{"vulnerability": "CVE-2021-4232", "sightings": [{"uuid": "c958b7db-c1d6-47de-8ed6-594bd71d87c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "d00d3389-d72d-42bc-8738-35c310d4d98f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971173", "content": "", "creation_timestamp": "2024-12-24T20:25:21.295711Z"}, {"uuid": "f7c6c09e-e1df-4d00-bc74-1840d7c5bf0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "76b4bd3a-6469-40eb-9df5-5ce99c888ef2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:40.000000Z"}, {"uuid": "1acdd262-9eca-4762-b3f8-94e728b91ee0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:58.000000Z"}, {"uuid": "e0f4cd23-968c-4604-a629-9114e3ee60a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_chainedserializationbinder_rce.rb", "content": "", "creation_timestamp": "2022-08-19T16:31:57.000000Z"}, {"uuid": "02c10ab9-3eb5-4563-a93c-d0978a10ac12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/043df6f6-a167-4beb-a3a9-0f81632bf69a", "content": "", "creation_timestamp": "2026-02-02T12:28:32.898086Z"}, {"uuid": "a6945581-0ef7-4acf-ba13-3994bf4f03d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_35/2021", "content": "", "creation_timestamp": "2021-11-24T07:25:09.000000Z"}, {"uuid": "47acd6ca-70d4-4f26-bae1-523b4eff4aef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=690", "content": "", "creation_timestamp": "2021-11-10T04:00:00.000000Z"}, {"uuid": "d5334ee8-7441-4edc-900b-3451031a6776", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/c54ba016-1255-4e07-9fb6-686f9a0a936b", "content": "", "creation_timestamp": "2024-12-06T06:02:25.058002Z"}, {"uuid": "1ffc261a-ca70-4d1f-9fdc-f4f31cc964c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/fdda4963-0aa7-4d15-8a8f-969db8f304ca", "content": "", "creation_timestamp": "2025-02-28T23:49:13.272798Z"}, {"uuid": "5c7e6c9f-2136-44e4-a225-738a5072d3bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://t.me/cKure/8187", "content": "CVE-2021-42321: Proof-of-concept exploit code has been released online over the weekend for an actively exploited high severity vulnerability impacting Microsoft Exchange servers.\n\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398", "creation_timestamp": "2021-11-22T23:01:08.000000Z"}, {"uuid": "2d018c0c-6d8d-43fa-bdfb-f0014bb1616c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cKure/7972", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Microsoft Fixes Exchange Server Zero-Day. November security update contains patches for 55 bugs \u2014 including six zero-days across various products including CVE-2021-42298, Exchange Server (CVE-2021-42321), Microsoft Excel (CVE-2021-42292), CVE-2021-38631\u00a0and\u00a0CVE-2021-41371\u00a0\u2014 involve Microsoft's RDP while flaws \u2014\u00a0CVE-2021-43208\u00a0and\u00a0CVE-2021-43209\u00a0are RCEs in Microsoft's 3D Viewer Remote technology.", "creation_timestamp": "2021-11-10T12:44:04.000000Z"}, {"uuid": "771c4210-c343-482c-9ed4-a8cae844090c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8147", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 SLUB overflow CVE-2021-42327\n\nhttps://docfate111.github.io/blog/securityresearch/2021/11/08/SLUBoverflow.html", "creation_timestamp": "2021-11-21T06:33:42.000000Z"}, {"uuid": "67161f0f-9d4c-4770-8d2e-592410128334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8492", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Proxylogon, Proxyshell, Proxyoracle, Proxytoken, CVE-2021-42321 Deserialization RCE full chain exploit tool.\n\nhttps://github.com/FDlucifer/Proxy-Attackchain", "creation_timestamp": "2021-12-26T11:46:24.000000Z"}, {"uuid": "e9d87503-5687-45ed-ae7d-4a70ab19a9c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://t.me/ckuRED/65", "content": "CVE-2021-42321: Proof-of-concept exploit code has been released online over the weekend for an actively exploited high severity vulnerability impacting Microsoft Exchange servers.\n\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398", "creation_timestamp": "2021-11-22T23:00:56.000000Z"}, {"uuid": "20179fb8-14f9-4531-957a-8aca12047fc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/itsec_news/1708", "content": "\u200b\ud83d\udd13 Microsoft: \u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u043a\u0430\u043f\u043b\u0438\u0432\u0430\u0435\u0442 \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\ud83d\udcac Microsoft \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430\u0441\u0442\u0443\u043f\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043a\u0438\u0431\u0435\u0440\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u041a\u0438\u0442\u0430\u044f \u0443\u043b\u0443\u0447\u0448\u0438\u043b\u0438\u0441\u044c \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0437\u0430\u043a\u043e\u043d\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u041f\u0435\u043a\u0438\u043d\u0443 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u043d\u0435\u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041f\u041e.\n\n\u0412\u043b\u0430\u0441\u0442\u0438 \u041a\u0438\u0442\u0430\u044f \u0432 2021 \u0433\u043e\u0434\u0443 \u043f\u0440\u0438\u043d\u044f\u043b\u0438 \u0437\u0430\u043a\u043e\u043d, \u043e\u0431\u044f\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u043e\u043e\u0431\u0449\u0430\u0442\u044c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043b\u0430\u0441\u0442\u044f\u043c, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0438\u0445 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0434\u0440\u0443\u0433\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 . \u041f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u041f\u0435\u043a\u0438\u043d\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0441\u0442\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u0413\u043e\u0434 \u0441\u043f\u0443\u0441\u0442\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0410\u0442\u043b\u0430\u043d\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u043e\u0432\u0435\u0442\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438, \u0447\u0442\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445, \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f, \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u043b\u043e\u0441\u044c, \u0430 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u043b\u043e\u0441\u044c.\n\n\u0412 \u043e\u0442\u0447\u0435\u0442\u0435 Microsoft \u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u0435 \u0437\u0430 2022 \u0433\u043e\u0434 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f , \u0447\u0442\u043e \u044d\u0442\u043e\u0442 \u0437\u0430\u043a\u043e\u043d \u00ab\u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u043c\u0443 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0440\u0443\u0436\u0438\u044f\u00bb.\n\nMicrosoft \u0437\u0430\u044f\u0432\u0438\u043b, \u0447\u0442\u043e \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u0433\u043e\u0434 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0441\u0443\u0431\u044a\u0435\u043a\u0442\u043e\u0432, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043e\u0442\u0440\u0430\u0436\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u041a\u0438\u0442\u0430\u044f \u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0432\u0430\u0436\u043d\u044b\u0439 \u0448\u0430\u0433 \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u0430.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043e\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0437\u043e\u0432\u0430\u043b\u0430 \u0431\u0430\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0445\u0441\u044f \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u041a\u0438\u0442\u0430\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043a\u0430\u043a \u00ab\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u044b\u0442\u043d\u044b\u0445\u00bb \u0432 \u043f\u043b\u0430\u043d\u0435 \u0434\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f. Microsoft \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0438\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043e\u043d\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c\u0438. \u0421\u044e\u0434\u0430 \u0432\u0445\u043e\u0434\u044f\u0442:\n\nCVE-2021-35211 (SolarWinds Serv-U);\nCVE-2021-40539 (Zoho ManageEngine ADSelfService Plus);\nCVE-2021-44077 (Zoho ManageEngine ServiceDesk Plus);\nCVE-2021-42321 (Microsoft Exchange);\nCVE-2022-26134 (Confluence).\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Microsoft, \u041a\u0438\u0442\u0430\u0439 \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u0448\u043f\u0438\u043e\u043d\u0430\u0436 \u0438 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 \u0441 \u0446\u0435\u043b\u044c\u044e \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0441\u0442\u043e\u044f\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c \u0421\u0428\u0410 \u0443\u0441\u0438\u043b\u0438\u0442\u044c \u0441\u0432\u043e\u0435 \u0432\u043b\u0438\u044f\u043d\u0438\u0435 \u0432 \u042e\u0433\u043e-\u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0410\u0437\u0438\u0438. \u0412 114-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u041a\u0438\u0442\u0430\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0441\u0442\u0441\u043a\u0438\u0435 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438.\n\n#Microsoft #\u041a\u0438\u0442\u0430\u0439 #\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-11-07T15:55:02.000000Z"}, {"uuid": "6e5b45ab-e2af-41e1-95e8-3136339896a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/349", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935", "creation_timestamp": "2022-05-12T22:17:01.000000Z"}, {"uuid": "09e6aa49-7a1b-4a3d-8d8d-9a6aadfb5ffc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://t.me/CyberGovIL/1342", "content": "\u05e2\u05d3\u05db\u05d5\u05df \u05d4\u05d0\u05d1\u05d8\u05d7\u05d4 \u05d4\u05d7\u05d5\u05d3\u05e9\u05d9 \u05e9\u05dc \u05de\u05d9\u05e7\u05e8\u05d5\u05e1\u05d5\u05e4\u05d8 - \u05e0\u05d5\u05d1\u05de\u05d1\u05e8 2021 | Com10760\n\n\u05d1-9 \u05dc\u05d7\u05d5\u05d3\u05e9 \u05e4\u05e8\u05e1\u05de\u05d4 \u05de\u05d9\u05e7\u05e8\u05d5\u05e1\u05d5\u05e4\u05d8 \u05db-55 \u05e2\u05d3\u05db\u05d5\u05e0\u05d9 \u05d0\u05d1\u05d8\u05d7\u05d4 \u05dc\u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05d1\u05ea\u05d5\u05db\u05e0\u05d5\u05ea \u05e0\u05ea\u05de\u05db\u05d5\u05ea.\n\n6 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05de\u05e1\u05d5\u05d5\u05d2\u05d5\u05ea \u05db\u05e7\u05e8\u05d9\u05d8\u05d9\u05d5\u05ea. 4 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05d3\u05d5\u05d5\u05d7\u05d5 \u05e4\u05d5\u05de\u05d1\u05d9\u05ea \u05dc\u05e4\u05e0\u05d9 \u05e4\u05e8\u05e1\u05d5\u05dd \u05d4\u05e2\u05d3\u05db\u05d5\u05df. 2 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05de\u05e0\u05d5\u05e6\u05dc\u05d5\u05ea \u05d1\u05e4\u05d5\u05e2\u05dc \u05e2\u05dc \u05d9\u05d3\u05d9 \u05ea\u05d5\u05e7\u05e4\u05d9\u05dd \u05d1\u05e2\u05d5\u05dc\u05dd (Zero Day).\n\n\u05d0\u05d7\u05ea \u05de\u05d4\u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05d4\u05de\u05e0\u05d5\u05e6\u05dc\u05d5\u05ea \u05d1\u05e4\u05d5\u05e2\u05dc (CVE-2021-42321) \u05d4\u05d9\u05d0 \u05d1\u05e9\u05e8\u05ea\u05d9 Exchange, \u05d5\u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05d4\u05e8\u05e6\u05ea \u05e7\u05d5\u05d3 \u05de\u05e8\u05d7\u05d5\u05e7 (RCE) \u05dc\u05de\u05e9\u05ea\u05de\u05e9 \u05de\u05d6\u05d5\u05d4\u05d4 (Authenticated).\n\n13 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05e0\u05d9\u05ea\u05e0\u05d5\u05ea \u05dc\u05e0\u05d9\u05e6\u05d5\u05dc \u05e2\u05dc \u05d9\u05d3\u05d9 \u05ea\u05d5\u05e7\u05e3 \u05de\u05e8\u05d5\u05d7\u05e7 \u05dc\u05d4\u05e8\u05e6\u05ea \u05e7\u05d5\u05d3 (RCE).\n\n\u05de\u05d5\u05de\u05dc\u05e5 \u05de\u05d0\u05d3 \u05dc\u05d1\u05d7\u05d5\u05df \u05d4\u05e2\u05d3\u05db\u05d5\u05e0\u05d9\u05dd \u05d1\u05e1\u05d1\u05d9\u05d1\u05ea \u05e0\u05d9\u05e1\u05d5\u05d9, \u05d5\u05dc\u05d4\u05ea\u05e7\u05d9\u05e0\u05dd \u05d1\u05d4\u05e7\u05d3\u05dd \u05d4\u05d0\u05e4\u05e9\u05e8\u05d9.", "creation_timestamp": "2021-11-10T18:50:57.000000Z"}, {"uuid": "76dc52f1-6ad1-4bfe-9f5c-fc598ab4d4f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/poxek/1941", "content": "Proxy-Attackchain\nproxylogon, proxyshell, proxyoracle, proxytoken, CVE-2021-42321 Deserialization RCE full chain exploit tool\nProxyLogon: \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0438 \u0432\u043b\u0438\u044f\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u043b\u044f Exchange.\nProxyOracle: \u0430\u0442\u0430\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043b\u044e\u0431\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Exchange \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430\nProxyShell: \u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043d\u0430 Pwn2Own 2021 \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 Exchange.\nhttps://github.com/FDlucifer/Proxy-Attackchain\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-07-08T09:00:47.000000Z"}, {"uuid": "e74f60a3-eae7-4c9e-8549-03468dcb526d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/ptswarm/91", "content": "Some notes about Microsoft Exchange Deserialization RCE (CVE-2021\u201342321)\n\n\ud83d\udc64 by Peterjson\n\nPost-Auth Deserialization RCE in Microsoft Exchange Server 2016 and 2019. The vulnerability occurs due to issues with the validation of cmdlet arguments\n\n\ud83d\udcdd Contents: \n\u2022 Intro\n\u2022 The Sink\n\u2022 The Source\n\u2022 Full Exploit\n\u2022 Improvement\n\nhttps://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852", "creation_timestamp": "2021-11-22T15:04:04.000000Z"}, {"uuid": "ba0474e1-5663-4836-bef2-c0221601af38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "published-proof-of-concept", "source": "https://t.me/linkersec/129", "content": "SLUB overflow CVE-2021-42327\n\nA concise article about exploiting a slab buffer-overflow bug in the AMD GPU driver. By Thelford Williams.