{"vulnerability": "cve-2021-3695", "sightings": [{"uuid": "cfaf1cd0-393e-4ae4-95d5-65b2714683c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "2b830802-54cf-4cae-b26c-8241a565f3a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:19.000000Z"}, {"uuid": "31a6447d-252e-4ffd-858e-bfe96ce056d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "MISP/35b42540-d55e-4aed-99e3-be21d39a5a88", "content": "", "creation_timestamp": "2022-07-11T09:22:39.000000Z"}, {"uuid": "3be67e74-042d-4db3-8d58-79bb9a5a7f08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "MISP/fbf7b599-58a8-4c4e-93ec-103e2fa9bf10", "content": "", "creation_timestamp": "2024-11-14T06:10:08.000000Z"}, {"uuid": "50c23fb8-8ef7-4df4-827c-ae3f41eb0018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970971", "content": "", "creation_timestamp": "2024-12-24T20:22:29.504622Z"}, {"uuid": "2ce2b9c6-ba0e-41a2-bbce-4bc3407de6ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:57.000000Z"}, {"uuid": "d594f753-e168-4c29-9d7d-9c0e8112f430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "MISP/35b42540-d55e-4aed-99e3-be21d39a5a88", "content": "", "creation_timestamp": "2025-06-04T13:18:47.000000Z"}, {"uuid": "adac2343-5856-4982-9169-a8f87534fa8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_19/2021", "content": "", "creation_timestamp": "2021-07-01T09:58:27.000000Z"}, {"uuid": "5d1708db-17ee-4dae-97e5-f3b46f4f28b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-36955", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2afe3392-7d47-42f8-b47e-0dc0b5b42a93", "content": "", "creation_timestamp": "2026-02-02T12:28:58.049087Z"}, {"uuid": "c0746443-4610-4972-8e9d-a2856781fe4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/cyberbannews_ir/3937", "content": "\u200d \ud83d\uded1\u0622\u067e\u062f\u06cc\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\u061b \u062e\u062f\u0627\u062d\u0627\u0641\u0638\u06cc \u0628\u0627 \u062a\u0646\u0647\u0627 \u0628\u0627\u0632\u0645\u0627\u0646\u062f\u0647 PrintNightmare\n\n\u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u067e\u062f\u06cc\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u0631\u0648\u0632 \u0635\u0641\u0631 PrintNightmare (\u067e\u0631\u06cc\u0646\u062a \u0646\u0627\u06cc\u062a\u0645\u0631) \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647 \u0633\u0631\u0639\u062a\u060c \u0645\u062c\u0648\u0632 \u062f\u0633\u062a\u0631\u0633\u06cc \u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0645\u0647\u0627\u062c\u0645\u06cc\u0646 \u0628\u0631 \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0647\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0631\u0627 \u0635\u0627\u062f\u0631 \u06a9\u0646\u0646\u062f. \n\n\u0627\u06af\u0631\u0686\u0647 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0648 \u0622\u067e\u062f\u06cc\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc \u0627\u0632 \u0628\u06cc\u0646 \u0628\u0631\u062f\u0646 \u067e\u0631\u06cc\u0646\u062a \u0646\u0627\u06cc\u062a\u0645\u0650\u0631 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f \u0627\u0645\u0627 \u067e\u0633 \u0627\u0632 \u0622\u0646 \u06cc\u06a9 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u06cc\u06af\u0631 \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u06cc\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f \u06a9\u0647 \u0647\u0645\u0686\u0646\u0627\u0646 \u0627\u0645\u06a9\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0628\u0627 \u0627\u062a\u0635\u0627\u0644 \u0628\u0647 \u06cc\u06a9 \u0633\u0631\u0648\u0631 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u067e\u0631\u06cc\u0646\u062a \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u06cc\u0646 \u0645\u0647\u06cc\u0627 \u0645\u06cc \u06a9\u0646\u062f.  \n\n\u0634\u0646\u0627\u0633\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u067e\u0631\u06cc\u0646\u062a \u0646\u0627\u06cc\u062a\u0645\u0631 CVE-2021-36958 \u0645\u06cc \u0628\u0627\u0634\u062f. \u0627\u0645\u0627 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u062f\u0631 \u0622\u067e\u062f\u06cc\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0645\u0631\u0648\u0632 \u062e\u0648\u062f\u060c \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0627\u0635\u0644\u0627\u062d \u06a9\u0631\u062f. \n\n\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0627\u0635\u0644\u0627\u062d \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc\u060c \u0642\u0627\u0628\u0644\u06cc\u062a CopyFiles \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0647 \u0635\u0648\u0631\u062a \u067e\u06cc\u0634 \u0641\u0631\u0636 \u063a\u06cc\u0631 \u0641\u0639\u0627\u0644 \u06a9\u0631\u062f. \u0627\u0644\u0628\u062a\u0647 \u0627\u062f\u0645\u06cc\u0646 \u0647\u0627 \u0627\u06cc\u0646 \u0627\u062c\u0627\u0632\u0647 \u0631\u0627 \u062f\u0627\u0631\u0646\u062f \u062a\u0627 \u062f\u0648\u0628\u0627\u0631\u0647 \u0622\u0646 \u0631\u0627 \u0628\u0631\u0627\u06cc \u062e\u0648\u062f \u0641\u0639\u0627\u0644 \u06a9\u0646\u0646\u062f.\n\n\u06af\u0641\u062a\u0646\u06cc \u0627\u0633\u062a \u0628\u0627 \u0641\u0639\u0627\u0644 \u0633\u0627\u0632\u06cc \u062f\u0648\u0628\u0627\u0631\u0647 \u0627\u06cc\u0646 \u0642\u0627\u0628\u0644\u06cc\u062a\u060c \u0641\u0642\u0637 \u0641\u0627\u06cc\u0644 \u0647\u0627\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0631\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0646 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f. \n\n\u0627\u06cc\u0646 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0628\u0631 \u0631\u0648\u06cc \u0631\u0641\u062a\u0627\u0631 \u067e\u06cc\u0634 \u0641\u0631\u0636 \u0648\u06cc\u0646\u062f\u0648\u0632 \u062a\u0627\u062b\u06cc\u0631 \u06af\u0630\u0627\u0631 \u0628\u0627\u0634\u062f \u0648 \u0645\u0634\u062e\u0635 \u0646\u06cc\u0633\u062a \u0686\u0647 \u0645\u0634\u06a9\u0644\u0627\u062a\u06cc \u062f\u0631 \u062d\u06cc\u0646 \u067e\u0631\u06cc\u0646\u062a \u06a9\u0631\u062f\u0646 \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0628\u0647 \u0648\u062c\u0648\u062f \u062e\u0648\u0627\u0647\u062f \u0622\u0645\u062f.  \n\n\u0622\u067e\u062f\u06cc\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0645\u0631\u0648\u0632 \u0634\u0627\u0645\u0644 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632 \u0635\u0641\u0631 MSHTML \u0648\u06cc\u0646\u062f\u0648\u0632 \u0646\u06cc\u0632 \u0628\u0648\u062f. \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u0630\u06a9\u0648\u0631 \u0628\u0647 \u0635\u0648\u0631\u062a \u0641\u0639\u0627\u0644\u06cc \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u062f\u0627\u0634\u062a. \n\n#\u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\n\n@cyberbannews_ir", "creation_timestamp": "2021-09-15T07:10:31.000000Z"}, {"uuid": "6693816f-9b5b-45f0-820d-70c3494e703c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/BleepingComputer/10305", "content": "Microsoft confirms another Windows print spooler zero-day bug\n\nMicrosoft has issued an advisory for another zero-day Windows print spooler vulnerability tracked as CVE-2021-36958 that allows local attackers to gain SYSTEM privileges on a computer. [...]