Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

DeKrypto – Padding Oracle attack against IBM WebSphere Commerce (CVE-2013-05230)

netspi.com | vulnerability | CVE-2013-05230 | #cryptography | #padding-oracle | #ibm | #exploit-development | #websphere-commerce | #cve-2013-05230

Summary

A padding oracle attack against the krypto parameter in IBM WebSphere Commerce (CVE-2013-05230) is demonstrated with a public exploit, since none had been published for the flaw.
CVE
CVE-2013-05230
Published
Collected

original ↗

Related coverage

blog · xbow.com
Breaking Crypto with XBOW
XBOW's autonomous solve of a padding-oracle benchmark: the agent built an exploit to decrypt a server cookie and bypass authentication — an attack the author calls the hardest he taught at NYU.
vulnerability · yeswehack.com
Critical signature-spoofing vulnerability in OpenPGP.js hits the headlines
CVE-2025-47934: Codean Labs researchers found a critical OpenPGP.js signature-spoofing flaw via YesWeHack's Bug Bounty program (€7,500 bounty), covering discovery, remediation and disclosure.
High · vulnerability · nebusec.ai
IonStack part III: Rooting Android 17 with GhostLock
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world's first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.
vulnerability · 0xpat.github.io
Vulnerability discovery in Java applications
Finding bugs in OWASP WebGoat: decompiling the Java/Spring app, automating account creation in Python, spotting SQL-injection anti-patterns by regex, and building exploits—from a Ya!vaConf talk.
vulnerability · projectzero.google
[CVE-2020-9802] JITSploitation III: Subverting Control Flow
This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
vulnerability · projectzero.google
[CVE-2020-9802] JITSploitation II: Getting Read/Write
This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
back