{"vulnerability": "cve-2021-41379", "sightings": [{"uuid": "c60137b7-8d74-4783-9f36-f2c6ec081a4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "94ec6f8b-b5e0-4d4a-bcc6-9acf282598bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971357", "content": "", "creation_timestamp": "2024-12-24T20:28:07.399385Z"}, {"uuid": "5ddbe1d8-fccf-4ec3-9314-6bfc99a3ff87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:32.000000Z"}, {"uuid": "955cf09f-cd53-4cea-b53d-9b1f2b32d6df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:53.000000Z"}, {"uuid": "ed6b9c9d-85c8-43a4-a5cc-ccf8b3ea25fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_36/2021", "content": "", "creation_timestamp": "2021-11-24T09:22:01.000000Z"}, {"uuid": "72bd0c8d-6f7b-45c2-bc5f-4d64ebb6172d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-41379", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4bc8a80a-e207-4334-92a9-c1166e007e6f", "content": "", "creation_timestamp": "2026-02-02T12:28:11.765968Z"}, {"uuid": "8db915a9-6cc7-4e84-befa-a3d58281aa44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8190", "content": "Another Microsoft Zero-Day exploit pertaining to bad fix of CVE-2021-41379.\n\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nDetails: https://www.bleepingcomputer.com/news/microsoft/new-windows-zero-day-with-public-exploit-lets-you-become-an-admin/", "creation_timestamp": "2021-11-22T23:37:21.000000Z"}, {"uuid": "f6746559-0bee-440d-b35e-ca18fa19ffa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/ckuRED/66", "content": "Another Microsoft Zero-Day exploit pertaining to bad fix of CVE-2021-41379.\n\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nDetails: https://www.bleepingcomputer.com/news/microsoft/new-windows-zero-day-with-public-exploit-lets-you-become-an-admin/", "creation_timestamp": "2021-11-22T23:37:12.000000Z"}, {"uuid": "907e94a2-a006-4016-ab2d-5ed643cdfa6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "exploited", "source": "https://t.me/habr_com_news/1330", "content": "\u200b\u0412 \u0437\u043d\u0430\u043a \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0430 \u043f\u0440\u043e\u0442\u0438\u0432 \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u044b\u043f\u043b\u0430\u0442 bug bounty \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432\u044b\u043b\u043e\u0436\u0438\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f Windows\n\n22 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432\u044b\u043b\u043e\u0436\u0438\u043b \u043d\u0430 GitHub \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f Windows CVE-2021-41379, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f SYSTEM. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440, \u043a\u0430\u043a \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u043d\u0435 \u0434\u043e \u043a\u043e\u043d\u0446\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0438 \u0435\u0439 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0432\u0441\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 Microsoft \u0432\u0435\u0440\u0441\u0438\u0438 Windows, \u0432\u043a\u043b\u044e\u0447\u0430\u044f WIndows 10, Windows 11 \u0438 \u0434\u0430\u0436\u0435 Windows Server 2022. \u041f\u0440\u0438\u0447\u0438\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c \u2014 \u0435\u0433\u043e \u043f\u0440\u043e\u0442\u0435\u0441\u0442 \u043f\u0440\u043e\u0442\u0438\u0432 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Microsoft, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u044b\u043f\u043b\u0430\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043f\u043e \u0441\u0432\u043e\u0438\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u043c \u043f\u043e\u0438\u0441\u043a\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (bug bounty).", "creation_timestamp": "2021-11-24T14:28:42.000000Z"}, {"uuid": "4d5b5be6-cb91-4956-9d83-a459a7a04db3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/poxek/140", "content": "#windows #lpe\n\nBypass CVE-2021-41379 patch in Windows 11 and Server 2022 with November 2021.\n\nhttps://github.com/klinix5/InstallerFileTakeOver", "creation_timestamp": "2021-11-22T08:37:42.000000Z"}, {"uuid": "3a69304b-988c-40d9-9d80-d75c13e8a6a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/ggfcvj/2943", "content": "\u0628\u0639\u062f \u0623\u0646 \u062a\u0641\u0634\u062a \u062b\u063a\u0631\u0629 \u062e\u0637\u064a\u0631\u0629 \u0628\u064a\u0646 \u0627\u0644\u0647\u0627\u0643\u0631\u0632 ... \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u062e\u064a\u0631\u0627 \u062a\u0639\u0644\u0646 \u0639\u0646 \u0625\u063a\u0644\u0627\u0642\u0647\u0627! \n\u0627\u0644\u062b\u063a\u0631\u0629 ( CVE-2021-41379 ) \u062a\u0645 \u0643\u0634\u0641\u0647\u0627 \u0648\u0625\u063a\u0644\u0627\u0642\u0647\u0627 \u0645\u0646 \u0637\u0631\u0641 \u0627\u0644\u0628\u0627\u062d\u062b \u0627\u0644\u0627\u0645\u0646\u064a \"\u0639\u0628\u062f \u0627\u0644\u062d\u0645\u064a\u062f \u0646\u0627\u0635\u0631\u064a\" \u060c \u0648\u0647\u064a \u062b\u063a\u0631\u0629 \u062a\u0635\u064a\u0628 \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a \u0627\u0644\u0623\u062e\u064a\u0631\u0629 \u0645\u0646 \u0646\u0638\u0627\u0645 \u0627\u0644\u0648\u064a\u0646\u062f\u0648\u0632 10 \u062b\u0645 \u0627\u0644\u0648\u064a\u0646\u062f\u0648\u0632 11 \u0648\u062d\u062a\u0649 Windows Server 2022. \u0645\u0646 \u062e\u0644\u0627\u0644\u0647\u0627 \u064a\u0633\u062a\u0637\u064a\u0639 \u0627\u0644\u0647\u0627\u0643\u0631 \u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0639\u0644\u0649 \u0627\u0644\u0646\u0638\u0627\u0645\u060c \u0645\u0645\u0627 \u064a\u062e\u0648\u0644 \u0644\u0647 \u0628\u0646\u0634\u0631 \u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0645\u062e\u062a\u0644\u0641\u0629 \u064a\u0633\u062a\u0637\u064a\u0639 \u0645\u0646 \u062e\u0644\u0627\u0644\u0647\u0627 \u0627\u062e\u062a\u0631\u0627\u0642 \u0627\u0644\u0646\u0638\u0627\u0645.\n\u0627\u0639\u062a\u0642\u062f\u062a \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u0646\u0647\u0627 \u0623\u063a\u0644\u0642\u062a \u0627\u0644\u062b\u063a\u0631\u0629 \u0641\u064a \u0627\u0644\u0623\u064a\u0627\u0645 \u0627\u0644\u0645\u0627\u0636\u064a\u0629 \u0644\u0643\u0646\u0647\u0627 \u0643\u0627\u0646\u062a \u0644\u0627\u0632\u0627\u0644\u062a \u0645\u062a\u0627\u062d\u0629\u060c \u0644\u062a\u0639\u0644\u0646 \u0628\u0634\u0643\u0644 \u0645\u062a\u0623\u062e\u0631 \u0628\u0639\u062f \u0623\u0646 \u062a\u0641\u0634\u062a \u0628\u064a\u0646 \u0627\u0644\u0647\u0627\u0643\u0631\u0632\u060c \u0623\u0646\u0647\u0627 \u0623\u0635\u062f\u0631\u062a \u062a\u0631\u0642\u064a\u0639 \u0644\u0647\u0627 \u0643\u0641\u064a\u0644 \u0628\u063a\u0644\u0642\u0647\u0627. \n\n\n#My_pride_is_crazy", "creation_timestamp": "2021-11-28T12:59:00.000000Z"}, {"uuid": "9ac86a83-fb31-4e34-9e9d-689d45ee4052", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/anwar1213xx/1378", "content": "\u0628\u0639\u062f \u0623\u0646 \u062a\u0641\u0634\u062a \u062b\u063a\u0631\u0629 \u062e\u0637\u064a\u0631\u0629 \u0628\u064a\u0646 \u0627\u0644\u0647\u0627\u0643\u0631\u0632 ... \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u062e\u064a\u0631\u0627 \u062a\u0639\u0644\u0646 \u0639\u0646 \u0625\u063a\u0644\u0627\u0642\u0647\u0627! \n\u0627\u0644\u062b\u063a\u0631\u0629 ( CVE-2021-41379 ) \u062a\u0645 \u0643\u0634\u0641\u0647\u0627 \u0648\u0625\u063a\u0644\u0627\u0642\u0647\u0627 \u0645\u0646 \u0637\u0631\u0641 \u0627\u0644\u0628\u0627\u062d\u062b \u0627\u0644\u0627\u0645\u0646\u064a \"\u0639\u0628\u062f \u0627\u0644\u062d\u0645\u064a\u062f \u0646\u0627\u0635\u0631\u064a\" \u060c \u0648\u0647\u064a \u062b\u063a\u0631\u0629 \u062a\u0635\u064a\u0628 \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a \u0627\u0644\u0623\u062e\u064a\u0631\u0629 \u0645\u0646 \u0646\u0638\u0627\u0645 \u0627\u0644\u0648\u064a\u0646\u062f\u0648\u0632 10 \u062b\u0645 \u0627\u0644\u0648\u064a\u0646\u062f\u0648\u0632 11 \u0648\u062d\u062a\u0649 Windows Server 2022. \u0645\u0646 \u062e\u0644\u0627\u0644\u0647\u0627 \u064a\u0633\u062a\u0637\u064a\u0639 \u0627\u0644\u0647\u0627\u0643\u0631 \u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0639\u0644\u0649 \u0627\u0644\u0646\u0638\u0627\u0645\u060c \u0645\u0645\u0627 \u064a\u062e\u0648\u0644 \u0644\u0647 \u0628\u0646\u0634\u0631 \u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0645\u062e\u062a\u0644\u0641\u0629 \u064a\u0633\u062a\u0637\u064a\u0639 \u0645\u0646 \u062e\u0644\u0627\u0644\u0647\u0627 \u0627\u062e\u062a\u0631\u0627\u0642 \u0627\u0644\u0646\u0638\u0627\u0645.