CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apple iOS, iPadOS, and macOS Certificate Validation Bypass Vulnerability (CVE-2023-41991) Analysis and Mitigation Guide
[Affected Scope] Apple devices running iOS versions prior to 16.7, iPadOS versions prior to 16.7, and macOS Ventura versions prior to 13.6
[Impact] A malicious application can bypass signature and certificate validation, allowing it to execute with elevated privileges and compromise the system. This has been actively exploited in the wild
[Mitigation] Immediately update all affected devices to iOS/iPadOS 16.7 or later, and macOS Ventura 13.6 or later
Microsoft Windows WinVerifyTrust Authenticode Signature Bypass and Remote Code Execution Vulnerability (CVE-2013-3900)
[Affected Scope] All currently supported versions of Microsoft Windows, including Windows 10, Windows 11, and Windows Server
[Impact] Attackers can inject malicious code into the unverified padding areas of signed PE files without invalidating the digital signature, bypassing security controls to execute arbitrary code
[Mitigation] Enable the 'EnableCertPaddingCheck' registry setting to enforce strict Authenticode signature verification across all endpoints