details-for-CVE-2022-46505

CVE-2022-46505 세부 정보 MatrixSSL 세션 재개 버그 1. 버그 설명 MatrixSSL 4.5.1-open 및 이전 버전의 문제로 인해 SessionID 필드가 안전하게 검사되지 않아 모두 0인 MasterSecret 이 잘못 사용되어 비밀 데이터를 복호화할 수 있습니다. 2. 영향을 받는 버전 MatrixSSL 4.5.1-open 및 이전 버전 3. 취약점 유형 TLS 재개 세션 복호화 4. 버그 세부 사항 MatrixSSL 서버는 협상된 세션 정보를 리스트를 통해 저장합니다. root@kitploit:...

kr00ker

kr00ker ============ 설명 이 스크립트는 KR00K 취약점CVE-2019-15126을 악용하기 위한 간단한 실험입니다. 이 취약점은 취약한 장치액세스 포인트 또는 클라이언트에서 일부 WPA2 CCMP 데이터를 복호화할 수 있게 합니다. 보다 구체적으로, 이 스크립트는 다음을 알 때 WPA2 CCMP 패킷의 복호화된 데이터를 검색하려고 시도합니다: TK 128비트 모두 0 Nonce 패킷 헤더에 평문으로 전송됨 암호화된 데이터 여기서: WPA2 AES-CCMP 복호화 -- AESNonce,TK XOR 암호화된 데...

bedaisy-bypass

bedaisy-bypass Description bedaisy-bypass は、BEDaisy.sys から BEService.exe に送信されるレポートをバイパスするために設計されたカーネルドライバです。UEFI を使用していないユーザーの場合、このプロジェクトは Infinity Hook...

EUVD-2026-80067

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...

CVE-2026-15638

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...

CVE-2026-15638 Cryptographic Padding Oracle

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...

CVE-2026-15638

Delinea Secret Server is affected by a cryptographic padding oracle vulnerability (CVE-2026-15638). An unauthenticated user with network access to the server can leverage the oracle to decrypt or encrypt data using one of the server's cryptographic keys; however, the key itself is not directly ex...

CVE-2020-5248

CVE-2020-5248 CVE-2020-5248 の概念実証 PoC 概要 GLPI のバージョン 9.4.6 以前には、デフォルトの暗号化キーに関する脆弱性があります。GLPIKEY は公開されており、すべてのインスタンスで使用されています。つまり、誰でもこのキーを使用して保存された機密データを復号化できます。GLPI...

CVE-2020-5248

CVE-2020-5248 POC 환경 구성 및 테스트 입니다. 테스트 방법 환경 구성 root@kitploit: vim docker/nginx/default.conf servername docker host ip ; -change mysqlserver: mysql id: root pw: root 실행 root@kitploit: cd docker/app/ tar -xvf /docker/app/glpi-9.4.5.tgz chmod -R 777 glpi docker-compose up -d glpi 접속...

CVE-2026-81821

CVE-2026-81821 affects AVEVA Pipeline Integrity Monitor (PIMBoards) due to the use of a hard-coded cryptographic key . An attacker with local read access to PIMBoards project files can decrypt and view sensitive information stored within them. The CVSS 3.1 score is 8.4 (HIGH) with changed scope, ...

CVE-2026-81821 AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

CVE-2025-36271

IBM Integrated Analytics System (IIAS) versions 1.0.0.0 through 1.0.31.0 are affected by a predictable salt vulnerability in the Magneto component (specifically the resmgr.py module). The use of a predictable salt in cryptographic operations (classified as CWE-759 ) weakens hashing and encryption...

CVE-2025-36271 IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-4937

IBM PowerVM Hypervisor (FW1110.00–FW1110.20, FW1060.00–FW1060.71, FW950.00–FW950.H2) is vulnerable to insufficient entropy (CWE-331) in certain hypervisor calls, allowing a local attacker with administrative privileges to decrypt encrypted data. The CVSS 3.1 score is 5.3 (Medium) with a local att...

EUVD-2026-62842

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested...

Security Bulletin: This Power System update is being released to address CVE-2026-4937

Summary PowerVM could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested. Vulnerability Details CVEID:CVE-2026-4937 DESCRIPTION: PowerVM could allow a local attacker with administrative privileges t...

CVE-2025-30239

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...

CVE-2026-69247 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

CVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

CVE-2026-56582 HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.

HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack...