halite

Halite Halite es una interfaz de criptografía de alto nivel que depende de libsodium para todas sus operaciones criptográficas subyacentes. Halite fue creado por Paragon Initiative Enterprises como resultado de nuestros continuos esfuerzos por mejorar el ecosistema y hacer que la criptografía en...

awesome-malware-analysis

Awesome Malware Analysis Una lista curada de herramientas y recursos impresionantes para el análisis de malware. Inspirada por awesome-python y awesome-php. Colección de Malware Anonimizadores Honeypots Corpora de Malware Inteligencia de Amenazas de Código Abierto Herramientas Otros Recursos...

awesome-appsec

Awesome AppSec Una lista curada de recursos para aprender sobre seguridad de aplicaciones. Contiene libros, sitios web, publicaciones de blog y cuestionarios de autoevaluación. Mantenida por Paragon Initiative Enterprises con contribuciones de las comunidades de seguridad de aplicaciones y...

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...

Paragon Initiative Enterprises: Recaptcha Secret key Leaked

Greeting from @kashifinfo90, I hope Paragonie Security Team is doing great, Following Secret Keys are leaked: "secret-key": "6Ldy5BYTAAAAAPBh868BMm2nGZelOUyXJHTUE4no", "site-key": "6Ldy5BYTAAAAACk3Tj8wDUBLcVxSL2JXFBw-Dtj3" "secret-key": "6Ld27iETAAAAAF6tsd5SaoCgc5cFX-tkfHqx7FtX", "site-key":...

Paragon Initiative Enterprises: [Critical] billion dollars issue

Hey, My name is El-Sisi also i have famous name is بلحه Balaha and i have found documents that confirm you the github inc belong to you. if you need this documents give me reward and i will give u that documents. why i'm doing this because my mother tell me if you see some things like that you mu...

Paragon Initiative Enterprises: Paragonie Airship Admin CSRF on Extensions Pages

Summary ========== The /bridge/admin/skyport/install endpoint, as well as some of the endpoints around it, are vulnerable to Cross-Site Request Forgery. Description ========= The functions in src/Cabin/Bridge/Controller/Skyport.php in the Airship project appear to all be vulnerable to Cross-Site...

Paragon Initiative Enterprises: no session logout after changing the password in https://bridge.cspr.ng/

no session logout after changing the password in https://bridge.cspr.ng/...

Paragon Initiative Enterprises: Full Path Disclousure on https://airship.paragonie.com

Hi , i found an full path disclousure vulnerability on https://airship.paragonie.com For reproduce this vulnerability go to: https://airship.paragonie.com/my/cabins You will see something like this : Class '\ParagonIE\Airship\Cabins' not found 0 /var/www/paragonie/framework/Router.php236:...

Paragon Initiative Enterprises: There is an vulnerability in https://bridge.cspr.ng where an attacker can users directory

There is an vulnerability in https://bridge.cspr.ng where an attacker can check users directories by this url https://bridge.cspr.ng//users and can also check the documentations...

Paragon Initiative Enterprises: Full Path Disclosure in airship.paragonie.com '/cabins/'

Hello Team, first am so sorry if i test this in your site, since i got problem to install in my own. So when i see your blog i got end point to https://airship.paragonie.com which is "Powered By Airship" or made using Airship CMS. step To Reproduce 1. register an account 2. navigate to...

Paragon Initiative Enterprises: directory information disclose

step: 1. goto https://bridge.cspr.ng/my/files/Hull with your login id 2. upload a file 3. click on "File info" and see full path of file is disclose...

Paragon Initiative Enterprises: Cross-site-Scripting

step: 1: goto https://bridge.cspr.ng/my/account of your account 2. in "Custom Profile field option" check the box and enter xss payload in "display name" field payload: "palert'xss'" 3. update the information 4. open the account in INTERNET EXPLORER 11 and xss will executed note: here server is n...

Paragon Initiative Enterprises: Incomplete fix for #181225 (target=_blank vulnerability)

Hi, I believe the fix for 181225 is incomplete in the rules for Airship wysihtml parser rules. At https://github.com/paragonie/airship/blob/58f96aa0e5002b60e74456502d9bfc9483d77b3d/src/public/js/wysihtml5/parserrules/advancedandextended.js, the 'target' parameter for links is allowed to be...

Paragon Initiative Enterprises: Not using Binary::safe* functions for substr/strlen function

Several places in the code don't use Binary::safe or CryptoUtil::safe functions, but use raw functions instead strlen/substr which can act as mbfuncname instead not count bytes for strlen/etc... 1...

Paragon Initiative Enterprises: Missing GIT tag/commit verification in Docker

in: https://github.com/paragonie/airship/blob/master/docker/Dockerfile.airshipL14-L16 RUN git clone https://github.com/jedisct1/libsodium.git /tmp/sodium WORKDIR /tmp/sodium RUN git checkout tags/1.0.10 The code is fetched from Github without one of: 1. signature verification on relevant tag. GPG...

Paragon Initiative Enterprises: DMARC Not found for paragonie.com URGENT

Hi sir, , I am new hacker in hackerone platform I am glad to join paragonie bounty program ..i want to report a very critical bug that is i found DMARC missing for your domain paragonie.com Add DMARC record as soon as possible .. DMARC description Background Email authentication technologies SPF...

Paragon Initiative Enterprises: [Airship CMS] Local File Inclusion - RST Parser

Airship uses the very useful RST Parser from Gregwar. However, the parser has the RST directive include built-in why it isn't a separate directive per the spec, I don't know. However, as a result, LFI is possible in Airship. I realize this isn't directly Paragonie's code, but since Airship uses...

Paragon Initiative Enterprises: Session Management Issue CMS Airship

Hey, I've found a session management issue in CMS Airship bridge.cspr.ng Issue ---------- When the password of an account is changed from a session, other sessions doesn't expire! Steps to Reproduce + We Need to use two broswers 1. Login to one browser 2. Login to second browser 3. Then change th...