29 matches found
Symantec Messaging Gateway 10 Exposure Of Stored AD Password
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'digest' require "openssl" class MetasploitModule 'Symantec Messaging Gateway 10 Exposure of Stored AD Password Vulnerability', 'Description' = %q This module wi...
Exploit for OS Command Injection in Php
CVE-2024-4577 PoC Exploit...
A new video series, Google Forms spam and the various gray areas of cyber attacks
I found the juxtaposition of stories on the Talos blog over the past week-plus kind of funny. On one hand, we had a massive story about Arid Viper, a Middle Eastern threat actor spreading spyware, one of the most dangerous types of malware out there right now, operating out of Gaza no less. Then,...
CVE-2022-45170
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without knowing the key set by the user...
CVE-2022-45170: Use of a Broken or Risky Cryptographic Algorithm
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without knowing the key set by the user...
CVE-2022-29054
A missing cryptographic steps vulnerability CWE-325 in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it...
CVE-2022-29054
A missing cryptographic steps vulnerability CWE-325 in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it...
Flaws over DHCP and DNS keys encryption scheme
...
CVE-2022-29054: Generation of Predictable IV with CBC Mode
A missing cryptographic steps vulnerability CWE-325 in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it...
SUSE CVE-2020-26572
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcosdecipher...
CVE-2022-29053
A missing cryptographic steps vulnerability CWE-325 in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below 7.0.0 may allow an attacker in possession of the encrypted file to decipher it...
Flaws over keytab encryption scheme
...
CVE-2022-29053: Undefined Security Weakness
A missing cryptographic steps vulnerability CWE-325 in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below 7.0.0 may allow an attacker in possession of the encrypted file to decipher it...
CVE-2021-32945
An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06...
CVE-2021-32945: Inadequate Encryption Strength
An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06...
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.
...
opensc: stack-based buffer overflow in tcos_decipher
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcosdecipher...
OSV-2020-2276 Negative-size-param in tcos_decipher
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28768 Crash type: Negative-size-param Crash state: tcosdecipher scdecipher usekey...
decipher.site123.me Cross Site Scripting vulnerability OBB-1479544
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...