CVE-2026-8794

CVE-2026-8794 — PaperCut NG 인증 타이밍 부채널을 통한 사용자명 열거 필드| 세부 정보 ---|--- CVE ID| CVE-2026-8794 제품| PaperCut NG 영향받는 버전| 25.0.11 Build 75758 및 이전 버전 CWE| CWE-208 — 관측 가능한 타이밍 불일치 CVSS 점수| 3.7 낮음 — 단독 기준, CVE-2026-8793과 연계 시 위험도 상승 연구자| Vivien LEBAS @Hazaz 보고일| 2026년 5월 상태| 패치 완료 — PaperCut NG 26.0.3 요...

CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

결합 은닉 채널: CVE-2023-1206 + CVE-2024-49882 개요 이 프로젝트는 두 가지 Linux 커널 취약점을 이용한 은닉 통신 채널을 시연합니다: 구성 요소| CVE| 용도 ---|---|--- 동기화 채널| CVE-2023-1206| IPv6 해시 충돌 타이밍을 통한 클록 동기화 데이터 채널| CVE-2024-49882| 대형 페이지hugepage 누수를 통한 컨테이너 간 데이터 전송 root@kitploit:...

AVX-Side-Channel

AVX 기반 타이밍 부채널 — ASLR 탐지 저자: Byte Reaper 설명 AVX 메모리 로드 + RDTSCP 타이밍 및 선택적 SIGSEGV 탐지를 사용하여 ASLR 탐지를 시연하는 스크립트입니다. 요구 사항 : Linux x8664 -mavx2를 지원하는 GCC AVX2 및 RDTSCP를 지원하는 CPU 빌드 : root@kitploit: gcc -mavx2 -O2 file.c -o AVX-Side-Channel ./AVX-Side-Channel 빠른 출력 예시 빠른 접근 → ASLR not detected 느린 접근 ...

Linux Distros Unpatched Vulnerability : CVE-2026-84308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php...

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

ssh-enum

ssh-enum Статистическое валидационное исследование CVE-2016-6210 Воспроизводимое повторное исследование перебора имён пользователей OpenSSH с использованием статистического анализа. Этот проект заново исследует CVE-2016-6210 , документированный побочный канал по времени в OpenSSH, чтобы определит...

CVE-2026-84308

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...

DEBIAN-CVE-2026-84308

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...

CVE-2026-84308 phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...

CVE-2026-84308

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...

CVE-2026-84308

phpseclib , a PHP secure communications library, has a non-constant-time X25519 scalar multiplication flaw in versions prior to 3.0.57 and 4.0.1 . The root cause is data-dependent conditional modular reductions in the pure-PHP implementation (Math/PrimeField/Integer.php), which leak per-step timi...

CVE-2026-84308 phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...

Security update for libapr-util1

This update for libapr-util1 fixes the following issues: CVE-2025-49506: leaking content via side channel timing attack bsc1274237. CVE-2026-32327: XML stack recursion crash bsc1274235. CVE-2026-34191: SQL Injection via aprdbdoracle bsc1274850. CVE-2026-34502: heap buffer overflow in APR memcache...

Alibaba Cloud Linux 3 : 0274: pam (ALINUX3-SA-2026:0274)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0274 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-54411: Linux-PAM through 1.7.2 contains an...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – ポスト量子KEMタイミングサイドチャネル（Kyberデカプセル化） 概要 Kyber KEMデカプセル化の脆弱な実装は、暗号文拒否ステップにおけるタイミング差を通じて秘密鍵のビットを漏洩させ、完全な鍵回復を可能にします。 深刻度: 重大（秘密鍵の侵害） 脆弱なサーバー（C言語）& 攻撃スクリプト（Python） root@kitploit: // kybervulndecaps.c - Simulated vulnerable Kyber decapsulation include include include include // Secret...

Amazon Linux 2023 : apr-util, apr-util-devel, apr-util-ldap (ALAS2023-2026-2115)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2115 advisory. APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

Amazon Linux 2 : apr-util, --advisory ALAS2-2026-3892 (ALAS-2026-3892)

The version of apr-util installed on the remote host is prior to 1.6.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3892 advisory. APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or password...

CVE-2026-55785

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ueauthentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES and XRES with...

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions. Two authentication flows are affected in internal/sbi/processor/ueauthentication.go: 1. 5G-AKA confirmation compares RES and...