\n\u0627\u0639\u062a\u0642\u062f\u062a \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u0646\u0647\u0627 \u0623\u063a\u0644\u0642\u062a \u0627\u0644\u062b\u063a\u0631\u0629 \u0641\u064a \u0627\u0644\u0623\u064a\u0627\u0645 \u0627\u0644\u0645\u0627\u0636\u064a\u0629 \u0644\u0643\u0646\u0647\u0627 \u0643\u0627\u0646\u062a \u0644\u0627\u0632\u0627\u0644\u062a \u0645\u062a\u0627\u062d\u0629\u060c \u0644\u062a\u0639\u0644\u0646 \u0628\u0634\u0643\u0644 \u0645\u062a\u0623\u062e\u0631 \u0628\u0639\u062f \u0623\u0646 \u062a\u0641\u0634\u062a \u0628\u064a\u0646 \u0627\u0644\u0647\u0627\u0643\u0631\u0632\u060c \u0623\u0646\u0647\u0627 \u0623\u0635\u062f\u0631\u062a \u062a\u0631\u0642\u064a\u0639 \u0644\u0647\u0627 \u0643\u0641\u064a\u0644 \u0628\u063a\u0644\u0642\u0647\u0627. \n\n#My_pride_is_crazy", "creation_timestamp": "2021-11-28T13:01:35.000000Z"}, {"uuid": "b4ac437f-56b3-4d14-af61-ccc5658b9a17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "Telegram/Ftgw2JaC2Dq3yDjI-25ExUld5s60Y_gwvC5Rd9jZkoOn9sGU", "content": "", "creation_timestamp": "2025-02-06T02:42:28.000000Z"}, {"uuid": "c8f9d91e-fca7-44b7-b10e-d33e7b739291", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "Telegram/qH59CHDUaMCXB435BLTk3HxXMs5E7JfF8snYJwbDqHXI88Jj", "content": "", "creation_timestamp": "2025-02-06T02:41:38.000000Z"}, {"uuid": "2f0bedc4-de08-4845-868f-3e7728f3aa8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "Telegram/QB3HdCEtTV6ptfasK4uIqW7tM6aPczoU3zYH7ExTyDZZ6CRc", "content": "", "creation_timestamp": "2021-11-29T22:16:47.000000Z"}, {"uuid": "a28c2b81-c8aa-4b26-9f51-21d973db453e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/breachdetector/185713", "content": "{\n  \"Source\": \"https://spy.gen.tr/forum/\",\n  \"Content\": \"Windows Installer Elevation of Privilege Exploit |CVE-2021-41379| Zero-day | POC LPE |\", \n  \"author\": \" (MrSynox)\",\n  \"Detection Date\": \"21 Jan 2023\",\n  \"Type\": \"Data leak\"\n}\n\ud83d\udd39 t.me/breachdetector \ud83d\udd39", "creation_timestamp": "2023-01-21T03:19:31.000000Z"}, {"uuid": "59497375-4025-49e0-83cf-eff812141670", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/464", "content": "Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability CVE-2021-22053\nhttps://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053\n\nBypass CVE-2021-41379 patch in Windows 11 and Server 2022 with November 2021\nhttps://github.com/klinix5/InstallerFileTakeOver", "creation_timestamp": "2021-11-22T09:30:27.000000Z"}, {"uuid": "c3ecd6af-c321-428f-9ed2-a8a82aece418", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/hack77z99/9308", "content": "\u0628\u0639\u062f \u0623\u0646 \u062a\u0641\u0634\u062a \u062b\u063a\u0631\u0629 \u062e\u0637\u064a\u0631\u0629 \u0628\u064a\u0646 \u0627\u0644\u0647\u0627\u0643\u0631\u0632 ... \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u062e\u064a\u0631\u0627 \u062a\u0639\u0644\u0646 \u0639\u0646 \u0625\u063a\u0644\u0627\u0642\u0647\u0627! \n\u0627\u0644\u062b\u063a\u0631\u0629 ( CVE-2021-41379 ) \u062a\u0645 \u0643\u0634\u0641\u0647\u0627 \u0648\u0625\u063a\u0644\u0627\u0642\u0647\u0627 \u0645\u0646 \u0637\u0631\u0641 \u0627\u0644\u0628\u0627\u062d\u062b \u0627\u0644\u0627\u0645\u0646\u064a \"\u0639\u0628\u062f \u0627\u0644\u062d\u0645\u064a\u062f \u0646\u0627\u0635\u0631\u064a\" \u060c \u0648\u0647\u064a \u062b\u063a\u0631\u0629 \u062a\u0635\u064a\u0628 \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a \u0627\u0644\u0623\u062e\u064a\u0631\u0629 \u0645\u0646 \u0646\u0638\u0627\u0645 \u0627\u0644\u0648\u064a\u0646\u062f\u0648\u0632 10 \u062b\u0645 \u0627\u0644\u0648\u064a\u0646\u062f\u0648\u0632 11 \u0648\u062d\u062a\u0649 Windows Server 2022. \u0645\u0646 \u062e\u0644\u0627\u0644\u0647\u0627 \u064a\u0633\u062a\u0637\u064a\u0639 \u0627\u0644\u0647\u0627\u0643\u0631 \u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0639\u0644\u0649 \u0627\u0644\u0646\u0638\u0627\u0645\u060c \u0645\u0645\u0627 \u064a\u062e\u0648\u0644 \u0644\u0647 \u0628\u0646\u0634\u0631 \u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0645\u062e\u062a\u0644\u0641\u0629 \u064a\u0633\u062a\u0637\u064a\u0639 \u0645\u0646 \u062e\u0644\u0627\u0644\u0647\u0627 \u0627\u062e\u062a\u0631\u0627\u0642 \u0627\u0644\u0646\u0638\u0627\u0645.\n\u0627\u0639\u062a\u0642\u062f\u062a \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u0646\u0647\u0627 \u0623\u063a\u0644\u0642\u062a \u0627\u0644\u062b\u063a\u0631\u0629 \u0641\u064a \u0627\u0644\u0623\u064a\u0627\u0645 \u0627\u0644\u0645\u0627\u0636\u064a\u0629 \u0644\u0643\u0646\u0647\u0627 \u0643\u0627\u0646\u062a \u0644\u0627\u0632\u0627\u0644\u062a \u0645\u062a\u0627\u062d\u0629\u060c \u0644\u062a\u0639\u0644\u0646 \u0628\u0634\u0643\u0644 \u0645\u062a\u0623\u062e\u0631 \u0628\u0639\u062f \u0623\u0646 \u062a\u0641\u0634\u062a \u0628\u064a\u0646 \u0627\u0644\u0647\u0627\u0643\u0631\u0632\u060c \u0623\u0646\u0647\u0627 \u0623\u0635\u062f\u0631\u062a \u062a\u0631\u0642\u064a\u0639 \u0644\u0647\u0627 \u0643\u0641\u064a\u0644 \u0628\u063a\u0644\u0642\u0647\u0627. \n\n#My_pride_is_crazy", "creation_timestamp": "2021-11-28T13:01:38.000000Z"}, {"uuid": "3339863e-0023-4ad8-bf96-d6ddfff8a0eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "exploited", "source": "https://t.me/true_secator/2365", "content": "\u200b\u200b\u0415\u0449\u0435 \u0432\u0447\u0435\u0440\u0430 \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438 \u043e 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0435 Microsoft Windows (CVE-2021-41379), \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0443\u044e \u043a\u0430\u043a \u043e\u0431\u0445\u043e\u0434 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e Patch Tuesday, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0443 \u0441\u0430\u043c\u0443\u044e \u0434\u044b\u0440\u0443.\n \n\u0410 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0410\u0431\u0434\u0435\u043b\u044c\u0445\u0430\u043c\u0438\u0434\u043e\u043c \u041d\u0430\u0441\u0435\u0440\u0438 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0445\u0430\u043a\u0435\u0440\u044b \u0443\u0436\u0435 \u0441\u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043e\u0431\u0440\u0430\u0437\u0446\u044b \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b Cisco Talos Security Intelligence & Research Group.\n \n\u0425\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0440\u0430\u0431\u043e\u0442 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432\u0435\u0434\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043a\u043e\u0434\u0430, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0434\u043b\u044f \u0431\u0443\u0434\u0443\u0449\u0438\u0445 \u043f\u043e\u043b\u043d\u043e\u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439.\n \n\u041a\u0430\u043a \u043c\u044b \u0443\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u043b\u0438, \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e \u0435\u0449\u0435 \u0431\u043e\u043b\u0435\u0435 \u043d\u0430\u043a\u0430\u043b\u044f\u0435\u0442 \u0442\u043e, \u0447\u0442\u043e \u043f\u0430\u0442\u0447\u0435\u0439 \u0438\u043b\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0434\u043b\u044f \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443, \u0432 \u0441\u0430\u043c\u043e\u0435 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u044b \u0441\u0442\u0430\u043d\u0435\u043c \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044f\u043c\u0438 \u044d\u0442\u0438\u0445 \u0441\u0430\u043c\u044b\u0445 \u0430\u0442\u0430\u043a.", "creation_timestamp": "2021-11-24T11:11:26.000000Z"}, {"uuid": "26d3a7df-ea56-4644-aa94-7ab9599be963", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/2358", "content": "\u200b\u200b\u041d\u0438\u043a\u0442\u043e \u0434\u0430\u0436\u0435 \u043d\u0435 \u0443\u0434\u0438\u0432\u0438\u043b\u0441\u044f \u0438 \u043d\u0435 \u0441\u043e\u043c\u043d\u0435\u0432\u0430\u043b\u0441\u044f.