\n\nhttps://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-another-windows-print-spooler-zero-day-bug/", "creation_timestamp": "2021-08-12T10:25:12.000000Z"}, {"uuid": "950736f1-27ee-46a8-a224-b0195a69a38d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "https://t.me/arpsyndicate/1598", "content": "#ExploitObserverAlert\n\nCVE-2021-36955\n\nDESCRIPTION: Exploit Observer has 5 entries related to CVE-2021-36955. Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36963, CVE-2021-38633.\n\nFIRST-EPSS: 0.005580000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-10T02:09:23.000000Z"}, {"uuid": "f2c30281-c6a6-4321-a5e1-948cbb17f301", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "exploited", "source": "https://t.me/true_secator/2001", "content": "\u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043f\u043e\u043a\u0430 \u0432\u0435\u0441\u044c \u0438\u043d\u0444\u043e\u0441\u0435\u043a \u043f\u043e \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e \u0441 Microsoft \u0432\u044b\u043f\u0438\u043b\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043d\u043e\u0432\u044b\u0435 \u0438 \u043d\u043e\u0432\u044b\u0435 \u0434\u044b\u0440\u044b PrintNightmare (\u0433\u0440\u0443\u043f\u043f\u0430 \u043e\u0448\u0438\u0431\u043e\u043a CVE-2021-1675 , CVE-2021-34527 \u0438 CVE-2021-36958), \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0438\u043c\u0430\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u043e\u0439 \u043e\u043f\u044b\u0442 \u043a\u043e\u043b\u043b\u0435\u0433, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044f \u0432 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Windows.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u044d\u0442\u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (LPE) \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0434\u043e\u043c\u0435\u043d\u0430 Windows \u0447\u0435\u0440\u0435\u0437 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 (RCE) \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 SYSTEM.\n\n\u041d\u0430 \u0434\u043d\u044f\u0445 Crowdstrike \u0443\u043b\u0438\u0447\u0438\u043b\u0438 \u0432 \u044d\u0442\u043e\u043c \u0431\u0430\u043d\u0434\u0443 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 Magniber, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0442\u0435\u043f\u0435\u0440\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b PrintNightmare \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u043d\u0430 \u044e\u0436\u043d\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u0438\u0445 \u0436\u0435\u0440\u0442\u0432. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e, \u0447\u0442\u043e \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435, Magniber \u0443\u0434\u0430\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0443\u0442\u0430\u043d\u043d\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a DLL, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0432\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\nMagniber \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0441 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2017 \u0433\u043e\u0434\u0430, \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0430\u0441\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0442\u0430 Magnitude Exploit Kit (EK) \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0435\u0435\u043c\u043d\u0438\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f Cerber, \u0441\u0435\u0439\u0447\u0430\u0441 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 Magnitude EK \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Internet Explorer \u0441 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u043e\u0439 CVE-2020-0968. \u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u0430 \u043d\u0430 \u042e\u0436\u043d\u0443\u044e \u041a\u043e\u0440\u0435\u044e, \u041a\u0438\u0442\u0430\u0439, \u0422\u0430\u0439\u0432\u0430\u043d\u044c, \u0413\u043e\u043d\u043a\u043e\u043d\u0433, \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440, \u041c\u0430\u043b\u0430\u0439\u0437\u0438\u044e \u0438 \u0434\u0440\u0443\u0433\u0438\u0435. \u0418 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 30 \u0434\u043d\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u0430, \u0442\u0435\u043f\u0435\u0440\u044c \u043f\u043e\u043d\u044f\u0442\u043d\u043e \u043f\u043e\u0447\u0435\u043c\u0443.\n\n\u041a \u0430\u0442\u0430\u043a\u0430\u043c PrintNightmare \u043f\u0440\u0438\u0441\u043e\u0441\u0435\u0434\u0438\u043b\u0438\u0441\u044c \u0438 ransomware Vice Society (\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 HelloKitty), \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0431\u043e\u043a\u043e\u0432\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u044f\u043c \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432. \u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0431\u0430\u043d\u0434\u044b \u043f\u043e\u043f\u0430\u043b\u0430 \u043f\u043e\u0434 \u043f\u0440\u0438\u0446\u0435\u043b Cisco Talos, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0432\u0438\u0434\u0435\u043b\u0438, \u043a\u0430\u043a Vice Society \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u044e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u043e\u043d\u043e\u0432\u043a\u0438 (DLL) \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a CVE-2021-1675 \u0438 CVE-2021-34527.\n\n\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, Vice Society \u0448\u0438\u0444\u0440\u0443\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Windows \u0438 Linux \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e OpenSSL (AES256 + secp256k1 + ECDSA) \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0445 \u0438\u043b\u0438 \u0441\u0440\u0435\u0434\u043d\u0438\u0445 \u0436\u0435\u0440\u0442\u0432, \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443\u0435\u0442 \u0434\u0432\u043e\u0439\u043d\u043e\u0435 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f\u043c. TTP \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u0445 \u043a\u043e\u043f\u0438\u0439 \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u0438 \u043e\u0431\u0445\u043e\u0434 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b Windows \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043a \u043d\u043e\u0432\u0438\u0447\u043a\u0430\u043c \u043b\u0435\u043d\u0442\u044b \u0441\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u0438\u043b\u0438\u0441\u044c \u0438 Conti, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Windows \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0438\u0437\u043b\u044e\u0431\u043b\u0435\u043d\u043d\u043e\u0439  PrintNightmare.\n\n\u0414\u0430 \u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u044d\u0442\u043e\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u0441\u0442\u0440\u043e, \u0440\u0430\u0432\u043d\u043e \u043a\u0430\u043a \u0438 \u0441\u043f\u0438\u0441\u043e\u043a \u0438\u0445 \u0436\u0435\u0440\u0442\u0432. \u0422\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u044f, \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u043d\u0430 \u043b\u0438\u0446\u043e.", "creation_timestamp": "2021-08-13T16:07:13.000000Z"}, {"uuid": "51052c49-b026-432f-ad40-ed5082111593", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "exploited", "source": "https://t.me/true_secator/1997", "content": "\u200b\u200b\u041d\u0435 \u043f\u0440\u043e\u0448\u043b\u043e \u0438 24 \u0447\u0430\u0441\u043e\u0432, \u043a\u0430\u043a \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c, \u0447\u0442\u043e Microsoft \u0432\u043d\u043e\u0432\u044c \u043e\u0431\u043b\u0430\u0436\u0430\u043b\u0438\u0441\u044c.\n\n\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432\u0447\u0435\u0440\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0411\u0435\u043d\u0434\u0436\u0430\u043c\u0438\u043d\u043e\u043c \u0414\u0435\u043b\u043f\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows, \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0432\u0448\u0438\u0441\u044c \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u0435\u0447\u0430\u0442\u0438. \n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b \u043e\u0448\u0438\u0431\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b \u0435\u0439 CVE-2021-36958, \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u0440\u043e\u043b\u043e\u043d\u0433\u0438\u0440\u043e\u0432\u0430\u0432 \u044d\u043f\u043e\u043f\u0435\u044e PrintNightmare.\n\n\u041a\u0430\u043a \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Microsoft \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430, \u043f\u043e\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0432 \u0434\u043b\u044f \u043d\u0435\u0435 \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0442\u0430\u043a\u0438\u0445 \u043f\u0440\u0430\u0432 \u043d\u0435 \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0443, \u0435\u0441\u043b\u0438 \u044d\u0442\u043e\u0442 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d. \u0415\u0441\u043b\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 - \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0443 \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 CopyFile \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0435\u0437 \u043f\u0440\u0430\u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \n\n\u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0431\u0430\u0433\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c DLL \u0414\u0435\u043b\u043f\u0438 \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442 \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0435\u0435, \u0447\u0442\u043e\u0431\u044b \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0443\u0440\u043e\u0432\u043d\u044f SYSTEM.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 SYSTEM, \u0430 \u0437\u0430\u0442\u0435\u043c \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441 \u043f\u043e\u043b\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\nMicrosoft \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0432 \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0432 \u0441\u043b\u0443\u0436\u0431\u0443 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438, \u0438, \u0441\u043b\u0435\u0434\u0443\u044f \u043b\u043e\u0433\u0438\u043a\u0435, \u0432\u043e\u043e\u0431\u0449\u0435 \u043e\u0442\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043e\u0442 \u043f\u0435\u0447\u0430\u0442\u0438 (?).\n\n\u041d\u043e \u0443\u0434\u0438\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u043d\u0435 \u0441\u0442\u043e\u0438\u0442, \u044d\u0442\u043e \u0436\u0435 Microsoft. \u0417\u0430\u0431\u0430\u0432\u043d\u044b\u0439 \u043a\u0432\u0435\u0441\u0442 PrintNightmare \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f.", "creation_timestamp": "2021-08-12T14:09:47.000000Z"}, {"uuid": "cc3a9411-efe1-4fa9-bc0b-607405e5bf09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3695", "type": "seen", "source": "https://t.me/cibsecurity/45684", "content": "\u203c CVE-2021-3695 \u203c\n\nA crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-06T20:14:36.000000Z"}, {"uuid": "50a66e89-d17b-4c8c-be9e-6e4d5b9b7f5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36956", "type": "seen", "source": "https://t.me/cibsecurity/28886", "content": "\u203c CVE-2021-36956 \u203c\n\nAzure Sphere Information Disclosure Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-15T16:22:32.000000Z"}, {"uuid": "331bfc0d-b05c-457f-ab37-83bfb04d6dc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/thehackernews/1435", "content": "Microsoft warns of yet another UNPATCHED Windows Print Spooler vulnerability  (CVE-2021-36958) allowing RCE attacks.\n\nRead: https://thehackernews.com/2021/08/microsoft-security-bulletin-warns-of.html\n\nUsers are advised to stop and disable the Print Spooler service to prevent malicious actors from exploiting the vulnerability.", "creation_timestamp": "2021-08-12T08:24:57.000000Z"}, {"uuid": "e99f0e26-f832-4005-bc63-88eed3bc42e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/xakep_ru/11147", "content": "Microsoft \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043e \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 Print Spooler\n\nMicrosoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Print Spooler (CVE-2021-36958), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435.\n\nhttps://xakep.ru/2021/08/12/one-more-printnightmare/", "creation_timestamp": "2021-08-12T18:04:25.000000Z"}, {"uuid": "a1c21de6-a93b-428b-b5d9-f9e816dc7d63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4203", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-31956 - Win NTFS EoP\nhttps://t.me/cybersecuritytechnologies/4110\nCVE-2021-36958 - Print Spooler RCE\nhttps://mobile.twitter.com/gentilkiwi/status/1416429860566847490?s=20\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nhttps://t.me/cybersecuritytechnologies/4044\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nhttps://t.me/cybersecuritytechnologies/4090\nCVE-2021-20090 - Path traversal in Buffalo routers\nhttps://t.me/cybersecuritytechnologies/3986\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2021-09-02T11:05:07.000000Z"}, {"uuid": "1db79787-21a9-497f-8964-aba645eed1dd", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/672705d9-5db1-4010-bd1c-f181f3f33d52", "content": "", "creation_timestamp": "2026-06-19T12:48:01.309081Z"}, {"uuid": "1563ab70-de3e-40db-ad3e-43e23817179f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7cacc207-c461-4a09-9b96-92047a8d2d56", "content": "", "creation_timestamp": "2026-06-23T14:04:33.083620Z"}, {"uuid": "dd6a0649-ec1c-49ef-ac15-9b8bfef2bda2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "https://t.me/hacking_Attack/23976", "content": "atpost that a trio of local privilege-escalation vulnerabilities in the Windows Common Log File System Driver (CVE-2021-36955, CVE-2021-36963, CVE-2021-38633) are also noteworthy, all of them being listed as \u201cexploitation more likely.\u201d\n\n\u201cLocal priv-esc vulnerabilities are a key component of almost every successful cyberattack, especially for the likes of ransomware operators who abuse this kind of exploit to gain the highest level of access,\u201d Breen said via email. \u201cThis allows them to disable antivirus, delete backups and ensure their encryptors can reach even the most sensitive of files.\u201d\n\nOne glaring example of that emerged in May, when hundreds of millions of Dell users were found to be at risk\u00a0from kernel-privilege bugs. The bugs lurked undisclosed for 12 years, and could have allowed attackers to bypass security products, execute code and pivot to other parts of the network for lateral movement.\n\nThe three exploits Microsoft patched on Tuesday aren\u2019t remote, meaning that attackers need to have achieved code execution by other means. One such way would be via CVE-2021-40444.\n\nTwo other vulnerabilities \u2013 CVE-2021-38639\u00a0and CVE-2021-36975, both Win32k escalation of privilege flaws \u2013 have also been listed as \u201cexploitation more likely\u201d and, together, cover the full range of supported Windows versions.\n\nBreen said that he\u2019s starting to feel like a broken record when it comes to privilege escalation vulnerabilities. They\u2019re not rated as high a severity risk as RCE bugs, but \u201cthese local exploits can be the linchpin in the post-exploitation phases of an experienced attacker,\u201d he asserted. \u201cIf you can block them here you have the potential to significantly limit their damage.\u201d\n\nhe added, \u201cIf we assume a determined attacker will be able to infect a victim\u2019s device through social engineering or other techniques, I would argue that patching priv-esc vulnerabilities is even more important than patching some other remote code-execution vulns,\u201d Breen said. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerStill, This RCE Is Pretty ImportantDanny Kim, a principal architect at Virsec who spent time at Microsoft during his graduate work on the OS security development team, wants security teams to pay attention to CVE-2021-36965\u00a0\u2013 an important-rated Windows WLAN AutoConfig Service RCE vulnerability \u2013 given its combination of severity (with a CVSS:3.0 base score of 8.8); no requirement for privilege escalation/user interaction to exploit; and breadth of affected Windows versions.\n\nThe WLAN AutoConfig Service is part of the mechanism that Windows 10 uses to choose the wireless network a computer will connect to, and to the Windows Scripting Engine, respectively.\n\nThe patch fixes a flaw that could allow network-adjacent attackers to run their code on affected systems at system level.\n\nAs the Zero Day Initiative explained, that means an attacker could \u201ccompletely take over the target \u2013 provided they are on an adjacent network.\u201d That would come in quite handy in a coffee-shop attack, where multiple people use an unsecured Wi-Fi network.\n\nThis one \u201cis especially alarming,\u201d Kim said: Think SolarWinds\u00a0and PrintNightmare.\n\n\u201cAs recent trends have shown, remote code execution-based attacks are the most critical vulnerabilities that can lead to the largest negative impact on an enterprise, as we have seen in the Solarwinds and PrintNightmare attacks,\u201d he said in an email.\n\nKim said that in spite of the exploit code maturity being currently unproven, the vulnerability has been confirmed to exist, leaving an opening for attackers.\n\n\u201cIt specifically relies on the attacker being located in the same network, so it would not be surprising to see this vulnerability used in combination with another CVE/attack to achieve an attacker\u2019s end goal,\u201d he predicted. \u201cRemote code execution attacks can lead to unverified processes running on the server workload, only highlighting the need for constant, deter[...]", "creation_timestamp": "2026-09-01T20:02:23.034766Z"}, {"uuid": "03b6a57f-6ce8-4e40-bb85-bc7e84b2f4f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst7ffarto2m", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-36955: Windows Common Log File System Driver Elevation of Privilege Vulnerability\nCVSS 7.8 \u00b7 EPSS 4.0% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-36955\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T18:07:07.590104Z"}, {"uuid": "3e340500-9780-4829-aa37-290d7c7a1ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-01T17:00:41.714376Z"}, {"uuid": "033d2922-03a3-4798-b4ec-a1ba4c42066e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/hacking_Attack/20095", "content": "Black Hat Ethical Hacking\nMicrosoft Warns: Another Unpatched PrintNightmare Zero-Day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-DayPost Views: 141 \nReading Time: 1 Minute\nOne day after dropping its scheduled August Patch Tuesday update, Microsoft issued a warning about yet another unpatched privilege escalation/remote code-execution (RCE) vulnerability in the Windows Print Spooler.\nThe zero-day bug, tracked as CVE-2021-36958, carries a CVSS vulnerability-severity scale rating of 7.3, meaning that it\u2019s rated as \u201cimportant.\u201d Microsoft said that it allows for a local attack vector requiring user interaction, but that the attack complexity is low, with few privileges required.\n\n\u201cA remote code-execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d the computing giant explained in its Wednesday advisory. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change or delete data; or create new accounts with full user rights.\u201d\n\nThe CERT Coordination Center actually flagged the issue in mid-July, when it warned that a working exploit\u00a0was available. That proof-of-concept (PoC), issued by Benjamin Delpy, comes complete with a video.\nSo apparently @offenseindepth reported this to Microsoft before your public PoC on July 17?\nAnd Microsoft is only just now publishing an out-of-band bulletin on it on August 11?\nhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f914.png pic.twitter.com/8eDHD7tg7A\n\n\u2014 Will Dormann (@wdormann) August 11, 2021\nSee Also: Auth Bypass Bug Exploited, Affecting Millions of Routers On Thursday, CERT/CC issued more details on the issue, explaining that it arises from an oversight in signature requirements around the \u201cPoint and Print\u201d capability, which allows users without administrative privileges to install printer drivers that execute with SYSTEM privileges via the Print Spooler service.\n\nWhile Microsoft requires that printers installable via Point are either signed by a WHQL release signature or by a trusted certificate, Windows printer drivers can specify queue-specific files that are associated with the use of the device, which leaves a loophole for malicious actors.\n\n\u201cFor example, a shared printer can specify a CopyFiles directive for arbitrary files,\u201d according to the CERT/CC advisory. \u201cThese files, which may be copied over alongside the digital-signature-enforced printer driver files, are not covered by any signature requirement. Furthermore, these files can be used to overwrite any of the signature-verified files that were placed on a system during printer driver install. This can allow for local privilege escalation to SYSTEM on a vulnerable system.\u201d\nSee Also: Offensive Security Tool: Mimikatz Microsoft credited Victor Mata of FusionX at Accenture Security with originally reporting the issue, which Mata said occurred back in December 2020:\nHey guys, I reported the vulnerability in Dec'20 but haven't disclosed details at MSRC's request. It looks like they acknowledged it today due to the recent events with print spooler.\n\n\u2014 Victor Mata (@offenseindepth) August 11, 2021\nSo far, Microsoft hasn\u2019t seen any attacks in the wild using the bug, but it noted that exploitation is \u201cmore likely.\u201d With a working exploit in circulation, that seems a fair assessment. Print Spooler-Palooza and the PrintNightmareDelpy characterized this latest zero-day as being part of the string of Print Spooler bugs collectively known as PrintNightmare.\n\nThe bad dream started in early[...]", "creation_timestamp": "2026-09-01T20:02:28.458561Z"}, {"uuid": "bbc3c492-e726-413b-aecb-ea2f066b376c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "https://t.me/hacking_Attack/23976", "content": "atpost that a trio of local privilege-escalation vulnerabilities in the Windows Common Log File System Driver (CVE-2021-36955, CVE-2021-36963, CVE-2021-38633) are also noteworthy, all of them being listed as \u201cexploitation more likely.\u201d\n\n\u201cLocal priv-esc vulnerabilities are a key component of almost every successful cyberattack, especially for the likes of ransomware operators who abuse this kind of exploit to gain the highest level of access,\u201d Breen said via email. \u201cThis allows them to disable antivirus, delete backups and ensure their encryptors can reach even the most sensitive of files.\u201d\n\nOne glaring example of that emerged in May, when hundreds of millions of Dell users were found to be at risk\u00a0from kernel-privilege bugs. The bugs lurked undisclosed for 12 years, and could have allowed attackers to bypass security products, execute code and pivot to other parts of the network for lateral movement.\n\nThe three exploits Microsoft patched on Tuesday aren\u2019t remote, meaning that attackers need to have achieved code execution by other means. One such way would be via CVE-2021-40444.\n\nTwo other vulnerabilities \u2013 CVE-2021-38639\u00a0and CVE-2021-36975, both Win32k escalation of privilege flaws \u2013 have also been listed as \u201cexploitation more likely\u201d and, together, cover the full range of supported Windows versions.\n\nBreen said that he\u2019s starting to feel like a broken record when it comes to privilege escalation vulnerabilities. They\u2019re not rated as high a severity risk as RCE bugs, but \u201cthese local exploits can be the linchpin in the post-exploitation phases of an experienced attacker,\u201d he asserted. \u201cIf you can block them here you have the potential to significantly limit their damage.\u201d\n\nhe added, \u201cIf we assume a determined attacker will be able to infect a victim\u2019s device through social engineering or other techniques, I would argue that patching priv-esc vulnerabilities is even more important than patching some other remote code-execution vulns,\u201d Breen said. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerStill, This RCE Is Pretty ImportantDanny Kim, a principal architect at Virsec who spent time at Microsoft during his graduate work on the OS security development team, wants security teams to pay attention to CVE-2021-36965\u00a0\u2013 an important-rated Windows WLAN AutoConfig Service RCE vulnerability \u2013 given its combination of severity (with a CVSS:3.0 base score of 8.8); no requirement for privilege escalation/user interaction to exploit; and breadth of affected Windows versions.\n\nThe WLAN AutoConfig Service is part of the mechanism that Windows 10 uses to choose the wireless network a computer will connect to, and to the Windows Scripting Engine, respectively.\n\nThe patch fixes a flaw that could allow network-adjacent attackers to run their code on affected systems at system level.\n\nAs the Zero Day Initiative explained, that means an attacker could \u201ccompletely take over the target \u2013 provided they are on an adjacent network.\u201d That would come in quite handy in a coffee-shop attack, where multiple people use an unsecured Wi-Fi network.\n\nThis one \u201cis especially alarming,\u201d Kim said: Think SolarWinds\u00a0and PrintNightmare.\n\n\u201cAs recent trends have shown, remote code execution-based attacks are the most critical vulnerabilities that can lead to the largest negative impact on an enterprise, as we have seen in the Solarwinds and PrintNightmare attacks,\u201d he said in an email.\n\nKim said that in spite of the exploit code maturity being currently unproven, the vulnerability has been confirmed to exist, leaving an opening for attackers.\n\n\u201cIt specifically relies on the attacker being located in the same network, so it would not be surprising to see this vulnerability used in combination with another CVE/attack to achieve an attacker\u2019s end goal,\u201d he predicted. \u201cRemote code execution attacks can lead to unverified processes running on the server workload, only highlighting the need for constant, deter[...]", "creation_timestamp": "2026-09-02T01:02:53.001709Z"}, {"uuid": "807e1863-73d2-41ba-839b-0d1e054708b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/hacking_Attack/20095", "content": "Black Hat Ethical Hacking\nMicrosoft Warns: Another Unpatched PrintNightmare Zero-Day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-DayPost Views: 141 \nReading Time: 1 Minute\nOne day after dropping its scheduled August Patch Tuesday update, Microsoft issued a warning about yet another unpatched privilege escalation/remote code-execution (RCE) vulnerability in the Windows Print Spooler.