certReport

CertReport Questo strumento è pensato per ridurre lo sforzo necessario per segnalare certificati Authenticode. Il suo scopo è richiedere il minimo sforzo possibile a chi effettua la segnalazione, fornendo comunque all'autorità di certificazione la maggior parte delle informazioni necessarie per...

SigFlip

Cos'è? SigFlip è uno strumento per modificare file PE firmati con authenticode exe, dll, sys ..etc in modo che non influisca o rompa la firma authenticode esistente. In altre parole, è possibile modificare il checksum/hash del file PE incorporando dati ad esempio shellcode senza rompere la firma...

CVE-2013-3900-PowerShell-PoC

CVE-2013-3900-PowerShell-PoC Dieser PoC dient ausschließlich zu Bildungs- und Forschungszwecken. Der Autor übernimmt keine Verantwortung für Missbrauch oder Schäden, die durch diesen Code verursacht werden. Dieses PowerShell-Skript ist ein Testwerkzeug zur Simulation des in CVE-2013-3900...

badecparams

BADECPARAMS Proof of Concept für CVE-2020-0601. badecparams.py erzeugt eine Zwischenzertifizierungsstelle, die die Sicherheitslücke ausnutzt, und stellt dann Authenticode- und TLS-Zertifikate aus. Die TLS-Zertifikate besitzen Extended Validation in Microsoft Edge und Internet Explorer. httpd.py...

CVE-2026-8863

CVE-2026-8863 Raccolta dei binari shim UEFI Secure Boot firmati affetti da CVE-2026-8863, con la versione dello shim incorporata, il firmatario Authenticode e gli hash di revoca di ciascuna immagine. Le release che includono lo shim firmato byte-identico vengono raggruppate in un'unica riga: un...

Fix-WinVerifyTrustSignatureValidationVuln

Fix-WinVerifyTrustSignatureValidationVuln Behebt die Schwachstelle bei der WinVerifyTrust-Signaturvalidierung, CVE-2013-39001, QID-3783322 Dieser Fix ist für 64-Bit-Windows-Computer gedacht Dieser PowerShell-Code ist eine Möglichkeit, die Schwachstelle zu beheben – abgesehen vom Erstellen einer...

cve-2013-3900-winverifytrust-mitigation

Mitigazione CVE-2013-3900 WinVerifyTrust / EnableCertPaddingCheck Questo repository contiene uno script di remediation e verifica PowerShell che risolve la segnalazione Tenable/Nessus: Plugin ID: 166555 Nome: Mitigazione della convalida della firma WinVerifyTrust CVE-2013-3900...

-WinVerifyTrust-Signature-Validation-CVE-2013-3900-Mitigation

CVE-2013-3900 è una vulnerabilità di esecuzione remota di codice nel modo in cui la funzione WinVerifyTrust di Microsoft gestisce la verifica delle firme Authenticode di Windows. Questa falla consente a un utente malintenzionato di modificare un file eseguibile firmato aggiungendo codice dannoso ...

CVE-2026-54001

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to...

CVE-2026-54001 osquery: Heap buffer overflow via `authenticode` table (Windows)

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to...

CVE-2026-54001

CVE-2026-54001 affects osquery on Windows prior to version 5.23.1. A local, unprivileged attacker can trigger a heap out-of-bounds write via the authenticode table by crafting a malicious binary query, due to publisher information parsing in getOriginalProgramName. Successful exploitation could e...

CVE-2026-54001 osquery: Heap buffer overflow via `authenticode` table (Windows)

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to...

SUSE-SU-2026:0741-2 Security update for shim

This update for shim fixes the following issues: shim is updated to version 16.1: - shimstartimage: fix guid/handle pairing when uninstalling protocols - Fix uncompressed ipv6 netboot - fix test segfaults caused by uninitialized memory - SbatLevelVariable.txt: minor typo fix. - Realloc needs to...

CVE-2026-8863

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the...

EUVD-2026-35791

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the...

PT-2026-48216

Name of the Vulnerable Software and Affected Versions Spyrus WTGCreator version 4.2 Baramundi Management Suite versions prior to 2024R1 WhiteCanyon WipeDrive versions 8.0.0 through 8.1.3 Finland Matriculation Exam Abitti 1 version 1.0.0 NTC IT Rosa versions R9 and R10 PC-Doctor Service Center...

DrvEye

drivertool A static-analysis & exploitation-triage toolkit...

Security update for shim

This update for shim fixes the following issues: shim is updated to version 16.1: shimstartimage: fix guid/handle pairing when uninstalling protocols Fix uncompressed ipv6 netboot fix test segfaults caused by uninitialized memory SbatLevelVariable.txt: minor typo fix. Realloc needs to allocate on...

SUSE-SU-2026:1414-1 Security update for shim

This update for shim fixes the following issues: shim is updated to version 16.1: - shimstartimage: fix guid/handle pairing when uninstalling protocols - Fix uncompressed ipv6 netboot - fix test segfaults caused by uninitialized memory - SbatLevelVariable.txt: minor typo fix. - Realloc needs to...

CVE-2026-39856

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code pepagehashcalc. When processing PE sections for page hashing, the function uses...