bkcrack

bkcrack 使用 Biham 和 Kocher 的已知明文攻击破解传统 ZIP 加密。 概述 ZIP 归档可能包含许多条目，其内容可以被压缩和/或加密。 具体来说，条目可以使用基于密码的对称加密算法进行加密，该算法通常称为传统 PKWARE 加密、传统加密或 ZipCrypto。 该算法生成一个伪随机字节流（密钥流），通过与条目内容（明文）进行异或运算来产生加密数据（密文）。 生成器的状态由三个 32 位整数组成，使用密码初始化，并在加密过程中随着明文不断更新。 这种加密算法容易受到已知明文攻击，如 Eli Biham 和 Paul C. Kocher 的研究论文《对 PKZIP...

bkcrack

bkcrack Crack legacy zip encryption with Biham and Kocher's known plaintext attack. Overview A ZIP archive may contain many entries whose content can be compressed and/or encrypted. In particular, entries can be encrypted with a password-based symmetric encryption algorithm referred to as...

NOW

NØW — Word-Based Shellcode Encoder Encode shellcode as natural-looking English prose. Decode it back with the right sentence + password. What is NØW? NØW Natural Output Words is a C tool that converts raw shellcode bytes into human-readable English text — either a plain list of codewords or fluen...

CVE-2026-74578

In the Linux kernel, the following vulnerability has been resolved: crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly into the skcipher request. After iosubmit the socket lock is dropped and...

CVE-2026-74578

CVE-2026-74578 affects the Linux kernel crypto/algif_skcipher path. The AIO/async path in skcipher_recvmsg() could expose an attacker-controlled IV by overwriting ctx->iv via concurrent ALG_SET_IV writes, enabling IV/keystream reuse for CTR/stream modes and potentially plaintext recovery of co...

JLSEC-2026-1156 Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker...

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...

PT-2026-57670

The EVbee Service Android app uses TLS encrypted communication HTTPS, but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is...

MAL-2026-6495 Malicious code in animatecss-postcss-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be12cec08d0999c157774b746c3e431825ae61635bb8ddddf36061d4602cec7 [email protected] ships a tiny PostCSS plugin factory whose body contains an obfuscator.io-style string-array + RC4 decoder functions...

PT-2026-52970

Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a...

SUSE CVE-2026-9076

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-9076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can...

CVE-2026-9076

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...

AZL-89873 CVE-2026-9076 affecting package edk2 for versions less than 20240524git3e722403cd16-18

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...

ALPINE-CVE-2026-9076

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...

AZL-89790 CVE-2026-9076 affecting package openssl-fips-provider 3.1.2-2

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...

CVE-2026-9076

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...

CVE-2026-9076

The OpenSSL library is vulnerable to a heap out-of-bounds read in the kek_unwrap_key() function during CMS password-based decryption (RFC 3211 / PWRI key unwrap). This occurs because an attacker-chosen stream-mode KEK cipher can bypass length checks, leading to an over-read of a few bytes. While ...

CVE-2026-9076 Out-of-Bounds Read in CMS Password-Based Decryption

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...

PT-2026-47856

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A heap out-of-bounds read can occur during CMS password-based decryption RFC 3211 / PWRI key unwrap when processing attacker-supplied CMS data. The issue arises in the kek unwrap key function...

CVE-2026-9076

Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of...