padre

padre padre は、CBCモード暗号に対するPadding Oracle攻撃のための高度なエクスプロイターです。 特徴: 高速で並行処理に対応した実装 トークンの復号 任意のデータの暗号化 Padding Oracleの自動フィンガープリンティング 暗号ブロック長の自動検出 ヒント！操作中に失敗が発生した場合、成功するために調整できる点についてヒントを提供します GET/POSTパラメータ、Cookie内のトークンをサポート エンコードルールの柔軟な指定（base64、hexなど） デモ インストール/アップデート...

lucky13

LUCKY13 Exploit 이 리포지토리는 암호화 시스템에서 CBC암호 블록 체인 모드의 특정 구현에 대한 타이밍 공격인 LUCKY13 취약점CVE-2013-0169에 대한 개념 증명POC 익스플로잇을 포함합니다. 이 익스플로잇은 패딩 검증에 따른 응답 시간 차이를 이용하여 대상 토큰을 복호화하는 것을 목표로 합니다. 전제 조건 익스플로잇을 실행하기 전에 다음 사항이 준비되어 있는지 확인하십시오: 머신에 Python 3.x가 설치되어 있어야 합니다. requests 라이브러리. 작동 방식 익스플로잇은 다음과 같이 작동합니다:...

CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

Exploit for CVE-2026-21847

CVE-2026-21847: Hardcoded AES Encryption Key in DPDC Customer...

CVE-2026-24772

OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a share...

CVE-2026-24772

OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a share...

CVE-2026-24772 OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a share...

CVE-2026-24772

OpenProject 17.0 introduced a synchronization server that exchanges an encrypted authentication token with the backend. The backend generates a 24-hour token, encrypted with a shared secret, which the frontend passes to the synchronization server. The synchronization server fails to validate the ...

CVE-2026-24772 OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a share...

CVE-2026-24772: Insufficient Verification of Data Authenticity

OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a share...

CVE-2025-52268

StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens...

StarCharge Artemis AC Charger 安全漏洞

StarCharge Artemis AC Charger is an AC charger from StarCharge Singapore. A security vulnerability exists in the StarCharge Artemis AC Charger version 7-22 kW 1.0.4, which stems from the use of a hard-coded AES key, which could allow an attacker to forge or decrypt a valid login token...

CVE-2025-52268

StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens...

PT-2025-43959

Name of the Vulnerable Software and Affected Versions StarCharge Artemis AC Charger version 1.0.4 Description The StarCharge Artemis AC Charger version 1.0.4 contains a hardcoded AES key. This allows attackers to forge or decrypt valid login tokens. Recommendations At the moment, there is no...

EUVD-2020-19058

Malware in sbrugna...

CVE-2025-55619

Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering...

PT-2025-34450

Name of the Vulnerable Software and Affected Versions: Reolink version 4.54.0.4.20250526 Description: The Reolink application contains a hardcoded encryption key and initialization vector. This allows an attacker to decrypt access tokens and web session tokens through reverse engineering...

CVE-2025-55619

Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering...

Reolink App 安全漏洞

Reolink App is a mobile application from Reolink USA. A security vulnerability exists in Reolink App version v4.54.0.4.20250526, which stems from the use of hard-coded encryption keys and initialization vectors, which could lead to the decryption of access tokens and session tokens...