{"metadata": {"vulnerability": "CVE-2019-0841", "count": 76, "kinds": {"milestone": 4, "sighting": 42, "kev": 11, "other": 19}, "linked_omitted": 0}, "data": [{"timestamp": "2018-11-26T00:00:00Z", "date_only": false, "value": "2018-11-26T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.dateReserved"}, {"timestamp": "2019-04-09T20:18:32Z", "date_only": false, "value": "2019-04-09T20:18:32.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2019-04-09T21:29:00Z", "date_only": false, "value": "2019-04-09T21:29:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WQQ2-J7VF-7RW9", "record": "GHSA-WQQ2-J7VF-7RW9", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2019-04-09T21:29:00Z", "date_only": false, "value": "2019-04-09T21:29Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2019-0841", "record": "GSD-2019-0841", "field": "namespaces.nvd.nist.gov.publishedDate", "linked_record": true}, {"timestamp": "2019-04-09T21:29:01.990Z", "date_only": false, "value": "2019-04-09T21:29:01.990", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2019-0841", "record": "FKIE_CVE-2019-0841", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2019-04-10T00:00:00Z", "date_only": false, "value": "2019-04-10T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2019-AVI-158", "record": "CERTFR-2019-AVI-158", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2019-04-10T00:00:00Z", "date_only": true, "value": "2019-04-10", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2019-31056", "record": "CNVD-2019-31056", "field": "submitTime", "linked_record": true}, {"timestamp": "2019-04-10T08:14:06Z", "date_only": false, "value": "2019-04-10T08:14:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ExcreamOnSecurity/40", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "d75a0e6a-80dd-4cb7-8e02-9f866bb266b9", "content": "DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841)\n\nThis vulnerability allows low privileged users to hijack file that are owned by NT AUTHORITY\\SYSTEM by overwriting permissions on the targeted file. Successful exploitation results in \"Full Control\" permissions for the low privileged user. \n\nhttps://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/\n\n#privesc #windows", "url": "https://t.me/ExcreamOnSecurity/40", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-04-10T08:15:27Z", "date_only": false, "value": "2019-04-10T08:15:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ExcreamOnSecurity/41", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "a5d2fb69-4a31-495c-938d-bfb482227523", "content": "PoC code for CVE-2019-0841 Privilege Escalation vulnerability\n\nhttps://github.com/rogue-kdc/CVE-2019-0841\n\n#exploit #windows #LPE", "url": "https://t.me/ExcreamOnSecurity/41", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-04-10T21:31:35Z", "date_only": false, "value": "2019-04-10T21:31:35.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/antichat/4378", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "23786ea1-8eb4-4d66-9a0f-9f8816de4cc7", "content": "DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841)\nhttps://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/", "url": "https://t.me/antichat/4378", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-04-10T21:57:30Z", "date_only": false, "value": "2019-04-10T21:57:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/canyoupwnme/5390", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "51f8d775-144b-49ce-aa1f-aef1f2cb048c", "content": "DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841)\nhttps://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/", "url": "https://t.me/canyoupwnme/5390", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-04-11T11:01:54Z", "date_only": false, "value": "2019-04-11T11:01:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/SecLabNews/4699", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "92ac0a47-85c4-4bee-8d27-de3dd63c3bbb", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u041d\u0430\u0431\u0438\u043b \u0410\u0445\u043c\u0435\u0434 (Nabeel Ahmed) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-0841) \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Windows, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0436\u0435\u0441\u0442\u043a\u0438\u0445 \u0441\u0441\u044b\u043b\u043e\u043a \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c AppX Deployment Service (AppXSVC), \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Windows Apps, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438 \u0434\u0435\u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.    \n\u0412 \u0421\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d PoC-\u043a\u043e\u0434 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows", "url": "https://t.me/SecLabNews/4699", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-05-19T08:26:35Z", "date_only": false, "value": "2019-05-19T08:26:35.