\nThe zero-day bug, tracked as CVE-2021-36958, carries a CVSS vulnerability-severity scale rating of 7.3, meaning that it\u2019s rated as \u201cimportant.\u201d Microsoft said that it allows for a local attack vector requiring user interaction, but that the attack complexity is low, with few privileges required.\n\n\u201cA remote code-execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d the computing giant explained in its Wednesday advisory. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change or delete data; or create new accounts with full user rights.\u201d\n\nThe CERT Coordination Center actually flagged the issue in mid-July, when it warned that a working exploit\u00a0was available. That proof-of-concept (PoC), issued by Benjamin Delpy, comes complete with a video.\nSo apparently @offenseindepth reported this to Microsoft before your public PoC on July 17?\nAnd Microsoft is only just now publishing an out-of-band bulletin on it on August 11?\nhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f914.png pic.twitter.com/8eDHD7tg7A\n\n\u2014 Will Dormann (@wdormann) August 11, 2021\nSee Also: Auth Bypass Bug Exploited, Affecting Millions of Routers On Thursday, CERT/CC issued more details on the issue, explaining that it arises from an oversight in signature requirements around the \u201cPoint and Print\u201d capability, which allows users without administrative privileges to install printer drivers that execute with SYSTEM privileges via the Print Spooler service.\n\nWhile Microsoft requires that printers installable via Point are either signed by a WHQL release signature or by a trusted certificate, Windows printer drivers can specify queue-specific files that are associated with the use of the device, which leaves a loophole for malicious actors.\n\n\u201cFor example, a shared printer can specify a CopyFiles directive for arbitrary files,\u201d according to the CERT/CC advisory. \u201cThese files, which may be copied over alongside the digital-signature-enforced printer driver files, are not covered by any signature requirement. Furthermore, these files can be used to overwrite any of the signature-verified files that were placed on a system during printer driver install. This can allow for local privilege escalation to SYSTEM on a vulnerable system.\u201d\nSee Also: Offensive Security Tool: Mimikatz Microsoft credited Victor Mata of FusionX at Accenture Security with originally reporting the issue, which Mata said occurred back in December 2020:\nHey guys, I reported the vulnerability in Dec'20 but haven't disclosed details at MSRC's request. It looks like they acknowledged it today due to the recent events with print spooler.\n\n\u2014 Victor Mata (@offenseindepth) August 11, 2021\nSo far, Microsoft hasn\u2019t seen any attacks in the wild using the bug, but it noted that exploitation is \u201cmore likely.\u201d With a working exploit in circulation, that seems a fair assessment. Print Spooler-Palooza and the PrintNightmareDelpy characterized this latest zero-day as being part of the string of Print Spooler bugs collectively known as PrintNightmare.\n\nThe bad dream started in early[...]", "creation_timestamp": "2026-09-02T01:03:01.753895Z"}, {"uuid": "597951d1-a316-439d-8c14-af287bca5265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-02T01:04:27.795443Z"}, {"uuid": "7e7720b1-93d1-406b-b889-64cc4c217575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "https://t.me/hacking_Attack/23976", "content": "atpost that a trio of local privilege-escalation vulnerabilities in the Windows Common Log File System Driver (CVE-2021-36955, CVE-2021-36963, CVE-2021-38633) are also noteworthy, all of them being listed as \u201cexploitation more likely.\u201d\n\n\u201cLocal priv-esc vulnerabilities are a key component of almost every successful cyberattack, especially for the likes of ransomware operators who abuse this kind of exploit to gain the highest level of access,\u201d Breen said via email. \u201cThis allows them to disable antivirus, delete backups and ensure their encryptors can reach even the most sensitive of files.\u201d\n\nOne glaring example of that emerged in May, when hundreds of millions of Dell users were found to be at risk\u00a0from kernel-privilege bugs. The bugs lurked undisclosed for 12 years, and could have allowed attackers to bypass security products, execute code and pivot to other parts of the network for lateral movement.\n\nThe three exploits Microsoft patched on Tuesday aren\u2019t remote, meaning that attackers need to have achieved code execution by other means. One such way would be via CVE-2021-40444.\n\nTwo other vulnerabilities \u2013 CVE-2021-38639\u00a0and CVE-2021-36975, both Win32k escalation of privilege flaws \u2013 have also been listed as \u201cexploitation more likely\u201d and, together, cover the full range of supported Windows versions.\n\nBreen said that he\u2019s starting to feel like a broken record when it comes to privilege escalation vulnerabilities. They\u2019re not rated as high a severity risk as RCE bugs, but \u201cthese local exploits can be the linchpin in the post-exploitation phases of an experienced attacker,\u201d he asserted. \u201cIf you can block them here you have the potential to significantly limit their damage.\u201d\n\nhe added, \u201cIf we assume a determined attacker will be able to infect a victim\u2019s device through social engineering or other techniques, I would argue that patching priv-esc vulnerabilities is even more important than patching some other remote code-execution vulns,\u201d Breen said. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerStill, This RCE Is Pretty ImportantDanny Kim, a principal architect at Virsec who spent time at Microsoft during his graduate work on the OS security development team, wants security teams to pay attention to CVE-2021-36965\u00a0\u2013 an important-rated Windows WLAN AutoConfig Service RCE vulnerability \u2013 given its combination of severity (with a CVSS:3.0 base score of 8.8); no requirement for privilege escalation/user interaction to exploit; and breadth of affected Windows versions.\n\nThe WLAN AutoConfig Service is part of the mechanism that Windows 10 uses to choose the wireless network a computer will connect to, and to the Windows Scripting Engine, respectively.