\n\nThe author didn't have access to an AMD GPU, so they manually replicated the vulnerable code. The exploit uses msg_msg elastic objects to leak the kernel address, overwrite slab freelist pointer, allocate memory containing modprobe_path, and overwrite it for code execution.", "creation_timestamp": "2021-11-16T14:28:42.000000Z"}, {"uuid": "f423836f-57b5-4c69-a2b7-b1e5ee8c1d39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://t.me/alexmakus/4390", "content": "\u0418 \u043d\u0435 \u0437\u0430\u0431\u044b\u0432\u0430\u0435\u043c \u043f\u0440\u043e \u0442\u043e, \u0447\u0442\u043e \u043d\u0430 \u044d\u0442\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u0443 Microsoft \u0431\u044b\u043b \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 patch tuesday! \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 CVE \u2014\u00a055 \u0448\u0442\u0443\u043a! \u043d\u0443, \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c, \u043d\u0435 71, \u043a\u0430\u043a \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435, \u043d\u043e \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435. 6 \u0438\u0437 \u043d\u0438\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0435, 49 \u2014\u00a0\u0442\u0430\u043a, \u0435\u0440\u0443\u043d\u0434\u0430, \u043d\u0435 \u0441\u0442\u043e\u0438\u0442 \u0434\u0430\u0436\u0435 \u0438 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0439 \ud83d\ude42\n\nhttps://msrc.microsoft.com/update-guide/releaseNote/2021-Nov\n\n\u0412\u043e\u0442 \u044d\u0442\u0430 \u0432 Exchange Server, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321\n\n\u0411\u043e\u043b\u0435\u0435 \u043f\u043e\u043b\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043f\u0430\u0442\u0447\u0430 \u0442\u0443\u0442 \u2014\u00a0https://www.zerodayinitiative.com/blog/2021/11/9/the-november-2021-security-update-review\n\n\u043d\u043e \u0432\u044b \u0438 \u0442\u0430\u043a \u0437\u043d\u0430\u0435\u0442\u0435, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c \ud83d\ude42", "creation_timestamp": "2021-11-18T12:47:38.000000Z"}, {"uuid": "17ef7d1a-ea74-45d9-b8e1-2ab8013bee57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/42844", "content": "Expert released PoC exploit code for Microsoft Exchange CVE-2021-42321 RCE bug\n\nhttps://ift.tt/3xhWB4X", "creation_timestamp": "2021-11-23T18:22:25.000000Z"}, {"uuid": "98b20ddb-9ca6-4e84-a9a2-7a468d62b3ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "published-proof-of-concept", "source": "https://t.me/anwar1213xx/1285", "content": "\u062a\u062c\u0627\u0648\u0632 SLUB CVE-2021-42327\n\n\u0645\u0642\u0627\u0644\u0629 \u0645\u0648\u062c\u0632\u0629 \u062d\u0648\u0644 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062e\u0637\u0623 \u062a\u062c\u0627\u0648\u0632 \u0633\u0639\u0629 \u0627\u0644\u0645\u062e\u0632\u0646 \u0627\u0644\u0645\u0624\u0642\u062a \u0644\u0644\u0628\u0644\u0627\u0637\u0629 \u0641\u064a \u0628\u0631\u0646\u0627\u0645\u062c \u062a\u0634\u063a\u064a\u0644 \u0648\u062d\u062f\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0631\u0633\u0648\u0645\u0627\u062a AMD. \u0628\u0642\u0644\u0645 \u062b\u064a\u0644\u0641\u0648\u0631\u062f \u0648\u064a\u0644\u064a\u0627\u0645\u0632.\n\n\u0644\u0645 \u064a\u0643\u0646 \u0644\u062f\u0649 \u0627\u0644\u0645\u0624\u0644\u0641 \u062d\u0642 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0648\u062d\u062f\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0631\u0633\u0648\u0645\u0627\u062a AMD \u060c \u0644\u0630\u0644\u0643 \u0642\u0627\u0645\u0648\u0627 \u064a\u062f\u0648\u064a\u064b\u0627 \u0628\u0646\u0633\u062e \u0627\u0644\u0643\u0648\u062f \u0627\u0644\u0636\u0639\u064a\u0641. \u064a\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0643\u0627\u0626\u0646\u0627\u062a msg_msg \u0627\u0644\u0645\u0631\u0646\u0629 \u0644\u062a\u0633\u0631\u064a\u0628 \u0639\u0646\u0648\u0627\u0646 \u0627\u0644\u0646\u0648\u0627\u0629 \u060c \u0648\u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u0648\u0642 \u0645\u0624\u0634\u0631 \u0627\u0644\u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u062d\u0631\u0629 \u0644\u0644\u0628\u0644\u0627\u0637\u0629 \u060c \u0648\u062a\u062e\u0635\u064a\u0635 \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0627\u0644\u062a\u064a \u062a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 modprobe_path \u060c \u0648\u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u0648\u0642\u0647\u0627 \u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u062a\u0639\u0644\u064a\u0645\u0627\u062a \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0629.", "creation_timestamp": "2021-11-16T18:00:06.000000Z"}, {"uuid": "def89f30-d24f-4dcf-abed-5c576ade6333", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/arpsyndicate/1842", "content": "#ExploitObserverAlert\n\nCVE-2021-42321\n\nDESCRIPTION: Exploit Observer has 36 entries related to CVE-2021-42321. Microsoft Exchange Server Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.913120000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2023-12-17T21:18:36.000000Z"}, {"uuid": "3212b1aa-fe64-4c77-a7df-57f2cb46a7a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "published-proof-of-concept", "source": "https://t.me/Termux_AND_Security7667/327", "content": "\u062a\u062c\u0627\u0648\u0632 SLUB CVE-2021-42327\n\n\u0645\u0642\u0627\u0644\u0629 \u0645\u0648\u062c\u0632\u0629 \u062d\u0648\u0644 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062e\u0637\u0623 \u062a\u062c\u0627\u0648\u0632 \u0633\u0639\u0629 \u0627\u0644\u0645\u062e\u0632\u0646 \u0627\u0644\u0645\u0624\u0642\u062a \u0644\u0644\u0628\u0644\u0627\u0637\u0629 \u0641\u064a \u0628\u0631\u0646\u0627\u0645\u062c \u062a\u0634\u063a\u064a\u0644 \u0648\u062d\u062f\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0631\u0633\u0648\u0645\u0627\u062a AMD. \u0628\u0642\u0644\u0645 \u062b\u064a\u0644\u0641\u0648\u0631\u062f \u0648\u064a\u0644\u064a\u0627\u0645\u0632.\n\n\u0644\u0645 \u064a\u0643\u0646 \u0644\u062f\u0649 \u0627\u0644\u0645\u0624\u0644\u0641 \u062d\u0642 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0648\u062d\u062f\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0631\u0633\u0648\u0645\u0627\u062a AMD \u060c \u0644\u0630\u0644\u0643 \u0642\u0627\u0645\u0648\u0627 \u064a\u062f\u0648\u064a\u064b\u0627 \u0628\u0646\u0633\u062e \u0627\u0644\u0643\u0648\u062f \u0627\u0644\u0636\u0639\u064a\u0641. \u064a\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0643\u0627\u0626\u0646\u0627\u062a msg_msg \u0627\u0644\u0645\u0631\u0646\u0629 \u0644\u062a\u0633\u0631\u064a\u0628 \u0639\u0646\u0648\u0627\u0646 \u0627\u0644\u0646\u0648\u0627\u0629 \u060c \u0648\u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u0648\u0642 \u0645\u0624\u0634\u0631 \u0627\u0644\u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u062d\u0631\u0629 \u0644\u0644\u0628\u0644\u0627\u0637\u0629 \u060c \u0648\u062a\u062e\u0635\u064a\u0635 \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0627\u0644\u062a\u064a \u062a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 modprobe_path \u060c \u0648\u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u0648\u0642\u0647\u0627 \u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u062a\u0639\u0644\u064a\u0645\u0627\u062a \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0629.", "creation_timestamp": "2021-11-16T18:00:06.000000Z"}, {"uuid": "61c49999-5783-4db3-b02d-c793d74f4632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/463", "content": "CVE-2021-42321 Microsoft Exchange Server Post-Auth RCE\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398\n\nGhost let me Inject OS Commands RCE\nhttps://medium.com/@Hossam.Mesbah/ghost-let-me-inject-os-commands-rce-a6e71e54445d", "creation_timestamp": "2021-11-22T09:23:23.000000Z"}, {"uuid": "08d832c2-9c34-40a4-8ff4-5509c141da4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "published-proof-of-concept", "source": "https://t.me/hack77z99/9007", "content": "\u062a\u062c\u0627\u0648\u0632 SLUB CVE-2021-42327\n\n\u0645\u0642\u0627\u0644\u0629 \u0645\u0648\u062c\u0632\u0629 \u062d\u0648\u0644 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062e\u0637\u0623 \u062a\u062c\u0627\u0648\u0632 \u0633\u0639\u0629 \u0627\u0644\u0645\u062e\u0632\u0646 \u0627\u0644\u0645\u0624\u0642\u062a \u0644\u0644\u0628\u0644\u0627\u0637\u0629 \u0641\u064a \u0628\u0631\u0646\u0627\u0645\u062c \u062a\u0634\u063a\u064a\u0644 \u0648\u062d\u062f\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0631\u0633\u0648\u0645\u0627\u062a AMD. \u0628\u0642\u0644\u0645 \u062b\u064a\u0644\u0641\u0648\u0631\u062f \u0648\u064a\u0644\u064a\u0627\u0645\u0632.\n\n\u0644\u0645 \u064a\u0643\u0646 \u0644\u062f\u0649 \u0627\u0644\u0645\u0624\u0644\u0641 \u062d\u0642 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0648\u062d\u062f\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0631\u0633\u0648\u0645\u0627\u062a AMD \u060c \u0644\u0630\u0644\u0643 \u0642\u0627\u0645\u0648\u0627 \u064a\u062f\u0648\u064a\u064b\u0627 \u0628\u0646\u0633\u062e \u0627\u0644\u0643\u0648\u062f \u0627\u0644\u0636\u0639\u064a\u0641. \u064a\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0643\u0627\u0626\u0646\u0627\u062a msg_msg \u0627\u0644\u0645\u0631\u0646\u0629 \u0644\u062a\u0633\u0631\u064a\u0628 \u0639\u0646\u0648\u0627\u0646 \u0627\u0644\u0646\u0648\u0627\u0629 \u060c \u0648\u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u0648\u0642 \u0645\u0624\u0634\u0631 \u0627\u0644\u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u062d\u0631\u0629 \u0644\u0644\u0628\u0644\u0627\u0637\u0629 \u060c \u0648\u062a\u062e\u0635\u064a\u0635 \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0627\u0644\u062a\u064a \u062a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 modprobe_path \u060c \u0648\u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u0648\u0642\u0647\u0627 \u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u062a\u0639\u0644\u064a\u0645\u0627\u062a \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0629.", "creation_timestamp": "2021-11-16T18:00:09.000000Z"}, {"uuid": "4b9c172c-4087-4ffe-ac7c-7b2f9b18771a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://t.me/true_secator/2359", "content": "\u200b\u200b\u0421\u043f\u0435\u0448\u0438\u043c \u0432\u0430\u0441 \u043e\u0431\u0440\u0430\u0434\u043e\u0432\u0430\u0442\u044c \u0435\u0449\u0435 \u043e\u0434\u043d\u043e\u0439 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u043e\u0441\u0442\u044c\u044e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u0441\u0440\u0435\u0434\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 (\u0438 \u0432 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0410\u0420\u0422) Microsoft Exchange. \u041d\u043e \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438 - \u0432\u0441\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043c\u043e.\n \n\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0438\u0435 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c Janggggg \u0431\u044b\u043b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 CVE-2021-42321, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 Exchange Server 2016 \u0438 Exchange Server 2019 (\u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c\u0438 \u0432 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 Exchange). \u041e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u0430 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 Patch Tuesday.\n \n\u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f RCE \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0432 Exchange \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445.\n \n\u041f\u043e\u043a\u0430 Microsoft \u0442\u0440\u0443\u0431\u044f\u0442 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u0430\u0434\u043c\u0438\u043d\u044b Exchange \u0432\u043e\u0432\u0441\u044e \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u044e\u0442, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0441\u043a\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0438\u0445.