CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 단일 또는 배치 exp 사용 방법 공개 키 생성 python3 exp.py -u ip:port -k idrsa2048.pub -l hosts.txt로 파일 지정 일괄 실행 FOFA title="FortiGate"...

CVE-2026-29000-PoC

CVE-2026-29000 — pac4j-jwt JwtAuthenticator 인증 우회 PoC CVE-2026-29000 에 대한 개념 증명PoC입니다. 이는 pac4j-jwt의 JwtAuthenticator 구성 요소에서 발생하는 인증 우회 취약점입니다 CVSS 10.0 , 치명적. 이 스크립트는 비밀 키를 전혀 알지 못해도 대상이 RSA 공개 키를 노출하기만 하면, 모든 사용자를 가장하고 모든 역할을 부여받은 토큰을 위조합니다. !WARNING 이 도구는 교육 목적 및 승인된 보안 테스트 전용 으로 제공됩니다. Hack...

CVE-2026-29000

CVE-2026-29000 pac4j-jwt ライブラリに見つかった重大な認証バイパス脆弱性である CVE-2026-29000 の概念実証スクリプト 免責事項 この概念実証は、教育および倫理的なセキュリティテストの目的のみを対象としています。これは、HackTheBox ラボ環境の一部として CVE-2026-29000 の技術的な根本原因を実証するために開発されました。...

CVE-2026-0257

CVE-2026-0257: GlobalProtect 認証バイパス 概要 このエクスプロイトは、サーバーの公開されているTLS証明書 のみを使用して認証クッキーを偽造することで、Palo Alto GlobalProtect ゲートウェイ/ポータルへの未認証VPNアクセス を実現します。 核心となる脆弱性（なぜ機能するのか） GlobalProtect は、クライアントの認証を可能にする事前認証クッキー （portal-userauthcookie）を使用しています。ここに致命的な欠陥があります： root@kitploit: Normal Flow: 1. Client...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-31790 DESCRIPTION: Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a...

swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization

A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

PT-2026-64003

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP PKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

RockyLinux 10 : openssl (RLSA-2026:19066)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19066 advisory. openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-31790 Tenable has extracted the preceding description blo...

AZL-87909 CVE-2026-39829 affecting package kubernetes for versions less than 1.30.10-25

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...

AZL-88086 CVE-2026-39829 affecting package moby-engine for versions less than 25.0.3-18

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...

CVE-2026-39829

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...

EUVD-2026-19969

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process whi...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the RSASVE encapsulation process. An attacker can obtain sensitive information by supplying an invalid RSA public key and triggering the use of uninitialized memory contents as...

K000160641: pac4j vulnerability CVE-2026-29000

Security Advisory Description pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can...

GHSA-MVF2-F6GM-W987 fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

Summary The fix for GHSA-c2ff-88x2-x9pg CVE-2023-48223 is incomplete. The publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that the CVE patched. Details The f...

fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

Summary The fix for GHSA-c2ff-88x2-x9pg CVE-2023-48223 is incomplete. The publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that the CVE patched. Details The f...

CVE-2026-4603

Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations e.g., verify and encryption to collapse to...