CVE-2024-3183-POC

CVE-2024-3183-POC POC for CVE-2024-3183 FreeIPA Rosting Impact: A low-privileged user can obtain a hash of the passwords of all domain users and perform offline brute force kerberoasting. Patch impacket-getTGT: 1. Add decoder.decode.defaultErrorState = stGetValueDecoderByTag to...

pixiewps

概要 Pixiewps はC言語で書かれたツールで、一部のソフトウェア実装における低エントロピーまたはエントロピー欠如を利用してWPS PINをオフラインでブルートフォースする ためのものです。これは、2014年夏にDominique Bongardによって発見された、いわゆる「ピクシーダスト攻撃」です。教育目的のみを意図しています。 ReaverやBullyなどのツールで実装されている従来のオンラインブルートフォース攻撃（PINを数時間で回復することを目的とする）とは対照的に、この方法は、ターゲットによっては、脆弱な場合 、わずか数秒 または数分 でPINを取得できます。...

o5logon-fetch

o5logon-fetch 一个小型Java程序，用于尝试在易受攻击的Oracle 11服务器上利用CVE-2012-3137漏洞。通过利用此漏洞，您可以运行离线暴力破解攻击，直到发现指定用户的密码，且不会留下明显审计痕迹。 漏洞详情 关于此漏洞的详细文章（包括如何防范）可在此处找到。 替代工具 此工具的替代方案是一个位于此处的nmap脚本。 如果您不想使用工具，可以手动完成这些工具的功能，方法如下： 从Oracle获取包含Instant Client包的SQLPlus。 启动数据包捕获工具，例如Wireshark。 使用SQLPlus以您要攻击的用户身份登录，并使用虚假密码。...

Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3755)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243755 advisory. CVE-2024-2698 freeipa: delegation rules allow a proxy service to impersonate any user to access another target service CVE-2024-3183 freeipa: user can obta...

Rocky Linux 9 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3754)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243754 advisory. freeipa: delegation rules allow a proxy service to impersonate any user to access another target service CVE-2024-2698 freeipa: user can obtain a hash of t...

AlmaLinux 9.2 [TuxCare] Security Update: ipa-client / ipa-client-common / ipa-client-epn / ipa-client-samba / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763391572)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763391572 advisory. - A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for...

CVE-2026-97469

A flaw was found in PostgreSQL Anonymizer. An authenticated, unprivileged masked user can bypass access restrictions to execute restricted functions by embedding function calls within a subquery. By repeatedly invoking functions such as anon.hash, an attacker can collect output to deduce the...

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

EUVD-2026-87134

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469: Use of Weak Hash

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

CVE-2026-86187 WWBN AVideo Weak PRNG Password Generation via External Login

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-86187: Use of Insufficiently Random Values

WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...

CVE-2026-81718

opensslencrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping password...

CVE-2026-81718 openssl_encrypt before 1.4.9 Weak Cryptographic Parameters

opensslencrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping password...

CVE-2026-81718 openssl_encrypt before 1.4.9 Weak Cryptographic Parameters

opensslencrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping password...

CVE-2026-81697: Untrusted Search Path

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2026-75112

OTTO® Fleet Manager uses an insufficient bcrypt work factor, lowering the computational cost for offline brute-force attacks on stored password hashes if an attacker obtains an unencrypted system backup. CVSS 6.9 (Medium), ADJACENT vector. No exploitation reported; Rockwell advisory SD1791 refere...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...