poodle-PoC

Poodle PoC 🐩 🐩 🐩 Una prueba de concepto del ataque Poodle Padding Oracle On Downgraded Legacy Encryption : un exploit de hombre en el medio que aprovecha la degradación a SSL 3.0 de los clientes de software de seguridad y de Internet El ataque Poodle te permite recuperar datos cifrados enviados p...

OpenSSH-4.7p1-CVE-2008-5161-Exploit

CVE-2008-5161 OpenSSH 4.7p1 Asistente de Auditoría Automatiza la comprobación de versiones y la auditoría de credenciales de objetivos con el OpenSSH 4.7p1 heredado Debian-8ubuntu1, controlando el módulo auxiliary/scanner/ssh/sshlogin de Metasploit desde Python mediante pwntools. Este proyecto es...

padre

padre padre is an advanced exploiter for Padding Oracle attacks against CBC mode encryption Features: blazing fast, concurrent implementation decryption of tokens encryption of arbitrary data automatic fingerprinting of padding oracles automatic detection of cipher block length HINTS! if failure...

lucky13

LUCKY13 Exploit Este repositorio contiene un exploit de prueba de concepto POC para la vulnerabilidad LUCKY13 CVE-2013-0169, que es un ataque de temporización contra ciertas implementaciones del modo de operación CBC Cipher Block Chaining en sistemas criptográficos. El exploit tiene como objetivo...

Simple-Sweet32

Sweet32 Esta es una demostración del ataque Sweet32 CVE-2016-2183: https://sweet32.info/ El ataque es un ejemplo de un ataque de cumpleaños que explota algoritmos criptográficos con tamaños de bloque pequeños 64 bits en modo CBC, como 3DES y Blowfish. El ataque requiere la generación de una gran...

USN-8769-1: phpseclib vulnerability

It was discovered that phpseclib did not perform padding validation in constant time when using AES in CBC mode. A remote attacker could possibly use this issue to conduct a padding oracle timing attack and obtain sensitive information...

CVE-2026-47842

A flaw was found in Spring Security. Applications configured to use AesBytesEncryptor with a two-argument constructor or a null Initialization Vector IV generator in Cipher Block Chaining CBC mode will encrypt data using a predictable, all-zero IV. This deterministic encryption allows an attacker...

EUVD-2026-66677

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...

Generation of Predictable IV with CBC Mode

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Generation of Predictable IV with CBC Mode via AesBytesEncryptor when using the two-argument constructor or specifying a null I...

libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...

EUVD-2026-59939

In the Linux kernel, the following vulnerability has been resolved: crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly into the skcipher request. After iosubmit the socket lock is dropped and...

CVE-2025-59322: Generation of Predictable IV with CBC Mode

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext...

CVE-2026-14969

The CVE-2026-14969 entry concerns 389-ds-base. The LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC, enabling a privileged attacker with filesystem access to detect plaintext equality across encrypted entries by ciphertext block comparison. ...

CVE-2024-56141: Generation of Predictable IV with CBC Mode

Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager encryption routine CryptManager.kt initializes its AES cipher using an initialization vector IV that is set equal to the secret...

Malicious code in node-pino (npm)

node-pino is a one-edit typosquat of the popular pino logger that ships repackaged winston plus a malicious postinstall dropper. On npm install, the postinstall hook npm run license - node lib/winston/license spawns a DETACHED, unref'd child process that reads an AES-256-CBC-encrypted blob...

Exploit for Generation of Predictable IV with CBC Mode in Redhat Enterprise_Linux

C...

Security Bulletin: Securing your products against OpenSSL and TLS vulnerabilities

Question Security Bulletin: Securing your products against OpenSSL and TLS vulnerabilities "Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Product":"code":"SS8NDZ","label":"IBM Aspera","Component":"","Platform":"code":"PF025","label":"Platform Independent","Version":"All...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

copy-fail CVE-2026-31431 Copy Fail – a C language PoC,...

CVE-2026-40514

SmarterTools SmarterMail builds prior to 9610 are affected by a cryptographic weakness in file and email sharing endpoints. DES-CBC is used with keys and IVs derived from System.Random seeded with insufficient entropy, reducing the seed space to about 19,000 values. An unauthenticated attacker ca...

EUVD-2026-21235

A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated...