253 matches found
go-pkcs12
包 pkcs12 root@kitploit: import "software.sslmate.com/src/go-pkcs12" 包 pkcs12 实现了 PKCS12（也称为 P12 或 PFX）的部分功能。它用于解码 DER 编码的 P12/PFX 文件，以便与 crypto/tls 包一起使用，以及编码 P12/PFX 文件供不支持新格式的旧版应用程序使用。由于 PKCS12 使用弱加密原语，因此不应将其用于新的应用程序。 请注意，仅支持 DER 编码的 PKCS12 文件，尽管 PKCS12 允许 BER 编码。这是因为 encoding/asn1 仅支持 DER。...
CVE-2026-6837-zyxel-export-cgi-command-injection
CVE-2026-6837：Zyxel export-cgi PKCS12 命令注入 本仓库整理了 CVE-2026-6837 的公开分析文章、快速验证脚本及配套证据。 这是什么 CVE-2026-6837 是 Zyxel export-cgi 处理器中的一个认证后命令注入漏洞。在 category=pkcs12 分支中，处理器根据证书名称和导出密码构造一条 shell 命令，然后将该字符串传递给 system。密码中精心构造的双引号会突破预期字符串边界并执行 shell 语法。 本仓库中的本地逆向工作以 WAX650S V7.10ABRM.4C0 为基准，但 Zyxel 于...
CVE-2025-11187
CVE-2025-11187 Desbordamiento de búfer de pila en la longitud de clave PBKDF2 de PKCS12 PBMAC1 OpenSSL 3.X Encontré este desbordamiento de búfer de pila hace aproximadamente un año, resultó ser un duplicado CVE-2025-11187 El problema ocurre en el manejo de PKCS PBMAC1 de libcrypto cuando la...
PoC-CVE-2025-69421
CVE-2025-69421 仅崩溃复现器 本仓库包含一个最小的畸形 PKCS12 文件，可在隔离的实验室环境中复现 CVE-2025-69421。 生成的 PFX 包含 EncryptedData，其 EncryptedContentInfo 省略了可选的 encryptedContent 字段。易受影响的 OpenSSL 版本可能会将 NULL ASN1OCTETSTRING 指针从 PKCS12unpackp7encdata 传递给 PKCS12itemdecryptd2iex，而后者在未进行 NULL 检查的情况下解引用该指针。...
CVE-2026-13586
A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting an iteration-count bound issue in the PKCS12 Message Authentication Code MAC and bag-decryption Key Derivation Function KDF. This could make the affected system...
Exploit for CVE-2026-6837
CVE-2026-6837: Zyxel export-cgi PKCS12 Command Injection T...
CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection
Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...
CVE-2026-47232
Admidio prior to v5.0.10 exposes a sensitive action (mode=export) that returns a PKCS#12 bundle containing the private key and certificate without requiring CSRF validation. The vulnerability arises because the CSRF check in modules/sso/keys.php is commented out, enabling a forged POST from an au...
CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection
Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...
CVE-2026-13586
In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...
CVE-2026-42015
A flaw was found in gnutls. An off-by-one error exists in the PKCS12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of...
RockyLinux 8 : openssl (RLSA-2026:3042)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:3042 advisory. openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS12 processing CVE-2025-69419 Tenable has extracted the preceding description block...
openssl security update
An update is available for openssl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transpo...
MiracleLinux 8 : openssl-1.1.1k-15.el8_6 (AXSA:2026-218:06)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-218:06 advisory. openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS12 processing CVE-2025-69419 Tenable has extracted the preceding description bloc...
openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
A flaw was found in OpenSSL. When processing a specially crafted PKCS12 Personal Information Exchange Syntax Standard file, a remote attacker can exploit an out-of-bounds write vulnerability. This issue, occurring within the OPENSSLuni2utf8 function, leads to memory corruption by writing data...
openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing
A flaw was found in OpenSSL. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by providing a specially crafted, malformed PKCS12 file to an application that processes it. The flaw occurs due to a NULL pointer dereference in the PKCS12itemdecryptd2iex function when...
EUVD-2012-2197
Malware in sbrugna...
EUVD-2018-0124
Malware in sbrugna...