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/antichat/5002", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "ac314d91-dce8-4f51-b291-bbfe06d88b3b", "content": "https://rastamouse.me/2019/04/weaponizing-cve-2019-0841-with-laps", "url": "https://t.me/antichat/5002", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-05-23T17:09:30Z", "date_only": false, "value": "2019-05-23T17:09:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BleepingComputer/5109", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "763a5d90-d892-4f90-b2cd-ac1db141415a", "content": "Two More Windows 10 Zero-Day PoC Exploits Released, Brings Total to 4\n\nAfter releasing exploit code for three zero-day vulnerabilities in Windows 10 over the past 48 hours, security researcher and exploit developer SandboxEscaper today has published two more, bypass for the\u00a0CVE-2019-0841 patch and LPE PoC exploit dubbed\u00a0InstallerBypass. [...]\n\nhttps://www.bleepingcomputer.com/news/security/two-more-windows-10-zero-day-poc-exploits-released-brings-total-to-4/", "url": "https://t.me/BleepingComputer/5109", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-05-23T19:16:31Z", "date_only": false, "value": "2019-05-23T19:16:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/11720", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "e5a3c1ae-3dce-4aee-bcf3-4f9df29c57a5", "content": "Today's releases consists of two more zero-day local privilege escalation vulnerabilities. One is a bypass of Microsoft's patch for CVE-2019-0841 and the other is a new one titled", "url": "https://t.me/ctinow/11720"}, {"timestamp": "2019-06-07T10:54:13Z", "date_only": false, "value": "2019-06-07T10:54:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/antichat/5312", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "e92c8130-29f4-4b98-ac93-7e8d00e74ce4", "content": "Hacker going by the name of SandboxEscaper today discloses a second zero-day exploit that apparently bypasses Microsoft's patch for a Windows EoP vulnerability (CVE-2019-0841)\n\nhttps://thehackernews.com/2019/06/windows-eop-exploit.html", "url": "https://t.me/antichat/5312", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2019-06-07T12:52:57Z", "date_only": false, "value": "2019-06-07T12:52:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thehackernews/333", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "dd8420fe-a9f8-4294-95a6-ff6f9f1b8280", "content": "Hacker going by the name of SandboxEscaper today discloses a second zero-day exploit that apparently bypasses Microsoft's patch for a Windows EoP vulnerability (CVE-2019-0841)\n\nhttps://thehackernews.com/2019/06/windows-eop-exploit.html", "url": "https://t.me/thehackernews/333", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-06-07T17:33:07Z", "date_only": false, "value": "2019-06-07T17:33:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/4756", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "30cefcd1-bc02-4f78-84ec-1ccc92afffdd", "content": "\u274c SandboxEscaper Debuts ByeBear Windows Patch Bypass \u274c\n\nSandboxEscaper is back, with a second bypass for the recent CVE-2019-0841 Windows patch.\n\n\ud83d\udcd6 Read\n\nvia \"Threatpost\".", "url": "https://t.me/cibsecurity/4756"}, {"timestamp": "2019-06-08T07:55:51Z", "date_only": false, "value": "2019-06-08T07:55:51.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/28272", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "6c013019-e6fd-4842-a4d5-381412d19e95", "content": "An anonymous hacker SanboxEscaper came back and leaked another Windows zero-day vulnerability that exploits already patched (CVE-2019-0841) local privilege escalation vulnerability in Windows 10. This is a second zero-day that bypass CVE-2019-0841, An elevation of privilege vulnerability exists when Windows AppX Deployment Service improperly handles hard links. and the vulnerability has been already patched by [\u2026]\nThe post Hacker Leaked New Windows 10 Zero-day Exploit Online To Bypass Already Patched Bug (https://gbhackers.com/hacker-leaked-new-zero-day-exploit-online-to-bypass-already-patched-bug/) appeared first on GBHackers On Security (https://gbhackers.com/).", "url": "https://t.me/information_security_channel/28272", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2019-06-08T23:13:13Z", "date_only": false, "value": "2019-06-08T23:13:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ctinow/12346", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "49817f28-9d82-44d7-92e9-dc912a107c48", "content": "RT @rogue_kdc: Now that SandboxEscaper found 2 bypasses for CVE-2019-0841 and released them as 0days both based on my public PoC. I wonder if these 0days