\n \n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0410\u0431\u0434\u0435\u043b\u044c\u0445\u0430\u043c\u0438\u0434\u0443 \u041d\u0430\u0441\u0435\u0440\u0438 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Windows CVE-2021-41379, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 Microsoft \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Patch Tuesday.\n \n\u0412\u0441\u0435 \u0434\u0435\u043b\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043e\u0431\u0445\u043e\u0434 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u043e\u0442\u0440\u044b\u0432 \u043f\u043e \u0444\u0430\u043a\u0442\u0443 \u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0432\u043e \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Windows, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Windows 10, Windows 11 \u0438 Windows Server 2022. \u0411\u0430\u0433\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u00ab\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435\u00bb \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0435 \u043c\u043e\u0433\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0430 MSI.\n \n\u0420\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0431\u044b\u043b \u043d\u0430 \u0434\u043d\u044f\u0445 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430 GitHub. \u041d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435, \u0441\u043e \u0441\u043b\u043e\u0432 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043c\u0438\u0440 \u0431\u044b \u043d\u0435 \u0443\u0432\u0438\u0434\u0435\u043b InstallerFileTakeOver, \u0435\u0441\u043b\u0438 \u0431\u044b \u043c\u0438\u043a\u0440\u043e\u043c\u044f\u0433\u043a\u0438\u0435 \u043d\u0435 \u044d\u043a\u043e\u043d\u043e\u043c\u0438\u043b\u0438 \u043d\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u043e\u0448\u0438\u0431\u043a\u0438.\n \n\u0414\u0440\u0430\u043c\u0430\u0442\u0438\u0437\u043c\u0430 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0438 \u0442\u043e\u0442 \u0444\u0430\u043a\u0442, \u0447\u0442\u043e \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u0442, \u0430 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u0441\u044f \u0438\u0437-\u0437\u0430 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043b\u044e\u0431\u0430\u044f \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u043d\u0435\u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0430 Windows.\n \n\u041f\u043e\u043a\u0430 \u0436\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043f\u0440\u0438\u0434\u0435\u0442\u0441\u044f \u043e\u0436\u0438\u0434\u0430\u0442\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 Patch Tuesday. \u041d\u043e \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 Microsoft \u043c\u044b \u0431\u044b \u043d\u0435 \u043f\u0438\u0442\u0430\u043b\u0438 \u043e\u0441\u043e\u0431\u044b\u0445 \u043d\u0430\u0434\u0435\u0436\u0434.\n \n\u0423\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u044f\u043c\u043e \u043d\u0430 \u0432\u0438\u0434\u0435\u043e (\u0442\u0435\u0441\u0442 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 Windows 10 21H1 build 19043.1348)", "creation_timestamp": "2021-11-23T11:17:30.000000Z"}, {"uuid": "4da476f7-2249-4f24-9e27-5a94b8f59354", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/NeKaspersky/1484", "content": "\u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442 Microsoft, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u0431\u0434\u0435\u043b\u0438\u043b\u0438 \u043f\u0440\u0435\u043c\u0438\u0435\u0439, \u0440\u0435\u0448\u0438\u043b \u043e\u0442\u043e\u043c\u0441\u0442\u0438\u0442\u044c.\n\n\u041d\u0430 \u0434\u043d\u044f\u0445 \u0438\u0441\u043b\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0410\u0431\u0434\u0435\u043b\u044c\u0445\u0430\u043c\u0438\u0434 \u041d\u0430\u0441\u0435\u0440\u0438, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043e \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Windows, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 Windows 10, Windows 11, Windows Server 2022.\n\n\u0412 \u043d\u043e\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c CVE-2021-41379, \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u041d\u0430\u0441\u0435\u0440\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0432\u044b\u0448\u0430\u043b\u0430 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a \u0412\u0438\u043d\u0434\u044b. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0432 \u043f\u0430\u0442\u0447\u0435, \u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442 \u043d\u0430\u0448\u0435\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u0435\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 \u0438 \u0435\u0449\u0435 \u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0438\u0437-\u0437\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0435\u0435, \u043d\u0430 GitHub \u043f\u043e\u043f\u0430\u043b\u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d\u0430. \n\n\u041a\u0430\u043a \u0436\u0435 \u044d\u0442\u043e \u0432\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442? \u0412\u043e\u0437\u044c\u043c\u0435\u043c \u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0443\u0440\u043e\u0432\u043d\u044f Standard, \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0432\u0435\u0434\u044c \u0432 \u043d\u0435\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u043e\u043c Windows. \u0417\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b InstallerFileTakeOver.exe \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u041d\u0430\u0441\u0435\u0440\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0438\u0437-\u043f\u043e\u0434 \u043d\u0430\u0448\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 Standard. \u0412\u0441\u0435\u0433\u043e \u0437\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u0435\u043a\u0443\u043d\u0434 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430 \u043f\u043e\u0432\u044b\u0448\u0430\u044e\u0442\u0441\u044f \u0434\u043e SYSTEM. \u0412\u043e\u0442 \u0442\u0430\u043a \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u0438 \u043b\u0435\u0433\u043a\u043e.\n\n\u041f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u0447\u0442\u043e-\u0442\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438\u043c\u0438 \u0440\u0443\u043a\u0430\u043c\u0438 \u043d\u0435 \u0441\u0442\u043e\u0438\u0442, \u0432\u0435\u0434\u044c \u043b\u044e\u0431\u0430\u044f \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0430 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u043f\u043e\u043b\u043e\u043c\u043a\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u2014 \u044d\u0442\u043e \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u0435 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043e\u0442 Microsoft, \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0432\u044b\u0439\u0434\u0435\u0442 \u0441 \u043d\u043e\u0432\u044b\u043c\u0438 \u0431\u0440\u0435\u0448\u0430\u043c\u0438 \u0438 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438.", "creation_timestamp": "2021-11-27T14:30:09.000000Z"}, {"uuid": "ada38336-52f8-4da6-a954-9eacadcfedab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1208", "content": "#exploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\n@BlueRedTeam", "creation_timestamp": "2021-11-23T11:43:21.000000Z"}, {"uuid": "221cae43-74b1-45ab-903b-105a14d2d6e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/SecLabNews/11255", "content": "\u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442 \u0440\u0430\u0437\u043e\u0447\u0430\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u0432 Microsoft \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b PoC-\u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0432 \u0421\u0435\u0442\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 ( CVE-2021-41379 ) \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0435 Windows, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0434\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Windows 10, Windows 11 \u0438 Windows Server.\n\n\u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443 \u043c\u043e\u0433\u0443\u0442 \u043b\u0435\u0433\u043a\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0436\u0435\u0440\u0442\u0432\u044b.