{"vulnerability": "CVE-2023-38146", "sightings": [{"uuid": "b8c3850b-ad2a-4291-9da1-48cb2bff2a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:46.000000Z"}, {"uuid": "849fa763-c247-40b3-aa37-b146158cdd0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:55.000000Z"}, {"uuid": "e374e789-7a9b-42de-a4d6-d942caa3e7fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/ap_security/26", "content": "\ud83c\udf10\u041f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f RCE ThemeBleed \u0432 Windows 11\n\n\u26a1\ufe0f\u0412\u044b\u0448\u0435\u043b proof-of-concept \u0434\u043b\u044f CVE-2023-38146, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434\n\n\u26a1\ufe0f\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 8,8 \u0431\u0430\u043b\u043b\u043e\u0432 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0432 \u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u043e\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b .THEME\n\n\u26a1\ufe0f\u0424\u0430\u0439\u043b .THEME \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u0441\u044b\u043b\u043a\u0443 \u043a \u0444\u043e\u0440\u043c\u0430\u0442\u0443 .msstyles, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u0432\u0438\u0434\u0430. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0442\u0430\u043a\u043e\u0439 \u0444\u0430\u0439\u043b, \u0445\u0430\u043a\u0435\u0440 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0431\u0430\u0433 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 DLL\n\n#infosec #itnews #cve", "creation_timestamp": "2023-09-16T14:05:46.000000Z"}, {"uuid": "bca298f0-b938-4d69-89ea-9e98e28ef2e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb", "content": "", "creation_timestamp": "2024-01-04T17:37:35.000000Z"}, {"uuid": "7017b53a-bce6-44eb-95bf-f56de528629e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:01.000000Z"}, {"uuid": "9de5f61e-f544-4977-814a-7bd61c8a813d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/5402", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aPoC for the ThemeBleed Windows 11 CVE-2023-38146 written in python using impacket\nURL\uff1ahttps://github.com/Jnnshschl/CVE-2023-38146\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-10-13T15:43:13.000000Z"}, {"uuid": "a1d9ed86-2637-447b-bb3f-edc65af5c3d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/5133", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aProof-of-Concept for CVE-2023-38146 (\\\"ThemeBleed\\\")\nURL\uff1ahttps://github.com/gabe-k/themebleed\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-09-14T12:39:51.000000Z"}, {"uuid": "d5fb7867-9d07-4546-b9c1-247b8ae5b45d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/BleepingComputer/18183", "content": "\u200aWindows 11 \u2018ThemeBleed\u2019 RCE bug gets proof-of-concept exploit\n\nSecurity researcher Gabe Kirkpatrick has made a proof-of-concept (PoC) exploit available for CVE-2023-38146, aka \"ThemeBleed,\" which enables attackers to trigger arbitrary remote code execution if the target opens a specially crafted '.theme' file. [...]\n\nhttps://www.bleepingcomputer.com/news/security/windows-11-themebleed-rce-bug-gets-proof-of-concept-exploit/", "creation_timestamp": "2023-09-14T17:16:22.000000Z"}, {"uuid": "3f071102-1e31-4aa3-8351-d0533f80b639", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/6155", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aA proof of concept using python for the CVE-2023-38146 \\\"ThemeBleed\\\"\nURL\uff1ahttps://github.com/Durge5/ThemeBleedPy\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-12-12T19:16:20.000000Z"}, {"uuid": "004762f2-7be1-4f15-bc8c-a1c1ca76a934", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/itsec_news/3221", "content": "\u200b\u26a1\ufe0fThemeBleed: \u043a\u0430\u0441\u0442\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f Windows \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u043e\u0438\u0442\u044c \u0436\u0438\u0437\u043d\u0438 \u0432\u0430\u0448\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\ud83d\udcac\u042d\u043a\u0441\u043f\u0435\u0440\u0442 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0413\u0435\u0439\u0431 \u041a\u0438\u0440\u043a\u043f\u0430\u0442\u0440\u0438\u043a \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0434\u043b\u044f \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0432\u0438\u0437\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0442\u0438\u043b\u044f\u0445 Windows, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ThemeBleed. \u042d\u0442\u043e\u0442 \u0434\u0435\u0444\u0435\u043a\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u0435\u043c\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435. Microsoft \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447, \u043d\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0432\u0441\u0435 \u0435\u0449\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u0432\u043e\u043f\u0440\u043e\u0441\u044b.\n\nThemeBleed (\u0438\u043b\u0438 CVE-2023-38146) \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0446\u0435\u043d\u043a\u0443 8.8 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CVSS). \u041e\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0444\u0430\u0439\u043b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435\u043c.THEME. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u041a\u0438\u0440\u043a\u043f\u0430\u0442\u0440\u0438\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u044f \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0444\u043e\u0440\u043c\u0430\u0442\u044b \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 Windows, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u043a\u0430\u0441\u0442\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430.\n\n\u0415\u0441\u043b\u0438 \u0432 \u0444\u0430\u0439\u043b\u0435 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435\u043c .MSSTYLES \u0443\u043a\u0430\u0437\u0430\u043d \u043d\u043e\u043c\u0435\u0440 \u0432\u0435\u0440\u0441\u0438\u0438 999, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0430 \u043c\u0435\u0436\u0434\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0438 \u043c\u043e\u043c\u0435\u043d\u0442\u043e\u043c \u0435\u0451 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u043e\u043a\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043e \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438.\n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u043a\u0430\u043b\u044c\u043a\u0443\u043b\u044f\u0442\u043e\u0440 Windows, \u0435\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0442\u0435\u043c\u044b. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0431\u0430\u0433\u043e\u043c, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u043e\u0442 \u043c\u043e\u043c\u0435\u043d\u0442 \u2013 \u0438\u0434\u0435\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u041a\u0438\u0440\u043a\u043f\u0430\u0442\u0440\u0438\u043a \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430 \u044d\u043a\u0440\u0430\u043d\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u00abmark-of-the-web\u00bb, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0444\u0430\u0439\u043b \u0442\u0435\u043c\u044b. \u041e\u0434\u043d\u0430\u043a\u043e, \u0435\u0441\u043b\u0438 \u044d\u0442\u043e\u0442 \u0444\u0430\u0439\u043b \u00ab\u0443\u043f\u0430\u043a\u043e\u0432\u0430\u0442\u044c\u00bb \u0432 \u0444\u043e\u0440\u043c\u0430\u0442 .THEMEPACK, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u043e \u043d\u0435 \u0431\u0443\u0434\u0435\u0442.\n\nMicrosoft \u0443\u0434\u0430\u043b\u0438\u043b\u0430 \u0441\u043f\u043e\u0440\u043d\u0443\u044e \u00ab\u0432\u0435\u0440\u0441\u0438\u044e 999\u00bb, \u043d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0433\u043e\u043d\u043a\u0438, \u043e\u0441\u0442\u0430\u043b\u0430\u0441\u044c \u043d\u0435\u0440\u0435\u0448\u0435\u043d\u043d\u043e\u0439. \u041a \u0442\u043e\u043c\u0443 \u0436\u0435, Microsoft \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u043e\u0432 .THEMEPACK.