CVE-2025-40019-POC

proof of concept for CVE-2025-40019 CVE-2025-40019 is the Encrypted Salt-Sector Initialization Vector mechanism crypto/essiv.c which has insufficient validation of Associated Authentication Data AAD length relative to the Initialization Vector IV size, leading to out-of-bounds memory access. The...

TokenMan

访问和刷新令牌套件。 Token Man 是一款使用 AAD 访问令牌和/或刷新令牌来支持后渗透活动的工具。 目录 用法 命令 Fetch Search Swap FOCI 应用程序客户端 ID 映射 AZ OAuth 用法 root@kitploit: usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -- v0.1.1 positional arguments: fetch,search,swap,az,oauth Command fetch Retrieve data via Graph API searc...

azbelt

azbelt 用于枚举 Azure 相关凭据的独立 DLL 和 sliver 扩展，主要针对已加入 AAD 的机器 模块 aadjoin - 通过 NetGetAadJoinInformation 获取机器的 AAD 状态信息 credman - 从凭据管理器获取凭据 env - 查找可能包含机密的 Azure/AAD 特定环境变量 managed - 调用 IMDS 端点获取具有托管身份的机器的信息 msal - 在各个 MSAL 缓存中查找令牌。解析令牌以显示作用域和有效性 sso - 如果机器已加入 AAD，获取已签名的 PRT cookie tbres - 从...

Azure-AccessPermissions

Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...

SUSE CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832

CVE-2026-80832 is a buffer underallocation flaw in the Linux kernel's QCE (Qualcomm Crypto Engine) crypto driver , specifically in qce_aead_ccm_prepare_buf_assoclen(). The AAD buffer size is computed as ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN, while the DMA scatterlist length uses ALIGN(as...

EUVD-2026-71282

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832 crypto: qce - fix CCM AAD buffer underallocation

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

PT-2026-85710

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qce aead ccm prepare buf assoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated...

Linux Distros Unpatched Vulnerability : CVE-2026-80832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into t...

GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

JLSEC-2026-1144 Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the...

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is present, so with no AAD the G1 block nonce, length, flag is never mixed into the MAC and...

CVE-2026-12803

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12803 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

PT-2026-67016

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-6458

Missing cryptographic step in Caliptra Core Firmware aes256gcmupdate module results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the first update call, causing the final tag to exclude th...

CVE-2026-6458

CVE-2026-6458 involves the Caliptra Core Firmware (aes_256_gcm_update module) where a missing cryptographic step in the streaming AES-256-GCM API with empty AAD leads to the hardware GHASH accumulator state not being saved after the first update. As a result, the final GCM authentication tag does...