\n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u041d\u0430\u0441\u0435\u0440\u0438, \u043e\u043d \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0437-\u0437\u0430 \u0443\u043c\u0435\u043d\u044c\u0448\u0435\u043d\u0438\u044f \u0432\u044b\u043f\u043b\u0430\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Microsoft \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n https://www.securitylab.ru/news/526797.php", "creation_timestamp": "2022-03-11T19:56:14.000000Z"}, {"uuid": "5a704b3c-8653-4a21-bdf1-3e73770a5cdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "exploited", "source": "https://t.me/S_E_Reborn/1392", "content": "\u200b\u200b\u0415\u0449\u0435 \u0432\u0447\u0435\u0440\u0430 \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438 \u043e 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0435 Microsoft Windows (CVE-2021-41379), \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0443\u044e \u043a\u0430\u043a \u043e\u0431\u0445\u043e\u0434 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e Patch Tuesday, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0443 \u0441\u0430\u043c\u0443\u044e \u0434\u044b\u0440\u0443.\n \n\u0410 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0410\u0431\u0434\u0435\u043b\u044c\u0445\u0430\u043c\u0438\u0434\u043e\u043c \u041d\u0430\u0441\u0435\u0440\u0438 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0445\u0430\u043a\u0435\u0440\u044b \u0443\u0436\u0435 \u0441\u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043e\u0431\u0440\u0430\u0437\u0446\u044b \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b Cisco Talos Security Intelligence & Research Group.\n \n\u0425\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0440\u0430\u0431\u043e\u0442 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432\u0435\u0434\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043a\u043e\u0434\u0430, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0434\u043b\u044f \u0431\u0443\u0434\u0443\u0449\u0438\u0445 \u043f\u043e\u043b\u043d\u043e\u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439.\n \n\u041a\u0430\u043a \u043c\u044b \u0443\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u043b\u0438, \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e \u0435\u0449\u0435 \u0431\u043e\u043b\u0435\u0435 \u043d\u0430\u043a\u0430\u043b\u044f\u0435\u0442 \u0442\u043e, \u0447\u0442\u043e \u043f\u0430\u0442\u0447\u0435\u0439 \u0438\u043b\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0434\u043b\u044f \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u0442. \u041f\u043e\u044d\u0442\u043e\u043c\u0443, \u0432 \u0441\u0430\u043c\u043e\u0435 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u044b \u0441\u0442\u0430\u043d\u0435\u043c \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044f\u043c\u0438 \u044d\u0442\u0438\u0445 \u0441\u0430\u043c\u044b\u0445 \u0430\u0442\u0430\u043a.", "creation_timestamp": "2021-11-24T12:38:31.000000Z"}, {"uuid": "2d20093d-5204-4423-963e-8101fdf2c620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4813", "content": "#exploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver", "creation_timestamp": "2021-11-23T11:01:25.000000Z"}, {"uuid": "ddde80ab-a25d-49d1-9c81-f2f447988268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4889", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Nov 1-30)\nCVE-2021-22205 - GitLab CE/EE RCE\nhttps://t.me/cybersecuritytechnologies/4602\nCVE-2021-30883 - iOS IOMFB Vuln\nhttps://t.me/cybersecuritytechnologies/4497\nCVE-2021-3064 - Memory Corruption in PAN-OS GlobalProtect Portal/Gateway Interfaces\nhttps://t.me/cybersecuritytechnologies/4724\nCVE-2021-41379 - Windows Installer LPE\nhttps://t.me/cybersecuritytechnologies/4813\nCVE-2021-42321 - MS Exchange Post-Auth RCE\nhttps://t.me/cybersecuritytechnologies/4809\nCVE-2021-40539 - Zoho ManageEngine Auth. Bypass\nhttps://t.me/cybersecuritytechnologies/4718\nCVE-2021-41277 - MetaBase Arbitrary File Read\nhttps://t.me/cybersecuritytechnologies/4802\nCVE-2021-43267 - Remote Kernel Heap Overflow in TIPC\nhttps://t.me/cybersecuritytechnologies/4678\nCVE-2021-42574 - Unicode Bidirectional override vuln\nhttps://github.com/js-on/CVE-2021-42574\nhttps://github.com/pierDipi/unicode-control-characters-action\nCVE-2021-24084 - Windows MDM LPE\nhttps://t.me/cybersecuritytechnologies/4850", "creation_timestamp": "2021-12-03T11:00:35.000000Z"}, {"uuid": "73ea0452-32eb-46d8-966a-ad9c901bf457", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d91de3af-8937-495f-b1a8-78e777fa3269", "content": "", "creation_timestamp": "2026-06-19T12:47:36.885627Z"}, {"uuid": "c076ba1c-43db-48c9-bb7c-cbb085a62e0b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ac1aa63d-9220-412c-85d6-1ab6bd583ce7", "content": "", "creation_timestamp": "2026-06-23T14:05:05.589547Z"}, {"uuid": "d5edf030-a94b-418d-beea-9b4b54b7daee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/Positive_Technologies/346", "content": "MaxPatrol VM \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 Microsoft Windows\n\n\ud83d\udea8 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430 Microsoft \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-41379. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043d\u0430 \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Microsoft Windows, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Windows 10, Windows 11 \u0438 Windows Server 2022. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0442\u0430\u043a, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0435 \u043c\u043e\u0433\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0430 MSI.\n\n\u26a0 \u0412\u0430\u0436\u043d\u043e! \u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432\u044b\u043b\u043e\u0436\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\n\ud83d\udee1 \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 MaxPatrol VM \u0438 MaxPatrol 8 \u0441\u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u0433\u0440\u043e\u0437\u0443 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u043e\u043c, \u043a\u0430\u043a\u0438\u0435 \u0443\u0437\u043b\u044b \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n#Positive\u041f\u0440\u043e\u0434\u0443\u043a\u0442\u044b #security #cybersecurity", "creation_timestamp": "2026-07-17T05:00:09.503176Z"}, {"uuid": "22d223d8-5963-4aa1-8e26-c3eadd4ff3b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/Positive_Technologies/346", "content": "MaxPatrol VM \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 Microsoft Windows\n\n\ud83d\udea8 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430 Microsoft \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-41379. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043d\u0430 \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Microsoft Windows, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Windows 10, Windows 11 \u0438 Windows Server 2022. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0433\u0440\u0443\u043f\u043f\u043e\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0442\u0430\u043a, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0435 \u043c\u043e\u0433\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0430 MSI.