{"metadata": {"vulnerability": "CVE-2025-8355", "count": 41, "kinds": {"milestone": 5, "sighting": 24, "kev": 0, "other": 12}}, "data": [{"timestamp": "2025-07-30T13:54:04.373Z", "date_only": false, "value": "2025-07-30T13:54:04.373Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-8355", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0262", "record": "NCSC-2025-0262", "field": "document.tracking.generator.date"}, {"timestamp": "2025-08-08T15:27:00Z", "date_only": false, "value": "2025-08-08T15:27:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Xerox", "record": "CVE-2025-8355", "field": "containers.cna.datePublic"}, {"timestamp": "2025-08-08T15:31:44.554Z", "date_only": false, "value": "2025-08-08T15:31:44.554Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-8355", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-08-08T15:43:07.165Z", "date_only": false, "value": "2025-08-08T15:43:07.165Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Xerox", "record": "CVE-2025-8355", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-08-08T16:02:33.856Z", "date_only": false, "value": "2025-08-08T16:02:33.856898Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-8355", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-08-08T16:02:33.856Z", "date_only": false, "value": "2025-08-08T16:02:33.856898Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-8355", "record": "FKIE_CVE-2025-8355", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-08-08T16:02:42.866Z", "date_only": false, "value": "2025-08-08T16:02:42.866Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-8355", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-08-08T16:02:42.866Z", "date_only": false, "value": "2025-08-08T16:02:42.866Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-8355", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-08-08T16:15:27Z", "date_only": false, "value": "2025-08-08T16:15:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6C2V-98PF-9VGR", "record": "GHSA-6C2V-98PF-9VGR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-08-08T16:15:27.917Z", "date_only": false, "value": "2025-08-08T16:15:27.917", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-8355", "record": "FKIE_CVE-2025-8355", "field": "published"}, {"timestamp": "2025-08-08T18:32:22Z", "date_only": false, "value": "2025-08-08T18:32:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6C2V-98PF-9VGR", "record": "GHSA-6C2V-98PF-9VGR", "field": "published"}, {"timestamp": "2025-08-08T18:32:22Z", "date_only": false, "value": "2025-08-08T18:32:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6C2V-98PF-9VGR", "record": "GHSA-6C2V-98PF-9VGR", "field": "modified"}, {"timestamp": "2025-08-11T11:21:56.556Z", "date_only": false, "value": "2025-08-11T11:21:56.556581Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw4okhoabkr2", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "d1b1f060-d18e-483d-a2fc-e6bd860acdc0", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw4okhoabkr2"}, {"timestamp": "2025-08-11T11:40:37.388Z", "date_only": false, "value": "2025-08-11T11:40:37.388336Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lw4plysvmlm2", "record": "cve-2025-8355", "field": "creation_timestamp", "uuid": "b3522882-11a7-4e34-97db-979add55b9fa", "url": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3lw4plysvmlm2"}, {"timestamp": "2025-08-11T13:26:09.410Z", "date_only": false, "value": "2025-08-11T13:26:09.410443Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/paxioncyber.bsky.social/post/3lw4vil66k22m", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "0f8d45b3-2917-47fb-a259-c96e15b1b39f", "url": "https://bsky.app/profile/paxioncyber.bsky.social/post/3lw4vil66k22m"}, {"timestamp": "2025-08-11T16:18:32.272Z", "date_only": false, "value": "2025-08-11T16:18:32.272493Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3lw5752gqbk2r", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "794a1582-cd36-48ff-af72-bc1877c971ac", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3lw5752gqbk2r"}, {"timestamp": "2025-08-11T19:33:58.330Z", "date_only": false, "value": "2025-08-11T19:33:58.330167Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw5jzxslko42", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "3f90e7b0-2526-4a13-b7a0-1b47aa6a9917", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw5jzxslko42"}, {"timestamp": "2025-08-12T05:41:07.007Z", "date_only": false, "value": "2025-08-12T05:41:07.007255Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw6lxy6l7nc2", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "f8989613-844a-4464-b8b1-e81309456ce5", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw6lxy6l7nc2"}, {"timestamp": "2025-08-12T11:05:46.134Z", "date_only": false, "value": "2025-08-12T11:05:46.134536