Matroschka

Матрёшка About Matroshka is a command-line steganography tool written in pure Python. You can use it to hide and encrypt images or text in the least significant bits of pixels in an image. Encryption The encryption uses HMAC-SHA256 to authenticate the hidden data. Therefore the supplied MAC...

CFB

What is it? !CAUTION CFB is meant for research and debug purposes, it should never be used on production systems. Also BSoD may happen. You've been warned. Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the...

sdc

+------------------------------------------------------------------------------+ SDC - Self Decrypting Binary Generator Copyright C 2006 Claes M Nyberg +------------------------------------------------------------------------------+ -= What is this The SDC program creates self decrypting binaries...

CVE-2025-56801

CVE-2025-56801 AES-CFB IV Generation Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-1204: Generation of Weak Initialization Vector IV, CWE-321: Use of Hard-coded Cryptographic Key CVSS : 5.1 MEDIUM Vector...

CVE-2025-56802

CVE-2025-56802 AES-CFB Key Generation and Management Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-321: Use of Hard-coded Cryptographic Key, CWE-522: Insufficiently Protected Credentials CVSS : 5.1 MEDIUM...

GO-2026-6689 Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize

Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize...

CVE-2026-85243

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...

EUVD-2026-104185

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...

CVE-2026-85243 Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...

Exploit for CVE-2026-85243

CVE-2026-85243 — camel-crypto-pgp: integrity-verification down...

CVE-2026-85243: Improper Validation of Integrity Check Value

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...

GHSA-2J4C-FFCH-9F23 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Summary Any file whose first 8 bytes are the OLE compound-file signature D0 CF 11 E0 A1 B1 1A E1 is routed by OpenFile/OpenReader/OpenBytes → openReaderAt → Decrypt. The version dispatch only guarantees lenEncryptionInfo = 4 before handing attacker-controlled EncryptionInfo/EncryptedPackage buffe...

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Summary extractPart allocates directly from the mscfb directory-entry size with no clamping crypt.go:198, same missing bound at crypt.go:204: go buf := makebyte, entry.Size entry.Size is the raw streamSize field from the attacker-controlled CFB directory entry mscfb v1.0.8 fixFile, file.go:109-12...

GHSA-X2Q3-8CJH-766F Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Summary extractPart allocates directly from the mscfb directory-entry size with no clamping crypt.go:198, same missing bound at crypt.go:204: go buf := makebyte, entry.Size entry.Size is the raw streamSize field from the attacker-controlled CFB directory entry mscfb v1.0.8 fixFile, file.go:109-12...

CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory...

CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory...

CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory...

CVE-2026-107215

The Excelize Go library (versions 2.3.1 to 2.11.0 ) is vulnerable to a remote panic or Out-of-Memory (OOM) Denial of Service due to improper validation of CFB directory-entry sizes. The extractPart function trusts the streamSize for EncryptionInfo and EncryptedPackage allocations before validatin...

Security Bulletin: Bouncy Castle(bcprov and bcpg) security vulnerability in IBM FileNet Content Manager(FNCM) reported for FileNet Deployment Manager(FDM)

Summary IBM FileNet Content ManagerFNCM 5.7.0-IF6 addresses multiple Bouncy Castle CVEs reported for FileNet Deployment ManagerFDM Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This iss...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...