\n\n\u26a0 \u0412\u0430\u0436\u043d\u043e! \u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0432\u044b\u043b\u043e\u0436\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\n\ud83d\udee1 \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 MaxPatrol VM \u0438 MaxPatrol 8 \u0441\u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0443\u0433\u0440\u043e\u0437\u0443 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u043e\u043c, \u043a\u0430\u043a\u0438\u0435 \u0443\u0437\u043b\u044b \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n#Positive\u041f\u0440\u043e\u0434\u0443\u043a\u0442\u044b #security #cybersecurity", "creation_timestamp": "2026-07-18T00:00:34.012646Z"}, {"uuid": "ce4a57ae-5682-47b3-829e-e8ef01d58556", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/cissp/4879", "content": "Offensive_security\nSecurity Testing and Enumeration of WebSockets\nhttps://github.com/PalindromeLabs/STEWS#installation--usage\n\nexploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nThreat_Research\n1. Unauthenticated RCE against CommVault Command Center\nhttps://srcincite.io/blog/2021/11/22/unlocking-the-vault.html\n]-> PoC: https://srcincite.io/pocs/cve-2021-%7B34993,34996%7D.py.txt\n2. A review of Microsoft Azure Sphere vulnerabilities\nhttps://blog.talosintelligence.com/2021/11/a-review-of-azure-sphere.html?m=1\n3. Exploiting the Qualcomm NPU (neural processing unit) kernel driver (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)\nhttps://securitylab.github.com/research/qualcomm_npu\n\n_security\nPicky PPID Spoofing\nhttps://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html\n\nexploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2026-09-01T17:00:34.760916Z"}, {"uuid": "93fe21eb-1002-444e-a68c-3067b4e5eb0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/hacking_Attack/32400", "content": "Black Hat Ethical Hacking\nNew Windows zero-day with public exploit lets you become an admin\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Windows zero-day with public exploit lets you become an adminPost Views: 404 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF-1.gif \nReading Time: 1 Minute\nA security researcher has publicly disclosed an exploit for a new Windows zero-day local privilege elevation vulnerability that gives admin privileges in Windows 10, Windows 11, and Windows Server.\nBleepingComputer has tested the exploit and used it to open to command prompt with SYSTEM privileges from an account with only low-level \u2018Standard\u2019 privileges.\n\nUsing this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network.\n\nThe vulnerability affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server 2022. Researcher releases bypass to patched vulnerabilityAs part of the November 2021 Patch Tuesday, Microsoft fixed a \u2018Windows Installer Elevation of Privilege Vulnerability\u2019 vulnerability tracked as CVE-2021-41379.\n\nThis vulnerability was discovered by security researcher Abdelhamid Naceri, who found a bypass to the patch and a more powerful new zero-day privilege elevation vulnerability after examining Microsoft\u2019s fix.\n\nYesterday, Naceri published a working proof-of-concept exploit for the new zero-day on GitHub, explaining that it works on all supported versions of Windows.\n\n\u201cThis variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass,\u201d explains Naceri in his writeup.\u00a0\u201cI have chosen to actually drop this variant as it is more powerful than the original one.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nFurthermore, Naceri explained that while it is possible to configure group policies\u00a0to prevent \u2018Standard\u2019 users from performing MSI installer operations, his zero-day bypasses this policy and will work anyway.\n\nBleepingComputer tested Naceri\u2019s \u2018InstallerFileTakeOver\u2019 exploit, and it only took a few seconds to gain SYSTEM privileges from a test account with \u2018Standard\u2019 privileges, as demonstrated in the video below.\nThe\u00a0test was performed on a fully up-to-date Windows 10 21H1 build 19043.1348 install.\n\nWhen BleepingComputer asked Naceri why he publicly disclosed the zero-day vulnerability, we were told he did it out of frustration over Microsoft\u2019s decreasing payouts in their bug bounty program.\n\n\u201cMicrosoft bounties has been trashed since April 2020, I really wouldn\u2019t do that if MSFT didn\u2019t take the decision to downgrade those bounties,\u201d explained Naceri.\nSee Also: Microsoft Exchange servers hacked in internal reply-chain attacks Under Microsoft's new bug bounty program one of my zerodays has gone from being worth $10,000 to $1,000 \ud83d\udc80\n\n\u2014 MalwareTech (@MalwareTechBlog) July 27, 2020\nBE CAREFUL! Microsoft will reduce your bounty at any time! This is a Hyper-V RCE vulnerability be able to trigger from a Guest Machine, but it is just eligible for a $5000.00 bounty award under the Windows Insider Preview Bounty Program. Unfair! @msftsecresponse @msftsecurity pic.twitter.com/sJw3cjsliF\n\n\u2014 rthhh (@rthhh17) November 9, 2021\nBleepingComputer has reached out to Microsoft about the disclosed zero-day and will update the article if we receive a reply.\n\nAs is typical with zero days, Microsoft will likely fix the vulnerability in a future Patch Tuesday update.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools However, Naceri warned that it i[...]", "creation_timestamp": "2026-09-01T20:02:08.709949Z"}, {"uuid": "0f69f71f-5fd0-4ea1-aa97-7a8701af34f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/hacking_Attack/32517", "content": "Black Hat Ethical Hacking\nMalware now trying to exploit new Windows Installer zero-day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Malware now trying to exploit new Windows Installer zero-dayPost Views: 143 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nMalware creators have already started testing a proof-of-concept exploit targeting a new Microsoft Windows Installer zero-day publicly disclosed by security researcher Abdelhamid Naceri over the weekend.\n\u201cTalos has already detected malware samples in the wild that are attempting to take advantage of this vulnerability,\u201d said\u00a0Jaeson Schultz, Technical Leader for Cisco\u2019s Talos Security Intelligence & Research Group.\n\nHowever, as Cisco Talos\u2019 Head of Outreach Nick Biasini told BleepingComputer, these exploitation attempts are part of low volume attacks likely focused on testing and tweaking exploits for full-blown campaigns.\n\n\u201cDuring our investigation, we looked at recent malware samples and were able to identify several that were already attempting to leverage the exploit,\u201d Biasini told BleepingComputer.\n\n\u201cSince the volume is low, this is likely people working with the proof of concept code or testing for future campaigns. This is just more evidence on how quickly adversaries work to weaponize a publicly available exploit.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Zero-day bypasses Windows Installer patchThe vulnerability in question is a local privilege elevation bug found as a bypass to a patch Microsoft released during November 2021\u2019s Patch Tuesday to address a flaw tracked as CVE-2021-41379.\n\nOn Sunday, Naceri published a working proof-of-concept exploit\u00a0for this new zero-day, saying it works on all supported versions of Windows.\n\nIf successfully exploited, this bypass gives attackers SYSTEM privileges on up-to-date devices running the latest Windows releases, including Windows 10, Windows 11, and Windows Server 2022.\n\nSYSTEM privileges\u00a0are the highest user\u00a0rights\u00a0available to a Windows user and make it possible to perform any operating system\u00a0command.\n\nBy exploiting this zero-day, attackers with limited access to compromised systems can easily elevate their privileges to help spread laterally within a victim\u2019s network.\nSee Also: New Windows zero-day with public exploit lets you become an admin BleepingComputer has tested Naceri\u2019s exploit and used it to successfully open a command prompt with SYSTEM permissions from an account with low-level \u2018Standard\u2019 privileges.\n\n\u201cThe best workaround available at the time of writing this is to wait Microsoft to release a security patch, due to the complexity of this vulnerability,\u201d explained Naceri.\n\n\u201cAny attempt to patch the binary directly will break windows installer. So you better wait and see how Microsoft will screw the patch again.\u201d\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools \u201cWe are aware of the disclosure and will do what is necessary to keep our customers safe and protected. An attacker using the methods described must already have access and the ability to run code on a target victim\u2019s machine,\u201d\u00a0a Microsoft spokesperson told BleepingComputer when asked for more details regarding this vulnerability.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.808883Z"}, {"uuid": "3e8c847f-3116-49b7-a397-803aad7b1654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/hacking_Attack/32400", "content": "Black Hat Ethical Hacking\nNew Windows zero-day with public exploit lets you become an admin\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Windows zero-day with public exploit lets you become an adminPost Views: 404 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF-1.gif \nReading Time: 1 Minute\nA security researcher has publicly disclosed an exploit for a new Windows zero-day local privilege elevation vulnerability that gives admin privileges in Windows 10, Windows 11, and Windows Server.\nBleepingComputer has tested the exploit and used it to open to command prompt with SYSTEM privileges from an account with only low-level \u2018Standard\u2019 privileges.\n\nUsing this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network.\n\nThe vulnerability affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server 2022. Researcher releases bypass to patched vulnerabilityAs part of the November 2021 Patch Tuesday, Microsoft fixed a \u2018Windows Installer Elevation of Privilege Vulnerability\u2019 vulnerability tracked as CVE-2021-41379.\n\nThis vulnerability was discovered by security researcher Abdelhamid Naceri, who found a bypass to the patch and a more powerful new zero-day privilege elevation vulnerability after examining Microsoft\u2019s fix.\n\nYesterday, Naceri published a working proof-of-concept exploit for the new zero-day on GitHub, explaining that it works on all supported versions of Windows.\n\n\u201cThis variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass,\u201d explains Naceri in his writeup.\u00a0\u201cI have chosen to actually drop this variant as it is more powerful than the original one.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nFurthermore, Naceri explained that while it is possible to configure group policies\u00a0to prevent \u2018Standard\u2019 users from performing MSI installer operations, his zero-day bypasses this policy and will work anyway.\n\nBleepingComputer tested Naceri\u2019s \u2018InstallerFileTakeOver\u2019 exploit, and it only took a few seconds to gain SYSTEM privileges from a test account with \u2018Standard\u2019 privileges, as demonstrated in the video below.\nThe\u00a0test was performed on a fully up-to-date Windows 10 21H1 build 19043.1348 install.\n\nWhen BleepingComputer asked Naceri why he publicly disclosed the zero-day vulnerability, we were told he did it out of frustration over Microsoft\u2019s decreasing payouts in their bug bounty program.\n\n\u201cMicrosoft bounties has been trashed since April 2020, I really wouldn\u2019t do that if MSFT didn\u2019t take the decision to downgrade those bounties,\u201d explained Naceri.\nSee Also: Microsoft Exchange servers hacked in internal reply-chain attacks Under Microsoft's new bug bounty program one of my zerodays has gone from being worth $10,000 to $1,000 \ud83d\udc80\n\n\u2014 MalwareTech (@MalwareTechBlog) July 27, 2020\nBE CAREFUL! Microsoft will reduce your bounty at any time! This is a Hyper-V RCE vulnerability be able to trigger from a Guest Machine, but it is just eligible for a $5000.00 bounty award under the Windows Insider Preview Bounty Program. Unfair! @msftsecresponse @msftsecurity pic.twitter.com/sJw3cjsliF\n\n\u2014 rthhh (@rthhh17) November 9, 2021\nBleepingComputer has reached out to Microsoft about the disclosed zero-day and will update the article if we receive a reply.\n\nAs is typical with zero days, Microsoft will likely fix the vulnerability in a future Patch Tuesday update.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools However, Naceri warned that it i[...]", "creation_timestamp": "2026-09-02T01:02:34.915834Z"}, {"uuid": "9b2e340b-5946-4ed5-8749-44cdfd4aede9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/hacking_Attack/32517", "content": "Black Hat Ethical Hacking\nMalware now trying to exploit new Windows Installer zero-day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Malware now trying to exploit new Windows Installer zero-dayPost Views: 143 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nMalware creators have already started testing a proof-of-concept exploit targeting a new Microsoft Windows Installer zero-day publicly disclosed by security researcher Abdelhamid Naceri over the weekend.\n\u201cTalos has already detected malware samples in the wild that are attempting to take advantage of this vulnerability,\u201d said\u00a0Jaeson Schultz, Technical Leader for Cisco\u2019s Talos Security Intelligence & Research Group.\n\nHowever, as Cisco Talos\u2019 Head of Outreach Nick Biasini told BleepingComputer, these exploitation attempts are part of low volume attacks likely focused on testing and tweaking exploits for full-blown campaigns.\n\n\u201cDuring our investigation, we looked at recent malware samples and were able to identify several that were already attempting to leverage the exploit,\u201d Biasini told BleepingComputer.\n\n\u201cSince the volume is low, this is likely people working with the proof of concept code or testing for future campaigns. This is just more evidence on how quickly adversaries work to weaponize a publicly available exploit.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Zero-day bypasses Windows Installer patchThe vulnerability in question is a local privilege elevation bug found as a bypass to a patch Microsoft released during November 2021\u2019s Patch Tuesday to address a flaw tracked as CVE-2021-41379.\n\nOn Sunday, Naceri published a working proof-of-concept exploit\u00a0for this new zero-day, saying it works on all supported versions of Windows.\n\nIf successfully exploited, this bypass gives attackers SYSTEM privileges on up-to-date devices running the latest Windows releases, including Windows 10, Windows 11, and Windows Server 2022.\n\nSYSTEM privileges\u00a0are the highest user\u00a0rights\u00a0available to a Windows user and make it possible to perform any operating system\u00a0command.\n\nBy exploiting this zero-day, attackers with limited access to compromised systems can easily elevate their privileges to help spread laterally within a victim\u2019s network.\nSee Also: New Windows zero-day with public exploit lets you become an admin BleepingComputer has tested Naceri\u2019s exploit and used it to successfully open a command prompt with SYSTEM permissions from an account with low-level \u2018Standard\u2019 privileges.\n\n\u201cThe best workaround available at the time of writing this is to wait Microsoft to release a security patch, due to the complexity of this vulnerability,\u201d explained Naceri.\n\n\u201cAny attempt to patch the binary directly will break windows installer. So you better wait and see how Microsoft will screw the patch again.\u201d\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools \u201cWe are aware of the disclosure and will do what is necessary to keep our customers safe and protected. An attacker using the methods described must already have access and the ability to run code on a target victim\u2019s machine,\u201d\u00a0a Microsoft spokesperson told BleepingComputer when asked for more details regarding this vulnerability.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:34.988650Z"}, {"uuid": "36a6ec05-47f0-4f64-bd4a-23372b7ed6bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "seen", "source": "https://t.me/cissp/4879", "content": "Offensive_security\nSecurity Testing and Enumeration of WebSockets\nhttps://github.com/PalindromeLabs/STEWS#installation--usage\n\nexploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nThreat_Research\n1. Unauthenticated RCE against CommVault Command Center\nhttps://srcincite.io/blog/2021/11/22/unlocking-the-vault.html\n]-> PoC: https://srcincite.io/pocs/cve-2021-%7B34993,34996%7D.py.txt\n2. A review of Microsoft Azure Sphere vulnerabilities\nhttps://blog.talosintelligence.com/2021/11/a-review-of-azure-sphere.html?m=1\n3. Exploiting the Qualcomm NPU (neural processing unit) kernel driver (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)\nhttps://securitylab.github.com/research/qualcomm_npu\n\n_security\nPicky PPID Spoofing\nhttps://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html\n\nexploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2026-09-02T01:04:18.511374Z"}, {"uuid": "63f5a07f-24ab-4001-a44e-6c40effd8092", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "exploited", "source": "https://t.me/hacking_Attack/32517", "content": "Black Hat Ethical Hacking\nMalware now trying to exploit new Windows Installer zero-day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Malware now trying to exploit new Windows Installer zero-dayPost Views: 143 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nMalware creators have already started testing a proof-of-concept exploit targeting a new Microsoft Windows Installer zero-day publicly disclosed by security researcher Abdelhamid Naceri over the weekend.\n\u201cTalos has already detected malware samples in the wild that are attempting to take advantage of this vulnerability,\u201d said\u00a0Jaeson Schultz, Technical Leader for Cisco\u2019s Talos Security Intelligence & Research Group.\n\nHowever, as Cisco Talos\u2019 Head of Outreach Nick Biasini told BleepingComputer, these exploitation attempts are part of low volume attacks likely focused on testing and tweaking exploits for full-blown campaigns.\n\n\u201cDuring our investigation, we looked at recent malware samples and were able to identify several that were already attempting to leverage the exploit,\u201d Biasini told BleepingComputer.\n\n\u201cSince the volume is low, this is likely people working with the proof of concept code or testing for future campaigns. This is just more evidence on how quickly adversaries work to weaponize a publicly available exploit.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Zero-day bypasses Windows Installer patchThe vulnerability in question is a local privilege elevation bug found as a bypass to a patch Microsoft released during November 2021\u2019s Patch Tuesday to address a flaw tracked as CVE-2021-41379.\n\nOn Sunday, Naceri published a working proof-of-concept exploit\u00a0for this new zero-day, saying it works on all supported versions of Windows.\n\nIf successfully exploited, this bypass gives attackers SYSTEM privileges on up-to-date devices running the latest Windows releases, including Windows 10, Windows 11, and Windows Server 2022.\n\nSYSTEM privileges\u00a0are the highest user\u00a0rights\u00a0available to a Windows user and make it possible to perform any operating system\u00a0command.\n\nBy exploiting this zero-day, attackers with limited access to compromised systems can easily elevate their privileges to help spread laterally within a victim\u2019s network.\nSee Also: New Windows zero-day with public exploit lets you become an admin BleepingComputer has tested Naceri\u2019s exploit and used it to successfully open a command prompt with SYSTEM permissions from an account with low-level \u2018Standard\u2019 privileges.\n\n\u201cThe best workaround available at the time of writing this is to wait Microsoft to release a security patch, due to the complexity of this vulnerability,\u201d explained Naceri.\n\n\u201cAny attempt to patch the binary directly will break windows installer. So you better wait and see how Microsoft will screw the patch again.\u201d\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools \u201cWe are aware of the disclosure and will do what is necessary to keep our customers safe and protected. An attacker using the methods described must already have access and the ability to run code on a target victim\u2019s machine,\u201d\u00a0a Microsoft spokesperson told BleepingComputer when asked for more details regarding this vulnerability.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T04:00:03.980660Z"}, {"uuid": "e66b16d0-0856-4cc2-b363-cbdb2a1bb262", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32400", "content": "Black Hat Ethical Hacking\nNew Windows zero-day with public exploit lets you become an admin\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Windows zero-day with public exploit lets you become an adminPost Views: 404 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF-1.gif \nReading Time: 1 Minute\nA security researcher has publicly disclosed an exploit for a new Windows zero-day local privilege elevation vulnerability that gives admin privileges in Windows 10, Windows 11, and Windows Server.\nBleepingComputer has tested the exploit and used it to open to command prompt with SYSTEM privileges from an account with only low-level \u2018Standard\u2019 privileges.\n\nUsing this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network.\n\nThe vulnerability affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server 2022. Researcher releases bypass to patched vulnerabilityAs part of the November 2021 Patch Tuesday, Microsoft fixed a \u2018Windows Installer Elevation of Privilege Vulnerability\u2019 vulnerability tracked as CVE-2021-41379.\n\nThis vulnerability was discovered by security researcher Abdelhamid Naceri, who found a bypass to the patch and a more powerful new zero-day privilege elevation vulnerability after examining Microsoft\u2019s fix.\n\nYesterday, Naceri published a working proof-of-concept exploit for the new zero-day on GitHub, explaining that it works on all supported versions of Windows.\n\n\u201cThis variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass,\u201d explains Naceri in his writeup.\u00a0\u201cI have chosen to actually drop this variant as it is more powerful than the original one.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nFurthermore, Naceri explained that while it is possible to configure group policies\u00a0to prevent \u2018Standard\u2019 users from performing MSI installer operations, his zero-day bypasses this policy and will work anyway.\n\nBleepingComputer tested Naceri\u2019s \u2018InstallerFileTakeOver\u2019 exploit, and it only took a few seconds to gain SYSTEM privileges from a test account with \u2018Standard\u2019 privileges, as demonstrated in the video below.\nThe\u00a0test was performed on a fully up-to-date Windows 10 21H1 build 19043.1348 install.\n\nWhen BleepingComputer asked Naceri why he publicly disclosed the zero-day vulnerability, we were told he did it out of frustration over Microsoft\u2019s decreasing payouts in their bug bounty program.\n\n\u201cMicrosoft bounties has been trashed since April 2020, I really wouldn\u2019t do that if MSFT didn\u2019t take the decision to downgrade those bounties,\u201d explained Naceri.\nSee Also: Microsoft Exchange servers hacked in internal reply-chain attacks Under Microsoft's new bug bounty program one of my zerodays has gone from being worth $10,000 to $1,000 \ud83d\udc80\n\n\u2014 MalwareTech (@MalwareTechBlog) July 27, 2020\nBE CAREFUL! Microsoft will reduce your bounty at any time! This is a Hyper-V RCE vulnerability be able to trigger from a Guest Machine, but it is just eligible for a $5000.00 bounty award under the Windows Insider Preview Bounty Program. Unfair! @msftsecresponse @msftsecurity pic.twitter.com/sJw3cjsliF\n\n\u2014 rthhh (@rthhh17) November 9, 2021\nBleepingComputer has reached out to Microsoft about the disclosed zero-day and will update the article if we receive a reply.\n\nAs is typical with zero days, Microsoft will likely fix the vulnerability in a future Patch Tuesday update.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools However, Naceri warned that it i[...]", "creation_timestamp": "2026-09-07T04:00:04.088278Z"}, {"uuid": "fb4adaf9-4eff-4a0c-81b5-09169fc79427", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "exploited", "source": "https://t.me/hacking_Attack/32517", "content": "Black Hat Ethical Hacking\nMalware now trying to exploit new Windows Installer zero-day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Malware now trying to exploit new Windows Installer zero-dayPost Views: 143 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF2.gif \nReading Time: 1 Minute\nMalware creators have already started testing a proof-of-concept exploit targeting a new Microsoft Windows Installer zero-day publicly disclosed by security researcher Abdelhamid Naceri over the weekend.\n\u201cTalos has already detected malware samples in the wild that are attempting to take advantage of this vulnerability,\u201d said\u00a0Jaeson Schultz, Technical Leader for Cisco\u2019s Talos Security Intelligence & Research Group.\n\nHowever, as Cisco Talos\u2019 Head of Outreach Nick Biasini told BleepingComputer, these exploitation attempts are part of low volume attacks likely focused on testing and tweaking exploits for full-blown campaigns.