CVE-2022-40684

CVE-2022-40684 CVE-2022-40684の単独またはバッチ用exp 使用方法 公開鍵を生成 python3 exp.py -u ip:port -k idrsa2048.pub -l hosts.txtでファイルを指定してバッチ処理 FOFA title="FortiGate"...

CVE-2026-29000

CVE-2026-29000 pac4j-jwt ライブラリに見つかった重大な認証バイパス脆弱性である CVE-2026-29000 の概念実証スクリプト 免責事項 この概念実証は、教育および倫理的なセキュリティテストの目的のみを対象としています。これは、HackTheBox ラボ環境の一部として CVE-2026-29000 の技術的な根本原因を実証するために開発されました。...

CVE-2026-0257

CVE-2026-0257: GlobalProtect 認証バイパス 概要 このエクスプロイトは、サーバーの公開されているTLS証明書 のみを使用して認証クッキーを偽造することで、Palo Alto GlobalProtect ゲートウェイ/ポータルへの未認証VPNアクセス を実現します。 核心となる脆弱性（なぜ機能するのか） GlobalProtect は、クライアントの認証を可能にする事前認証クッキー （portal-userauthcookie）を使用しています。ここに致命的な欠陥があります： root@kitploit: Normal Flow: 1. Client...

CVE-2026-29000-PoC

CVE-2026-29000 — pac4j-jwt JwtAuthenticator 認証バイパス PoC これは、pac4j-jwt の JwtAuthenticator コンポーネントにおける認証バイパス（CVSS 10.0 、緊急）である CVE-2026-29000 の概念実証（PoC）です。 このスクリプトは、ターゲットが RSA の公開 鍵を提供している限り、いかなる秘密も知らなくても、 任意のユーザーと任意のロールを偽装するトークンを偽造します。 !WARNING このツールは教育目的および許可されたセキュリティテスト専用 に提供されます。Hack The Box のマシ...

CVE-2026-67276: Improper Verification of Cryptographic Signature

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

pac4j-check v0.2.0

pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...

Amazon Linux 2023 : swiftlang, swiftlang-lib (ALAS2023-2026-2073)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2073 advisory. When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-31790 DESCRIPTION: Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a...

swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization

A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

PT-2026-64003

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP PKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823: Double Free

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

RockyLinux 10 : openssl (RLSA-2026:19066)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19066 advisory. openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-31790 Tenable has extracted the preceding description blo...

AZL-87909 CVE-2026-39829 affecting package kubernetes for versions less than 1.30.10-25

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...

AZL-88086 CVE-2026-39829 affecting package moby-engine for versions less than 25.0.3-18

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...

CVE-2026-39829

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...

EUVD-2026-19969

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process whi...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the RSASVE encapsulation process. An attacker can obtain sensitive information by supplying an invalid RSA public key and triggering the use of uninitialized memory contents as...