\n\nThe patch fixes a flaw that could allow network-adjacent attackers to run their code on affected systems at system level.\n\nAs the Zero Day Initiative explained, that means an attacker could \u201ccompletely take over the target \u2013 provided they are on an adjacent network.\u201d That would come in quite handy in a coffee-shop attack, where multiple people use an unsecured Wi-Fi network.\n\nThis one \u201cis especially alarming,\u201d Kim said: Think SolarWinds\u00a0and PrintNightmare.\n\n\u201cAs recent trends have shown, remote code execution-based attacks are the most critical vulnerabilities that can lead to the largest negative impact on an enterprise, as we have seen in the Solarwinds and PrintNightmare attacks,\u201d he said in an email.\n\nKim said that in spite of the exploit code maturity being currently unproven, the vulnerability has been confirmed to exist, leaving an opening for attackers.\n\n\u201cIt specifically relies on the attacker being located in the same network, so it would not be surprising to see this vulnerability used in combination with another CVE/attack to achieve an attacker\u2019s end goal,\u201d he predicted. \u201cRemote code execution attacks can lead to unverified processes running on the server workload, only highlighting the need for constant, deter[...]", "creation_timestamp": "2026-09-07T15:00:06.426328Z"}, {"uuid": "c9f007b6-de39-4839-8b07-1225562d8d50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/20095", "content": "Black Hat Ethical Hacking\nMicrosoft Warns: Another Unpatched PrintNightmare Zero-Day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-DayPost Views: 141 \nReading Time: 1 Minute\nOne day after dropping its scheduled August Patch Tuesday update, Microsoft issued a warning about yet another unpatched privilege escalation/remote code-execution (RCE) vulnerability in the Windows Print Spooler.\nThe zero-day bug, tracked as CVE-2021-36958, carries a CVSS vulnerability-severity scale rating of 7.3, meaning that it\u2019s rated as \u201cimportant.\u201d Microsoft said that it allows for a local attack vector requiring user interaction, but that the attack complexity is low, with few privileges required.\n\n\u201cA remote code-execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d the computing giant explained in its Wednesday advisory. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change or delete data; or create new accounts with full user rights.\u201d\n\nThe CERT Coordination Center actually flagged the issue in mid-July, when it warned that a working exploit\u00a0was available. That proof-of-concept (PoC), issued by Benjamin Delpy, comes complete with a video.\nSo apparently @offenseindepth reported this to Microsoft before your public PoC on July 17?\nAnd Microsoft is only just now publishing an out-of-band bulletin on it on August 11?\nhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f914.png pic.twitter.com/8eDHD7tg7A\n\n\u2014 Will Dormann (@wdormann) August 11, 2021\nSee Also: Auth Bypass Bug Exploited, Affecting Millions of Routers On Thursday, CERT/CC issued more details on the issue, explaining that it arises from an oversight in signature requirements around the \u201cPoint and Print\u201d capability, which allows users without administrative privileges to install printer drivers that execute with SYSTEM privileges via the Print Spooler service.\n\nWhile Microsoft requires that printers installable via Point are either signed by a WHQL release signature or by a trusted certificate, Windows printer drivers can specify queue-specific files that are associated with the use of the device, which leaves a loophole for malicious actors.\n\n\u201cFor example, a shared printer can specify a CopyFiles directive for arbitrary files,\u201d according to the CERT/CC advisory. \u201cThese files, which may be copied over alongside the digital-signature-enforced printer driver files, are not covered by any signature requirement. Furthermore, these files can be used to overwrite any of the signature-verified files that were placed on a system during printer driver install. This can allow for local privilege escalation to SYSTEM on a vulnerable system.\u201d\nSee Also: Offensive Security Tool: Mimikatz Microsoft credited Victor Mata of FusionX at Accenture Security with originally reporting the issue, which Mata said occurred back in December 2020:\nHey guys, I reported the vulnerability in Dec'20 but haven't disclosed details at MSRC's request. It looks like they acknowledged it today due to the recent events with print spooler.\n\n\u2014 Victor Mata (@offenseindepth) August 11, 2021\nSo far, Microsoft hasn\u2019t seen any attacks in the wild using the bug, but it noted that exploitation is \u201cmore likely.\u201d With a working exploit in circulation, that seems a fair assessment. Print Spooler-Palooza and the PrintNightmareDelpy characterized this latest zero-day as being part of the string of Print Spooler bugs collectively known as PrintNightmare.\n\nThe bad dream started in early[...]", "creation_timestamp": "2026-09-07T19:00:03.794960Z"}, {"uuid": "3e3cd632-6d95-4ef0-bf94-fb283c965b9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/20095", "content": "Black Hat Ethical Hacking\nMicrosoft Warns: Another Unpatched PrintNightmare Zero-Day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-DayPost Views: 141 \nReading Time: 1 Minute\nOne day after dropping its scheduled August Patch Tuesday update, Microsoft issued a warning about yet another unpatched privilege escalation/remote code-execution (RCE) vulnerability in the Windows Print Spooler.\nThe zero-day bug, tracked as CVE-2021-36958, carries a CVSS vulnerability-severity scale rating of 7.3, meaning that it\u2019s rated as \u201cimportant.\u201d Microsoft said that it allows for a local attack vector requiring user interaction, but that the attack complexity is low, with few privileges required.\n\n\u201cA remote code-execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d the computing giant explained in its Wednesday advisory. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change or delete data; or create new accounts with full user rights.\u201d\n\nThe CERT Coordination Center actually flagged the issue in mid-July, when it warned that a working exploit\u00a0was available. That proof-of-concept (PoC), issued by Benjamin Delpy, comes complete with a video.\nSo apparently @offenseindepth reported this to Microsoft before your public PoC on July 17?\nAnd Microsoft is only just now publishing an out-of-band bulletin on it on August 11?\nhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f914.png pic.twitter.com/8eDHD7tg7A\n\n\u2014 Will Dormann (@wdormann) August 11, 2021\nSee Also: Auth Bypass Bug Exploited, Affecting Millions of Routers On Thursday, CERT/CC issued more details on the issue, explaining that it arises from an oversight in signature requirements around the \u201cPoint and Print\u201d capability, which allows users without administrative privileges to install printer drivers that execute with SYSTEM privileges via the Print Spooler service.\n\nWhile Microsoft requires that printers installable via Point are either signed by a WHQL release signature or by a trusted certificate, Windows printer drivers can specify queue-specific files that are associated with the use of the device, which leaves a loophole for malicious actors.\n\n\u201cFor example, a shared printer can specify a CopyFiles directive for arbitrary files,\u201d according to the CERT/CC advisory. \u201cThese files, which may be copied over alongside the digital-signature-enforced printer driver files, are not covered by any signature requirement. Furthermore, these files can be used to overwrite any of the signature-verified files that were placed on a system during printer driver install. This can allow for local privilege escalation to SYSTEM on a vulnerable system.\u201d\nSee Also: Offensive Security Tool: Mimikatz Microsoft credited Victor Mata of FusionX at Accenture Security with originally reporting the issue, which Mata said occurred back in December 2020:\nHey guys, I reported the vulnerability in Dec'20 but haven't disclosed details at MSRC's request. It looks like they acknowledged it today due to the recent events with print spooler.\n\n\u2014 Victor Mata (@offenseindepth) August 11, 2021\nSo far, Microsoft hasn\u2019t seen any attacks in the wild using the bug, but it noted that exploitation is \u201cmore likely.\u201d With a working exploit in circulation, that seems a fair assessment. Print Spooler-Palooza and the PrintNightmareDelpy characterized this latest zero-day as being part of the string of Print Spooler bugs collectively known as PrintNightmare.\n\nThe bad dream started in early[...]", "creation_timestamp": "2026-09-08T00:00:27.335389Z"}, {"uuid": "241e3333-c0cb-428e-8fca-6f799f583abc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36955", "type": "seen", "source": "https://t.me/hacking_Attack/23976", "content": "atpost that a trio of local privilege-escalation vulnerabilities in the Windows Common Log File System Driver (CVE-2021-36955, CVE-2021-36963, CVE-2021-38633) are also noteworthy, all of them being listed as \u201cexploitation more likely.\u201d\n\n\u201cLocal priv-esc vulnerabilities are a key component of almost every successful cyberattack, especially for the likes of ransomware operators who abuse this kind of exploit to gain the highest level of access,\u201d Breen said via email. \u201cThis allows them to disable antivirus, delete backups and ensure their encryptors can reach even the most sensitive of files.\u201d\n\nOne glaring example of that emerged in May, when hundreds of millions of Dell users were found to be at risk\u00a0from kernel-privilege bugs. The bugs lurked undisclosed for 12 years, and could have allowed attackers to bypass security products, execute code and pivot to other parts of the network for lateral movement.\n\nThe three exploits Microsoft patched on Tuesday aren\u2019t remote, meaning that attackers need to have achieved code execution by other means. One such way would be via CVE-2021-40444.\n\nTwo other vulnerabilities \u2013 CVE-2021-38639\u00a0and CVE-2021-36975, both Win32k escalation of privilege flaws \u2013 have also been listed as \u201cexploitation more likely\u201d and, together, cover the full range of supported Windows versions.\n\nBreen said that he\u2019s starting to feel like a broken record when it comes to privilege escalation vulnerabilities. They\u2019re not rated as high a severity risk as RCE bugs, but \u201cthese local exploits can be the linchpin in the post-exploitation phases of an experienced attacker,\u201d he asserted. \u201cIf you can block them here you have the potential to significantly limit their damage.\u201d\n\nhe added, \u201cIf we assume a determined attacker will be able to infect a victim\u2019s device through social engineering or other techniques, I would argue that patching priv-esc vulnerabilities is even more important than patching some other remote code-execution vulns,\u201d Breen said. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerStill, This RCE Is Pretty ImportantDanny Kim, a principal architect at Virsec who spent time at Microsoft during his graduate work on the OS security development team, wants security teams to pay attention to CVE-2021-36965\u00a0\u2013 an important-rated Windows WLAN AutoConfig Service RCE vulnerability \u2013 given its combination of severity (with a CVSS:3.0 base score of 8.8); no requirement for privilege escalation/user interaction to exploit; and breadth of affected Windows versions.\n\nThe WLAN AutoConfig Service is part of the mechanism that Windows 10 uses to choose the wireless network a computer will connect to, and to the Windows Scripting Engine, respectively.\n\nThe patch fixes a flaw that could allow network-adjacent attackers to run their code on affected systems at system level.\n\nAs the Zero Day Initiative explained, that means an attacker could \u201ccompletely take over the target \u2013 provided they are on an adjacent network.\u201d That would come in quite handy in a coffee-shop attack, where multiple people use an unsecured Wi-Fi network.\n\nThis one \u201cis especially alarming,\u201d Kim said: Think SolarWinds\u00a0and PrintNightmare.\n\n\u201cAs recent trends have shown, remote code execution-based attacks are the most critical vulnerabilities that can lead to the largest negative impact on an enterprise, as we have seen in the Solarwinds and PrintNightmare attacks,\u201d he said in an email.\n\nKim said that in spite of the exploit code maturity being currently unproven, the vulnerability has been confirmed to exist, leaving an opening for attackers.\n\n\u201cIt specifically relies on the attacker being located in the same network, so it would not be surprising to see this vulnerability used in combination with another CVE/attack to achieve an attacker\u2019s end goal,\u201d he predicted. \u201cRemote code execution attacks can lead to unverified processes running on the server workload, only highlighting the need for constant, deter[...]", "creation_timestamp": "2026-09-08T00:00:42.000445Z"}, {"uuid": "88f54b4c-ce32-406c-ac1d-50bd31ad0e3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-10T21:00:04.953437Z"}, {"uuid": "d22ea7f6-4ee5-47e7-b17d-51134b6482e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-11T00:00:12.282753Z"}]}