{"vulnerability": "CVE-2023-3604", "sightings": [{"uuid": "f7742c98-342d-419a-8017-9040a45727e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36045", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/13962", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-36045\n\ud83d\udd25 CVSS Score: 7.8 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)\n\ud83d\udd39 Description: Microsoft Office Graphics Remote Code Execution Vulnerability\n\ud83d\udccf Published: 2023-11-14T17:57:32.529Z\n\ud83d\udccf Modified: 2025-04-29T23:34:41.707Z\n\ud83d\udd17 References:\n1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36045", "creation_timestamp": "2025-04-30T00:12:49.000000Z"}, {"uuid": "0d2ec824-2a66-4b21-ad36-b18d32ca9265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36049", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/13943", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-36049\n\ud83d\udd25 CVSS Score: 7.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L/E:P/RL:O/RC:C)\n\ud83d\udd39 Description: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability\n\ud83d\udccf Published: 2023-11-14T20:18:04.925Z\n\ud83d\udccf Modified: 2025-04-29T23:34:52.670Z\n\ud83d\udd17 References:\n1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049", "creation_timestamp": "2025-04-30T00:12:24.000000Z"}, {"uuid": "efcec8c5-14bd-48a6-8102-3fd8f162acf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36045", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/705", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-36045\n\ud83d\udd39 Description: Microsoft Office Graphics Remote Code Execution Vulnerability\n\ud83d\udccf Published: 2023-11-14T17:57:32.529Z\n\ud83d\udccf Modified: 2025-01-08T16:04:13.943Z\n\ud83d\udd17 References:\n1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36045", "creation_timestamp": "2025-01-08T16:13:04.000000Z"}, {"uuid": "27648718-a0cf-4404-b614-29817b4d1137", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36047", "type": "published-proof-of-concept", "source": "Telegram/qSE0RWa0QV6YyZWR5F-8tcoTUlt3b0ZF9tAn7gIh0Pp7CIs", "content": "", "creation_timestamp": "2024-05-22T10:58:09.000000Z"}, {"uuid": "61a6b5da-781a-401a-b9eb-2de484714b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36047", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/2285", "content": "https://github.com/Wh04m1001/UserManagerEoP\n\nCVE-2023-36047\n#github #tools", "creation_timestamp": "2024-04-10T16:52:41.000000Z"}, {"uuid": "07a4d723-5a6f-459d-a2be-f77ce7027036", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36047", "type": "seen", "source": "https://t.me/proxy_bar/2000", "content": "CVE-2023-36047\n* \n\u0414\u044b\u0440\u043a\u0430 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 usermanager, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0444\u0430\u0439\u043b\u044b \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e \u043a Elevation of Privilege. \n\u0417\u0430\u0411\u0430\u0433\u0424\u0438\u043a\u0441\u0438\u043b\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0432\u0441\u0435 \u0435\u0449\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043b\u0430\u0441\u044c \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 NT AUTHORITY\\\\SYSTEM. \u042d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f  SAM /SYSTEM/SECURITY \u0438\u0437 \u0442\u0435\u043d\u0435\u0432\u043e\u0439 \u043a\u043e\u043f\u0438\u0438. \n\u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c \u0438  \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c  \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2024-21447\n*\nExploit\n\n#windows #eop", "creation_timestamp": "2024-04-10T15:37:32.000000Z"}, {"uuid": "28e7b2ff-5496-4e1f-9e6a-caf607496f6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-3604", "type": "seen", "source": "https://t.me/cibsecurity/68900", "content": "\u203c CVE-2023-3604 \u203c\n\nThe Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-21T20:41:16.000000Z"}, {"uuid": "78934337-79c6-4943-bbb0-62a8cd0e47b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36047", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/10308", "content": "#exploit\n1. CVE-2023-36047:\nWindows Authentication EoP\nhttps://github.com/Wh04m1001/UserManagerEoP\n\n2. CVE-2024-25723:\nZenML Remote Privilege Escalation\nhttps://github.com/david-botelho-mariano/exploit-CVE-2024-25723\n\n3. CI and Backdoor Account in D-Link NAS\nhttps://github.com/netsecfish/dlink", "creation_timestamp": "2024-04-10T14:50:06.000000Z"}, {"uuid": "8181798e-1796-4f2d-b034-2c105f859d62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36047", "type": "seen", "source": "https://t.me/S_E_Reborn/5335", "content": "\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \n\n\u041f\u043e\u043c\u0438\u043c\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 Windows, \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043c\u043e\u0433\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432: \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u043b\u0435\u0436\u0435\u043d\u0438\u044f, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0438\u0433\u0440\u0443\u0448\u043a\u0438. \u0412 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0441\u0432\u043e\u0435\u043c \u043e\u043d\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c, \u0440\u0430\u0431\u043e\u0442\u0430\u044f \u043e\u0442 \u043b\u0438\u0446\u0430 NT AUTHORITY\\SYSTEM. \n\n\u041f\u0440\u0438\u0447\u0435\u043c, \u043a\u0430\u043a \u044f \u043f\u043e\u043d\u0438\u043c\u0430\u044e, \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0441\u043b\u0443\u0436\u0431\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u0434\u043e\u043b\u0436\u043d\u044b \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0444\u0438\u0440\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u041f\u041e, \u0447\u0442\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u0430\u0435\u0442 \u043d\u0430\u043c \u0435\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u0435\u043a\u0442\u043e\u0440 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \n\n\u0415\u0441\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u041f\u041e \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435:\n# \u0418\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 \u0438\u0437 \u0440\u0435\u0435\u0441\u0442\u0440\u0430\nGet-ChildItem \"HKLM:\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" | Get-ItemProperty | Where-Object {$_.DisplayName -ne $null} | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate\n\n# wmi\nwmic product get name,version,vendor  \n\n# Seatbelt\n.\\SeatBelt.exe InstalledProducts\n\n\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0432\u0430\u043c\u0438 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c \u0441\u043f\u0438\u0441\u043e\u0447\u043a\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u043b\u0443\u0436\u0431, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043c\u043e\u0447\u044c \u0432\u0437\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u0430\u0447\u043a\u0435. \u041e\u0434\u043d\u043e\u0437\u043d\u0430\u0447\u043d\u043e \u043d\u0443\u0436\u043d\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Exploit-Street, \u043d\u043e \u044f \u0447\u0442\u043e-\u0442\u043e \u043d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043a\u0430\u043a. \u041c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0443 \u0432\u0430\u0441 \u0435\u0441\u0442\u044c \u0438\u0434\u0435\u0438?\n\nManageEngine ServiceDesk\n- https://github.com/horizon3ai/CVE-2021-44077\n\nManageEngine ADSelfService\n- https://github.com/synacktiv/CVE-2021-40539\n- CVE-2022-47966\n- CVE-XXXX-XXXX (\u0441 \u0432\u0435\u0440\u0441\u0438\u0438 ADSelfService Plus 4.2.9, 2012 \u0438 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 6.3 Build 6301)\n\nUserManager\n- CVE-2023-36047\n\nITunes\n- CVE-2024-44193\n\nRazer ( \u0434\u043e 3.7.1209.121307)\n- RazerEoP\n\nDatacard XPS Card Printer Driver \n- CVE-2024-34329\n\nAppGate\n- CVE-2019-19793\n\nSeagate\n- CVE-2022-40286\n\nAWS VPN Client\n- CVE-2022-25165\n\nAIDA (\u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0438\u0436\u0435 7.00.6742)\n- AIDA64DRIVER-EOP\n\nVboxSDS\n- CVE-2024-21111\n\nTeamViewer\n- CVE-2024-7479 CVE-2024-7481\n\nGamingService \u043e\u0442 XBOX\n- GamingServiceEoP\n- GamingServiceEoP5\n\nChrome Updater\n- CVE-2023-7261\n\nPlantronics Desktop Hub\n- CVE-2024-27460", "creation_timestamp": "2024-12-26T13:38:29.000000Z"}, {"uuid": "ab734ae1-582a-48a8-bd7a-662fdfe42314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36041", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/9475", "content": "#exploit\n1. CVE-2023-20963:\nAndroid: mismatching parcel/unparcel logic for WorkSource\nhttps://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-20963.html\n2. CVE-2023-36041:\nMicrosoft Excel RCE\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2023-1835", "creation_timestamp": "2023-11-27T12:27:01.000000Z"}, {"uuid": "c3ce9962-7681-4c99-8f54-2a58cbaafbb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36049", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/10122", "content": "#exploit\n1. CVE-2023-36049:\nMicrosoft .NET CRLF Injection Arbitrary File Write/Deletion\nhttps://www.zerodayinitiative.com/blog/2024/3/6/cve-2023-36049-microsoft-net-crlf-injection-arbitrary-file-writedeletion-vulnerability\n\n2. CVE-2022-36266, CVE-2022-36267, CVE-2022-36264, CVE-2022-36265:\nAirspan AirSpot 5410 Vulnerabilities\nhttps://neroteam.com/blog/airspan-airspot-5410-vulnerability-report", "creation_timestamp": "2024-03-11T07:14:50.000000Z"}, {"uuid": "c1fd3f7b-21bc-4ab6-a89f-c3b7c0ab684e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36041", "type": "seen", "source": "https://t.me/Rootsec_2/2124", "content": "#exploit\n1. CVE-2023-20963:\nAndroid: mismatching parcel/unparcel logic for WorkSource\nhttps://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-20963.html\n2. CVE-2023-36041:\nMicrosoft Excel RCE\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2023-1835", "creation_timestamp": "2024-08-16T08:52:59.000000Z"}]}