\n\n\u201cDuring our investigation, we looked at recent malware samples and were able to identify several that were already attempting to leverage the exploit,\u201d Biasini told BleepingComputer.\n\n\u201cSince the volume is low, this is likely people working with the proof of concept code or testing for future campaigns. This is just more evidence on how quickly adversaries work to weaponize a publicly available exploit.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Zero-day bypasses Windows Installer patchThe vulnerability in question is a local privilege elevation bug found as a bypass to a patch Microsoft released during November 2021\u2019s Patch Tuesday to address a flaw tracked as CVE-2021-41379.\n\nOn Sunday, Naceri published a working proof-of-concept exploit\u00a0for this new zero-day, saying it works on all supported versions of Windows.\n\nIf successfully exploited, this bypass gives attackers SYSTEM privileges on up-to-date devices running the latest Windows releases, including Windows 10, Windows 11, and Windows Server 2022.\n\nSYSTEM privileges\u00a0are the highest user\u00a0rights\u00a0available to a Windows user and make it possible to perform any operating system\u00a0command.\n\nBy exploiting this zero-day, attackers with limited access to compromised systems can easily elevate their privileges to help spread laterally within a victim\u2019s network.\nSee Also: New Windows zero-day with public exploit lets you become an admin BleepingComputer has tested Naceri\u2019s exploit and used it to successfully open a command prompt with SYSTEM permissions from an account with low-level \u2018Standard\u2019 privileges.\n\n\u201cThe best workaround available at the time of writing this is to wait Microsoft to release a security patch, due to the complexity of this vulnerability,\u201d explained Naceri.\n\n\u201cAny attempt to patch the binary directly will break windows installer. So you better wait and see how Microsoft will screw the patch again.\u201d\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools \u201cWe are aware of the disclosure and will do what is necessary to keep our customers safe and protected. An attacker using the methods described must already have access and the ability to run code on a target victim\u2019s machine,\u201d\u00a0a Microsoft spokesperson told BleepingComputer when asked for more details regarding this vulnerability.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:01:00.315915Z"}, {"uuid": "49ef5f1a-b705-460e-aaad-4b2d472f1a6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32400", "content": "Black Hat Ethical Hacking\nNew Windows zero-day with public exploit lets you become an admin\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Windows zero-day with public exploit lets you become an adminPost Views: 404 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/BF-1.gif \nReading Time: 1 Minute\nA security researcher has publicly disclosed an exploit for a new Windows zero-day local privilege elevation vulnerability that gives admin privileges in Windows 10, Windows 11, and Windows Server.\nBleepingComputer has tested the exploit and used it to open to command prompt with SYSTEM privileges from an account with only low-level \u2018Standard\u2019 privileges.\n\nUsing this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network.\n\nThe vulnerability affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server 2022. Researcher releases bypass to patched vulnerabilityAs part of the November 2021 Patch Tuesday, Microsoft fixed a \u2018Windows Installer Elevation of Privilege Vulnerability\u2019 vulnerability tracked as CVE-2021-41379.\n\nThis vulnerability was discovered by security researcher Abdelhamid Naceri, who found a bypass to the patch and a more powerful new zero-day privilege elevation vulnerability after examining Microsoft\u2019s fix.\n\nYesterday, Naceri published a working proof-of-concept exploit for the new zero-day on GitHub, explaining that it works on all supported versions of Windows.\n\n\u201cThis variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass,\u201d explains Naceri in his writeup.\u00a0\u201cI have chosen to actually drop this variant as it is more powerful than the original one.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nFurthermore, Naceri explained that while it is possible to configure group policies\u00a0to prevent \u2018Standard\u2019 users from performing MSI installer operations, his zero-day bypasses this policy and will work anyway.\n\nBleepingComputer tested Naceri\u2019s \u2018InstallerFileTakeOver\u2019 exploit, and it only took a few seconds to gain SYSTEM privileges from a test account with \u2018Standard\u2019 privileges, as demonstrated in the video below.\nThe\u00a0test was performed on a fully up-to-date Windows 10 21H1 build 19043.1348 install.\n\nWhen BleepingComputer asked Naceri why he publicly disclosed the zero-day vulnerability, we were told he did it out of frustration over Microsoft\u2019s decreasing payouts in their bug bounty program.\n\n\u201cMicrosoft bounties has been trashed since April 2020, I really wouldn\u2019t do that if MSFT didn\u2019t take the decision to downgrade those bounties,\u201d explained Naceri.\nSee Also: Microsoft Exchange servers hacked in internal reply-chain attacks Under Microsoft's new bug bounty program one of my zerodays has gone from being worth $10,000 to $1,000 \ud83d\udc80\n\n\u2014 MalwareTech (@MalwareTechBlog) July 27, 2020\nBE CAREFUL! Microsoft will reduce your bounty at any time! This is a Hyper-V RCE vulnerability be able to trigger from a Guest Machine, but it is just eligible for a $5000.00 bounty award under the Windows Insider Preview Bounty Program. Unfair! @msftsecresponse @msftsecurity pic.twitter.com/sJw3cjsliF\n\n\u2014 rthhh (@rthhh17) November 9, 2021\nBleepingComputer has reached out to Microsoft about the disclosed zero-day and will update the article if we receive a reply.\n\nAs is typical with zero days, Microsoft will likely fix the vulnerability in a future Patch Tuesday update.\nSee Also: Offensive Security Tools: Awesome Bug Bounty Tools However, Naceri warned that it i[...]", "creation_timestamp": "2026-09-08T00:01:00.435289Z"}, {"uuid": "e6bc626f-67d8-4dda-971a-65d394e4bee2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4879", "content": "Offensive_security\nSecurity Testing and Enumeration of WebSockets\nhttps://github.com/PalindromeLabs/STEWS#installation--usage\n\nexploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nThreat_Research\n1. Unauthenticated RCE against CommVault Command Center\nhttps://srcincite.io/blog/2021/11/22/unlocking-the-vault.html\n]-> PoC: https://srcincite.io/pocs/cve-2021-%7B34993,34996%7D.py.txt\n2. A review of Microsoft Azure Sphere vulnerabilities\nhttps://blog.talosintelligence.com/2021/11/a-review-of-azure-sphere.html?m=1\n3. Exploiting the Qualcomm NPU (neural processing unit) kernel driver (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)\nhttps://securitylab.github.com/research/qualcomm_npu\n\n_security\nPicky PPID Spoofing\nhttps://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html\n\nexploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2026-09-10T14:00:06.065724Z"}, {"uuid": "0d1b5e1f-1c84-47e9-a724-e9b097caf573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41379", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4879", "content": "Offensive_security\nSecurity Testing and Enumeration of WebSockets\nhttps://github.com/PalindromeLabs/STEWS#installation--usage\n\nexploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nThreat_Research\n1. Unauthenticated RCE against CommVault Command Center\nhttps://srcincite.io/blog/2021/11/22/unlocking-the-vault.html\n]-> PoC: https://srcincite.io/pocs/cve-2021-%7B34993,34996%7D.py.txt\n2. A review of Microsoft Azure Sphere vulnerabilities\nhttps://blog.talosintelligence.com/2021/11/a-review-of-azure-sphere.html?m=1\n3. Exploiting the Qualcomm NPU (neural processing unit) kernel driver (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)\nhttps://securitylab.github.com/research/qualcomm_npu\n\n_security\nPicky PPID Spoofing\nhttps://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html\n\nexploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2026-09-11T00:00:36.980675Z"}]}