wouldn't be public if I never disclosed the details. \ud83e\udd14 https://t.co/szdrY73T1L http://twitter.com/BleepinComputer/status/1137467169472700419", "url": "https://t.me/ctinow/12346", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-06-10T19:01:15Z", "date_only": false, "value": "2019-06-10T19:01:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Pen7esting/174", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "e26be51e-785c-41e5-b1f1-e361812cd2b9", "content": "https://unaaldia.hispasec.com/2019/06/filtrado-otro-zero-day-de-windows-para-cve-2019-0841.html", "url": "https://t.me/Pen7esting/174", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-07-15T14:52:11Z", "date_only": false, "value": "2019-07-15T14:52:11.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "4cae3e78-9f30-4d00-998a-a89ed193c432", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb"}, {"timestamp": "2019-07-15T16:06:10Z", "date_only": false, "value": "2019-07-15T16:06:10.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2019-0841", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2019-07-16T00:00:00Z", "date_only": false, "value": "2019-07-16T00:00:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://www.exploit-db.com/exploits/47128", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "ad8e4f74-1777-4467-9c08-87eea8254766", "url": "https://www.exploit-db.com/exploits/47128", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2019-09-11T00:00:00Z", "date_only": true, "value": "2019-09-11", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2019-31056", "record": "CNVD-2019-31056", "field": "openTime", "linked_record": true}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": false, "value": "2022-03-15T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2019-0841", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "50426b7b-c26f-4856-b7f1-a705b31d2b9e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": false, "value": "2022-03-15T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2019-0841", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "a486d1ed-ba6d-45ce-b258-951aa8675493", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": true, "value": "2022-03-15", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2019-0841", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": true, "value": "2022-03-15", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2019-0841", "record": "GSD-2019-0841", "field": "namespaces.cisa.gov.dateAdded", "linked_record": true}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": false, "value": "2022-03-15T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2019-0841", "field": "evidence.0.details.added_date", "uuid": "a486d1ed-ba6d-45ce-b258-951aa8675493", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": true, "value": "2022-03-15", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2019-0841", "field": "evidence.0.details.date_added", "uuid": "50426b7b-c26f-4856-b7f1-a705b31d2b9e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": false, "value": "2022-03-15T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2019-0841", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "50426b7b-c26f-4856-b7f1-a705b31d2b9e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": false, "value": "2022-03-15T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2019-0841", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "a486d1ed-ba6d-45ce-b258-951aa8675493", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": false, "value": "2022-03-15T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2019-0841", "field": "status.status_updated_at", "uuid": "50426b7b-c26f-4856-b7f1-a705b31d2b9e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": false, "value": "2022-03-15T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2019-0841", "field": "status.status_updated_at", "uuid": "a486d1ed-ba6d-45ce-b258-951aa8675493", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-15T00:00:00Z", "date_only": false, "value": "2022-03-15T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2019-0841", "field": "containers.adp.1.timeline.0.time", "text": "CVE-2019-0841 added to CISA KEV"}, {"timestamp": "2022-04-05T00:00:00Z", "date_only": true, "value": "2022-04-05", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2019-0841", "field": "evidence.0.details.due_date", "uuid": "50426b7b-c26f-4856-b7f1-a705b31d2b9e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-05T00:00:00Z", "date_only": true, "value": "2022-04-05", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2019-0841", "record": "GSD-2019-0841", "field": "namespaces.cisa.gov.dueDate", "linked_record": true}, {"timestamp": "2022-05-13T01:21:38Z", "date_only": false, "value": "2022-05-13T01:21:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WQQ2-J7VF-7RW9", "record": "GHSA-WQQ2-J7VF-7RW9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2022-06-27T04:16:42Z", "date_only": false, "value": "2022-06-27T04:16:42.