publiccms_decrypt

publiccmsdecrypt https://github.com/sanluan/PublicCMS publiccms-core-V4.0.202004.a.jar!/com/publiccms/common/constants/CommonConstants.class publiccms-common-V4.0.202004.a.jar!/com/publiccms/common/tools/VerificationUtils.class com.publiccms.common.tools.VerificationUtils...

CVE-2019-6693

CVE-2019-6693 Decrypt FortiGate configuration secrets Original advisory Vendor advisory For Fortigate VM/appliances below versions 6.2.0, 6.0.0 to 6.0.6, 5.6.10 configuration secrets are stored encrypted with a unique key. For versions above the non-default private-data-encryption parameter lets...

CVE-2024-5764

CVE-2024-5764 This repository contains a Python script capable of exploiting CVE-2024-5764 by decrypting encrypted data with the static encryption key. Sonatype announcement available here. Usage root@kitploit: usage: cve-2024-5764.py -h -e ENCRYPTEDPAYLOAD -p PASSPHRASE Decrypt data encrypted by...

CVE-2023-45184

CVE-2023-45184 IBM i Access Client Solutions 1.1.9.4 - Local server broken access control. Timeline Vulnerability reported to vendor: 22.09.2023 New fixed 1.1.9.4 version released: 08.12.2023 Public disclosure: 15.12.2023 Description IBM i Access Client Solutions for storing temporary password...

cve-2019-6693

FortiGate パスワード復号スクリプト - CVE-2019-6693 🔐 標準の暗号化キーにアクセスできる、またはその知識を持つ認可されたリモートユーザーは、FortiOS バックアップファイル、およびすべての非管理者パスワード、秘密鍵、High Availability（HA）パスワードにアクセスして復号化できる可能性があります。 概要 この Python スクリプトは、FortiGate の暗号化方式で暗号化されたパスワードを復元するために設計されています。FortiOS 設定ファイルに保存されているユーザーパスワードと High...

eWeLink-QR-Code

eWeLink mobile Application - Incorrect Access Control Vulnerability CVE-2021-27941 Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application through 4.9.2 on Android and through 4.9.1 on iOS allows a physically proximate attacker...

poc-cribl-rce

Disclaimer This is for informational/educational purposes only. This was put together to demonstrate an insecurity in the tool, in order for a fix to be verified by the vendor. Info Tested on Cribl v1.5.0 - Previous versions not tested but likely vulnerable. A valid JWT token can be transfered fr...

CVE-2020-5248

CVE-2020-5248 Proof of Concept PoC for CVE-2020-5248. Summary GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The issue of a null pointer dereference error in generateencryptionkey has been fixed. If a client sends two session setups with KRB5 authentication to ksmbd, a null pointer dereference error in generateencryptionkey can...

CVE-2016-4437

CVE-2016-4437 Python POC to Exploit CVE-2016-4437 Apache Shiro Deserialization Vulnerability Due to Hardcoded Encryption Key Example Usage: ./CVE-2016-4437.py -c nslookup -u https://example.com/ -i ecsepnkqtxlishpynfdge01543e4vmx7v.oast.fun See comments and the code for more information...

CVE-2020-27688

CVE-2020-27688 Introduction RVTools is an application developed by Robware.net and is written in .NET 4.6.1. It interacts with vSphere enviroments to extract information in a CSV or XLSX format. It can be run through an GUI or using an input CSV File in which the information is stored to connect ...

magento2-encryption-key-manager-cli

Magento 2 加密密钥管理器 CLI 一款用于 Magento 2 加密密钥轮换和管理的实用工具。CVE-2024-34102（又名 Cosmic Sting）的受害者可将其用于善后处理。 设计用途 开发用途 部署自动化 CVE-2024-34102（又名 Cosmic Sting）善后处理 CVE-2024-34102（又名 Cosmic Sting） 应用安全补丁后，您需要执行一次密钥轮换，以完全阻止攻击者通过管理员级别的 WebAPI 访问。 如果您无法升级或应用官方隔离补丁，请参阅 我们的补丁。 如果官方的加密密钥轮换命令 php bin/magento...

EUVD-2026-75111

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-28590

In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28590

In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73949

In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28590

CVE-2026-28590 is an improper encryption key validation vulnerability in the Android core operating system and Media Framework , caused by a logic error in the code. It enables local privilege escalation with no additional execution privileges required and no user interaction. The vulnerability c...

CVE-2026-78325

CVE-2026-78325 is a cross-site scripting (XSS) vulnerability in the Evernote and Google Keep note importers of Standard Notes for Android through version 3.201.24 . An attacker can craft a malicious .enex or Google Keep HTML file that, when imported by a victim, executes arbitrary JavaScript in t...

CVE-2026-78325 XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...

CVE-2026-85147

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication...