Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2013-3900
HistoryDec 11, 2013 - 12:55 a.m.

CVE-2013-3900

2013-12-1100:55:03
CWE-20
[email protected]
web.nvd.nist.gov
3

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

7.5 High

AI Score

Confidence

Low

0.742 High

EPSS

Percentile

98.1%

JSON

The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka “WinVerifyTrust Signature Validation Vulnerability.”

Affected configurations

NVD
Node
microsoftwindows_10Match-
OR
microsoftwindows_10Match20h2
OR
microsoftwindows_10Match21h1
OR
microsoftwindows_10Match21h2
OR
microsoftwindows_10Match1607
OR
microsoftwindows_10Match1809
OR
microsoftwindows_10Match1909
OR
microsoftwindows_11Match-arm64
OR
microsoftwindows_11Match-x64
OR
microsoftwindows_7Match-sp1
OR
microsoftwindows_8.1Match-
OR
microsoftwindows_rt_8.1Match-
OR
microsoftwindows_server_2003Match-sp2itanium
OR
microsoftwindows_server_2003Match-sp2x64
OR
microsoftwindows_server_2008Match-sp2
OR
microsoftwindows_server_2008Matchr2sp1x64
OR
microsoftwindows_server_2012Match-
OR
microsoftwindows_server_2012Matchr2
OR
microsoftwindows_server_2016Match-
OR
microsoftwindows_server_2019Match-
OR
microsoftwindows_server_2022Match-
OR
microsoftwindows_vistaMatch-sp2-x64
OR
microsoftwindows_xpMatch-sp2professionalx64
OR
microsoftwindows_xpMatch-sp3

Related

openvas 2
checkpoint_advisories 3
thn 4
kaspersky 2
cvelist 1
nessus 2
symantec 1
cisa_kev 1
mscve 1
attackerkb 1
cve 1
prion 1
mssecure 1
threatpost 2
mmpc 1
securityvulns 1
avleonov 1
qualysblog 2
cisa 1
openvas
openvas
Microsoft WinVerifyTrust Signature Validation Vulnerability (2893294)
2013-12-11 00:00:00
Microsoft WinVerifyTrust Signature Validation Vulnerability (2893294)
2013-12-11 00:00:00
checkpoint_advisories
checkpoint_advisories
Portable Executable Files With Weak Encryption (CVE-2013-3900)
2013-12-10 00:00:00
Microsoft Windows WinVerifyTrust PE Validation Security Bypass (MS13-098; CVE-2013-3900)
2014-01-20 00:00:00
Microsoft Windows WinVerifyTrust Signature Validation Code Execution (MS13-098; CVE-2013-3900)
2013-12-10 00:00:00
thn
thn
New Zloader Banking Malware Campaign Exploiting Microsoft Signature Verification
2022-01-05 11:00:00
Cryptocurrency Companies Targeted in Sophisticated 3CX Supply Chain Attack
2023-04-04 03:54:00
Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit
2023-04-12 06:38:00
kaspersky
kaspersky
KLA12431 RCE vulnerability in Microsoft Windows
2022-01-21 00:00:00
KLA12432 RCE vulnerability in Microsoft Products (ESU)
2022-01-21 00:00:00
cvelist
cvelist
CVE-2013-3900
2013-12-11 00:00:00
nessus
nessus
WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation (EnableCertPaddingCheck)
2022-10-26 00:00:00
MS13-098: Vulnerability in Windows Could Allow Remote Code Execution (2893294)
2013-12-11 00:00:00
symantec
symantec
Microsoft Windows CVE-2013-3900 Remote Code Execution Vulnerability
2013-12-10 00:00:00
cisa_kev
cisa_kev
Microsoft WinVerifyTrust function Remote Code Execution
2022-01-10 00:00:00
mscve
mscve
WinVerifyTrust Signature Validation Vulnerability
2022-01-21 08:00:00
attackerkb
attackerkb
CVE-2013-3900
2013-12-11 00:00:00
cve
cve
CVE-2013-3900
2013-12-11 00:55:03
prion
prion
Input validation
2013-12-11 00:55:00
mssecure
mssecure
Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware
2022-04-13 16:00:00
threatpost
threatpost
Skeletons in the Closet: Security 101 Takes a Backseat to 0-days
2022-04-22 10:56:16
No Critical Bugs for Microsoft February 2022 Patch Tuesday, 1 Zero-Day
2022-02-08 20:24:17
mmpc
mmpc
Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware
2022-04-13 16:00:00
securityvulns
securityvulns
Microsoft Windows multiple security vulnerabilities
2013-12-30 00:00:00
avleonov
avleonov
Microsoft Patch Tuesday February 2022
2022-02-28 20:52:10
qualysblog
qualysblog
Microsoft and Adobe Patch Tuesday, May 2023 Security Update Review
2023-05-09 21:24:08
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
cisa
cisa
CISA Adds 15 Known Exploited Vulnerabilities to Catalog
2022-01-10 00:00:00

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

7.5 High

AI Score

Confidence

Low

0.742 High

EPSS

Percentile

98.1%

JSON
Related for NVD:CVE-2013-3900
openvas2checkpoint_advisories3thn4kaspersky2cvelist1nessus2symantec1cisa_kev1mscve1attackerkb1cve1prion1mssecure1threatpost2mmpc1securityvulns1avleonov1qualysblog2cisa1