryption library can lead to a failed internal check. A remote attacker, by placing a specially crafted encrypted value or controlling application responses, could exploit thi...

EUVD-2026-87681

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

CVE-2026-100708

Froxlor versions before 2.3.13 are vulnerable to private key disclosure via the Certificates.get and Certificates.listing API commands. The root cause is that the results of underlying domain_ssl_settings queries are processed by ApiCommand::response() without any field stripping or allowlist, ca...

openSUSE 16 Security Update : cjose (openSUSE-SU-2026:21944-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21944-1 advisory. - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap- based buffer overflow bsc1279844. -...

CVE-2026-79762 Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-79762 Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

EUVD-2026-86162

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-79762

The Termix web-based server management platform (versions 1.7.0 to 2.5.1 ) is vulnerable to credential decryption due to hardcoded default keys. In src/backend/utils/user-crypto.ts, the system derives wrapping keys for OIDC and WebAuthn users' Data Encryption Keys (DEKs) from committed default st...

PT-2026-97920

Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0 Description Termix derives keys used to wrap Data Encryption Keys DEK for OIDC and WebAuthn users from committed default strings and the public userId salt within the src/backend/utils/user-crypto.ts file...

CVE-2026-63273

A flaw was found in LibreOffice Draw. This vulnerability allows a remote attacker to cause a denial of service by crafting a specially designed encrypted PDF document. When a user opens this malicious document, a heap buffer overflow occurs because the software incorrectly handles the decryption...

SUSE CVE-2026-63273

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length large...

CVE-2025-36084 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2025-36084

IBM Concert versions 1.0.0 through 3.0.0 are affected by multiple vulnerabilities involving the use of weaker than expected cryptographic algorithms . This weakness could allow an attacker to decrypt highly sensitive information . No specific exploit information or remediation details are provide...