196 matches found
pixiewps
Resumen Pixiewps es una herramienta escrita en C utilizada para realizar un ataque de fuerza bruta fuera de línea al PIN de WPS aprovechando la baja o nula entropía de algunas implementaciones de software, el llamado "ataque pixie-dust" descubierto por Dominique Bongard en el verano de 2014. Está...
Shelltropy
Shelltropy The more predictable you are, the less you get detected A technique of hiding malicious shellcode based on low-entropy via Shannon encoding. Entropy is the measure of the randomness in a set of data here: shellcode. The higher the entropy, the more random the data is. Shannon Entropy i...
CVE-2025-63666
CVE-2025-63666 — Tenda AC15 Summary Tenda AC15 firmware V15.03.05.18multi issues an authentication cookie in the form password= and returns it without HttpOnly, Secure, or SameSite flags, exposing the password hash to the client. The low-entropy suffix acts as a predictable session identifier,...
claude-awm
claude-awm: can you scrub a SynthID text watermark by editing the text? Yes, but only one family of attack works, and it isn't the one everyone assumes. Unicode variation selectors category Mn, U+FE00 to U+FE0F and U+E0100 to U+E01EF drive the detector below threshold and stay there. Every other...
WTSRM
WTSRM - Writing Tiny Small Reliable Malware demo repository for my corresponding talk. Unhooks all Windows Dlls with \KnownDlls\ No CRT dependencies Small size Low entropy Random string encryption key thus no plaintext strings API hashing Hook detection Walks around hooks for initial unhooking on...
meshtastic-cve-2025-52464-poc
Prova di concetto di Meshtastic CVE-2025-52464 Panoramica Questo progetto è una prova di concetto esclusivamente software che dimostra CVE-2025-52464 , una vulnerabilità che interessa le versioni del firmware Meshtastic dalla 2.5.0 alla 2.6.10. L'implementazione riproduce il comportamento...
DEBIAN-CVE-2026-56706
Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...
CVE-2026-56706
Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...
CVE-2026-56706
Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...
EUVD-2026-65204
Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...
Linux Distros Unpatched Vulnerability : CVE-2026-56706
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone...
CVE-2026-19636
The CVE-2026-19636 issue concerns CSRF token generation using a predictable method. The connected documents confirm a fix that increases randomness and entropy in token generation, addressing the vulnerability. The description does not specify affected products, versions, or exploit details. The ...
CVE-2026-73230 Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets
Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...
CVE-2026-73230
Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...
CVE-2026-73230
The CVE covers Ente: 2of3 cards v1. Before 2026.07.28, the card format version 1 stored the secret byte length and a 32-bit FNV-1a checksum in cleartext on every card. This enables someone with one card to offline-test candidate secrets against low-entropy or predictable secrets, potentially comp...
CVE-2026-73230 Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets
Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...
CVE-2026-73230 Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets
Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...
EUVD-2025-210611
A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related...
CVE-2026-38447
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...