PT-2025-2380 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions = 2.6.4 Description: A reachable assertion in the ogs kdf hash mme function allows attackers to cause a Denial of Service DoS via a crafted NAS packet. Recommendations: For Open5GS versions = 2.6.4, update to a version greate...

Authenticator 加密问题漏洞

Authenticator is an open source authenticator from Authenticator Extension. An encryption issue vulnerability exists in Authenticator version 7.0.0 and prior versions, which stems from the fact that user data encryption keys are stored using only AES-256 and EVPBytesToKey KDF, which could lead to...

PT-2024-40807 · Git +1 · Openssl

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a null-dereference read crash. Technical details include a crash type of null-dereference READ and a crash state involving do evp...

PT-2024-40808 · Git +1 · Openssl

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a null-dereference read crash. Technical details about the crash include the functions evp mac final, kbkdf derive, and do evp kd...

CVE-2024-29916

The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the ke...

CVE-2024-29916

The CVE describes a vulnerability in dormakaba Saflok systems (pre‑November‑2023 software update) where an attacker who has a valid active or expired keycard for a property can unlock arbitrary doors via forged keycards. The root cause is a UID‑only based key derivation function, affecting Saflok...

CVE-2024-29916

The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the ke...

Saflok - Key Derication Function Exploit

// Exploit Title: Saflok KDF // Date: 2023-10-29 // Exploit Author: a51199deefa2c2520cea24f746d899ce // Vendor Homepage: https://www.dormakaba.com/ // Version: System 6000 // Tested on: Dormakaba Saflok cards // CVE: N/A include include define MAGICTABLESIZE 192 define KEYLENGTH 6 define UIDLENGT...

CVE-2022-45195

CVE-2022-45195 affects SimpleXMQ <3.4.0 (used in SimpleX Chat

Mozilla: Stack buffer overflow in HKDF output

A flaw was discovered in both Firefox and Thunderbird where 4 bytes of a HMAC output could be written past the end of a buffer stored on the memory stack. This could allow an attacker to execute arbitrary code or lead to a crash. This flaw can be exploited over the network...

USN-3138-1 python-cryptography vulnerability

Markus Döring discovered that python-cryptography incorrectly handled certain HKDF lengths. This could result in python-cryptography returning an empty string instead of the expected derived key...

So I lost my OpenBSD FDE password

The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase. We know things get interesting when I lose a password. I did a weak attempt at finding some public bruteforce tool, and found nothing...

krb5: PKINIT null pointer deref leads to DoS

The pkinitserverreturnpadata function in plugins/preauth/pkinit/pkinitsrv.c in the PKINIT implementation in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a...

CVE-2005-3801

CounterPane PasswordSafe 1.x and 2.x allows local users to test possible encryption keys against a subset of the stored key data without performing the more expensive key derivation function KDF function, which reduces the search time in brute force attacks...