CurveBall

CurveBall CVE-2020-0601 - PoC CVE-2020-0601: Conosciuto anche come CurveBall o ChainOffFools, è una vulnerabilità nella Microsoft CryptoApi specificamente in Crypt32.dll in cui le firme a curva ellittica ECDSA dei certificati non vengono verificate correttamente. C'è un ottimo articolo sul blog q...

CVE-2020-0601

CVE-2020-0601 PoC per CVE-2020-0601- Windows CryptoAPI Crypt32.dll POC: https://github.com/ollypwn/CurveBall Su kali: 1.Crea un file PKCS12 root@kitploit: openssl req -new -x509 -key spoofedca.key -out spoofedca.crt openssl ecparam -name secp384r1 -genkey -noout -out Microsoft.key openssl req -ne...

chainoffools

CryptoAPI CVE-2020-0601: sfruttamento della vulnerabilità di spoofing di CryptoAPI di Windows. Maggiori informazioni nel nostro post del blog. Installazione dei requisiti root@kitploit: pip install -U -r requirements.txt La generazione dei certificati funziona con OpenSSL fino alla versione 1.0.2...

Curveball

Curveball Una PoC per CVE-2020-0601. Un post dettagliato del blog può essere trovato qui. Questo exploit permette di creare un certificato fidato falso sfruttando come CryptoAPI gestisce alcuni parametri sui certificati basati su ECC. Setup Clona il repository e aprilo in Visual Studio 2019. Pass...

CVE-2026-55144

Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally...

CVE-2026-55144

Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally...

Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability

Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally...

FP-Predictor - False Positive Prediction for Static Analysis Reports

Static Application Security Testing SAST tools play a vital role in modern software development by automatically detecting potential vulnerabilities in source code. However, their effectiveness is often limited by a high rate of false positives, which wastes developer's effort and undermines trus...

EUVD-2023-39342

Malicious code in bioql PyPI...

EUVD-2023-28924

Malicious code in bioql PyPI...

EUVD-2021-7146

Malicious code in bioql PyPI...

EUVD-2023-28925

Malicious code in bioql PyPI...

BIT-GOLANG-2020-0601

A spoofing vulnerability exists in the way Windows CryptoAPI Crypt32.dll validates Elliptic Curve Cryptography ECC certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted,...

CVE-2023-35339

Windows CryptoAPI Denial of Service Vulnerability...

Denial of service

Windows CryptoAPI Denial of Service Vulnerability...

CVE-2023-35339 Windows CryptoAPI Denial of Service Vulnerability

...

CVE-2023-35339

CVE-2023-35339 is a Windows CryptoAPI Denial of Service vulnerability with a CVSS v3.1 base score of 7.5 (NETWORK, LOW attack complexity, NONE privileges, NONE user interaction, HIGH availability impact). The provided records do not specify affected versions, root cause details, exploitation stat...

CVE-2023-35339 Windows CryptoAPI Denial of Service Vulnerability

...

Windows CryptoAPI Denial of Service Vulnerability

...

PT-2023-3852 · Microsoft · Windows Cryptoapi +1

Name of the Vulnerable Software and Affected Versions: Windows CryptoAPI affected versions not specified Description: The issue is related to incorrect clearing or release of resources in the Windows CryptoAPI, which can be exploited by a remote attacker to cause a denial of service...