\n \n\u041f\u043e\u043c\u043d\u044f \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 2021 \u0433\u043e\u0434\u0430 Exchange \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u043b\u0438\u0441\u044c \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyLogon \u0438 ProxyShell, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043f\u043e\u0441\u043a\u043e\u0440\u0435\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 Exchange \u0438 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0441\u043e\u0431\u044b\u0442\u0438\u044f \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0435 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2021-42321, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u043d\u0430\u043a\u0430\u0442\u0438\u0442\u044c \u0432\u0441\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c \u043f\u0430\u0442\u0447\u0438.", "creation_timestamp": "2021-11-23T13:06:43.000000Z"}, {"uuid": "db703a00-40d8-4fa2-bdbf-924d8f7e970b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/true_secator/2302", "content": "\u200b\u200bMicrosoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0439 PatchTuesday, \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0432 6 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0435\u0449\u0435 49 \u0432\u0430\u0436\u043d\u044b\u0445, \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e 55: \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 20 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, 2 - \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, 15 - \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430, 10 - \u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, 3 - \u0441 \u043e\u0442\u043a\u0430\u0437\u043e\u043c \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438, 4 - \u0441\u043e \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u043e\u043c.\n \n\u0422\u0435\u043a\u0443\u0449\u0438\u0439 Patch \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 2 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-42292 (\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Microsoft Excel) \u0438 CVE-2021-42321 (\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430 \u0432 Microsoft Exchange Server).\n \n\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 Microsoft Exchange \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043a\u043e\u043d\u043a\u0443\u0440\u0441\u0430 Tianfu Cup, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435.\n \n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432, \u043e\u0434\u043d\u0430\u043a\u043e \u0437\u0430\u0432\u0435\u0440\u044f\u044e\u0442, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0438 \u043d\u043e\u0441\u0438\u043b\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Exchange 2016 \u0438 2019, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 Microsoft Exchange Server, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c\u0438 \u0432 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 Exchange. \u041d\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u043e \u043f\u043e\u043c\u043d\u0438\u043c \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u0438 \u0421\u0428\u0410 \u0438 \u0438\u0445 \u0441\u043e\u044e\u0437\u043d\u0438\u043a\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0415\u0421, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u044e \u0438 \u041d\u0410\u0422\u041e, \u0432 \u0430\u0434\u0440\u0435\u0441 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0432\u043b\u0430\u0441\u0442\u0435\u0439 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0448\u0438\u0440\u043e\u043a\u043e\u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043d\u0430 Microsoft Exchange.\n \n\u0412\u0442\u043e\u0440\u043e\u0439 0-day \u0431\u044b\u043b \u0437\u0430\u043c\u0435\u0447\u0435\u043d \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 Microsoft Excel \u0438 \u043e\u043f\u0438\u0441\u0430\u043d \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0445 \u0442\u0430\u0431\u043b\u0438\u0446. \u0414\u044b\u0440\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u0426\u0435\u043d\u0442\u0440\u043e\u043c \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0443\u0433\u0440\u043e\u0437 \u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439.\n \n\u041d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f CVE-2021-3711, \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f SM2 OpenSSL, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0441\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0435. \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u044f (DoS).\n \n\u0414\u0440\u0443\u0433\u0438\u0435 \u0432\u0430\u0436\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0432 Chakra Scripting Engine (CVE-2021-42279), Microsoft Defender (CVE-2021-42298), Microsoft Virtual Machine Bus (CVE-2021-26443), RDP (CVE-2021-38631 \u0438 CVE-2021-41371), \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u0445 3D-\u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 (CVE-2021-43208 \u0438 CVE-2021-43209).\n \n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Microsoft Patch Tuesday \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 Azure, Microsoft Edge, Visual Studio \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 Windows.\n \n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 Patch Tuesday \u0442\u0430\u043a\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0442 Adobe, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 4 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d \u0441\u0430\u043c\u044b\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a CVE-2021-39858 \u0432 RoboHelp Server (RHS2020.0.1 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043e\u0434 Windows) \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043e\u0446\u0435\u043d\u043a\u0443 \u00ab\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439\u00bb, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0440\u0435\u0434\u0443 \u0430\u0442\u0430\u043a\u0430\u043c \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n \n\u041f\u043e\u043b\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430 \u043d\u043e\u044f\u0431\u0440\u044c 2021 \u0433\u043e\u0434\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0437\u0434\u0435\u0441\u044c.\n \n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f Mac \u043f\u043e\u043a\u0430 \u0435\u0449\u0435 \u043d\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b, \u0434\u0430\u0436\u0435 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Excel \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Microsoft Office \u0434\u043b\u044f macOS.\n \n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c Windows \u0431\u0435\u0437 \u043f\u0440\u043e\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0441\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c macOS \u0443\u043f\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u0443\u0434\u0430\u0447\u0443 \u0438 \u0442\u0435\u0440\u043f\u0435\u043d\u0438\u0435.", "creation_timestamp": "2021-11-10T13:12:56.000000Z"}, {"uuid": "b18e6d24-aca5-46bd-bfc5-291f247e8839", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "published-proof-of-concept", "source": "Telegram/n-eJb_bPDdKFJMa22aYLTja9lfApX45ftzuXjh3MC3aMiQ", "content": "", "creation_timestamp": "2021-11-03T15:01:23.000000Z"}, {"uuid": "3bd1f9e4-bbc3-4426-a22b-ff7b4d0b0edc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cisoclub/1133", "content": "#\u041d\u043e\u0432\u043e\u0441\u0442\u0438 \u0437\u0430 25 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433. \ud83d\udcf0\n\n1\ufe0f\u20e3 \u041f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c \ud83d\udcdd\u043e\u0431\u0437\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u043e\u0448\u043b\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e. \u0412 \u0446\u0435\u043d\u0442\u0440\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f: Conti, GoDaddy, Seneca Family of Agencies, Utah Imaging Associated, Eskenazi Health, California Pizza Kitchen, WSpot, BGFI. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n2\ufe0f\u20e3 \u0426\u0435\u043d\u0442\u0440 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \ud83d\udcbb\u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u044b UserGate \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u00ab\u0421\u0438\u0441\u0442\u0435\u043c\u0443 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0412\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439\u00bb (\u0421\u041e\u0412) UserGate \u043d\u043e\u0432\u0443\u044e \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0443, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \ud83d\udd0d\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-42321. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n3\ufe0f\u20e3 \u0412 \ud83c\udfe6\u0421\u0431\u0435\u0440\u0435 \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u043d\u0435\u0435 \u0438 \u0432\u0441\u0451 \u0447\u0430\u0449\u0435 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u043e\u0432\u044b\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \ud83d\udcdfIoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n4\ufe0f\u20e3 \u0412 Group-IB \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \ud83d\udcbb\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u041f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0438\u0437 \ud83c\uddf7\ud83c\uddfa\u0420\u0424 \u043f\u043b\u0430\u0442\u0438\u043b\u0438 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u043f\u043e \ud83d\udcb53 \u043c\u043b\u043d. \u0440\u0443\u0431\u043b\u0435\u0439 \u0445\u0430\u043a\u0435\u0440\u0430\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f\u043c \u0432 2021 \u0433\u043e\u0434\u0443. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n \n5\ufe0f\u20e3 \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u0432 \u0441\u0444\u0435\u0440\u0435 \u043e\u043d\u043b\u0430\u0439\u043d-\u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \ud83d\udcc8\u0443\u0442\u0440\u043e\u0438\u043b\u043e\u0441\u044c \u0432 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u00ab\u0447\u0435\u0440\u043d\u043e\u0439 \u043f\u044f\u0442\u043d\u0438\u0446\u044b\u00bb. \u0412 \"\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\" \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 \"\u043f\u043e\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443\" \ud83e\udd21\u043c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043f\u043e\u0434 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0432\u0435\u0441\u0442\u043a\u0443 \u0434\u043d\u044f. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n6\ufe0f\u20e3 \ud83c\udf4fApple \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u043e\u0431\u0449\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u0438\u0445 \ud83d\udcf1\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u041d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c\u0438 APT-\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c\u0438.  \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435", "creation_timestamp": "2026-07-30T00:02:59.623191Z"}, {"uuid": "0bf912eb-2006-4c6d-a23f-b1088999a4dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/sysadm_in_up/906", "content": "PoC of CVE-2021-42321: pop mspaint.exe on the target\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398", "creation_timestamp": "2026-07-30T00:03:06.571060Z"}, {"uuid": "75e0bff7-0464-4c1e-987c-025f68e30c98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/shmelovod/441", "content": "\u0412 \u0441\u0435\u0442\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0441\u0432\u0435\u0436\u0435\u0439 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Exchange\n\nhttps://xakep.ru/2021/11/24/cve-2021-42321-poc/", "creation_timestamp": "2026-07-30T00:03:08.710126Z"}, {"uuid": "632d9520-eb8b-49e7-93d2-f2ebc94bacc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/sysadm_in_up/906", "content": "PoC of CVE-2021-42321: pop mspaint.exe on the target\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398", "creation_timestamp": "2026-08-04T04:00:03.242382Z"}, {"uuid": "5fcef8d3-5962-46c9-a5c2-53ab5035b710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/shmelovod/441", "content": "\u0412 \u0441\u0435\u0442\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0441\u0432\u0435\u0436\u0435\u0439 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Exchange\n\nhttps://xakep.ru/2021/11/24/cve-2021-42321-poc/", "creation_timestamp": "2026-08-04T06:00:05.097791Z"}, {"uuid": "d6702e55-b710-41da-b1bb-a02dcb9447a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42320", "type": "seen", "source": "https://t.me/cibsecurity/34039", "content": "\u203c CVE-2021-43242 \u203c\n\nMicrosoft SharePoint Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-42320.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-15T18:20:42.000000Z"}, {"uuid": "c2b960fe-658a-40d6-96cf-c2de8d75a00a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "seen", "source": "https://t.me/cibsecurity/30963", "content": "\u203c CVE-2021-42327 \u203c\n\ndp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-21T20:37:09.000000Z"}, {"uuid": "070cf72f-9cca-45bc-ad93-bc2a0f02f5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42325", "type": "seen", "source": "https://t.me/cibsecurity/30461", "content": "\u203c CVE-2021-42325 \u203c\n\nFroxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-13T00:25:48.000000Z"}, {"uuid": "14b1add3-d7ad-454a-aa7a-dcad9edd2dfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42329", "type": "seen", "source": "https://t.me/cibsecurity/30624", "content": "\u203c CVE-2021-42329 \u203c\n\nThe \u00e2\u20ac\u0153List_Add\u00e2\u20ac\ufffd function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user\u00e2\u20ac\u2122s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-15T16:28:58.000000Z"}, {"uuid": "6ebbe924-915c-450b-8b68-dc8827918dcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42326", "type": "seen", "source": "https://t.me/cibsecurity/30446", "content": "\u203c CVE-2021-42326 \u203c\n\nRedmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-12T22:25:46.000000Z"}, {"uuid": "572039b6-049f-4a18-9cb5-53291d53467e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/HackerOne/3238", "content": "\u2b55\ufe0fPoC of MS Exchange RCE via mspaint.exe\n\n@securation", "creation_timestamp": "2021-11-23T13:52:23.000000Z"}, {"uuid": "7f70ec92-6e4e-482a-8098-d27ff07e68f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/thehackernews/1642", "content": "< Nov. 2021 Patch Tuesday > \n\nMicrosoft releases security patches for 55 new vulnerabilities, including two actively exploited zero-day flaws in Excel (CVE-2021-42292) and Exchange Server (CVE-2021-42321).