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw75ythalcp2", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "15add373-3901-48ee-a5ae-f3f6e9d8f7f5", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw75ythalcp2"}, {"timestamp": "2025-08-12T19:01:24.527Z", "date_only": false, "value": "2025-08-12T19:01:24.527567Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw7ylynmne62", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "46f1c42f-0fbd-4944-8a9a-70e9d8833fef", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lw7ylynmne62"}, {"timestamp": "2025-08-12T21:42:12.993Z", "date_only": false, "value": "2025-08-12T21:42:12.993588Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwabdehiqak2", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "2da750a1-3d85-44d4-8429-bd1ff6edfd81", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwabdehiqak2"}, {"timestamp": "2025-08-13T06:41:31.237Z", "date_only": false, "value": "2025-08-13T06:41:31.237981Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwb7sou6oel2", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "86ea92a8-ffb1-4cdc-891b-2c4af6e3ed37", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwb7sou6oel2"}, {"timestamp": "2025-08-13T09:23:52.217Z", "date_only": false, "value": "2025-08-13T09:23:52.217307Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwbis2guw3f2", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "644c2610-282e-4b38-8d62-b82df02d7d38", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwbis2guw3f2"}, {"timestamp": "2025-08-13T12:48:23.193Z", "date_only": false, "value": "2025-08-13T12:48:23.193191Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwbubqy4xi32", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "f9976856-360e-48fb-87e3-50d536201579", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lwbubqy4xi32"}, {"timestamp": "2025-08-13T14:51:30.694Z", "date_only": false, "value": "2025-08-13T14:51:30.694097Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3lwc37fuqrq2e", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "20825f44-7de1-4f6e-b927-31f4087397e0", "url": "https://bsky.app/profile/buherator.bsky.social/post/3lwc37fuqrq2e"}, {"timestamp": "2025-08-14T07:00:50.843Z", "date_only": false, "value": "2025-08-14T07:00:50.843871Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0262", "record": "NCSC-2025-0262", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-08-14T07:00:50.843Z", "date_only": false, "value": "2025-08-14T07:00:50.843871Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0262", "record": "NCSC-2025-0262", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-08-14T07:00:50.843Z", "date_only": false, "value": "2025-08-14T07:00:50.843871Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0262", "record": "NCSC-2025-0262", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-08-17T21:05:13.597Z", "date_only": false, "value": "2025-08-17T21:05:13.597888Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lwmrx6xcns2x", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "3937f4b2-1a28-41ab-a24e-f58094494b58", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lwmrx6xcns2x"}, {"timestamp": "2025-08-18T08:00:01.548Z", "date_only": false, "value": "2025-08-18T08:00:01.548328Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecindustry.bsky.social/post/3lwnwk7v5n52g", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "9ca6d354-4678-470d-a78c-9d9ffe689cf8", "url": "https://bsky.app/profile/infosecindustry.bsky.social/post/3lwnwk7v5n52g"}, {"timestamp": "2025-08-19T02:28:16.209Z", "date_only": false, "value": "2025-08-19T02:28:16.209266Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3lwpuhvmi2s2i", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "269106ef-56cb-43a8-99cb-4294d918e1e6", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3lwpuhvmi2s2i"}, {"timestamp": "2025-08-20T11:13:15Z", "date_only": false, "value": "2025-08-20T11:13:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/15218", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "e52f93fc-450b-4a9e-bcd3-afb185742b30", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 Zoom and Xerox have addressed critical security flaws in Zoom Clients for Windows and FreeFlow Core that could allow privilege escalation and remote code execution.\n\nThe vulnerability impacting Zoom Clients for Windows, tracked as CVE-2025-49457 (CVSS score: 9.6), relates to a case of an untrusted search path that could pave the way for privilege escalation.\n\nOther vulnerabilities:\n\nCVE-2025-8355 (CVSS score: 7.5) - XML External Entity (XXE) injection vulnerability leading to server-side request forgery (SSRF)\n\nCVE-2025-8356 (CVSS score: 9.8) - Path traversal vulnerability leading to remote code execution\n\nhttps://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf\n\nhttps://www.zoom.com/en/trust/security-bulletin/zsb-25030/\n\nhttps://thehackernews.com/2025/08/zoom-and-xerox-release-critical.html", "url": "https://t.me/cKure/15218"}, {"timestamp": "2025-08-20T12:58:31.798Z", "date_only": false, "value": "2025-08-20T12:58:31.798527Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lwti5r2rp22i", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "e038e4b5-a7c9-4cc8-ae07-cb2f0520d097", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lwti5r2rp22i"}, {"timestamp": "2026-04-07T21:00:00Z", "date_only": false, "value": "2026-04-07T21:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://jvn.jp/en/vu/JVNVU90253343/", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "ebf83d03-6253-4631-8b09-e5fd7bf3cb1e", "url": "https://jvn.jp/en/vu/JVNVU90253343/"}, {"timestamp": "2026-06-17T10:06:48.860Z", "date_only": false, "value": "2026-06-17T10:06:48.860", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-8355", "record": "FKIE_CVE-2025-8355", "field": "lastModified"}, {"timestamp": "2026-07-29T12:01:56.930Z", "date_only": false, "value": "2026-07-29T12:01:56.930344Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberdom_business/1383", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "20673cac-654c-4f26-a282-263519583e03", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Zoom \u0438 Xerox: \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\n\nZoom \u0438 Xerox \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0431\u0440\u0435\u0448\u0438 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u2014 \u0431\u0430\u0433\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e.\n\nZoom (CVE-2025-49457, CVSS 9.6)\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439 Offensive Security \u0431\u0430\u0433 \u0441\u0432\u044f\u0437\u0430\u043d \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u043f\u0443\u0442\u0451\u043c \u043f\u043e\u0438\u0441\u043a\u0430 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f Windows. \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u2014 \u044d\u0442\u043e \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0432\u0435\u0440\u0441\u0438\u0438:\n\u27a1\ufe0f Zoom Workplace \u0434\u043e 6.3.10\n\u27a1\ufe0f Zoom Workplace VDI \u0434\u043e 6.3.10 (\u043a\u0440\u043e\u043c\u0435 6.1.16 \u0438 6.2.12)\n\u27a1\ufe0f Zoom Rooms \u0434\u043e 6.3.10\n\u27a1\ufe0f Zoom Rooms Controller \u0434\u043e 6.3.10\n\u27a1\ufe0f Zoom Meeting SDK \u0434\u043e 6.3.10\n\nXerox FreeFlow Core\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\u27a1\ufe0f CVE-2025-8355 (CVSS 7.5) \u2014 XXE-\u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0435 \u043a SSRF\n\u27a1\ufe0f CVE-2025-8356 (CVSS 9.8) \u2014 \u043e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043a\u043e\u0434\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0435 Horizon 3 AI, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0438 \u0431\u0430\u0433\u0438 \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0445\u0438\u0449\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u044f\u0442\u044c\u0441\u044f \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043d\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: The Hackers News\n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438_\u0418\u0411\n\n\ud83c\udfe0 \u041a\u0438\u0431\u0435\u0440\u0434\u043e\u043c\u0430", "url": "https://t.me/cyberdom_business/1383"}, {"timestamp": "2026-08-14T16:00:07.291Z", "date_only": false, "value": "2026-08-14T16:00:07.291322Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/purp_sec/1030", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "f2835a1e-2fa6-4e79-8987-2b193d3dbaed", "content": "\u0412\u043e\u0442 \u044d\u0442\u0438 \u0431\u0430\u0433\u0438, \u043a\u0441\u0442\u0430\u0442\u0438, \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0432 \u0441\u0432\u044f\u0437\u043a\u0443 \u0434\u043b\u044f RCE-\u0430\u0442\u0430\u043a: \u0441\u043d\u0430\u0447\u0430\u043b\u0430 XXE \u2014 \u043f\u043e\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c \u2014 \u043f\u043e\u0442\u043e\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u0435\u0431\u0448\u0435\u043b\u043b\u0430 \u0447\u0435\u0440\u0435\u0437 Path Traversal \u2014 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430. \ud83d\ude0f\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u0430\u044f:\n[\u0410\u0442\u0430\u043a\u0435\u0440] \n   \u2193 (XXE payload)\n[\u0421\u0435\u0440\u0432\u0438\u0441 JMF Client \u043d\u0430 4004] \u2014 XXE \u2192 SSRF \n   \u2193 (\u0437\u0430\u043f\u0440\u043e\u0441 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 Path Traversal endpoint)\n[\u041e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432] \u2014 Path Traversal \u2192 \u0412\u0435\u0431\u0448\u0435\u043b\u043b \u0432 webroot\n   \u2193 (HTTP GET)\n[\u0412\u0435\u0431-\u043f\u043e\u0440\u0442\u0430\u043b FreeFlow Core] \u2014 \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0432\u0435\u0431\u0448\u0435\u043b\u043b\u0430 \u2192 RCE\n\n\n\u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c CVE-2025-8355. \u0410\u0442\u0430\u043a\u0443\u0435\u043c JMF Client \u043d\u0430 \u043f\u043e\u0440\u0442\u0443 4004, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0430\u0440\u0441\u0438\u0442 JMF-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML \u0431\u0435\u0437 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 XML External Entities. \u041f\u043e\u0441\u043b\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c XML \u0441  \u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0443\u0449\u043d\u043e\u0441\u0442\u044c\u044e, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 HTTP-\u0441\u0435\u0440\u0432\u0438\u0441 Xerox \u0438\u043b\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c SSRF-\u0434\u043e\u0441\u0442\u0443\u043f. \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u043c\u0443 \u0442\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u0447\u0438\u0442\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 API, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u041f\u043e\u0441\u043b\u0435 \u043d\u0430\u0441\u0442\u0430\u0435\u0442 \u0447\u0435\u0440\u0435\u0434 CVE-2025-8356. \u0424\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u043c JMF-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0441 \u043f\u043e\u043b\u0435\u043c, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u043c \u043f\u0443\u0442\u044c \u0432\u0440\u043e\u0434\u0435 ../../../../webapps/ROOT/shell.jsp, \u0438 \u0432 \u0442\u0435\u043b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u043c \u043a\u043e\u0434 \u0432\u0435\u0431\u0448\u0435\u043b\u043b\u0430. \u0424\u0430\u0439\u043b \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0432\u0435\u0431-\u043a\u0430\u0442\u0430\u043b\u043e\u0433. \u041f\u043e\u0441\u043b\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0435\u0431\u0448\u0435\u043b\u043b\u0430 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0435\u0433\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u043f\u043e\u0440\u0442\u0430\u043b Xerox FreeFlow Core (\u0443 \u043d\u0435\u0433\u043e \u0435\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u043e\u0442\u0434\u0430\u0447\u0438 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432) \u043f\u043e URL \u0432\u0438\u0434\u0430 https://victim.example.com/shell.jsp. \u0412\u0435\u0431\u0448\u0435\u043b\u043b \u0434\u0430\u0441\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u043e\u0434 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0432\u0435\u0431-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430.\n\n#red_team", "url": "https://t.me/purp_sec/1030"}, {"timestamp": "2026-08-14T16:00:09.112Z", "date_only": false, "value": "2026-08-14T16:00:09.112620Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/purp_sec/1029", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "24754944-1cab-4799-83e9-17056258408b", "content": "\ud83d\udd12 \u041a\u043e\u043c\u0430\u043d\u0434\u0430 Horizon3.ai \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Xerox FreeFlow Core\n\n\u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u043b\u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u0421\u043e\u0444\u0442 Horizon3.ai \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u043d\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e XXE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0435\u0433\u043e \u0441\u0440\u0435\u0434\u0435 \u0434\u0430\u0436\u0435 \u043d\u0435 \u0431\u044b\u043b\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e. \u0421\u0438\u0441\u0442\u0435\u043c\u0430 \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 callbacks \u0441 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u043c\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 XXE-\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0435\u0448\u0438\u043b\u0438 \u0433\u043b\u0443\u0431\u0436\u0435 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043d\u044f\u0442\u044c \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u0438 \u0432 \u0438\u0442\u043e\u0433\u0435 \u0432\u044b\u0448\u043b\u0438 \u043d\u0430 Xerox FreeFlow Core \u0438 \u0441\u0435\u0440\u0432\u0438\u0441 JMF Client \u043d\u0430 \u043f\u043e\u0440\u0442\u0443 4004. \n\n\u041f\u0440\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 XML-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043a\u043e\u0434\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 JMF-\u043a\u043e\u043c\u0430\u043d\u0434 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0434\u0432\u0430 \u0431\u0430\u0433\u0430:\n\n\ud83d\udd35 CVE-2025-8355 (XXE Injection) \u2014 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 JMF Client Xerox FreeFlow Core, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0443 4004 \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 JMF, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f XML-\u043f\u0430\u0440\u0441\u0435\u0440, \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0438 \u043d\u0435 \u0444\u0438\u043b\u044c\u0442\u0440\u0443\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 XML External Entities. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XML-\u0437\u0430\u043f\u0440\u043e\u0441 \u0438 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c SSRF-\u0430\u0442\u0430\u043a\u0443, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0438\u043b\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c.\n\n\ud83d\udd35 CVE-2025-8356 (Path Traversal) \u2014 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 JMF-\u043a\u043e\u043c\u0430\u043d\u0434\u0430\u0445 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0441\u0442\u044c \u043f\u0443\u0442\u0438, \u0447\u0442\u043e \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 path traversal. \u0411\u0430\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 FreeFlow Core. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0433 \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0435\u0433\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432 \u043f\u043e\u043b\u043d\u044b\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439.\n\n\ud83d\udd17 \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n#blue_team #Xerox", "url": "https://t.me/purp_sec/1029"}, {"timestamp": "2026-08-15T00:00:14.116Z", "date_only": false, "value": "2026-08-15T00:00:14.116124Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/purp_sec/1029", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "1fa6c723-5302-451b-984e-f41de36cd79f", "content": "\ud83d\udd12 \u041a\u043e\u043c\u0430\u043d\u0434\u0430 Horizon3.ai \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Xerox FreeFlow Core\n\n\u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u043b\u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u0421\u043e\u0444\u0442 Horizon3.ai \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u043d\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e XXE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0435\u0433\u043e \u0441\u0440\u0435\u0434\u0435 \u0434\u0430\u0436\u0435 \u043d\u0435 \u0431\u044b\u043b\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e. \u0421\u0438\u0441\u0442\u0435\u043c\u0430 \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 callbacks \u0441 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u043c\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 XXE-\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0435\u0448\u0438\u043b\u0438 \u0433\u043b\u0443\u0431\u0436\u0435 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043d\u044f\u0442\u044c \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u0438 \u0432 \u0438\u0442\u043e\u0433\u0435 \u0432\u044b\u0448\u043b\u0438 \u043d\u0430 Xerox FreeFlow Core \u0438 \u0441\u0435\u0440\u0432\u0438\u0441 JMF Client \u043d\u0430 \u043f\u043e\u0440\u0442\u0443 4004. \n\n\u041f\u0440\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 XML-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043a\u043e\u0434\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 JMF-\u043a\u043e\u043c\u0430\u043d\u0434 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0434\u0432\u0430 \u0431\u0430\u0433\u0430:\n\n\ud83d\udd35 CVE-2025-8355 (XXE Injection) \u2014 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 JMF Client Xerox FreeFlow Core, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0443 4004 \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 JMF, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f XML-\u043f\u0430\u0440\u0441\u0435\u0440, \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0438 \u043d\u0435 \u0444\u0438\u043b\u044c\u0442\u0440\u0443\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 XML External Entities. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XML-\u0437\u0430\u043f\u0440\u043e\u0441 \u0438 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c SSRF-\u0430\u0442\u0430\u043a\u0443, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0438\u043b\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c.\n\n\ud83d\udd35 CVE-2025-8356 (Path Traversal) \u2014 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 JMF-\u043a\u043e\u043c\u0430\u043d\u0434\u0430\u0445 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0441\u0442\u044c \u043f\u0443\u0442\u0438, \u0447\u0442\u043e \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 path traversal. \u0411\u0430\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 FreeFlow Core. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0433 \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0435\u0433\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432 \u043f\u043e\u043b\u043d\u044b\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439.\n\n\ud83d\udd17 \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n#blue_team #Xerox", "url": "https://t.me/purp_sec/1029"}, {"timestamp": "2026-08-15T00:00:14.240Z", "date_only": false, "value": "2026-08-15T00:00:14.240058Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/purp_sec/1030", "record": "CVE-2025-8355", "field": "creation_timestamp", "uuid": "3586994d-2c0e-42f3-ade3-a928380119c8", "content": "\u0412\u043e\u0442 \u044d\u0442\u0438 \u0431\u0430\u0433\u0438, \u043a\u0441\u0442\u0430\u0442\u0438, \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0432 \u0441\u0432\u044f\u0437\u043a\u0443 \u0434\u043b\u044f RCE-\u0430\u0442\u0430\u043a: \u0441\u043d\u0430\u0447\u0430\u043b\u0430 XXE \u2014 \u043f\u043e\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c \u2014 \u043f\u043e\u0442\u043e\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u0435\u0431\u0448\u0435\u043b\u043b\u0430 \u0447\u0435\u0440\u0435\u0437 Path Traversal \u2014 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430. \ud83d\ude0f\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u0430\u044f:\n[\u0410\u0442\u0430\u043a\u0435\u0440] \n   \u2193 (XXE payload)\n[\u0421\u0435\u0440\u0432\u0438\u0441 JMF Client \u043d\u0430 4004] \u2014 XXE \u2192 SSRF \n   \u2193 (\u0437\u0430\u043f\u0440\u043e\u0441 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 Path Traversal endpoint)\n[\u041e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432] \u2014 Path Traversal \u2192 \u0412\u0435\u0431\u0448\u0435\u043b\u043b \u0432 webroot\n   \u2193 (HTTP GET)\n[\u0412\u0435\u0431-\u043f\u043e\u0440\u0442\u0430\u043b FreeFlow Core] \u2014 \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0432\u0435\u0431\u0448\u0435\u043b\u043b\u0430 \u2192 RCE\n\n\n\u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c CVE-2025-8355. \u0410\u0442\u0430\u043a\u0443\u0435\u043c JMF Client \u043d\u0430 \u043f\u043e\u0440\u0442\u0443 4004, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0430\u0440\u0441\u0438\u0442 JMF-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML \u0431\u0435\u0437 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 XML External Entities. \u041f\u043e\u0441\u043b\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c XML \u0441  \u0438 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0443\u0449\u043d\u043e\u0441\u0442\u044c\u044e, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 HTTP-\u0441\u0435\u0440\u0432\u0438\u0441 Xerox \u0438\u043b\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c SSRF-\u0434\u043e\u0441\u0442\u0443\u043f. \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u043c\u0443 \u0442\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u0447\u0438\u0442\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 API, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u041f\u043e\u0441\u043b\u0435 \u043d\u0430\u0441\u0442\u0430\u0435\u0442 \u0447\u0435\u0440\u0435\u0434 CVE-2025-8356. \u0424\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u043c JMF-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0441 \u043f\u043e\u043b\u0435\u043c, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u043c \u043f\u0443\u0442\u044c \u0432\u0440\u043e\u0434\u0435 ../../../../webapps/ROOT/shell.jsp, \u0438 \u0432 \u0442\u0435\u043b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u043c \u043a\u043e\u0434 \u0432\u0435\u0431\u0448\u0435\u043b\u043b\u0430. \u0424\u0430\u0439\u043b \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0432\u0435\u0431-\u043a\u0430\u0442\u0430\u043b\u043e\u0433. \u041f\u043e\u0441\u043b\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0435\u0431\u0448\u0435\u043b\u043b\u0430 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0435\u0433\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u043f\u043e\u0440\u0442\u0430\u043b Xerox FreeFlow Core (\u0443 \u043d\u0435\u0433\u043e \u0435\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u043e\u0442\u0434\u0430\u0447\u0438 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432) \u043f\u043e URL \u0432\u0438\u0434\u0430 https://victim.example.com/shell.jsp. \u0412\u0435\u0431\u0448\u0435\u043b\u043b \u0434\u0430\u0441\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u043e\u0434 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0432\u0435\u0431-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430.\n\n#red_team", "url": "https://t.me/purp_sec/1030"}]}