{"vulnerability": "CVE-2021-4274", "sightings": [{"uuid": "99fb772b-ca58-4843-adc8-6e3abf90fc89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42740", "type": "seen", "source": "https://gist.github.com/konard/009400a33f6fb569a958b992389f5d49", "content": "", "creation_timestamp": "2025-12-11T22:14:09.000000Z"}, {"uuid": "8df4626e-bfd3-4211-84be-a6718aa0bea1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42740", "type": "seen", "source": "https://gist.github.com/konard/dd968c3f94817e10464ba8c79d2ef323", "content": "", "creation_timestamp": "2025-12-11T22:10:11.000000Z"}, {"uuid": "31905546-9352-4a14-9e1d-7dcc1b1a685a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4274", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/11674", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-4274\n\ud83d\udd25 CVSS Score: 3.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)\n\ud83d\udd39 Description: A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument request_args leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ef6b32c527478fefe7a4436e10b96ee28ed5b308. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216479.\n\ud83d\udccf Published: 2022-12-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-14T17:28:35.899Z\n\ud83d\udd17 References:\n1. https://github.com/sileht/bird-lg/pull/82\n2. https://github.com/sileht/bird-lg/commit/ef6b32c527478fefe7a4436e10b96ee28ed5b308\n3. https://vuldb.com/?id.216479", "creation_timestamp": "2025-04-14T17:54:42.000000Z"}, {"uuid": "fb4b7bf7-8df2-4d8f-bf4a-3b3c43178619", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42742", "type": "seen", "source": "https://t.me/true_secator/2254", "content": "\u041d\u0438 \u0434\u043d\u044f \u0431\u0435\u0437 ransomware: \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BQE Software \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0448\u0438\u0444\u0440\u0443\u044e\u0442 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 \u0431\u0438\u043b\u043b\u0438\u043d\u0433\u043e\u0432\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0439 BillQuick Web Suite. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432 - 400 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n \n\u0412 \u043c\u0430\u0441\u0441\u0435 \u0441\u0432\u043e\u0435\u0439 \u0430\u0442\u0430\u043a\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 BillQuick, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u043b\u044f CVE-2021-42258, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043b\u0435\u0433\u043a\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043d\u0430 \u0432\u0445\u043e\u0434 \u0441 \u043d\u0435\u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 (\u043e\u0434\u0438\u043d\u0430\u0440\u043d\u0430\u044f \u043a\u0430\u0432\u044b\u0447\u043a\u0430) \u0432 \u043f\u043e\u043b\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n \n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0435 7 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 22.0.9.1 BQE Software, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0435 \u0431\u0430\u0433\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b Huntress ThreatOps \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0435\u0449\u0435 \u0432\u043e\u0441\u0435\u043c\u044c \u0434\u0440\u0443\u0433\u0438\u0445 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 BillQuick (CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742). \u0412\u0441\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u044b.\n \n\u0410\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 Huntress Labs \u043a \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0431\u0430\u043d\u0434\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f: \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u0432 \u0434\u0435\u043b\u0435 \u0431\u043e\u043b\u0435\u0435 \u043c\u0435\u043b\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0439 ransomware \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 \u043c\u0430\u044f 2020 \u0433\u043e\u0434\u0430 \u0438 \u0432 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0437\u0430\u0438\u043c\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u043e\u0434 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 AutoIT. \u0425\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0412\u041f\u041e \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0438\u0441\u043e\u043a \u043e \u0432\u044b\u043a\u0443\u043f\u0435 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0430 \u043b\u0438\u0448\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 pusheken91@bk.ru \u043a\u043e \u0432\u0441\u0435\u043c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 \u0434\u043b\u044f \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u044f \u0432\u044b\u043a\u0443\u043f\u0430.\n \n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, BQE Software \u0432\u043e\u0432\u0441\u044e \u0432\u0435\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430\u0434 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438, \u0432\u043f\u0440\u043e\u0447\u0435\u043c, \u043a\u0430\u043a \u0438 \u0445\u0430\u043a\u0435\u0440\u044b. \u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432, \u043a \u0430\u0442\u0430\u043a\u0430\u043c BillQuick \u0443\u0436\u0435 \u0432 \u0441\u0430\u043c\u043e\u0435 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0442\u044c\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u0430\u043a\u0442\u043e\u0440\u044b.", "creation_timestamp": "2021-10-26T18:55:45.000000Z"}, {"uuid": "8323b22f-a1b4-491f-8256-219af17b0c1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42741", "type": "seen", "source": "https://t.me/true_secator/2254", "content": "\u041d\u0438 \u0434\u043d\u044f \u0431\u0435\u0437 ransomware: \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BQE Software \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0448\u0438\u0444\u0440\u0443\u044e\u0442 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 \u0431\u0438\u043b\u043b\u0438\u043d\u0433\u043e\u0432\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0439 BillQuick Web Suite. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432 - 400 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n \n\u0412 \u043c\u0430\u0441\u0441\u0435 \u0441\u0432\u043e\u0435\u0439 \u0430\u0442\u0430\u043a\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 BillQuick, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u043b\u044f CVE-2021-42258, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043b\u0435\u0433\u043a\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043d\u0430 \u0432\u0445\u043e\u0434 \u0441 \u043d\u0435\u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 (\u043e\u0434\u0438\u043d\u0430\u0440\u043d\u0430\u044f \u043a\u0430\u0432\u044b\u0447\u043a\u0430) \u0432 \u043f\u043e\u043b\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n \n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0435 7 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 22.0.9.1 BQE Software, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0435 \u0431\u0430\u0433\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b Huntress ThreatOps \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0435\u0449\u0435 \u0432\u043e\u0441\u0435\u043c\u044c \u0434\u0440\u0443\u0433\u0438\u0445 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 BillQuick (CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742). \u0412\u0441\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u044b.\n \n\u0410\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 Huntress Labs \u043a \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0431\u0430\u043d\u0434\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f: \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u0432 \u0434\u0435\u043b\u0435 \u0431\u043e\u043b\u0435\u0435 \u043c\u0435\u043b\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0439 ransomware \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 \u043c\u0430\u044f 2020 \u0433\u043e\u0434\u0430 \u0438 \u0432 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0437\u0430\u0438\u043c\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u043e\u0434 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 AutoIT. \u0425\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0412\u041f\u041e \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0438\u0441\u043e\u043a \u043e \u0432\u044b\u043a\u0443\u043f\u0435 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0430 \u043b\u0438\u0448\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 pusheken91@bk.ru \u043a\u043e \u0432\u0441\u0435\u043c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 \u0434\u043b\u044f \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u044f \u0432\u044b\u043a\u0443\u043f\u0430.\n \n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, BQE Software \u0432\u043e\u0432\u0441\u044e \u0432\u0435\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430\u0434 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438, \u0432\u043f\u0440\u043e\u0447\u0435\u043c, \u043a\u0430\u043a \u0438 \u0445\u0430\u043a\u0435\u0440\u044b. \u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432, \u043a \u0430\u0442\u0430\u043a\u0430\u043c BillQuick \u0443\u0436\u0435 \u0432 \u0441\u0430\u043c\u043e\u0435 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0442\u044c\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u0430\u043a\u0442\u043e\u0440\u044b.", "creation_timestamp": "2021-10-26T18:55:45.000000Z"}, {"uuid": "851094f7-d4a0-450d-b23b-4ecfe48b1cda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4274", "type": "seen", "source": "https://t.me/cibsecurity/55075", "content": "\u203c CVE-2021-4274 \u203c\n\nA vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument request_args leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ef6b32c527478fefe7a4436e10b96ee28ed5b308. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216479.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-12-21T22:13:03.000000Z"}, {"uuid": "d25d99e4-1bbb-4860-8117-969c3ab4586a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42743", "type": "seen", "source": "https://t.me/cibsecurity/42125", "content": "\u203c CVE-2021-42743 \u203c\n\nA misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-06T20:23:05.000000Z"}, {"uuid": "f2e9be4a-282f-46e5-9ea3-9e666d47f924", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42744", "type": "seen", "source": "https://t.me/cibsecurity/32737", "content": "\u203c CVE-2021-42744 \u203c\n\nPhilips MRI 1.5T and MRI 3T Version 5.x.x exposes sensitive information to an actor not explicitly authorized to have access.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-19T22:17:09.000000Z"}, {"uuid": "a5f571bc-e25c-40e6-8c9d-970e8cf2e4e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42740", "type": "seen", "source": "https://t.me/cibsecurity/30953", "content": "\u203c CVE-2021-42740 \u203c\n\nThe shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-21T18:36:55.000000Z"}, {"uuid": "c2b1d4a1-cda2-4b10-9c14-640355b6d3d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42742", "type": "exploited", "source": "https://t.me/S_E_Reborn/1208", "content": "\u041d\u0438 \u0434\u043d\u044f \u0431\u0435\u0437 ransomware: \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BQE Software \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0448\u0438\u0444\u0440\u0443\u044e\u0442 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 \u0431\u0438\u043b\u043b\u0438\u043d\u0433\u043e\u0432\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0439 BillQuick Web Suite. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432 - 400 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n \n\u0412 \u043c\u0430\u0441\u0441\u0435 \u0441\u0432\u043e\u0435\u0439 \u0430\u0442\u0430\u043a\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 BillQuick, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u043b\u044f CVE-2021-42258, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043b\u0435\u0433\u043a\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043d\u0430 \u0432\u0445\u043e\u0434 \u0441 \u043d\u0435\u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 (\u043e\u0434\u0438\u043d\u0430\u0440\u043d\u0430\u044f \u043a\u0430\u0432\u044b\u0447\u043a\u0430) \u0432 \u043f\u043e\u043b\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n \n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0435 7 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 22.0.9.1 BQE Software, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0435 \u0431\u0430\u0433\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b Huntress ThreatOps \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0435\u0449\u0435 \u0432\u043e\u0441\u0435\u043c\u044c \u0434\u0440\u0443\u0433\u0438\u0445 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 BillQuick (CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742). \u0412\u0441\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u044b.\n \n\u0410\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 Huntress Labs \u043a \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0431\u0430\u043d\u0434\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f: \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u0432 \u0434\u0435\u043b\u0435 \u0431\u043e\u043b\u0435\u0435 \u043c\u0435\u043b\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0439 ransomware \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 \u043c\u0430\u044f 2020 \u0433\u043e\u0434\u0430 \u0438 \u0432 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0437\u0430\u0438\u043c\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u043e\u0434 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 AutoIT. \u0425\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0412\u041f\u041e \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0438\u0441\u043e\u043a \u043e \u0432\u044b\u043a\u0443\u043f\u0435 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0430 \u043b\u0438\u0448\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 pusheken91@bk.ru \u043a\u043e \u0432\u0441\u0435\u043c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 \u0434\u043b\u044f \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u044f \u0432\u044b\u043a\u0443\u043f\u0430.\n \n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, BQE Software \u0432\u043e\u0432\u0441\u044e \u0432\u0435\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430\u0434 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438, \u0432\u043f\u0440\u043e\u0447\u0435\u043c, \u043a\u0430\u043a \u0438 \u0445\u0430\u043a\u0435\u0440\u044b. \u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432, \u043a \u0430\u0442\u0430\u043a\u0430\u043c BillQuick \u0443\u0436\u0435 \u0432 \u0441\u0430\u043c\u043e\u0435 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0442\u044c\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u0430\u043a\u0442\u043e\u0440\u044b.", "creation_timestamp": "2021-10-27T10:22:02.000000Z"}, {"uuid": "94c7c8bf-7aa4-4243-977b-863963d0c653", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42741", "type": "exploited", "source": "https://t.me/S_E_Reborn/1208", "content": "\u041d\u0438 \u0434\u043d\u044f \u0431\u0435\u0437 ransomware: \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BQE Software \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0448\u0438\u0444\u0440\u0443\u044e\u0442 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 \u0431\u0438\u043b\u043b\u0438\u043d\u0433\u043e\u0432\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0439 BillQuick Web Suite. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0436\u0435\u0440\u0442\u0432 - 400 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n \n\u0412 \u043c\u0430\u0441\u0441\u0435 \u0441\u0432\u043e\u0435\u0439 \u0430\u0442\u0430\u043a\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 BillQuick, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u043b\u044f CVE-2021-42258, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043b\u0435\u0433\u043a\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043d\u0430 \u0432\u0445\u043e\u0434 \u0441 \u043d\u0435\u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 (\u043e\u0434\u0438\u043d\u0430\u0440\u043d\u0430\u044f \u043a\u0430\u0432\u044b\u0447\u043a\u0430) \u0432 \u043f\u043e\u043b\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n \n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0435 7 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 22.0.9.1 BQE Software, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0435 \u0431\u0430\u0433\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b Huntress ThreatOps \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u0435\u0449\u0435 \u0432\u043e\u0441\u0435\u043c\u044c \u0434\u0440\u0443\u0433\u0438\u0445 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 BillQuick (CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742). \u0412\u0441\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Windows, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u044b.