{"vulnerability": "CVE-2021-28316", "sightings": [{"uuid": "28220ba1-24b7-4755-8261-ce8b9bafd817", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "published-proof-of-concept", "source": "https://t.me/cKure/4895", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316).\n\nhttps://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2021-04-17T09:25:13.000000Z"}, {"uuid": "10c2b624-117c-49b2-9237-6ebd6816de76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "published-proof-of-concept", "source": "https://t.me/cKure/4856", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316).\n\nhttps://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2021-04-15T00:48:33.000000Z"}, {"uuid": "73ae5919-62ec-43f7-bce3-495b35d6afc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "published-proof-of-concept", "source": "https://t.me/cKure/11498", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316).\n\nhttps://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2023-09-04T06:49:08.000000Z"}, {"uuid": "7d5b655e-6002-4957-9cb6-f2e3c010181f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "published-proof-of-concept", "source": "https://t.me/HackerOne/3003", "content": "Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316) https://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2021-05-13T15:51:27.000000Z"}, {"uuid": "ecbb1f21-fcc5-48ee-b022-a5faf752a944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3156", "content": "#Offensive_security\nAirstrike Attack - FDE bypass and EoP on domain joined Windows workstations/Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability (CVE-2021-28316)\nhttps://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2021-04-19T05:46:34.000000Z"}, {"uuid": "4be0a409-bf94-4eb1-ba9a-23d42636fc66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3279", "content": "#Analytics\nTop 10 Most Used Vulnerabilities of the Month (April 1-30)\n\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\nhttps://t.me/cybersecuritytechnologies/1515\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\nCVE-2021-22893 Pulse SecureVPN RCE\nhttps://t.me/cybersecuritytechnologies/3185\nCVE-2021-28310 - Win32k EoP Vulnerability\nhttps://t.me/cybersecuritytechnologies/3124\nCVE-2021-26411 - IE mshtml UAF\nhttps://t.me/cybersecuritytechnologies/2908\nCVE-2021-22204 - DjVu improper neutralization of user data\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\nhttps://t.me/cybersecuritytechnologies/3126\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\nhttps://t.me/cybersecuritytechnologies/3156\nCVE-2021-28480/28482 - MS Exchange Server RCE\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange", "creation_timestamp": "2024-04-30T17:11:44.000000Z"}, {"uuid": "9aa440f4-78a5-4deb-95c8-f1ac9f7def73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1093", "content": "Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316) https://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2026-08-03T11:06:34.289761Z"}, {"uuid": "ff6e08d7-63ff-4ec7-8e6b-3868e9acbeff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1093", "content": "Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316) https://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2026-08-04T00:00:41.332766Z"}, {"uuid": "ecf6ae01-7cbe-42ed-a1e1-03c21ee94580", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/reverseame/1093", "content": "Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316) https://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2026-07-29T12:02:58.738582Z"}, {"uuid": "f1fe248b-911e-47bc-8312-47d40a975eae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/reverseame/1093", "content": "Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316) https://shenaniganslabs.io/2021/04/13/Airstrike.html", "creation_timestamp": "2026-07-30T00:02:48.328052Z"}, {"uuid": "7f061237-4866-43ab-8d70-d6f256dbc122", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/cissp/3093", "content": "Analytics\nTop Most Used Vulnerabilities of the Month (April 1-30)\n\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\n\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\n\nCVE-2021-22893 Pulse SecureVPN \nRCE\n\nCVE-2021-28310 - Win32k EoP Vulnerability\n\nCVE-2021-26411 - IE mshtml UAF\n\nCVE-2021-22204 - DjVu improper neutralization of user data\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\n\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\n\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\n\nCVE-2021-28480/28482 - MS Exchange Server RCE\ud83d\ude01\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange", "creation_timestamp": "2026-09-01T17:00:51.443627Z"}, {"uuid": "472a7147-2c4d-4cfb-9ce8-8250dd924d73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/cissp/2993", "content": "1195777 chrome 0day\nhttps://github.com/avboy1337/1195777-chrome0day\n+ Cobalt Strike Chrome 0day:\nhttps://mp.weixin.qq.com/s/LOpAu8vs8ob85W3sCmXMew\n\nAnalytics\nmost exploited vulnerabilities of the week (April 12-18)\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\n\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\n\nCVE-2021-1647 - MS Defender RCE Vulnerability\nhttps://www.anquanke.com/post/id/231625\n\nCVE-2021-28310 - Win32k Elevation of Privilege Vulnerability\n\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\n\nCVE-2021-28480/28481/28482/28483 - MS Exchange Server RCE Vulnerability\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange\n\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability", "creation_timestamp": "2026-09-01T17:00:53.189360Z"}, {"uuid": "95d6d50c-e781-41c0-979c-ab3f6f12314c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/cissp/2986", "content": "exploit\nCVE-2021-29349:\nCSRF to remove all messages in Mahara 20.10 (PoC)\nhttps://github.com/Vulnmachines/CVE-2021-29349\n\nOffensive security:\nAirstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316)\nhttps://shenaniganslabs.io/2021/04/13/Airstrike.html\n\nMalware analysis:\n1. HackBoss: A cryptocurrency-stealing malware distributed through Telegram\nhttps://decoded.avast.io/romanalinkeova/hackboss-a-cryptocurrency-stealing-malware-distributed-through-telegram\n2. Carbine Loader Cryptojacking Campaign\nhttps://www.lacework.com/carbine-loader-cryptojacking-campaign\n\nRed Team Tactics\n1. Buffer overflow fuzzer and exploit script\nhttps://github.com/A1-exe/bufferoverflow\n2. PCI Express DIY hacking toolkit for Xilinx SP605\nhttps://github.com/Cr4sh/s6_pcie_microblaze\n\n\nThreat Research:\n1. Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310)\nhttps://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898\n2. Bugs in a Popular Third-Party Ethernet/IP Protocol Stack (CVE-2021-27478, CVE-2021-27482, CVE-2021-27498, CVE-2021-27500)\nhttps://www.claroty.com/2021/04/15/blog-research-fuzzing-and-pring\n3. New Vulnerability Affecting Container Engines CRI-O/Podman (CVE-2021-20291)\nhttps://unit42.paloaltonetworks.com/cve-2021-20291", "creation_timestamp": "2026-09-01T17:00:53.704649Z"}, {"uuid": "5c7f0075-b8b5-4b13-b13b-1939da0dbc7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/cissp/3093", "content": "Analytics\nTop Most Used Vulnerabilities of the Month (April 1-30)\n\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\n\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\n\nCVE-2021-22893 Pulse SecureVPN \nRCE\n\nCVE-2021-28310 - Win32k EoP Vulnerability\n\nCVE-2021-26411 - IE mshtml UAF\n\nCVE-2021-22204 - DjVu improper neutralization of user data\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\n\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\n\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability\n\nCVE-2021-28480/28482 - MS Exchange Server RCE\ud83d\ude01\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange", "creation_timestamp": "2026-09-02T01:04:40.858580Z"}, {"uuid": "6a71aa0b-6b0e-4830-9b6b-12eb8ed561ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/cissp/2993", "content": "1195777 chrome 0day\nhttps://github.com/avboy1337/1195777-chrome0day\n+ Cobalt Strike Chrome 0day:\nhttps://mp.weixin.qq.com/s/LOpAu8vs8ob85W3sCmXMew\n\nAnalytics\nmost exploited vulnerabilities of the week (April 12-18)\nCVE-2020-13379 - Unauth Full-Read SSRF in Grafana\n\nCVE-2021-24086 - Win IPv4/6 Stack RCE/DoS Vulns\nhttps://unit42.paloaltonetworks.com/cve-2021-24074-patch-tuesday\n\nCVE-2021-1647 - MS Defender RCE Vulnerability\nhttps://www.anquanke.com/post/id/231625\n\nCVE-2021-28310 - Win32k Elevation of Privilege Vulnerability\n\nCVE-2021-24027 - Remote exploitation of a man-in-the-disk vulnerability in WhatsApp\n\nCVE-2021-28480/28481/28482/28483 - MS Exchange Server RCE Vulnerability\nhttps://www.tenable.com/blog/cve-2021-28480-cve-2021-28481-cve-2021-28482-cve-2021-28483-four-critical-microsoft-exchange\n\nCVE-2021-28316 - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability", "creation_timestamp": "2026-09-02T01:04:43.368120Z"}, {"uuid": "7b91cbdf-6c50-4aa2-a1ef-55aaca2424c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28316", "type": "seen", "source": "https://t.me/cissp/2986", "content": "exploit\nCVE-2021-29349:\nCSRF to remove all messages in Mahara 20.10 (PoC)\nhttps://github.com/Vulnmachines/CVE-2021-29349\n\nOffensive security:\nAirstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316)\nhttps://shenaniganslabs.io/2021/04/13/Airstrike.html\n\nMalware analysis:\n1. HackBoss: A cryptocurrency-stealing malware distributed through Telegram\nhttps://decoded.avast.io/romanalinkeova/hackboss-a-cryptocurrency-stealing-malware-distributed-through-telegram\n2. Carbine Loader Cryptojacking Campaign\nhttps://www.lacework.com/carbine-loader-cryptojacking-campaign\n\nRed Team Tactics\n1. Buffer overflow fuzzer and exploit script\nhttps://github.com/A1-exe/bufferoverflow\n2. PCI Express DIY hacking toolkit for Xilinx SP605\nhttps://github.com/Cr4sh/s6_pcie_microblaze\n\n\nThreat Research:\n1. Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310)\nhttps://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898\n2. Bugs in a Popular Third-Party Ethernet/IP Protocol Stack (CVE-2021-27478, CVE-2021-27482, CVE-2021-27498, CVE-2021-27500)\nhttps://www.claroty.com/2021/04/15/blog-research-fuzzing-and-pring\n3. New Vulnerability Affecting Container Engines CRI-O/Podman (CVE-2021-20291)\nhttps://unit42.paloaltonetworks.com/cve-2021-20291", "creation_timestamp": "2026-09-02T01:04:44.163288Z"}]}