ecdsa-private-key-recovery

ecdsa-key-recovery 执行ECDSA和DSA nonce重用私钥恢复攻击 一个用于分析签名漏洞的密码学研究工具 让我们恢复两个共享相同 nonce k 的签名所对应的私钥。请注意，选择相同的 nonce k 会导致两个签名具有相同的签名值 r。要找到ECDSA nonce重用的良好候选者，请检查在不同消息（或哈希）上共享相同 r、pubkey 和 curve 的签名。例如，基于 bitcoind 的区块链项目通常是ECDSA签名材料的良好来源。 sampleA r , sA, hashA , pubkey, curve sampleB r , sB, hashB ,...

walletool

walletool 一个用于读取 wallet.dat 文件的工具 一个用于从 wallet.dat 文件中提取加密货币钱包数据的实用工具。 安装 安装 Python 3.x。 安装 bsddb3 模块（如果你使用的是 Windows，请使用 Gohlke 的网站）。 从 Bitcoin-QT/Litecoin-QT 钱包中提取私钥 准备好你的 wallet.dat 文件。 对于 Bitcoin，运行 python wtextractkeys.py -d wallet.dat -v 0 对于 Litecoin，运行 python wtextractkeys.py -d wallet.da...

CVE-2019-14222

CVE-2019-14222: Alfresco Communityのデフォルト証明書 Alfresco Community 5.x以下には、デフォルトで既知の秘密証明書のセットが同梱されています。ローカルマシンにAlfresco Communityソフトウェアをダウンロードしてインストールした人は誰でも、これらのファイルにアクセスできます。 これらの秘密鍵を入手すると、以下のことが可能になります： Solrへのアクセスを取得（x509証明書認証を使用） 信頼されたAlfresco証明書を使用してアクティブなMITM攻撃を開始...

ledger-app-monero-1.42-vuln

CVE-2020-6861: Ledger Monero アプリの送金鍵抽出 記事のPoCリポジトリ: https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html...

CVE-2026-90542

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the...

CVE-2026-90538

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later...

EUVD-2026-76869

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the videofromprogram API endpoint, allowing unauthenticated access to private playlist contents. Attackers can query the API without authentication to enumerate private playlist names, owne...

CVE-2026-90542 WWBN AVideo Missing Authorization via remindMe.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the...

CVE-2026-90538

WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain a missing authorization vulnerability in playlistsFromUser.json.php . The root cause is improper cache keying that conflates requests across different user contexts, allowing unauthenticated attackers to retrieve...

CVE-2026-90538 WWBN AVideo Missing Authorization via playlistsFromUser.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later...

walletool

walletool a tool for reading wallet.dat files A utility for extracting cryptocurrency wallet data from wallet.dat files. To set up the software on Windows or macOS, Windows and Linux users see the guide; macOS users can use the DMG file. Validate your Windows setup for Git and Python...

ecdsa-private-key-recovery

ecdsa-key-recovery 执行ECDSA和DSA随机数重用私钥恢复攻击 一个用于分析签名漏洞的密码学研究工具 让我们恢复两个共享相同 nonce k 的签名所对应的私钥。请注意，选择相同的 nonce k 会导致两个签名具有相同的签名值 r。要找到ECDSA随机数重用的良好候选者，请检查在 curve 上具有相同 r、pubkey 但针对不同消息（或哈希）的签名。例如，基于 bitcoind 的区块链项目通常是ECDSA签名材料的良好来源。 sampleA r , sA, hashA , pubkey, curve sampleB r , sB, hashB , pubkey...

CVE-2026-87797

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

CVE-2026-84025

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

CVE-2026-87797 Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

CVE-2026-87797

The Sprout Invoices WordPress plugin before 20.8.16 has a missing authorization check on the si_edit_private_note AJAX action. Because no capability or ownership verification is performed, any authenticated user with the subscriber role (or higher) can overwrite private notes belonging to other u...

EUVD-2026-76799

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

Linux Distros Unpatched Vulnerability : CVE-2026-89758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/mempolicy: skip non-present PMDs when queueing folios Patch series mm: handle device-private PMDs in walk callbacks, v3. Since commit 368076f52ebe...

DEBIAN-CVE-2026-89758

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...

CVE-2026-89758

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...