PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploiting the Windows CryptoAPI Vulnerability

blog.trailofbits.com | vulnerability | #windows | #cryptography | #trail-of-bits | #code-signing | #cryptoapi | #spoofing | #ecc | #certificate-validation | #cve-2020-0601 | #certificate-forgery
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits dissects the NSA-discovered Windows CryptoAPI flaw in Crypt32.dll, where improper ECC curve parameter validation lets attackers forge HTTPS and code-signing certificates.
Published
Collected

Related coverage

vulnerability · blog.trailofbits.com
2015 In Review
Trail of Bits' 2015 year in review: DARPA Cyber Grand Challenge participation, 64-bit mcsema support, the Empire Hacking meetup, open-sourcing Tuber, and advocacy against reactionary export rules.
vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
Critical · vulnerability · bishopfox.com
API Authentication Bypass in FortiClient EMS 7.4.5-7.4.6–CVE-2026-35616
CVE-2026-35616: FortiClient EMS 7.4.5-7.4.6 trusts spoofable headers as cert auth and skips signature checks, letting attackers forge certificates for API access; exploited in the wild.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
High · vulnerability · github.com
GOG Galaxy Local Privilege Escalation (LPE) PoC via DLL Search-Order Hijacking
Demonstrates persistent DLL hijacking vulnerabilities in popular gaming clients, showing how insecure service configurations and missing safe DLL search controls allow standard users to breach SYSTEM privilege boundaries.
vulnerability · blog.viettelcybersecurity.com
CVE-2026-55040: SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login
CVE-2026-55040: SharePoint Server Subscription Edition's token handler skips JWT signature validation, letting attackers forge Bearer tokens and log in as arbitrary accounts, including site admins.
Back