\n\nRead Details: https://thehackernews.com/2021/11/microsoft-issues-patches-for-actively.html", "creation_timestamp": "2021-11-10T07:32:55.000000Z"}, {"uuid": "4cbfee3f-8e31-48d0-b9ea-4211b4b924cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/xakep_ru/11626", "content": "\u0412 \u0441\u0435\u0442\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0441\u0432\u0435\u0436\u0435\u0439 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Exchange\n\n\u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e \u00ab\u0432\u0442\u043e\u0440\u043d\u0438\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439\u00bb Microsoft \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u0430\u0433 CVE-2021-42321, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0439 Exchange Server 2016 \u0438 Exchange Server 2019. \u0422\u0435\u043f\u0435\u0440\u044c \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442.\n\nhttps://xakep.ru/2021/11/24/cve-2021-42321-poc/", "creation_timestamp": "2021-11-24T21:03:24.000000Z"}, {"uuid": "8c9f55ee-0178-4693-a0de-60e803b7a333", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42325", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1259", "content": "#exploit\nCVE-2021-42325:\nFroxlor\u00a0Server Management Panel 0.10.28/0.10.29.x - RCE\nhttps://www.exploit-db.com/exploits/50502\n\n@BlueRedTeam", "creation_timestamp": "2021-12-03T04:43:36.000000Z"}, {"uuid": "a091a4d0-7484-4965-aece-493e33896f28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "Telegram/PmOi4UCqVk8vGB488C4H9nDpjCEpRjPBecP-Gyu-rWZ2rA0s", "content": "", "creation_timestamp": "2022-02-28T09:54:04.000000Z"}, {"uuid": "535eaf7d-73ad-4e42-9b68-e5bc041abf94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42325", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4887", "content": "#exploit\nCVE-2021-42325:\nFroxlor\u00a0Server Management Panel 0.10.28/0.10.29.x - RCE\nhttps://www.exploit-db.com/exploits/50502", "creation_timestamp": "2021-12-03T11:00:35.000000Z"}, {"uuid": "38efa2c3-b13f-4d49-b537-4618d105f142", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4809", "content": "#exploit\n1. CVE-2021-42321:\nExchange Post-Auth RCE\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398\n\n2. CVE-2021-22053:\nSpring Cloud Netflix Hystrix Dashboard\ntemplate resolution vulnerability\nhttps://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053", "creation_timestamp": "2021-11-22T11:01:01.000000Z"}, {"uuid": "d667a2df-5aa2-41b3-bb4c-5028cb46c8bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4889", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Nov 1-30)\nCVE-2021-22205 - GitLab CE/EE RCE\nhttps://t.me/cybersecuritytechnologies/4602\nCVE-2021-30883 - iOS IOMFB Vuln\nhttps://t.me/cybersecuritytechnologies/4497\nCVE-2021-3064 - Memory Corruption in PAN-OS GlobalProtect Portal/Gateway Interfaces\nhttps://t.me/cybersecuritytechnologies/4724\nCVE-2021-41379 - Windows Installer LPE\nhttps://t.me/cybersecuritytechnologies/4813\nCVE-2021-42321 - MS Exchange Post-Auth RCE\nhttps://t.me/cybersecuritytechnologies/4809\nCVE-2021-40539 - Zoho ManageEngine Auth. Bypass\nhttps://t.me/cybersecuritytechnologies/4718\nCVE-2021-41277 - MetaBase Arbitrary File Read\nhttps://t.me/cybersecuritytechnologies/4802\nCVE-2021-43267 - Remote Kernel Heap Overflow in TIPC\nhttps://t.me/cybersecuritytechnologies/4678\nCVE-2021-42574 - Unicode Bidirectional override vuln\nhttps://github.com/js-on/CVE-2021-42574\nhttps://github.com/pierDipi/unicode-control-characters-action\nCVE-2021-24084 - Windows MDM LPE\nhttps://t.me/cybersecuritytechnologies/4850", "creation_timestamp": "2021-12-03T11:00:35.000000Z"}, {"uuid": "a992d732-0938-4b1a-ad57-b7f0e99deead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1825", "content": "SLUB overflow CVE-2021-42327 https://docfate111.github.io/blog/securityresearch/2021/11/08/SLUBoverflow.html", "creation_timestamp": "2026-08-03T04:12:55.776302Z"}, {"uuid": "9b1b5942-7701-4e0d-b6d5-6bb0c3498648", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cisoclub/1133", "content": "#\u041d\u043e\u0432\u043e\u0441\u0442\u0438 \u0437\u0430 25 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433. \ud83d\udcf0\n\n1\ufe0f\u20e3 \u041f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c \ud83d\udcdd\u043e\u0431\u0437\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u043e\u0448\u043b\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e. \u0412 \u0446\u0435\u043d\u0442\u0440\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f: Conti, GoDaddy, Seneca Family of Agencies, Utah Imaging Associated, Eskenazi Health, California Pizza Kitchen, WSpot, BGFI. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n2\ufe0f\u20e3 \u0426\u0435\u043d\u0442\u0440 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \ud83d\udcbb\u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u044b UserGate \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u00ab\u0421\u0438\u0441\u0442\u0435\u043c\u0443 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0412\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439\u00bb (\u0421\u041e\u0412) UserGate \u043d\u043e\u0432\u0443\u044e \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0443, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \ud83d\udd0d\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-42321. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n3\ufe0f\u20e3 \u0412 \ud83c\udfe6\u0421\u0431\u0435\u0440\u0435 \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u043d\u0435\u0435 \u0438 \u0432\u0441\u0451 \u0447\u0430\u0449\u0435 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u043e\u0432\u044b\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \ud83d\udcdfIoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n4\ufe0f\u20e3 \u0412 Group-IB \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \ud83d\udcbb\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u041f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0438\u0437 \ud83c\uddf7\ud83c\uddfa\u0420\u0424 \u043f\u043b\u0430\u0442\u0438\u043b\u0438 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u043f\u043e \ud83d\udcb53 \u043c\u043b\u043d. \u0440\u0443\u0431\u043b\u0435\u0439 \u0445\u0430\u043a\u0435\u0440\u0430\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f\u043c \u0432 2021 \u0433\u043e\u0434\u0443. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n \n5\ufe0f\u20e3 \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u0432 \u0441\u0444\u0435\u0440\u0435 \u043e\u043d\u043b\u0430\u0439\u043d-\u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \ud83d\udcc8\u0443\u0442\u0440\u043e\u0438\u043b\u043e\u0441\u044c \u0432 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u00ab\u0447\u0435\u0440\u043d\u043e\u0439 \u043f\u044f\u0442\u043d\u0438\u0446\u044b\u00bb. \u0412 \"\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\" \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 \"\u043f\u043e\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443\" \ud83e\udd21\u043c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043f\u043e\u0434 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0432\u0435\u0441\u0442\u043a\u0443 \u0434\u043d\u044f. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n6\ufe0f\u20e3 \ud83c\udf4fApple \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u043e\u0431\u0449\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u0438\u0445 \ud83d\udcf1\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u041d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c\u0438 APT-\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c\u0438.  \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435", "creation_timestamp": "2026-08-03T23:00:14.283221Z"}, {"uuid": "76b45a7b-9729-46e3-b9fa-284891fb7765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cisoclub/1133", "content": "#\u041d\u043e\u0432\u043e\u0441\u0442\u0438 \u0437\u0430 25 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433. \ud83d\udcf0\n\n1\ufe0f\u20e3 \u041f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c \ud83d\udcdd\u043e\u0431\u0437\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u043e\u0448\u043b\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e. \u0412 \u0446\u0435\u043d\u0442\u0440\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f: Conti, GoDaddy, Seneca Family of Agencies, Utah Imaging Associated, Eskenazi Health, California Pizza Kitchen, WSpot, BGFI. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n2\ufe0f\u20e3 \u0426\u0435\u043d\u0442\u0440 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \ud83d\udcbb\u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u044b UserGate \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u00ab\u0421\u0438\u0441\u0442\u0435\u043c\u0443 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0412\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439\u00bb (\u0421\u041e\u0412) UserGate \u043d\u043e\u0432\u0443\u044e \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0443, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \ud83d\udd0d\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-42321. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n3\ufe0f\u20e3 \u0412 \ud83c\udfe6\u0421\u0431\u0435\u0440\u0435 \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u043d\u0435\u0435 \u0438 \u0432\u0441\u0451 \u0447\u0430\u0449\u0435 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u043e\u0432\u044b\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \ud83d\udcdfIoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n4\ufe0f\u20e3 \u0412 Group-IB \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \ud83d\udcbb\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u041f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0438\u0437 \ud83c\uddf7\ud83c\uddfa\u0420\u0424 \u043f\u043b\u0430\u0442\u0438\u043b\u0438 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u043f\u043e \ud83d\udcb53 \u043c\u043b\u043d. \u0440\u0443\u0431\u043b\u0435\u0439 \u0445\u0430\u043a\u0435\u0440\u0430\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f\u043c \u0432 2021 \u0433\u043e\u0434\u0443. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n \n5\ufe0f\u20e3 \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u0432 \u0441\u0444\u0435\u0440\u0435 \u043e\u043d\u043b\u0430\u0439\u043d-\u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \ud83d\udcc8\u0443\u0442\u0440\u043e\u0438\u043b\u043e\u0441\u044c \u0432 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u00ab\u0447\u0435\u0440\u043d\u043e\u0439 \u043f\u044f\u0442\u043d\u0438\u0446\u044b\u00bb. \u0412 \"\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\" \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 \"\u043f\u043e\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443\" \ud83e\udd21\u043c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043f\u043e\u0434 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0432\u0435\u0441\u0442\u043a\u0443 \u0434\u043d\u044f. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n6\ufe0f\u20e3 \ud83c\udf4fApple \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u043e\u0431\u0449\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u0438\u0445 \ud83d\udcf1\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u041d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c\u0438 APT-\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c\u0438.  \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435", "creation_timestamp": "2026-08-04T00:00:11.686268Z"}, {"uuid": "98c58dd8-469e-41ad-b1cd-ee71a1b20b89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1825", "content": "SLUB overflow CVE-2021-42327 https://docfate111.github.io/blog/securityresearch/2021/11/08/SLUBoverflow.html", "creation_timestamp": "2026-08-04T00:00:50.905391Z"}, {"uuid": "2e58f4bf-4970-4ec5-8634-64c953b5556e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/shmelovod/441", "content": "\u0412 \u0441\u0435\u0442\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0441\u0432\u0435\u0436\u0435\u0439 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Exchange\n\nhttps://xakep.ru/2021/11/24/cve-2021-42321-poc/", "creation_timestamp": "2026-08-05T00:00:53.620842Z"}, {"uuid": "3fcc2c5b-1e8d-4081-8215-5d69b3f26764", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/sysadm_in_up/906", "content": "PoC of CVE-2021-42321: pop mspaint.exe on the target\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398", "creation_timestamp": "2026-08-05T00:00:55.927150Z"}, {"uuid": "1793d7bc-ecd5-45f0-8f19-e5e306041c8e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7871e714-1093-4a94-a6ba-363a6b2fd169", "content": "", "creation_timestamp": "2026-06-19T12:47:44.466719Z"}, {"uuid": "138d4414-e53e-4916-9f82-5379332fa672", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3fcddbd7-bfff-4e41-b452-04f1f9a934af", "content": "", "creation_timestamp": "2026-06-23T14:04:50.338427Z"}, {"uuid": "007afdf8-0f5b-4f0b-a47e-c13686bf361e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mtju225ywx2y", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-42321: Microsoft Exchange Server Remote Code Execution Vulnerability\nCVSS 8.8 \u00b7 EPSS 91.7% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-42321\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-20T18:15:09.491194Z"}, {"uuid": "ee10744f-19eb-4448-be9c-e03f131435d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/EchelonEyes/862", "content": "Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u0435\n\n\u041e\u0442\u0447\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0433\u0438\u0433\u0430\u043d\u0442\u0430 \u00abMicrosoft Digital Defense Report 2022\u00bb \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 114 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438 \u043e\u0441\u0432\u0435\u0449\u0430\u0435\u0442 \u0432\u0435\u0441\u044c \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442 \u0443\u0433\u0440\u043e\u0437 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \n\n\u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0439 Microsoft \u0441\u0442\u0430\u043b\u043e \u00ab\u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043c\u0435\u0436\u0434\u0443 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u043e\u0432\u0430\u0440\u00bb. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u043b\u0438 \u041f\u041e \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u043b\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b\u0438 \u043c\u0435\u0440\u044b \u043f\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e \u0440\u0438\u0441\u043a\u043e\u0432. \u042d\u0442\u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442\u0441\u044f \u0438 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 CISA \u2013 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u0435\u0449\u0435 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2022 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u00ab\u0430\u0433\u0440\u0435\u0441\u0441\u0438\u0432\u043d\u043e\u00bb \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438.\n\nMicrosoft \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0432\u0441\u0435\u0433\u043e 14 \u0434\u043d\u0435\u0439 \u043d\u0430 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0425\u043e\u0442\u044f \u0430\u0442\u0430\u043a\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u044b \u043f\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0443, \u043e\u043d\u0438, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0435\u0440\u0435\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0433\u043b\u0430\u0432\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043c\u0438\u0440\u0443, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u043f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b. \u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 \u0423\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u041a\u0438\u0442\u0430\u044f \u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443 \u0440\u0430\u043d\u044c\u0448\u0435, \u0447\u0435\u043c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u0422\u0430\u043a\u043e\u0439 \u0437\u0430\u043a\u043e\u043d \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u043c \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0440\u0443\u0436\u0438\u044f.\n\nMicrosoft \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u044f\u0435\u0442 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043c\u0435\u043d\u043d\u043e \u041a\u0438\u0442\u0430\u0435\u043c, \u0432 \u0446\u0435\u043b\u044f\u0445 \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430:\n\nCVE-2021-35211 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10,0) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 SolarWinds Serv-U \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Serv-U Secure FTP.\n\nCVE-2021-40539 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Zoho ManageEngine ADSelfService Plus.\n\nCVE-2021-44077 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 Zoho ManageEngine ServiceDesk Plus.\n\nCVE-2021-42321 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,8) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 Microsoft Exchange Server.\n\nCVE-2022-26134 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u044f\u0437\u044b\u043a\u0430 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e-\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u0438 (OGNL) \u0432 Atlassian Confluence.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE5bUvv?culture=en-us&country=us \n\n#Microsoft #\u043e\u0442\u0447\u0435\u0442", "creation_timestamp": "2026-07-26T02:02:36.223851Z"}, {"uuid": "c09de397-5529-477d-8c13-fb77a1986e01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/Unidentified_TM/1299", "content": "< \u0646\u0648\u0627\u0645\u0628\u0631 2021 \u067e\u0686 \u0633\u0647 \u0634\u0646\u0628\u0647 >\n\n \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u067e\u0686 \u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc 55 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0645\u0646\u062a\u0634\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062f\u0648 \u0646\u0642\u0635 \u0632\u06cc\u0631\u0648-\u062f\u06cc \u062f\u0631 \u0627\u06a9\u0633\u0644 (CVE-2021-42292) \u0648 Exchange Server (CVE-2021-42321).\n\nCVE-2021-43208 (CVSS score: 7.8) - 3D Viewer Remote Code Execution Vulnerability\nCVE-2021-43209 (CVSS score: 7.8) - 3D Viewer Remote Code Execution Vulnerability\nCVE-2021-38631 (CVSS score: 4.4) - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability\nCVE-2021-41371 (CVSS score: 4.4) - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability\n\n\n@Unidentified_TM", "creation_timestamp": "2026-07-26T07:01:48.951904Z"}, {"uuid": "45e3b84f-7e9a-4c05-9af0-99085223cf42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/EchelonEyes/862", "content": "Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u0435\n\n\u041e\u0442\u0447\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0433\u0438\u0433\u0430\u043d\u0442\u0430 \u00abMicrosoft Digital Defense Report 2022\u00bb \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 114 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438 \u043e\u0441\u0432\u0435\u0449\u0430\u0435\u0442 \u0432\u0435\u0441\u044c \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442 \u0443\u0433\u0440\u043e\u0437 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \n\n\u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0439 Microsoft \u0441\u0442\u0430\u043b\u043e \u00ab\u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043c\u0435\u0436\u0434\u0443 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u043e\u0432\u0430\u0440\u00bb. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u043b\u0438 \u041f\u041e \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u043b\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b\u0438 \u043c\u0435\u0440\u044b \u043f\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e \u0440\u0438\u0441\u043a\u043e\u0432. \u042d\u0442\u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442\u0441\u044f \u0438 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 CISA \u2013 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u0435\u0449\u0435 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2022 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u00ab\u0430\u0433\u0440\u0435\u0441\u0441\u0438\u0432\u043d\u043e\u00bb \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438.\n\nMicrosoft \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0432\u0441\u0435\u0433\u043e 14 \u0434\u043d\u0435\u0439 \u043d\u0430 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0425\u043e\u0442\u044f \u0430\u0442\u0430\u043a\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u044b \u043f\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0443, \u043e\u043d\u0438, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0435\u0440\u0435\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0433\u043b\u0430\u0432\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043c\u0438\u0440\u0443, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u043f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b. \u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 \u0423\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u041a\u0438\u0442\u0430\u044f \u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443 \u0440\u0430\u043d\u044c\u0448\u0435, \u0447\u0435\u043c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u0422\u0430\u043a\u043e\u0439 \u0437\u0430\u043a\u043e\u043d \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u043c \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0440\u0443\u0436\u0438\u044f.\n\nMicrosoft \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u044f\u0435\u0442 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043c\u0435\u043d\u043d\u043e \u041a\u0438\u0442\u0430\u0435\u043c, \u0432 \u0446\u0435\u043b\u044f\u0445 \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430:\n\nCVE-2021-35211 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10,0) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 SolarWinds Serv-U \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Serv-U Secure FTP.\n\nCVE-2021-40539 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Zoho ManageEngine ADSelfService Plus.\n\nCVE-2021-44077 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 Zoho ManageEngine ServiceDesk Plus.\n\nCVE-2021-42321 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,8) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 Microsoft Exchange Server.\n\nCVE-2022-26134 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u044f\u0437\u044b\u043a\u0430 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e-\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u0438 (OGNL) \u0432 Atlassian Confluence.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE5bUvv?culture=en-us&country=us \n\n#Microsoft #\u043e\u0442\u0447\u0435\u0442", "creation_timestamp": "2026-07-27T00:01:12.205422Z"}, {"uuid": "cde3662b-9267-4c46-841e-ab13765a0717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/Unidentified_TM/1299", "content": "< \u0646\u0648\u0627\u0645\u0628\u0631 2021 \u067e\u0686 \u0633\u0647 \u0634\u0646\u0628\u0647 >\n\n \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u067e\u0686 \u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc 55 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0645\u0646\u062a\u0634\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062f\u0648 \u0646\u0642\u0635 \u0632\u06cc\u0631\u0648-\u062f\u06cc \u062f\u0631 \u0627\u06a9\u0633\u0644 (CVE-2021-42292) \u0648 Exchange Server (CVE-2021-42321).\n\nCVE-2021-43208 (CVSS score: 7.8) - 3D Viewer Remote Code Execution Vulnerability\nCVE-2021-43209 (CVSS score: 7.8) - 3D Viewer Remote Code Execution Vulnerability\nCVE-2021-38631 (CVSS score: 4.4) - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability\nCVE-2021-41371 (CVSS score: 4.4) - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability\n\n\n@Unidentified_TM", "creation_timestamp": "2026-07-27T00:01:33.299467Z"}, {"uuid": "846383eb-9201-49c7-bcc6-5ff32616e01c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/EchelonEyes/862", "content": "Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u0435\n\n\u041e\u0442\u0447\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0433\u0438\u0433\u0430\u043d\u0442\u0430 \u00abMicrosoft Digital Defense Report 2022\u00bb \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 114 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438 \u043e\u0441\u0432\u0435\u0449\u0430\u0435\u0442 \u0432\u0435\u0441\u044c \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442 \u0443\u0433\u0440\u043e\u0437 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \n\n\u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0439 Microsoft \u0441\u0442\u0430\u043b\u043e \u00ab\u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043c\u0435\u0436\u0434\u0443 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u043e\u0432\u0430\u0440\u00bb. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u043b\u0438 \u041f\u041e \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u043b\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b\u0438 \u043c\u0435\u0440\u044b \u043f\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e \u0440\u0438\u0441\u043a\u043e\u0432. \u042d\u0442\u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442\u0441\u044f \u0438 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 CISA \u2013 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u0435\u0449\u0435 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2022 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u00ab\u0430\u0433\u0440\u0435\u0441\u0441\u0438\u0432\u043d\u043e\u00bb \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438.\n\nMicrosoft \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0432\u0441\u0435\u0433\u043e 14 \u0434\u043d\u0435\u0439 \u043d\u0430 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0425\u043e\u0442\u044f \u0430\u0442\u0430\u043a\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u044b \u043f\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0443, \u043e\u043d\u0438, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0435\u0440\u0435\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0433\u043b\u0430\u0432\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043c\u0438\u0440\u0443, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u043f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b. \u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 \u0423\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u041a\u0438\u0442\u0430\u044f \u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443 \u0440\u0430\u043d\u044c\u0448\u0435, \u0447\u0435\u043c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u0422\u0430\u043a\u043e\u0439 \u0437\u0430\u043a\u043e\u043d \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u043c \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0440\u0443\u0436\u0438\u044f.\n\nMicrosoft \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u044f\u0435\u0442 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043c\u0435\u043d\u043d\u043e \u041a\u0438\u0442\u0430\u0435\u043c, \u0432 \u0446\u0435\u043b\u044f\u0445 \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430:\n\nCVE-2021-35211 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10,0) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 SolarWinds Serv-U \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Serv-U Secure FTP.\n\nCVE-2021-40539 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Zoho ManageEngine ADSelfService Plus.\n\nCVE-2021-44077 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 Zoho ManageEngine ServiceDesk Plus.\n\nCVE-2021-42321 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,8) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 Microsoft Exchange Server.\n\nCVE-2022-26134 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u044f\u0437\u044b\u043a\u0430 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e-\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u0438 (OGNL) \u0432 Atlassian Confluence.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE5bUvv?culture=en-us&country=us \n\n#Microsoft #\u043e\u0442\u0447\u0435\u0442", "creation_timestamp": "2026-07-28T05:00:04.062749Z"}, {"uuid": "e8ad7357-4f8d-44ef-8d06-671e059643bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/Unidentified_TM/1299", "content": "< \u0646\u0648\u0627\u0645\u0628\u0631 2021 \u067e\u0686 \u0633\u0647 \u0634\u0646\u0628\u0647 >\n\n \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u067e\u0686 \u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc 55 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0645\u0646\u062a\u0634\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u062f\u0648 \u0646\u0642\u0635 \u0632\u06cc\u0631\u0648-\u062f\u06cc \u062f\u0631 \u0627\u06a9\u0633\u0644 (CVE-2021-42292) \u0648 Exchange Server (CVE-2021-42321).\n\nCVE-2021-43208 (CVSS score: 7.8) - 3D Viewer Remote Code Execution Vulnerability\nCVE-2021-43209 (CVSS score: 7.8) - 3D Viewer Remote Code Execution Vulnerability\nCVE-2021-38631 (CVSS score: 4.4) - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability\nCVE-2021-41371 (CVSS score: 4.4) - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability\n\n\n@Unidentified_TM", "creation_timestamp": "2026-07-29T00:00:08.925043Z"}, {"uuid": "7a47220d-3f96-4d4d-a6eb-e829ecf860ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/EchelonEyes/862", "content": "Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0433\u043e\u0434\u043e\u0432\u043e\u0439 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u0435\n\n\u041e\u0442\u0447\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0433\u0438\u0433\u0430\u043d\u0442\u0430 \u00abMicrosoft Digital Defense Report 2022\u00bb \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 114 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438 \u043e\u0441\u0432\u0435\u0449\u0430\u0435\u0442 \u0432\u0435\u0441\u044c \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442 \u0443\u0433\u0440\u043e\u0437 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \n\n\u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0439 Microsoft \u0441\u0442\u0430\u043b\u043e \u00ab\u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043c\u0435\u0436\u0434\u0443 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u043e\u0432\u0430\u0440\u00bb. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u043b\u0438 \u041f\u041e \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u043b\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b\u0438 \u043c\u0435\u0440\u044b \u043f\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e \u0440\u0438\u0441\u043a\u043e\u0432. \u042d\u0442\u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442\u0441\u044f \u0438 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 CISA \u2013 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u0435\u0449\u0435 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2022 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u00ab\u0430\u0433\u0440\u0435\u0441\u0441\u0438\u0432\u043d\u043e\u00bb \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438.\n\nMicrosoft \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0432\u0441\u0435\u0433\u043e 14 \u0434\u043d\u0435\u0439 \u043d\u0430 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0425\u043e\u0442\u044f \u0430\u0442\u0430\u043a\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u044b \u043f\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0443, \u043e\u043d\u0438, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0435\u0440\u0435\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0433\u043b\u0430\u0432\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u043c\u0438\u0440\u0443, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u043f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b. \u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u044b\u043c \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 \u0423\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u041a\u0438\u0442\u0430\u044f \u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443 \u0440\u0430\u043d\u044c\u0448\u0435, \u0447\u0435\u043c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u0422\u0430\u043a\u043e\u0439 \u0437\u0430\u043a\u043e\u043d \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u043c \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0440\u0443\u0436\u0438\u044f.\n\nMicrosoft \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u044f\u0435\u0442 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043c\u0435\u043d\u043d\u043e \u041a\u0438\u0442\u0430\u0435\u043c, \u0432 \u0446\u0435\u043b\u044f\u0445 \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430:\n\nCVE-2021-35211 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10,0) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 SolarWinds Serv-U \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Serv-U Secure FTP.\n\nCVE-2021-40539 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Zoho ManageEngine ADSelfService Plus.\n\nCVE-2021-44077 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 Zoho ManageEngine ServiceDesk Plus.\n\nCVE-2021-42321 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,8) \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 Microsoft Exchange Server.\n\nCVE-2022-26134 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u044f\u0437\u044b\u043a\u0430 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e-\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u0438 (OGNL) \u0432 Atlassian Confluence.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE5bUvv?culture=en-us&country=us \n\n#Microsoft #\u043e\u0442\u0447\u0435\u0442", "creation_timestamp": "2026-07-29T00:00:46.988466Z"}, {"uuid": "23e5eb2c-375d-4818-8026-2bae8919d24f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "seen", "source": "https://t.me/reverseame/1825", "content": "SLUB overflow CVE-2021-42327 https://docfate111.github.io/blog/securityresearch/2021/11/08/SLUBoverflow.html", "creation_timestamp": "2026-07-29T12:02:51.379209Z"}, {"uuid": "908b57a6-00f7-4c58-a0e5-3f0321e2aac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/sysadm_in_up/906", "content": "PoC of CVE-2021-42321: pop mspaint.exe on the target\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398", "creation_timestamp": "2026-07-29T12:03:21.985998Z"}, {"uuid": "5b88ac34-2ebf-418a-a20f-2959e1e8ac81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cisoclub/1133", "content": "#\u041d\u043e\u0432\u043e\u0441\u0442\u0438 \u0437\u0430 25 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433. \ud83d\udcf0\n\n1\ufe0f\u20e3 \u041f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f \u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c \ud83d\udcdd\u043e\u0431\u0437\u043e\u0440\u043e\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u043e\u0448\u043b\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e. \u0412 \u0446\u0435\u043d\u0442\u0440\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f: Conti, GoDaddy, Seneca Family of Agencies, Utah Imaging Associated, Eskenazi Health, California Pizza Kitchen, WSpot, BGFI. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n2\ufe0f\u20e3 \u0426\u0435\u043d\u0442\u0440 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \ud83d\udcbb\u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437\u044b UserGate \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u00ab\u0421\u0438\u0441\u0442\u0435\u043c\u0443 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0412\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439\u00bb (\u0421\u041e\u0412) UserGate \u043d\u043e\u0432\u0443\u044e \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0443, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \ud83d\udd0d\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-42321. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n3\ufe0f\u20e3 \u0412 \ud83c\udfe6\u0421\u0431\u0435\u0440\u0435 \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u043d\u0435\u0435 \u0438 \u0432\u0441\u0451 \u0447\u0430\u0449\u0435 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u043e\u0432\u044b\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \ud83d\udcdfIoT-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n4\ufe0f\u20e3 \u0412 Group-IB \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \ud83d\udcbb\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u041f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0438\u0437 \ud83c\uddf7\ud83c\uddfa\u0420\u0424 \u043f\u043b\u0430\u0442\u0438\u043b\u0438 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u043f\u043e \ud83d\udcb53 \u043c\u043b\u043d. \u0440\u0443\u0431\u043b\u0435\u0439 \u0445\u0430\u043a\u0435\u0440\u0430\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f\u043c \u0432 2021 \u0433\u043e\u0434\u0443. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n \n5\ufe0f\u20e3 \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u0432 \u0441\u0444\u0435\u0440\u0435 \u043e\u043d\u043b\u0430\u0439\u043d-\u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \ud83d\udcc8\u0443\u0442\u0440\u043e\u0438\u043b\u043e\u0441\u044c \u0432 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u00ab\u0447\u0435\u0440\u043d\u043e\u0439 \u043f\u044f\u0442\u043d\u0438\u0446\u044b\u00bb. \u0412 \"\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\" \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 \"\u043f\u043e\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443\" \ud83e\udd21\u043c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043f\u043e\u0434 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0432\u0435\u0441\u0442\u043a\u0443 \u0434\u043d\u044f. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n6\ufe0f\u20e3 \ud83c\udf4fApple \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u043e\u0431\u0449\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u0438\u0445 \ud83d\udcf1\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u041d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u043c\u0438 APT-\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430\u043c\u0438.  \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435", "creation_timestamp": "2026-07-29T12:03:12.857137Z"}, {"uuid": "4e418805-2208-4b7b-ad16-032faa026d8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/shmelovod/441", "content": "\u0412 \u0441\u0435\u0442\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0441\u0432\u0435\u0436\u0435\u0439 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Exchange\n\nhttps://xakep.ru/2021/11/24/cve-2021-42321-poc/", "creation_timestamp": "2026-07-29T12:03:23.137104Z"}, {"uuid": "c0acc8c8-cf52-41d5-b28b-740705a05ff8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "seen", "source": "https://t.me/reverseame/1825", "content": "SLUB overflow CVE-2021-42327 https://docfate111.github.io/blog/securityresearch/2021/11/08/SLUBoverflow.html", "creation_timestamp": "2026-07-30T00:02:41.478362Z"}, {"uuid": "b8a1fb7a-8e7b-4ad6-a423-c4ef40c7b261", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cissp/4861", "content": "tools\nRed_Team_Tactics\n1. Lsass NTLM Authentication Backdoor\nhttps://github.com/kindtime/nosferatu\n2. Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon\nhttps://github.com/optiv/Registry-Recon\n\nAnalytics\nAdvanced threat predictions for 2022\ud83d\udc4d\ud83c\udffd\nhttps://securelist.com/advanced-threat-predictions-for-2022/104870\n\nMalware_analysis\nSquirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains\nhttps://www.trendmicro.com/en_us/research/21/k/Squirrelwaffle-Exploits-ProxyShell-and-ProxyLogon-to-Hijack-Email-Chains.html\n\nexploit\n1. CVE-2021-42321:\nExchange Post-Auth RCE\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398\n\n2. CVE-2021-22053:\nSpring Cloud Netflix Hystrix Dashboard\ntemplate resolution vulnerability\nhttps://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053\n\nOffensive_security\nExploiting OAuth:\nJourney to Account Takeover\nhttps://blog.dixitaditya.com/2021/11/19/account-takeover-chain.html", "creation_timestamp": "2026-09-01T17:00:34.987474Z"}, {"uuid": "192c617b-7e62-410a-b7dc-777e004e9866", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cissp/4779", "content": "< Nov. 2021 Patch Tuesday > \nMicrosoft releases security patches for 55 new vulnerabilities, including two actively exploited zero-day flaws in Excel (CVE-2021-42292) and Exchange Server (CVE-2021-42321).\nRead Details: https://thehackernews.com/2021/11/microsoft-issues-patches-for-actively.html\n\nA new zero-day vulnerability (CVE-2021-3064) has been discovered in Palo Alto Networks GlobalProtect VPN, which could be exploited by an unauthenticated attacker to execute arbitrary code with root privileges on affected devices.\nDetail: https://thehackernews.com/2021/11/palo-alto-warns-of-zero-day-bug-in.html\n\nAccording to a new report, the Iranian hacking group Lyceum is responsible for a series of targeted attacks on ISPs, telecom operators, and other targets in Israel, Morocco, Tunisia, and Saudi Arabia.\nRead details: https://thehackernews.com/2021/11/irans-lyceum-hackers-target-telecoms.html", "creation_timestamp": "2026-09-01T17:00:35.523728Z"}, {"uuid": "c3c8fba1-fb64-4386-8282-bb83ef77e7d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "seen", "source": "https://t.me/cissp/4730", "content": "Threat_Research\n1. CI/CD: Pre-Auth Takeover of Build Pipelines in GoCD\nhttps://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover\n2. Vulnerabilities in FreeSWITCH 1.10.7\nhttps://www.rtcsec.com/article/killing-bugs-one-vulnerability-report-at-a-time\n\nexploit\n1. CVE-2021-22214:\nGitlab CI Lint API SSRF\nhttps://github.com/antx-code/CVE-2021-22214\n\n2. CVE-2021-42327:\nWIP kernel exploit for minor bug in amd gpu driver\nhttps://github.com/docfate111/CVE-2021-42327\n\nRed_Team_Tactics\n1. Stored XSS in Mermaid when viewing Markdown files (GitLab)\nhttps://hackerone.com/reports/1212822\n2. Bypass 4xx HTTP response status codes.\nBased on cURL.\nhttps://github.com/ivan-sincek/forbidden\n\nResearch\nEscalating XSS to Sainthood with Nagios\n(Example End-to-End Attack: NSCA)\nhttps://blog.grimm-co.com/2021/11/escalating-xss-to-sainthood-with-nagios.html\n]-> Scripts:\nhttps://github.com/grimm-co/NotQuite0DayFriday/tree/trunk/2021.11.02-nagios\n\nWLAN_Security\nBrakTooth: Patch Status, Vulnerabilities and SDK/Firmware Version of Affected Devices\nhttps://isc.sans.edu/forums/diary/Revisiting+BrakTooth+Two+Months+Later/27992", "creation_timestamp": "2026-09-01T17:00:36.615788Z"}, {"uuid": "873f92d3-e94d-49bd-ab92-75dfa8879547", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:40.702467Z"}, {"uuid": "f87226d5-85f8-4022-a8e1-a686d6834067", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:39.977743Z"}, {"uuid": "4de9eb59-9383-4d43-9cee-1fd3231280a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/hacking_Attack/30807", "content": "Black Hat Ethical Hacking\nMicrosoft urges Exchange admins to patch bug exploited in the wild\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft urges Exchange admins to patch bug exploited in the wildPost Views: 222 \nReading Time: 1 Minute\nMicrosoft warned admins today to immediately a high severity Exchange Server vulnerability that may allow authenticated attackers to execute code remotely on vulnerable servers.\nThe security flaw tracked as CVE-2021-42321\u00a0impacts Exchange Server 2016 and Exchange Server 2019, and it is caused by improper validation of cmdlet arguments according to Redmond\u2019s security advisory.\n\nCVE-2021-42321 only affects on-premises Microsoft Exchange servers, including those used by customers in Exchange Hybrid mode (Exchange Online customers are protected against exploitation attempts and don\u2019t need to take any further action).\n\n\u201cWe are aware of limited targeted attacks in the wild using one of the vulnerabilities (CVE-2021-42321), which is a post-authentication\u00a0vulnerability in Exchange 2016 and 2019,\u201d Microsoft explained.\n\n\u201cOur recommendation is to install these updates immediately\u00a0to protect your environment.\u201d\n\nFor a quick inventory of all Exchange servers in your environment behind on updates (CUs and SUs), you can use the latest version of the Exchange Server Health Checker script.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Exchange_Server_update_paths.jpg \n<figcaptionExchange Server update paths (Microsoft) \nSee Also: Complete Offensive Security and Ethical Hacking Course\nIf you want to check and see if any of your Exchange servers were hit by CVE-2021-42321 exploitation attempts, you have to run the following PowerShell query on each Exchange server to check for specific events in the Event Log: Get-EventLog -LogName Application -Source \"MSExchange Common\" -EntryType Error | Where-Object { $_.Message -like \"*BinaryFormatter.Deserialize*\"} \nIn September, Microsoft has added a new Exchange Server feature named Microsoft Exchange Emergency Mitigation (EM) that provides automated protection for vulnerable Exchange servers.\n\nIt does that by automatically applying interim mitigations for high-risk security bugs to secure on-premises servers against incoming attacks and give admins additional time to apply security updates.\n\nWhile Redmond said\u00a0that it would use this new feature to mitigate actively exploited flaws like CVE-2021-42321, today\u2019s advisory\u00a0and the blog post\u00a0regarding this month\u2019s Exchange Server security updates don\u2019t include any mentions of Exchange EM being put to use.\nSee Also: All Windows versions impacted by new LPE zero-day vulnerability On-premises Exchange servers under attackSince the start of 2021, Exchange admins have dealt with two massive waves of attacks targeting the ProxyLogon and ProxyShell vulnerabilities.\n\nStarting with early March, multiple state-backed and financially motivated threat actors used\u00a0ProxyLogon exploits\u00a0to\u00a0deploy\u00a0web shells, cryptominers, ransomware, and other malware while\u00a0targeting over a quarter of a million Microsoft Exchange servers, belonging to tens of thousands of organizations worldwide.\n\nFour months later, US and allies, including the European Union, the United Kingdom, and NATO, officially blamed China\u00a0for this widespread Microsoft Exchange hacking campaign.\n\nIn August, attackers also\u00a0began scanning for\u00a0and hacking Exchange servers\u00a0using the ProxyShell vulnerabilities after security researchers managed to reproduce\u00a0a working exploit.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer While, in the beginning, payloads dropped on Exchange servers exploited [...]", "creation_timestamp": "2026-09-01T20:02:10.463318Z"}, {"uuid": "873dd60b-0f0a-4c7b-988e-555f64fb6d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:50.108153Z"}, {"uuid": "2fa3d7ef-fb5a-4699-94c3-a6ef9cc49a39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:49.709196Z"}, {"uuid": "285c9f70-5db0-4c81-8045-1d61df55d023", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/hacking_Attack/30807", "content": "Black Hat Ethical Hacking\nMicrosoft urges Exchange admins to patch bug exploited in the wild\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft urges Exchange admins to patch bug exploited in the wildPost Views: 222 \nReading Time: 1 Minute\nMicrosoft warned admins today to immediately a high severity Exchange Server vulnerability that may allow authenticated attackers to execute code remotely on vulnerable servers.\nThe security flaw tracked as CVE-2021-42321\u00a0impacts Exchange Server 2016 and Exchange Server 2019, and it is caused by improper validation of cmdlet arguments according to Redmond\u2019s security advisory.\n\nCVE-2021-42321 only affects on-premises Microsoft Exchange servers, including those used by customers in Exchange Hybrid mode (Exchange Online customers are protected against exploitation attempts and don\u2019t need to take any further action).\n\n\u201cWe are aware of limited targeted attacks in the wild using one of the vulnerabilities (CVE-2021-42321), which is a post-authentication\u00a0vulnerability in Exchange 2016 and 2019,\u201d Microsoft explained.\n\n\u201cOur recommendation is to install these updates immediately\u00a0to protect your environment.\u201d\n\nFor a quick inventory of all Exchange servers in your environment behind on updates (CUs and SUs), you can use the latest version of the Exchange Server Health Checker script.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Exchange_Server_update_paths.jpg \n<figcaptionExchange Server update paths (Microsoft) \nSee Also: Complete Offensive Security and Ethical Hacking Course\nIf you want to check and see if any of your Exchange servers were hit by CVE-2021-42321 exploitation attempts, you have to run the following PowerShell query on each Exchange server to check for specific events in the Event Log: Get-EventLog -LogName Application -Source \"MSExchange Common\" -EntryType Error | Where-Object { $_.Message -like \"*BinaryFormatter.Deserialize*\"} \nIn September, Microsoft has added a new Exchange Server feature named Microsoft Exchange Emergency Mitigation (EM) that provides automated protection for vulnerable Exchange servers.\n\nIt does that by automatically applying interim mitigations for high-risk security bugs to secure on-premises servers against incoming attacks and give admins additional time to apply security updates.\n\nWhile Redmond said\u00a0that it would use this new feature to mitigate actively exploited flaws like CVE-2021-42321, today\u2019s advisory\u00a0and the blog post\u00a0regarding this month\u2019s Exchange Server security updates don\u2019t include any mentions of Exchange EM being put to use.\nSee Also: All Windows versions impacted by new LPE zero-day vulnerability On-premises Exchange servers under attackSince the start of 2021, Exchange admins have dealt with two massive waves of attacks targeting the ProxyLogon and ProxyShell vulnerabilities.\n\nStarting with early March, multiple state-backed and financially motivated threat actors used\u00a0ProxyLogon exploits\u00a0to\u00a0deploy\u00a0web shells, cryptominers, ransomware, and other malware while\u00a0targeting over a quarter of a million Microsoft Exchange servers, belonging to tens of thousands of organizations worldwide.\n\nFour months later, US and allies, including the European Union, the United Kingdom, and NATO, officially blamed China\u00a0for this widespread Microsoft Exchange hacking campaign.\n\nIn August, attackers also\u00a0began scanning for\u00a0and hacking Exchange servers\u00a0using the ProxyShell vulnerabilities after security researchers managed to reproduce\u00a0a working exploit.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer While, in the beginning, payloads dropped on Exchange servers exploited [...]", "creation_timestamp": "2026-09-02T01:02:36.737209Z"}, {"uuid": "38097560-fd87-4df5-91f2-4f231c1bab0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cissp/4861", "content": "tools\nRed_Team_Tactics\n1. Lsass NTLM Authentication Backdoor\nhttps://github.com/kindtime/nosferatu\n2. Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon\nhttps://github.com/optiv/Registry-Recon\n\nAnalytics\nAdvanced threat predictions for 2022\ud83d\udc4d\ud83c\udffd\nhttps://securelist.com/advanced-threat-predictions-for-2022/104870\n\nMalware_analysis\nSquirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains\nhttps://www.trendmicro.com/en_us/research/21/k/Squirrelwaffle-Exploits-ProxyShell-and-ProxyLogon-to-Hijack-Email-Chains.html\n\nexploit\n1. CVE-2021-42321:\nExchange Post-Auth RCE\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398\n\n2. CVE-2021-22053:\nSpring Cloud Netflix Hystrix Dashboard\ntemplate resolution vulnerability\nhttps://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053\n\nOffensive_security\nExploiting OAuth:\nJourney to Account Takeover\nhttps://blog.dixitaditya.com/2021/11/19/account-takeover-chain.html", "creation_timestamp": "2026-09-02T01:04:18.959802Z"}, {"uuid": "3834c1e1-3b6b-4af7-a6f2-8206c118b878", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42327", "type": "seen", "source": "https://t.me/cissp/4730", "content": "Threat_Research\n1. CI/CD: Pre-Auth Takeover of Build Pipelines in GoCD\nhttps://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover\n2. Vulnerabilities in FreeSWITCH 1.10.7\nhttps://www.rtcsec.com/article/killing-bugs-one-vulnerability-report-at-a-time\n\nexploit\n1. CVE-2021-22214:\nGitlab CI Lint API SSRF\nhttps://github.com/antx-code/CVE-2021-22214\n\n2. CVE-2021-42327:\nWIP kernel exploit for minor bug in amd gpu driver\nhttps://github.com/docfate111/CVE-2021-42327\n\nRed_Team_Tactics\n1. Stored XSS in Mermaid when viewing Markdown files (GitLab)\nhttps://hackerone.com/reports/1212822\n2. Bypass 4xx HTTP response status codes.