CVE-2019-5420-PoC

CVE-2019-5420-PoC PentesterLab을 위해 작성했습니다. PentesterLab을 이용하시는 분이라면 커닝하지 마세요. 직접 배우는 것이 훨씬 낫습니다. 누군가에게는 유용하길 바랍니다. 미래의 저에게는 아니더라도요 : 멋진 argparse 코드네요. 나쁘지 않은 PoC입니다. 사용법 usage: script.py -h --appname APPNAME --cookie COOKIE --modify KEY VALUE CVE-2019-5420 options: -h, --help show this help messa...

CVE-2017-1000486

CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 또는 6.0 - 원격 코드 실행 익스플로잇 요구 사항을 설치하려면 다음을 실행하세요: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt 익스플로잇 사용 방법은 다음과 같습니다: $ python primefaces.py -h...

CLEANSTART-2026-GK62523 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the cri-tools package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2026-19553

A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...

Malicious code in imgbundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350 The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypt...

Malicious code in contoso-login-sim-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062ce76699c91a883d24e3ad609bb04faa3f52cbeaecfb24c1c3bcde8b496a5c Package ships a single 138 KB browser script whose entire body is an RC4-encrypted base64 blob decoded at runtime by an inline RC4 routine zc with a...

Seecret.it

📦 Seecret.it — 안전한 일회용 링크 공유 Seecret.it은 암호화된 일회용 링크를 통해 비밀번호, 문서 또는 민감한 정보를 공유할 수 있는 온라인 서비스입니다. 귀하의 데이터는 보이지 않고 안전하게 유지되며 열람 후 자동 파기됩니다. IT팀, 기업, 프리랜서 및 기밀 정보를 안전하게 전송하려는 모든 사람에게 이상적입니다. 🔐 주요 기능 서버 측 암호화 및 열람 후 자동 삭제 일회용 또는 사용자 지정 기간 링크 비밀번호, 메모, 메시지 또는 파일의 안전한 공유 선택적 2차 비밀번호 보호 액세스 통계 날짜, IP,...

CLEANSTART-2026-LW45744 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the minio-operator package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CVE-2022-3656

Imperva Red Team은 최근 Google Chrome 및 Chromium 기반 브라우저의 25억 명 이상의 사용자에게 영향을 미치는 CVE-2022-3656이라는 취약점을 공개했습니다. 이 취약점은 암호화된 지갑 및 클라우드 제공업체 자격 증명과 같은 민감한 파일의 탈취를 허용합니다. 취약점 세부 정보: 1.https://bugs.chromium.org/p/chromium/issues/detail?id=1345275c34...

Ironsquirrel

IRONSQUIRREL 本项目旨在以加密方式向受害者浏览器传递浏览器漏洞利用代码。采用椭圆曲线 Diffie-Hellman（secp256k1）进行密钥协商，并使用 AES 进行加密。 通过以加密方式向受害者传递漏洞利用代码（和 shellcode），攻击无法被重放。同时，HTML/JS 源代码经过加密，从而显著增加了逆向分析漏洞利用代码的难度。 如果您不明白我在说什么，请搜索“如何隐藏您的浏览器 0-day 漏洞”，并查看我的演讲。或者可以在 YouTube 上观看：https://www.youtube.com/watch?v=eyMDd98uljI 或者查看 SlideShar...

CVE-2026-75806: Improper Validation of Specified Quantity in Input

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is rout...

enseal

enseal 개발자를 위한 안전하고 일회성인 비밀 공유. Slack에 비밀을 붙여넣는 것을 중단하세요. enseal은 안전하지 않은 경로보다 안전한 경로를 더 빠르게 만듭니다 — 암호화된 일회용 채널을 통해 .env 파일과 비밀을 명령 하나로, 설정 없이 공유하세요.bash sender $ enseal share .env Share code: 7-guitarist-revenge Secrets: 14 variables staging Expires: on first receive recipient $ enseal receive...

Kothamine malware uses Tailscale’s tailcat to evade network detection

We discovered an undocumented remote-access Trojan RAT called Kothamine Agent. It supports more than 30 commands and it gives attackers control of an infected Windows computer: they can run commands, read and change files, and add new capabilities. Some versions can also steal browser data and...

PT-2026-98997

Creating a "2dsphere bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable encrypted range" indices. This issue affects MongoDB...

EUVD-2026-85707

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-81208

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-81208 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-81208

The IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a critical flaw where the pull endpoint improperly handles encrypted credentials. The system decrypts {dsnextenc}/{encval} blobs using the cluster-wide DSNEXT_SEC_KEY and re-encrypts them under a caller-supplied AES key/IV. Because ...

CVE-2026-81208 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-63273

A flaw was found in LibreOffice Draw. This vulnerability allows a remote attacker to cause a denial of service by crafting a specially designed encrypted PDF document. When a user opens this malicious document, a heap buffer overflow occurs because the software incorrectly handles the decryption...