{"uuid": "aa24d215-a88d-4701-8dda-0062c399ced9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41335", "type": "seen", "source": "https://t.me/hacking_Attack/27440", "content": "words, he explained, \u201can attacker would already need access to your network in order to exploit this vulnerability. Email servers will always be prime targets, simply due to the amount of data contained in emails and the range of possible ways attackers could use them for malicious purposes.\u201d\n\nWhile it\u2019s not \u201cright at the top\u201d of Breen\u2019s list of priorities to patch, \u201cit\u2019s certainly one to be wary of.\u201d\n\nRapid7\u2019s Wiseman concurs: This is a notable vulnerability, though it\u2019s mitigated \u201cby the fact that attacks are limited to a \u2018logically adjacent topology,\u2019\u201d meaning, in other words, that it can\u2019t be exploited directly over the public Internet.\nSee Also: Offensive Security Tool: Whispers Windows Hyper-VWiseman called on virtualization administrators to take heed of two RCEs affecting Windows Hyper-V: CVE-2021-40461\u00a0and CVE-2021-38672, both of which affect relatively new versions of Windows and which are considered critical.\n\nWindows Hyper-V is a native hypervisor that can create and run virtual machines (VMs) on x86-64 systems running Windows. These two flaws both allow a VM to escape from guest to host by triggering a memory allocation error, allowing it to read kernel memory in the host.\n\nChristopher Hass, Autmox director of information security and research, said that exploitation of these bugs \u201ccould allow a malicious guest VM to read kernel memory in the host.\u201d\n\nNeither vulnerability has been exploited publicly, and exploitation is less likely, however organizations using Hyper-V should patch these vulnerabilities as soon as possible, Hass recommended. One Step Away From Domain AdminThere\u2019s one bug that swings above its weight range: the DNS server remote code execution (RCE) vulnerability that\u2019s tracked as CVE-2021-40469.\n\nJake Williams, Co-Founder and CTO at BreachQuest,\u00a0calls this one \u201cinteresting,\u201d as in, that curse about living in interesting times.\n\nIts base score severity rating is 7.2, but its attack complexity is low, and an attack can be launched remotely. Exploitation does, however, require what VulDB\u00a0calls \u201can enhanced level of successful authentication.\u201d\n\nEven if that makes it tough to weaponize, this bug is still potentially uber nasty, given that, for one thing, it\u2019s been publicly disclosed in a proof of concept, and also that DNS servers sit in such a crucial spot.\n\n\u201cWhile it will likely be difficult to weaponize, DNS servers are typically run on domain controllers, making this extremely serious,\u201d Williams noted. \u201cA threat actor that gains remote code execution on a domain controller is likely to gain immediate domain administrator permissions. In the best case scenario, they are a mere step away from taking domain administrator.\u201d\n\nThis isn\u2019t the first time that Microsoft has had to stomp on an RCE vulnerability in DNS server this year, including in March\u2019s Patch Tuesday updates. This time around, the vulnerability affects various versions of Windows 7, 8.1 and 10, as well as Windows Server. Windows Kernel Elevation of Privilege FlawCVE-2021-41335, an elevation of privilege vulnerability that exists when the Windows kernel fails to properly handle objects in memory, is rated high severity, and it\u2019s been publicly disclosed in a proof-of-concept (POC) showing how successful exploitation could allow an attacker to run arbitrary code in kernel mode.\n\nExploitation would enable an attacker to install programs; view, change, or delete data; or create accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system and then run a specially crafted application to take control of the system.\n\nJustin Knapp, Automox senior product marketing manager, explained that \u201cElevation of privilege vulnerabilities like this are often an important step in the cyber kill chain and should be immediately prioritized and patched.\u201d Windows AppContainer Firewall Rules Security Feature BypassTracked as CVE-2021-413[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:14.062411Z"}