\nBased on cURL.\nhttps://github.com/ivan-sincek/forbidden\n\nResearch\nEscalating XSS to Sainthood with Nagios\n(Example End-to-End Attack: NSCA)\nhttps://blog.grimm-co.com/2021/11/escalating-xss-to-sainthood-with-nagios.html\n]-> Scripts:\nhttps://github.com/grimm-co/NotQuite0DayFriday/tree/trunk/2021.11.02-nagios\n\nWLAN_Security\nBrakTooth: Patch Status, Vulnerabilities and SDK/Firmware Version of Affected Devices\nhttps://isc.sans.edu/forums/diary/Revisiting+BrakTooth+Two+Months+Later/27992", "creation_timestamp": "2026-09-02T01:04:20.710301Z"}, {"uuid": "eff54b24-92d0-4a90-9b30-8e5fe4401f2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://t.me/cissp/4779", "content": "< Nov. 2021 Patch Tuesday > \nMicrosoft releases security patches for 55 new vulnerabilities, including two actively exploited zero-day flaws in Excel (CVE-2021-42292) and Exchange Server (CVE-2021-42321).\nRead Details: https://thehackernews.com/2021/11/microsoft-issues-patches-for-actively.html\n\nA new zero-day vulnerability (CVE-2021-3064) has been discovered in Palo Alto Networks GlobalProtect VPN, which could be exploited by an unauthenticated attacker to execute arbitrary code with root privileges on affected devices.\nDetail: https://thehackernews.com/2021/11/palo-alto-warns-of-zero-day-bug-in.html\n\nAccording to a new report, the Iranian hacking group Lyceum is responsible for a series of targeted attacks on ISPs, telecom operators, and other targets in Israel, Morocco, Tunisia, and Saudi Arabia.\nRead details: https://thehackernews.com/2021/11/irans-lyceum-hackers-target-telecoms.html", "creation_timestamp": "2026-09-02T01:04:20.199232Z"}, {"uuid": "f9149b2f-8485-489a-989f-4e1aeace75ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T21:00:05.644922Z"}, {"uuid": "d0e070a0-384b-4220-9ffa-cb13cfd77948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T21:00:06.121307Z"}, {"uuid": "a9ed34b8-90c5-47b9-acd7-933a628f2244", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:16.568052Z"}, {"uuid": "a0a531a8-6aee-4f1c-86a9-bb430f87d105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:36.456104Z"}, {"uuid": "7e2eb8f4-a8e4-4ecb-9f1d-5af2f4a2380f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://t.me/hacking_Attack/30807", "content": "Black Hat Ethical Hacking\nMicrosoft urges Exchange admins to patch bug exploited in the wild\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft urges Exchange admins to patch bug exploited in the wildPost Views: 222 \nReading Time: 1 Minute\nMicrosoft warned admins today to immediately a high severity Exchange Server vulnerability that may allow authenticated attackers to execute code remotely on vulnerable servers.\nThe security flaw tracked as CVE-2021-42321\u00a0impacts Exchange Server 2016 and Exchange Server 2019, and it is caused by improper validation of cmdlet arguments according to Redmond\u2019s security advisory.\n\nCVE-2021-42321 only affects on-premises Microsoft Exchange servers, including those used by customers in Exchange Hybrid mode (Exchange Online customers are protected against exploitation attempts and don\u2019t need to take any further action).\n\n\u201cWe are aware of limited targeted attacks in the wild using one of the vulnerabilities (CVE-2021-42321), which is a post-authentication\u00a0vulnerability in Exchange 2016 and 2019,\u201d Microsoft explained.\n\n\u201cOur recommendation is to install these updates immediately\u00a0to protect your environment.\u201d\n\nFor a quick inventory of all Exchange servers in your environment behind on updates (CUs and SUs), you can use the latest version of the Exchange Server Health Checker script.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Exchange_Server_update_paths.jpg \n<figcaptionExchange Server update paths (Microsoft) \nSee Also: Complete Offensive Security and Ethical Hacking Course\nIf you want to check and see if any of your Exchange servers were hit by CVE-2021-42321 exploitation attempts, you have to run the following PowerShell query on each Exchange server to check for specific events in the Event Log: Get-EventLog -LogName Application -Source \"MSExchange Common\" -EntryType Error | Where-Object { $_.Message -like \"*BinaryFormatter.Deserialize*\"} \nIn September, Microsoft has added a new Exchange Server feature named Microsoft Exchange Emergency Mitigation (EM) that provides automated protection for vulnerable Exchange servers.\n\nIt does that by automatically applying interim mitigations for high-risk security bugs to secure on-premises servers against incoming attacks and give admins additional time to apply security updates.\n\nWhile Redmond said\u00a0that it would use this new feature to mitigate actively exploited flaws like CVE-2021-42321, today\u2019s advisory\u00a0and the blog post\u00a0regarding this month\u2019s Exchange Server security updates don\u2019t include any mentions of Exchange EM being put to use.\nSee Also: All Windows versions impacted by new LPE zero-day vulnerability On-premises Exchange servers under attackSince the start of 2021, Exchange admins have dealt with two massive waves of attacks targeting the ProxyLogon and ProxyShell vulnerabilities.\n\nStarting with early March, multiple state-backed and financially motivated threat actors used\u00a0ProxyLogon exploits\u00a0to\u00a0deploy\u00a0web shells, cryptominers, ransomware, and other malware while\u00a0targeting over a quarter of a million Microsoft Exchange servers, belonging to tens of thousands of organizations worldwide.\n\nFour months later, US and allies, including the European Union, the United Kingdom, and NATO, officially blamed China\u00a0for this widespread Microsoft Exchange hacking campaign.\n\nIn August, attackers also\u00a0began scanning for\u00a0and hacking Exchange servers\u00a0using the ProxyShell vulnerabilities after security researchers managed to reproduce\u00a0a working exploit.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer While, in the beginning, payloads dropped on Exchange servers exploited [...]", "creation_timestamp": "2026-09-07T06:00:06.145229Z"}, {"uuid": "cbbdb0cd-22d1-49bd-bb57-ce01e1d881ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "exploited", "source": "https://t.me/hacking_Attack/30807", "content": "Black Hat Ethical Hacking\nMicrosoft urges Exchange admins to patch bug exploited in the wild\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft urges Exchange admins to patch bug exploited in the wildPost Views: 222 \nReading Time: 1 Minute\nMicrosoft warned admins today to immediately a high severity Exchange Server vulnerability that may allow authenticated attackers to execute code remotely on vulnerable servers.\nThe security flaw tracked as CVE-2021-42321\u00a0impacts Exchange Server 2016 and Exchange Server 2019, and it is caused by improper validation of cmdlet arguments according to Redmond\u2019s security advisory.\n\nCVE-2021-42321 only affects on-premises Microsoft Exchange servers, including those used by customers in Exchange Hybrid mode (Exchange Online customers are protected against exploitation attempts and don\u2019t need to take any further action).\n\n\u201cWe are aware of limited targeted attacks in the wild using one of the vulnerabilities (CVE-2021-42321), which is a post-authentication\u00a0vulnerability in Exchange 2016 and 2019,\u201d Microsoft explained.\n\n\u201cOur recommendation is to install these updates immediately\u00a0to protect your environment.\u201d\n\nFor a quick inventory of all Exchange servers in your environment behind on updates (CUs and SUs), you can use the latest version of the Exchange Server Health Checker script.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Exchange_Server_update_paths.jpg \n<figcaptionExchange Server update paths (Microsoft) \nSee Also: Complete Offensive Security and Ethical Hacking Course\nIf you want to check and see if any of your Exchange servers were hit by CVE-2021-42321 exploitation attempts, you have to run the following PowerShell query on each Exchange server to check for specific events in the Event Log: Get-EventLog -LogName Application -Source \"MSExchange Common\" -EntryType Error | Where-Object { $_.Message -like \"*BinaryFormatter.Deserialize*\"} \nIn September, Microsoft has added a new Exchange Server feature named Microsoft Exchange Emergency Mitigation (EM) that provides automated protection for vulnerable Exchange servers.\n\nIt does that by automatically applying interim mitigations for high-risk security bugs to secure on-premises servers against incoming attacks and give admins additional time to apply security updates.\n\nWhile Redmond said\u00a0that it would use this new feature to mitigate actively exploited flaws like CVE-2021-42321, today\u2019s advisory\u00a0and the blog post\u00a0regarding this month\u2019s Exchange Server security updates don\u2019t include any mentions of Exchange EM being put to use.\nSee Also: All Windows versions impacted by new LPE zero-day vulnerability On-premises Exchange servers under attackSince the start of 2021, Exchange admins have dealt with two massive waves of attacks targeting the ProxyLogon and ProxyShell vulnerabilities.\n\nStarting with early March, multiple state-backed and financially motivated threat actors used\u00a0ProxyLogon exploits\u00a0to\u00a0deploy\u00a0web shells, cryptominers, ransomware, and other malware while\u00a0targeting over a quarter of a million Microsoft Exchange servers, belonging to tens of thousands of organizations worldwide.\n\nFour months later, US and allies, including the European Union, the United Kingdom, and NATO, officially blamed China\u00a0for this widespread Microsoft Exchange hacking campaign.\n\nIn August, attackers also\u00a0began scanning for\u00a0and hacking Exchange servers\u00a0using the ProxyShell vulnerabilities after security researchers managed to reproduce\u00a0a working exploit.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer While, in the beginning, payloads dropped on Exchange servers exploited [...]", "creation_timestamp": "2026-09-08T00:00:58.367388Z"}, {"uuid": "99232470-7bf9-47f4-9bb5-5a6804f289f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_chainedserializationbinder_rce.rb", "content": "{\"aliases\": [\"exploit/windows/http/exchange_chainedserializationbinder_denylist_typo_rce\"], \"arch\": \"cmd, x86, x64\", \"author\": [\"pwnforsp\", \"zcgonvh\", \"Microsoft Threat Intelligence Center\", \"Microsoft Security Response Center\", \"peterjson\", \"testanull\", \"Grant Willcox\", \"Spencer McIntyre\", \"Markus Wulftange\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities within the ChainedSerializationBinder as used in\\n          Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and\\n          Exchange Server 2016 CU22 all prior to Mar22SU.\\n\\n          Note that authentication is required to exploit these vulnerabilities.\", \"disclosure_date\": \"2021-12-09\", \"fullname\": \"exploit/windows/http/exchange_chainedserializationbinder_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Microsoft Exchange Server ChainedSerializationBinder RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/exchange_chainedserializationbinder_rce.rb\", \"platform\": \"Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"windows/http/exchange_chainedserializationbinder_rce\", \"references\": [\"CVE-2021-42321\", \"URL-https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321\", \"URL-https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7\", \"URL-https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169\", \"URL-https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398\", \"URL-https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852\", \"CVE-2022-23277\", \"URL-https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html\", \"URL-https://testbnull.medium.com/note-nhanh-v%E1%BB%81-binaryformatter-binder-v%C3%A0-cve-2022-23277-6510d469604c\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Windows Command\", \"Windows Dropper\", \"PowerShell Stager\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:46.653338Z"}, {"uuid": "12b3c352-f13f-441b-8c56-871a3653cd69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42321", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4861", "content": "tools\nRed_Team_Tactics\n1. Lsass NTLM Authentication Backdoor\nhttps://github.com/kindtime/nosferatu\n2. Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon\nhttps://github.com/optiv/Registry-Recon\n\nAnalytics\nAdvanced threat predictions for 2022\ud83d\udc4d\ud83c\udffd\nhttps://securelist.com/advanced-threat-predictions-for-2022/104870\n\nMalware_analysis\nSquirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains\nhttps://www.trendmicro.com/en_us/research/21/k/Squirrelwaffle-Exploits-ProxyShell-and-ProxyLogon-to-Hijack-Email-Chains.html\n\nexploit\n1. CVE-2021-42321:\nExchange Post-Auth RCE\nhttps://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398\n\n2. CVE-2021-22053:\nSpring Cloud Netflix Hystrix Dashboard\ntemplate resolution vulnerability\nhttps://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053\n\nOffensive_security\nExploiting OAuth:\nJourney to Account Takeover\nhttps://blog.dixitaditya.com/2021/11/19/account-takeover-chain.html", "creation_timestamp": "2026-09-10T14:00:05.744937Z"}]}