401 matches found
poodle-PoC
Poodle PoC 🐩 🐩 🐩 Poodle AttackPadding Oracle On Downgraded Legacy Encryption의 개념 증명 : 인터넷 및 보안 소프트웨어 클라이언트가 SSL 3.0으로 대체fallback되는 것을 이용하는 중간자 공격man-in-the-middle입니다. Poodle 공격은 사용 중인 전송 계층 보안이 SSLv3인 경우 클라이언트가 서버로 보낸 암호화된 데이터를 검색할 수 있게 해줍니다. 하지만 요청을 암호화하는 데 사용된 개인 키를 검색할 수는 없습니다. 1. 🐩 공격의 개념 🐩...
OpenSSH-4.7p1-CVE-2008-5161-Exploit
CVE-2008-5161 OpenSSH 4.7p1 감사 헬퍼 레거시 OpenSSH 4.7p1Debian-8ubuntu1 대상의 버전 확인 및 자격 증명 감사를 자동화하며, pwntools를 통해 Python에서 Metasploit의 auxiliary/scanner/ssh/sshlogin 모듈을 구동합니다. 이 프로젝트는 연구 및 승인된 보안 테스트 목적으로만 사용됩니다. / \ / / | | | | | | | | | | | || | | | | | ' \ / \ ' \ \ \ | | | || | | | / | | | | | |...
padre
padre padre is an advanced exploiter for Padding Oracle attacks against CBC mode encryption Features: blazing fast, concurrent implementation decryption of tokens encryption of arbitrary data automatic fingerprinting of padding oracles automatic detection of cipher block length HINTS! if failure...
lucky13
LUCKY13 Exploit 이 리포지토리는 암호화 시스템에서 CBC암호 블록 체인 모드의 특정 구현에 대한 타이밍 공격인 LUCKY13 취약점CVE-2013-0169에 대한 개념 증명POC 익스플로잇을 포함합니다. 이 익스플로잇은 패딩 검증에 따른 응답 시간 차이를 이용하여 대상 토큰을 복호화하는 것을 목표로 합니다. 전제 조건 익스플로잇을 실행하기 전에 다음 사항이 준비되어 있는지 확인하십시오: 머신에 Python 3.x가 설치되어 있어야 합니다. requests 라이브러리. 작동 방식 익스플로잇은 다음과 같이 작동합니다:...
Simple-Sweet32
Sweet32 이것은 Sweet32 공격CVE-2016-2183의 데모입니다: https://sweet32.info/ 이 공격은 CBC 모드에서 3DES 및 Blowfish와 같이 작은 블록 크기64비트를 사용하는 암호화 알고리즘을 악용하는 생일 공격birthday attack의 예입니다. 이 공격은 알려진 평문을 포함한 많은 암호화 블록을 생성해야 합니다. 생성 후, 동일한 암호화 블록을 식별하고, 이들을 사용하여 알 수 없는 평문을 가진 블록의 평문 값을 식별할 수 있습니다. 이 구현은 암호화 알고리즘으로 3DESTripl...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : phpseclib vulnerabilities (USN-8830-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8830-1 advisory. It was discovered that phpseclib did not perform constant-time padding validation when using AES in CBC...
USN-8830-1 php-phpseclib vulnerabilities
It was discovered that phpseclib did not perform constant-time padding validation when using AES in CBC mode. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-32935 It was discovered that phpseclib did not use a constant-time comparison when validating SSH...
USN-8769-1: phpseclib vulnerability
It was discovered that phpseclib did not perform padding validation in constant time when using AES in CBC mode. A remote attacker could possibly use this issue to conduct a padding oracle timing attack and obtain sensitive information...
CVE-2026-47842
A flaw was found in Spring Security. Applications configured to use AesBytesEncryptor with a two-argument constructor or a null Initialization Vector IV generator in Cipher Block Chaining CBC mode will encrypt data using a predictable, all-zero IV. This deterministic encryption allows an attacker...
EUVD-2026-66677
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...
Generation of Predictable IV with CBC Mode
Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Generation of Predictable IV with CBC Mode via AesBytesEncryptor when using the two-argument constructor or specifying a null I...
libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
EUVD-2026-59939
In the Linux kernel, the following vulnerability has been resolved: crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly into the skcipher request. After iosubmit the socket lock is dropped and...
CVE-2025-59322: Generation of Predictable IV with CBC Mode
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext...
CVE-2026-14969
The CVE-2026-14969 entry concerns 389-ds-base. The LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC, enabling a privileged attacker with filesystem access to detect plaintext equality across encrypted entries by ciphertext block comparison. ...
CVE-2024-56141: Generation of Predictable IV with CBC Mode
Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager encryption routine CryptManager.kt initializes its AES cipher using an initialization vector IV that is set equal to the secret...
Malicious code in node-pino (npm)
node-pino is a one-edit typosquat of the popular pino logger that ships repackaged winston plus a malicious postinstall dropper. On npm install, the postinstall hook npm run license - node lib/winston/license spawns a DETACHED, unref'd child process that reads an AES-256-CBC-encrypted blob...
Exploit for Generation of Predictable IV with CBC Mode in Redhat Enterprise_Linux
C...
Security Bulletin: Securing your products against OpenSSL and TLS vulnerabilities
Question Security Bulletin: Securing your products against OpenSSL and TLS vulnerabilities "Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Product":"code":"SS8NDZ","label":"IBM Aspera","Component":"","Platform":"code":"PF025","label":"Platform Independent","Version":"All...