CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

결합 은닉 채널: CVE-2023-1206 + CVE-2024-49882 개요 이 프로젝트는 두 가지 Linux 커널 취약점을 이용한 은닉 통신 채널을 시연합니다: 구성 요소| CVE| 용도 ---|---|--- 동기화 채널| CVE-2023-1206| IPv6 해시 충돌 타이밍을 통한 클록 동기화 데이터 채널| CVE-2024-49882| 대형 페이지hugepage 누수를 통한 컨테이너 간 데이터 전송 root@kitploit:...

CVE-2026-21717

CVE-2026-21717 Node.js V8 文字列ハッシュの予測可能な衝突によるサービス拒否（DoS）の脆弱性 概要 V8の文字列ハッシュ機構における重大な脆弱性により、攻撃者はNode.jsアプリケーションに深刻なパフォーマンス低下を引き起こすことができます。整数のような文字列は数値にハッシュされるため、ハッシュ衝突を簡単に予測できます。V8の内部文字列テーブルで多数の衝突を引き起こす悪意のある入力を細工することで、攻撃者はパフォーマンスを著しく低下させたり、サービス拒否を引き起こしたりすることができます。 脆弱性の詳細 CVE ID : CVE-2026-21717 深刻度 ...

hashes

Magic hashes – PHP 해시 "충돌" password 1 로 등록한 다음 password 2 로 로그인해 보세요. 로그인에 성공한다면 저장소가 지정된 알고리즘으로 비밀번호를 해시하고 PHP가 ==를 사용해 비교한다는 뜻입니다MD5, SHA-1 및 plaintext의 경우. MD5, SHA-1, SHA-224, SHA-256 및 기타 MD5 , SHA-1 및 SHA-2 계열 의 경우, 오래전부터 알려진 트릭을 사용합니다실제로는 문서화된 기능입니다. PHP 유형 비교 표 및 부동 소수점 숫자를 참조하세요. PHP에서...

cve-2022-22976-bcrypt-skips-salt

BCrypt 哈希检查 为协助缓解 CVE-2022-xxxx 的修复步骤，您可以使用此工具检查数据库中需要更新的哈希。 在您将应用程序 与数据库集成 后，该工具分两步工作。 为了演示，这里使用了一个内存中的示例应用程序。 在该示例应用程序上，您可以像这样运行 check 步骤： root@kitploit: ./mvnw spring-boot:run@check 这将检查示例数据库中任何需要更新的 BCrypt 哈希。 然后，您可以像这样运行 update 步骤： root@kitploit: ./mvnw spring-boot:run@update...

CVE-2026-40017

A flaw was found in Dovecot. A remote attacker who can send mail to a user can craft a message header designed to cause collisions in an internal hash table. This manipulation forces the IMAP THREAD command to consume excessive CPU resources, leading to degradation or a complete denial of service...

collisions

TL;DR 이제 이 두 이미지의 MD5 충돌을 만드는 것은 사소한 일이 되어 즉각적으로 가능합니다. ⟷ 불장난하지 마세요, MD5를 믿지 마세요. 임의의 두 파일 간의 충돌을 만드는 것은 수년 전부터 가능했지만, 매번 몇 시간이 걸렸고 지름길도 없었습니다. 이 페이지는 파일 형식별 트릭과 미리 계산된 충돌 접두사를 제공하여 충돌을 즉시 가능하게 합니다. git clone. 스크립트 실행. 끝. 해시 충돌과 악용 Ange Albertini와 Marc Stevens 지음. 소개 현황 공격 동일 접두어 FastColl MD5...

Linux Distros Unpatched Vulnerability : CVE-2026-40017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

AZL-98286 CVE-2026-40017 affecting package dovecot 2.3.20-1

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

CVE-2026-40017

Dovecot (per Open-Xchange advisory) is vulnerable to a hash-table collision in the IMAP THREAD command: an attacker who can send mail to a user can craft message header values that collide in an internal hash table, causing the THREAD command to consume CPU disproportionate to message size , lead...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

EUVD-2026-67666

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

UBUNTU-CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

PT-2026-83059

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can send a crafted email with message header values designed to collide in an internal hash table. This causes the IMAP THREAD command to consume CPU resources disproportionate to the...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: Fixed the logic for accounting bulk flows in order to ensure host fairness. In schcake, we keep track of the number of active bulk flows per host. This is done when running in the dst/src host fairness mode, which...

AZL-96132 CVE-2026-74567 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyringgetkeychunk For description-level chunks keyringgetkeychunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

UBUNTU-CVE-2026-74567

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyringgetkeychunk For description-level chunks keyringgetkeychunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

CVE-2026-74315

In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first LOCKDFHHASHSIZE bytes of nfsfh.data when bucketing nlmfiles, independent of fh.size. Commit 3de744ee4e45 "lockd: Use xdrgen XDR functions fo...