74 matches found
DumpBrowserSecrets
DumpBrowserSecrets Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers Chrome, Microsoft Edge, Firefox, Opera, Opera GX, and Vivaldi. Quick Links Maldev...
CS-Remote-OPs-BOF
Remote Operations BOF This repo serves as an addition to our previously released SA repo. Our original stance was that we would not release our tooling that modified other systems, and we would only provide information gathering tooling in a ready to go format. Over time, we have seen many other...
SUSE CVE-2026-119283
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...
database-druid
druid encode java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools åÆē Example: java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools jas502n...
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
Summary joserfc.jwe.decryptjson, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation decryptcek for every recipient present in the input, with no cap on recipient...
GHSA-JPXQ-7H8P-2Q76 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
Summary joserfc.jwe.decryptjson, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation decryptcek for every recipient present in the input, with no cap on recipient...
CVE-2026-119283
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...
CVE-2026-119283 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...
CVE-2026-119283
The joserfc Python library, prior to version 1.7.5 , is vulnerable to a CPU exhaustion Denial of Service (DoS) attack. The issue resides in the joserfc.jwe.decrypt_json() function, which processes a JWE General JSON Serialization recipients array without enforcing a count limit. An unauthenticate...
CVE-2026-119283 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...
CVE-2026-119283 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...
CVE-2026-63578
Allocation of resources without limits in password-based private-key decryption PbeUtilities.GenerateCipherParameters in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS8 EncryptedPrivateKeyInfo or "ENCRYPTED PRIVAT...
CVE-2026-63578
Allocation of resources without limits in password-based private-key decryption PbeUtilities.GenerateCipherParameters in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS8 EncryptedPrivateKeyInfo or "ENCRYPTED PRIVAT...
EUVD-2026-91229
Allocation of resources without limits in password-based private-key decryption PbeUtilities.GenerateCipherParameters in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS8 EncryptedPrivateKeyInfo or "ENCRYPTED PRIVAT...
CVE-2026-63578
The bc-csharp library (versions before 2.7.0 ) by Legion of the Bouncy Castle Inc. is vulnerable to a denial of service via CPU exhaustion in the PbeUtilities.GenerateCipherParameters function. This is caused by the allocation of resources without limits during password-based private-key decrypti...
PT-2026-104137
šØ CVE-2026-63578 Allocation of resources without limits in password-based private-key decryption PbeUtilities.GenerateCipherParameters in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS8 EncryptedPrivateKeyInfo or...
CVE-2026-14663
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...
UBUNTU-CVE-2026-14663
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...
EUVD-2026-57832
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...
CVE-2026-14663 PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...