pixiewps

Panoramica Pixiewps è uno strumento scritto in C utilizzato per forzare bruteforce offline il PIN WPS sfruttando la bassa o nulla entropia di alcune implementazioni software, il cosiddetto "attacco pixie-dust" scoperto da Dominique Bongard nell'estate 2014. È inteso solo per scopi didattici. A...

Shelltropy

Shelltropy Più prevedibile sei, meno vieni rilevato Una tecnica per nascondere shellcode malevolo basata su bassa entropia tramite codifica di Shannon. L'entropia è la misura della casualità in un insieme di dati qui: shellcode. Maggiore è l'entropia, più casuali sono i dati. L'entropia di Shanno...

meshtastic-cve-2025-52464-poc

Prova di concetto di Meshtastic CVE-2025-52464 Panoramica Questo progetto è una prova di concetto esclusivamente software che dimostra CVE-2025-52464 , una vulnerabilità che interessa le versioni del firmware Meshtastic dalla 2.5.0 alla 2.6.10. L'implementazione riproduce il comportamento...

CVE-2026-94206

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...

claude-awm

claude-awm: can you scrub a SynthID text watermark by editing the text? Yes, but only one family of attack works, and it isn't the one everyone assumes. Unicode variation selectors category Mn, U+FE00 to U+FE0F and U+E0100 to U+E01EF drive the detector below threshold and stay there. Every other...

WTSRM

WTSRM - Repository demo di malware Writing Tiny Small Reliable per il mio talk. corrispondente Rimuove gli hook da tutte le DLL di Windows con \KnownDlls\ Nessuna dipendenza da CRT Dimensioni ridotte Bassa entropia Chiave di cifratura casuale per le stringhe quindi nessuna stringa in chiaro Hashi...

CVE-2025-63666

CVE-2025-63666 — Tenda AC15 Riepilogo Il firmware Tenda AC15 V15.03.05.18multi rilascia un cookie di autenticazione nella forma password= e lo restituisce senza i flag HttpOnly, Secure o SameSite, esponendo l'hash della password al client. Il suffisso a bassa entropia funge da identificatore di...

PT-2026-103946

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by...

CVE-2026-66372 Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space...

Fedora 43 : perl-Dancer2 (2026-d0bededb87)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d0bededb87 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

Astra Linux – Vulnerability in mbedtls

In Arm Mbed TLS before version 2.19.0, and Arm Mbed Crypto before version 2.0.0, when deterministic ECDSA is enabled, an RNG with insufficient entropy is used for blinding. This may allow an attacker to recover a private key through side-channel attacks if a victim signs the same message multiple...

Fedora 45 : perl-Dancer2 (2026-28c5da9193)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-28c5da9193 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

Fedora 44 : perl-Dancer2 (2026-d13a2593b1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d13a2593b1 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

CVE-2026-62646

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

EUVD-2026-72661

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

CVE-2026-62646

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

CVE-2026-62646

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

CVE-2026-62646

CVE-2026-62646 affects Reyrolle 7SR5 (all versions prior to V2.70 ), a Siemens industrial communication gateway. The vulnerability resides in the session identifier generation mechanism: an algorithm with insufficient randomness produces low-entropy tokens that can be predicted or brute-forced. A...

PT-2026-87005

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

Insecure Randomness

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Insecure Randomness in the CSRF token generation process. An attacker can recover the session secret and forge valid tokens by observing a single CSRF token, which may be obtained...