CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

Объединенный скрытый канал: CVE-2023-1206 + CVE-2024-49882 Обзор Этот проект демонстрирует скрытый канал связи с использованием двух уязвимостей ядра Linux: Компонент| CVE| Назначение ---|---|--- Канал синхронизации| CVE-2023-1206| Синхронизация времени через измерение коллизий хеша IPv6 Канал...

jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

hashes

Magic hashes – PHP 해시 "충돌" password 1 로 등록한 다음 password 2 로 로그인해 보세요. 로그인에 성공한다면 저장소가 지정된 알고리즘으로 비밀번호를 해시하고 PHP가 ==를 사용해 비교한다는 뜻입니다MD5, SHA-1 및 plaintext의 경우. MD5, SHA-1, SHA-224, SHA-256 및 기타 MD5 , SHA-1 및 SHA-2 계열 의 경우, 오래전부터 알려진 트릭을 사용합니다실제로는 문서화된 기능입니다. PHP 유형 비교 표 및 부동 소수점 숫자를 참조하세요. PHP에서...

CVE-2026-21717

CVE-2026-21717 Node.js V8 문자열 해싱 예측 가능한 충돌 취약점으로 인한 서비스 거부DoS 개요 V8의 문자열 해싱 메커니즘의 심각한 취약점으로 인해 공격자가 Node.js 애플리케이션에서 심각한 성능 저하를 유발할 수 있습니다. 정수 형태의 문자열은 숫자 값으로 해싱되어 해시 충돌을 쉽게 예측할 수 있습니다. V8 내부 문자열 테이블에서 많은 충돌을 유발하는 악의적인 입력을 구성함으로써, 공격자는 성능을 크게 저하시키거나 서비스 거부를 유발할 수 있습니다. 취약점 세부 정보 CVE ID :...

cve-2022-22976-bcrypt-skips-salt

BCrypt 해시 확인 CVE-2022-xxxx에 대한 완화 조치를 지원하기 위해 이 도구를 사용하여 데이터베이스에서 업데이트가 필요한 해시가 있는지 확인할 수 있습니다. 애플리케이션을 데이터베이스와 통합한 후, 이 도구는 두 단계로 작동합니다. 이를 설명하기 위해 인메모리 샘플 애플리케이션이 사용됩니다. 해당 샘플 애플리케이션에서 다음과 같이 check 단계를 실행할 수 있습니다. root@kitploit: ./mvnw spring-boot:run@check 이렇게 하면 샘플 데이터베이스에서 업데이트가 필요한 BCrypt 해...

collisions

TL;DR 이제 이 두 이미지의 MD5 충돌을 만드는 것은 사소한 일이 되어 즉각적으로 가능합니다. ⟷ 불장난하지 마세요, MD5를 믿지 마세요. 임의의 두 파일 간의 충돌을 만드는 것은 수년 전부터 가능했지만, 매번 몇 시간이 걸렸고 지름길도 없었습니다. 이 페이지는 파일 형식별 트릭과 미리 계산된 충돌 접두사를 제공하여 충돌을 즉시 가능하게 합니다. git clone. 스크립트 실행. 끝. 해시 충돌과 악용 Ange Albertini와 Marc Stevens 지음. 소개 현황 공격 동일 접두어 FastColl MD5...

CVE-2026-40017

A flaw was found in Dovecot. A remote attacker who can send mail to a user can craft a message header designed to cause collisions in an internal hash table. This manipulation forces the IMAP THREAD command to consume excessive CPU resources, leading to degradation or a complete denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-40017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

AZL-98286 CVE-2026-40017 affecting package dovecot 2.3.20-1

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

CVE-2026-40017

Dovecot (per Open-Xchange advisory) is vulnerable to a hash-table collision in the IMAP THREAD command: an attacker who can send mail to a user can craft message header values that collide in an internal hash table, causing the THREAD command to consume CPU disproportionate to message size , lead...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

EUVD-2026-67666

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

UBUNTU-CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

PT-2026-83059

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can send a crafted email with message header values designed to collide in an internal hash table. This causes the IMAP THREAD command to consume CPU resources disproportionate to the...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A hash collision flaw was discovered in the IPv6 connection lookup table within the Linux kernel’s IPv6 functionality. This flaw occurs when a user carries out a new type of SYN flood attack. A user located within the local network or with a high-bandwidth connection can cause the CPU usage of th...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099723)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099723 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6vti: fix incorrect tunnel matching in vti6tnllookup In vti6tnllookup, when an exact match for ...