ForgeCert

ForgeCert ForgeCert использует BouncyCastle C API и украденный сертификат центра сертификации CA + закрытый ключ для создания поддельных сертификатов для произвольных пользователей, способных пройти аутентификацию в Active Directory. Эта атака обозначена как DPERSIST1 в нашей технической статье...

cve-2020-0601_poc

Основная информация Исходный код этого инструмента предназначен для помощи в понимании уязвимости CVE-2020-0601, обнаруженной в Windows Crypto API. См. обзор CERT. Сам инструмент может использоваться для создания сертификата для произвольного домена, который будет подписан злонамеренным...

CVE-2020-0601

CVE-2020-0601: Эксплуатация уязвимости CurveBall Этот скрипт на Ruby можно использовать для подмены легитимного центра сертификации и генерации сертификата, который будет считаться действительным для компьютеров Windows, затронутых уязвимостью CurveBall. Вам необходимо получить сертификат от цент...

CVE-2020-0601-EXP

CVE-2020-0601-EXP Этот ресурс представляет собой воспроизведение уязвимости подписи сертификатов Microsoft CVE-2020-0601 автором, реализованное с использованием соответствующих ресурсов и статей. Рекомендуется обратиться к блогу автора, чтобы понять алгоритм ECC, механизм проверки Windows и...

-CVE-2020-0601-ECC---EXPLOIT

CurveBall CVE-2020-0601 — ЭКСПЛОЙТ ECC/Po2 CVE-2020-0601, также известная как CurveBall, — это уязвимость, при которой подпись сертификатов, использующих эллиптическую криптографию ECC, проверяется некорректно. ECC опирается на различные параметры. Для многих кривых используются стандартизированн...

CurveBall

CurveBall CVE-2020-0601 - PoC CVE-2020-0601: Также известная как CurveBall или ChainOffFools, это уязвимость в Microsoft CryptoApi конкретно в Crypt32.dll, где подписи эллиптических кривых ECDSA сертификатов некорректно проверяются. Существует очень хорошая статья здесь, которая очень аккуратно...

CVE-2026-67278

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...

CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...

CVE-2026-85175

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

EUVD-2026-70410

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-85175

SiYuan versions ≤ 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match but fails to restrict the TLS private key (conf/key.pem) and CA private key (conf/ca.key). Because the getFile handler skips the ...

Astra Linux – Vulnerability in LibreOffice

There was an improper certificate validation vulnerability in LibreOffice, where the determination of whether a macro was signed by a trusted author was based solely on comparing the serial number and issuer string of the used certificate with those of a trusted certificate. This is insufficient ...

CVE-2026-74882

openssl_encrypt versions before 1.4.0 ship with an insecure default in its IntegrityProxyConfig trusted_proxies that trusts the entire RFC 1918 private address space. This allows attackers on private networks to forge client certificate headers and bypass mTLS authentication when ProxyAuth valida...

SUSE SLES15 Security Update : erlang26 (SUSE-SU-2026:3579-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3579-1 advisory. - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application...

Security update for erlang26

This update for erlang26 fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...

SUSE-SU-2026:3579-1 Security update for erlang26

This update for erlang26 fixes the following issues: - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. - CVE-2026-42790:...

CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update

An update for erlang is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

JLSEC-2026-730 `wolfSSL_X509_verify_cert` in the OpenSSL compatibility layer accepts a certificate chain in which...

wolfSSLX509verifycert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints CA:FALSE that is legitimately signed by a trusted root. An attacker who obtains any leaf...