A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: kev:CVE-2013-3900
WinVerifyTrust function
Source reference: /product
Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2013-3900
Source reference: /cveID
Publisher severity
No explicit severity was provided.
Linked CVE context
These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.
Windows 10 Version 1809, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