\n \n\u0410\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 Huntress Labs \u043a \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0431\u0430\u043d\u0434\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f: \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u0432 \u0434\u0435\u043b\u0435 \u0431\u043e\u043b\u0435\u0435 \u043c\u0435\u043b\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0439 ransomware \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 \u043c\u0430\u044f 2020 \u0433\u043e\u0434\u0430 \u0438 \u0432 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0437\u0430\u0438\u043c\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u043e\u0434 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 AutoIT. \u0425\u0430\u043a\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0412\u041f\u041e \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0438\u0441\u043e\u043a \u043e \u0432\u044b\u043a\u0443\u043f\u0435 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0430 \u043b\u0438\u0448\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 pusheken91@bk.ru \u043a\u043e \u0432\u0441\u0435\u043c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 \u0434\u043b\u044f \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u044f \u0432\u044b\u043a\u0443\u043f\u0430.\n \n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, BQE Software \u0432\u043e\u0432\u0441\u044e \u0432\u0435\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430\u0434 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438, \u0432\u043f\u0440\u043e\u0447\u0435\u043c, \u043a\u0430\u043a \u0438 \u0445\u0430\u043a\u0435\u0440\u044b. \u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432, \u043a \u0430\u0442\u0430\u043a\u0430\u043c BillQuick \u0443\u0436\u0435 \u0432 \u0441\u0430\u043c\u043e\u0435 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0431\u0443\u0434\u0443\u0442 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0442\u044c\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u0430\u043a\u0442\u043e\u0440\u044b.", "creation_timestamp": "2021-10-27T10:22:02.000000Z"}, {"uuid": "a44d07ed-97d9-434f-a6e4-0838f8b16804", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42741", "type": "seen", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-01T20:02:12.576507Z"}, {"uuid": "4ff7d38c-d035-4695-b672-df1d12ce7c07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42742", "type": "seen", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-01T20:02:12.608519Z"}, {"uuid": "326dcb3d-4b1a-4060-8289-dd2eae207a89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42741", "type": "seen", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-02T01:02:38.394072Z"}, {"uuid": "857645d0-b9cc-4d97-bcab-d6f12bcd3725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42742", "type": "seen", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-02T01:02:38.432282Z"}, {"uuid": "8b9aa79e-931e-4e85-8069-4a8e18acfc96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42742", "type": "exploited", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-07T07:00:14.391035Z"}, {"uuid": "e808cd69-501a-473c-813d-3401bc4c038c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42741", "type": "exploited", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-07T07:00:14.716494Z"}, {"uuid": "e89d07a7-875b-4d05-addb-6c76913d4322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42741", "type": "exploited", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-08T00:00:56.670619Z"}, {"uuid": "84e62b6b-36df-4bec-8e2f-188f5217d8ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42742", "type": "exploited", "source": "https://t.me/hacking_Attack/29024", "content": "Black Hat Ethical Hacking\nHackers used billing software zero-day to deploy ransomware\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128 \nReading Time: 1 Minute\nAn unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets\u2019 networks in ongoing attacks.\nBQE Software, the company behind\u00a0BillQuick, claims to have a 400,000 strong user base worldwide.\n\nThe vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.\n\nThis actively exploited vulnerability was patched on October 7\u00a0after\u00a0Huntress Labs notified BQE Software of the bug.\n\nHowever, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they\u2019re still waiting for a patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company\u201cOur team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers\u2019 BillQuick data and run malicious commands on their on-premises Windows servers,\u201d Huntress Labs said.\n\n\u201cWe have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).\u201d\n\nAccording to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.\n\n\u201cThe actor we observed did not align with any known/large threat actor of which we are aware. It\u2019s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,\u201d Huntress Labs security researcher Caleb Stewart told BleepingComputer.\n\n\u201cHowever, based on the issues we\u2019ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven\u2019t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.\n\nAlso, it\u2019s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.\n\nBleepingComputer\u00a0found that the\u00a0ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.\n\nOnce deployed on target systems, it will add the pusheken91@bk.ru\u00a0extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg \n<figcaptionImage: Michael Gilles[...]", "creation_timestamp": "2026-09-08T00:00:56.328966Z"}, {"uuid": "5b7abeff-f645-4883-8862-a6ce0930a33a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42740", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv5lzfdsu724", "content": "CVE-2021-42740 - shell-quote\nThe shell-quote package for Node.js versions prior to 1.7.3 has a security flaw that allows an attacker to inject malicious commands on Windows systems. This could happen\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#shellquote #ljharb #npm #CVE #infosec", "creation_timestamp": "2026-09-10T08:10:04.169389Z"}]}