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c Windows \u0441\u043e\u0432\u0435\u0442\u0443\u044e\u0442 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u043f\u0430\u043a\u0435\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e ThemeBleed, \u043d\u043e \u0438 \u0434\u0432\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 57 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041d\u043e \u0434\u0430\u0436\u0435 \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u044d\u0442\u0438\u0445 \u043c\u0435\u0440, \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u043f\u0440\u043e\u0441: \u043a\u0430\u043a \u043c\u043d\u043e\u0433\u043e \u0434\u0440\u0443\u0433\u0438\u0445 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0436\u0438\u0434\u0430\u0435\u0442 \u0441\u0432\u043e\u0435\u0433\u043e \u0447\u0430\u0441\u0430?\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2023-09-16T08:57:51.000000Z"}, {"uuid": "5fa8dc72-0595-4204-bb0b-ca8909ad2220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/BleepingComputer/18176", "content": "Latest news and stories from BleepingComputer.com\nWindows 11 \u2018ThemeBleed\u2019 RCE bug gets proof-of-concept exploit\n\nSecurity researcher Gabe Kirkpatrick has made a proof-of-concept (PoC) exploit available for CVE-2023-38146, aka \"ThemeBleed,\" which enables attackers to trigger arbitrary remote code execution if the target opens a specially crafted '.theme' file. [...]", "creation_timestamp": "2023-09-14T16:30:26.000000Z"}, {"uuid": "dafaf0e2-6e37-4bfa-b99b-07e9cad8b150", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/arvinclub1/750", "content": "Write-up poc for CVE-2023-38146\nArbitrary Code Execution via Windows Themes\nhttps://exploits.forsale/themebleed", "creation_timestamp": "2023-09-14T12:49:46.000000Z"}, {"uuid": "c643acc3-6b71-45dc-a631-a8bf1d55c2fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/ap_security/104", "content": "\ud83c\udf10\u041f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f RCE ThemeBleed \u0432 Windows 11\n\n\u26a1\ufe0f\u0412\u044b\u0448\u0435\u043b proof-of-concept \u0434\u043b\u044f CVE-2023-38146, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434\n\n\u26a1\ufe0f\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 8,8 \u0431\u0430\u043b\u043b\u043e\u0432 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0432 \u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, \u0435\u0441\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u043e\u0442\u043a\u0440\u043e\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b .THEME\n\n\u26a1\ufe0f\u0424\u0430\u0439\u043b .THEME \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u0441\u044b\u043b\u043a\u0443 \u043a \u0444\u043e\u0440\u043c\u0430\u0442\u0443 .msstyles, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u0432\u0438\u0434\u0430. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0442\u0430\u043a\u043e\u0439 \u0444\u0430\u0439\u043b, \u0445\u0430\u043a\u0435\u0440 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0431\u0430\u0433 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 DLL\n\n#infosec #itnews #cve", "creation_timestamp": "2023-09-16T14:05:46.000000Z"}, {"uuid": "494c14b4-861e-4b3f-9fab-3b25b524af65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "seen", "source": "https://t.me/arpsyndicate/1821", "content": "#ExploitObserverAlert\n\nCVE-2023-38146\n\nDESCRIPTION: Exploit Observer has 9 entries related to CVE-2023-38146. Windows Themes Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.008540000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2023-12-16T13:01:52.000000Z"}, {"uuid": "0a0f468b-593c-411d-91ce-87821b20e96d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3199", "content": "Hackers Factory \n\nNext Generation DorX. Built by Dorks, for Dorks.