CVE-2024-5764

CVE-2024-5764 このリポジトリには、静的暗号化キーを使用して暗号化データを復号化することで CVE-2024-5764 を悪用できる Python スクリプトが含まれています。Sonatype のアナウンスはこちらから入手できます。 使用方法 usage: cve-2024-5764.py -h -e ENCRYPTEDPAYLOAD -p PASSPHRASE Decrypt data encrypted by the Java PasswordCipher class CVE-2024-5764. options: -h, --help show this help...

CVE-2019-6693

CVE-2019-6693 FortiGate 구성 비밀번호 해독 원본 권고 공급업체 권고 Fortigate VM/어플라이언스에서 6.2.0 미만, 6.0.06.0.6, 5.6.10 버전의 경우 구성 비밀번호가 고유 키로 암호화되어 저장됩니다. 그 이상 버전에서는 기본값이 아닌 private-data-encryption 매개변수를 통해 사용자가 사용자 정의 키를 사용할 수 있습니다. 이는 오늘날에도 거의 사용되지 않습니다. 이 스크립트는 덤프된 구성에서 비밀번호를 해독합니다...

CVE-2026-57262

The CVE-2026-57262 vulnerability affects LOGO! Soft Comfort (All versions

EUVD-2026-51103

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

CVE-2026-54367

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

EUVD-2026-39592

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic...

CVE-2026-9220 Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic...

CVE-2024-39342

Entrust Instant Financial Issuance formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library i.e. DCG.Security.dll with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of t...

EUVD-2019-15297

Malware in sbrugna...

EUVD-2018-8951

Malware in sbrugna...

EUVD-2019-17742

Malware in sbrugna...

EUVD-2022-34888

Malicious code in bioql PyPI...

EUVD-2023-37448

Malicious code in bioql PyPI...

EUVD-2022-28660

Malicious code in bioql PyPI...

CVE-2023-33283

Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key...

CVE-2022-23724

Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...

CVE-2018-17177

An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs event logs and core dumps to a USB stick. These logs are RC4-encrypted with a 9-character password of ^JEd4W!I that is obfuscated by hiding ...

CVE-2024-12078 ECOVACS lawnmowers and vacuums static BLE GATT encryption key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

CVE-2024-5764 Nexus Repository 3 - Static hard-coded encryption passphrase used by default

Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database SMTP or HTTP proxy credentials, user tokens, tokens, among others. The affected versions relied on ...

CVE-2024-20280

A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used fo...