\u00a0\n\nhttps://github.com/ResearchandDestroy/DorXNGy\n\nA framework for assessing the security of L2s\n\nhttps://github.com/quantstamp/l2-security-framework\n\nMultiPlatform HTTP Reverse Shell\n\nhttps://github.com/JoelGMSec/HTTP-Shell\n\nBypassing UAC with SSPI Datagram Contexts\n\nhttps://github.com/antonioCoco/SspiUacBypass\n\nA comprehensive Python-based security tool for file scanning, malware detection, and analysis in an ever-evolving cyber landscape\n\nhttps://github.com/samhaxr/VTScanner\n\nAnother tool to perform minidump of LSASS process using few technics to avoid detection.\n\nhttps://github.com/YOLOP0wn/POSTDump\n\nExploitation of echo_driver.sys\n\nhttps://github.com/YOLOP0wn/EchoDrv\n\nEncrypted shellcode Injection to avoid Kernel triggered memory scans\n\nhttps://github.com/S3cur3Th1sSh1t/Caro-Kann\n\nProof-of-Concept for CVE-2023-38146 (\"ThemeBleed\")\n\nhttps://github.com/gabe-k/themebleed\n\nAndroid App Pin Security Issue Allowing Unauthorized Payments via Google Wallet\n\nhttps://github.com/MrTiz/CVE-2023-35671\n\n#infosec #cybersecurity #hackersfactory \n\nhttps://t.me/dilagrafie", "creation_timestamp": "2024-02-21T13:45:38.000000Z"}, {"uuid": "81412ab1-337d-40c3-8cc3-8053c0c90a5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3195", "content": "Hackers Factory \n\nAn exploit has appeared for RCE ThemeBleed in Windows 11\n\nProof-of-concept for CVE-2023-38146 has been released, allowing remote code execution\n\nThe vulnerability received a CVSS score of 8.8 and can be exploited if the victim opens a malicious .THEME file\n\nThe .THEME file contains a reference to the .msstyles format used to customize the appearance. Using such a file, a hacker can use the bug to inject a malicious DLL\n\nThemeBleed RCE: Proof-of-concept.\n\nThis repository contains an exploit for the vulnerability we wrote about above\u2601\ufe0f\n\nRepository link: https://github.com/gabe-k/themebleed\n\nTelegram get Remote IP\n\nGet the IP address of the user during #Telegram call to obtain geolocation of ISP. It might have some bugs since on Android, it returns only local, not external IP Github:\n\nhttps://github.com/n0a/telegram-get-remote-ip\n\nNew analysis tool: donut-decryptor: Retrieve inner payloads from Donut samples\n\nhttps://github.com/volexity/donut-decryptor\n\nBabelInkCrypt is an open-source project that combines encryption, library of babel, and video making to create a secure infinite storage system.\n\nhttps://github.com/youneshlal7/BabelInkCrypt\n\nSimple PoC for demonstrating Race Conditions on Websockets\n\nhttps://github.com/redrays-io/WS_RaceCondition_PoC\n\nHun2race is an automated report generation tool designed for bug hunters and penetration testers.\n\nhttps://github.com/sudobyter-hub/Hun2race\n\nIntroduction to SensitiveDiscoverer, a Burp extension that discovers sensitive information inside HTTP messages.\n\nhttps://github.com/CYS4srl/SensitiveDiscoverer\n\nThe OSINT project, the main idea of which is to collect all the possible Google dorks search combinations and to find the information about the specific web-site: common admin panels, the widespread file types and path traversal. The 100% automated.\n\nhttps://github.com/IvanGlinkin/Fast-Google-Dorks-Scan\n\nAutomatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests\n\nhttps://github.com/portswigger/autorize\n\nCode Coverage Exploration Plugin for Ghidra\n\nhttps://github.com/nccgroup/Cartographer\n\nRedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.\n\nhttps://github.com/ihebski/A-Red-Teamer-diaries\n\n#infosec #cybersecurity #hackersfactory\n\nhttps://t.me/dilagrafie", "creation_timestamp": "2023-09-18T07:26:18.000000Z"}, {"uuid": "403387d4-b16b-4b11-8e14-50bde3e9a845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3193", "content": "Hackers Factory \n\nCloud Metadata Dictionary useful for SSRF Testing \u00b7 GitHub\n\nhttps://gist.github.com/BuffaloWill/fa96693af67e3a3dd3fb \n\nAI-powered cybersecurity chatbot designed to provide helpful and accurate answers to your cybersecurity-related queries and also do code analysis and scan analysis.\n\nhttps://github.com/morpheuslord/HackBot\n\nbug-bounty/methodology/01-recon.md at master \u00b7 JakobTheDev/bug-bounty\n\nhttps://github.com/JakobTheDev/bug-bounty/blob/master/methodology/01-recon.md\n\nKasperskyLab/TinyCheck: TinyCheck allows you to easily capture network communications from a smartphone or any device which can be associated to a Wi-Fi access point in order to quickly analyze them. This can be used to check if any suspect\n\nhttps://github.com/netstalking-core/netstalking-osint\n\nA fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.\n\nhttps://github.com/Bashfuscator/Bashfuscator\n\nOld Twint style, but zero fat.\n\nhttps://github.com/twintproject/twint-zero\n\nProof-of-Concept for CVE-2023-38146 (\"ThemeBleed\")\n\nhttps://github.com/gabe-k/themebleed\n\nHostHunter a recon tool for discovering hostnames using OSINT techniques.\n\nhttps://github.com/SpiderLabs/HostHunter\n\nOndrik8/RED-Team\n\nhttps://github.com/Ondrik8/RED-Team\n\nAn awesome list of honeypot resources\n\nhttps://github.com/paralax/awesome-honeypots\n\n#infosec #cybersecurity #hackersfactory \n\nhttps://t.me/dilagrafie", "creation_timestamp": "2023-09-16T20:31:38.000000Z"}, {"uuid": "33ee07c9-c4ec-45a5-a978-6e89d808dbd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/reverse_dungeon/3336", "content": "CVE-2023-38146: Arbitrary Code Execution via Windows Themes\n\nhttps://exploits.forsale/themebleed/\n\n@WindowsHackingLibrary", "creation_timestamp": "2023-09-18T21:23:21.000000Z"}, {"uuid": "226340ac-5bcd-4ee1-bf4c-0ac8057b7cf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/jokerplstaeen/20958", "content": "\u200f\u062a\u0645 \u0646\u0634\u0631 \u0643\u0648\u062f \"\u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 POC\" \u0644\u062b\u063a\u0631\u0629 \u0641\u064a \u0623\u0646\u0638\u0645\u0629 \u0648\u064a\u0646\u062f\u0648\u0632 CVE-2023-38146 \u062a\u0645\u0643\u0646 \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0645\u0646 \u0627\u0644\u062a\u062d\u0643\u0645 \u0648\u0627\u0644\u0633\u064a\u0637\u0631\u0629.\n\u062a\u0641\u0627\u0635\u064a\u0644 \u0627\u0644\u062b\u063a\u0631\u0629: exploits.forsale/themebleed/\u200e\n\u200e#\u0627\u0644\u0627\u0645\u0646_\u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a", "creation_timestamp": "2023-09-19T11:19:18.000000Z"}, {"uuid": "310293ec-e4ae-4e8f-99d6-56a7324535aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "seen", "source": "https://t.me/cibsecurity/70331", "content": "\u203c CVE-2023-38146 \u203c\n\nWindows Themes Remote Code Execution Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-12T20:29:23.000000Z"}, {"uuid": "8944dd4e-e6b9-4657-88a0-cc2e6e13af83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "Telegram/5P7ToOhXjkmazgXZ6Xuuz01jtMhkW7LbAlDRsflrrfvFTJQ", "content": "", "creation_timestamp": "2023-09-17T01:53:17.000000Z"}, {"uuid": "adcb32a9-7941-4a3f-864e-181085059ed5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/9032", "content": "#exploit\n1. CVE-2023-38146:\nArbitrary Code Execution via Windows Themes\nhttps://exploits.forsale/themebleed\n\n2. CVE-2022-31704, CVE-2022-31706, CVE-2022-31711:\nVMware vRealize Log Insight Unauthenticated RCE\nhttps://packetstormsecurity.com/files/174606", "creation_timestamp": "2023-09-16T12:27:01.000000Z"}, {"uuid": "142fa4de-786d-4ae5-a202-398dbcdc2380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38146", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/7775", "content": "CVE-2023-38146: Arbitrary Code Execution via Windows Themes\n\nhttps://exploits.forsale/themebleed/", "creation_timestamp": "2023-09-16T20:10:17.000000Z"}]}