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/etpTle02KZu4bwjSBmFNPkggU6Oy9UDinLPkfdjV0it7V-8", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "11c3d525-d9dd-4fd2-a9fd-ee62483f4627"}, {"timestamp": "2023-03-20T18:09:00Z", "date_only": false, "value": "2023-03-20T18:09Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2019-0841", "record": "GSD-2019-0841", "field": "namespaces.nvd.nist.gov.lastModifiedDate", "linked_record": true}, {"timestamp": "2023-06-14T21:10:03Z", "date_only": false, "value": "2023-06-14T21:10:03.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "13289047-8f92-48f2-9c5c-79b86878ca72"}, {"timestamp": "2023-10-26T20:37:33Z", "date_only": false, "value": "2023-10-26T20:37:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/284", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "d15f6350-740d-4e19-b98e-e24c8df43395", "content": "#Red_Team_Tactics\n1. Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin\nhttps://blog.preempt.com/drop-the-mic\n2. Coding a reliable CVE-2019-084 bypass\nhttps://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html", "url": "https://t.me/CyberSecurityTechnologies/284", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2023-12-13T01:23:39.079Z", "date_only": false, "value": "2023-12-13T01:23:39.079299Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2019-0841", "record": "GSD-2019-0841", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-07-17T10:19:24Z", "date_only": false, "value": "2024-07-17T10:19:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/306", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "0150cb9c-0412-4289-bfe9-b825d487df85", "content": "#exploit\n1. CVE-2019-0841:\nEoP vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links\nhttps://github.com/rogue-kdc/CVE-2019-0841\nhttps://github.com/0x00-0x00/CVE-2019-0841-BYPASS \n\n2. CVE-2019-0859:\nEoP vulnerability in Windows when the Win32k component fails to properly handle objects in memory\nhttps://github.com/Sheisback/CVE-2019-0859-1day-Exploit", "url": "https://t.me/CyberSecurityTechnologies/306", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-08-04T17:58:59.113Z", "date_only": false, "value": "2024-08-04T17:58:59.113Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2019-0841", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-11-14T06:09:57Z", "date_only": false, "value": "2024-11-14T06:09:57.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a993f49f-3797-4077-8c76-879d75a4e908", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "77665e66-f9f1-4c25-9086-95ff495af896"}, {"timestamp": "2024-12-24T20:28:27.862Z", "date_only": false, "value": "2024-12-24T20:28:27.862933Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971379", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "3393c764-fe0c-4933-97e5-5398bf0db418", "url": "https://feedsin.space/feed/CISAKevBot/items/2971379"}, {"timestamp": "2025-02-06T03:13:43Z", "date_only": false, "value": "2025-02-06T03:13:43.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "4751dd55-f6af-4447-b065-cbc733eb4616"}, {"timestamp": "2025-02-07T16:18:10.744Z", "date_only": false, "value": "2025-02-07T16:18:10.744157Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2019-0841", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-02-07T16:18:10.744Z", "date_only": false, "value": "2025-02-07T16:18:10.744157Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2019-0841", "record": "FKIE_CVE-2019-0841", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-23T02:10:21Z", "date_only": false, "value": "2025-02-23T02:10:21.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "80d72ae0-fc85-49d8-9822-234d134f2a87"}, {"timestamp": "2025-02-23T04:10:10Z", "date_only": false, "value": "2025-02-23T04:10:10.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "a787162e-7561-41ce-a134-ee0ec8129529"}, {"timestamp": "2025-08-31T03:00:48Z", "date_only": false, "value": "2025-08-31T03:00:48.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "7c90e375-8898-41aa-a224-e7a6a504cdf0"}, {"timestamp": "2025-10-21T23:45:39.637Z", "date_only": false, "value": "2025-10-21T23:45:39.637Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:45:39.637Z", "date_only": false, "value": "2025-10-21T23:45:39.637Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2019-0841", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:31:38Z", "date_only": false, "value": "2025-10-22T00:31:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WQQ2-J7VF-7RW9", "record": "GHSA-WQQ2-J7VF-7RW9", "field": "modified", "linked_record": true}, {"timestamp": "2026-01-22T14:43:48Z", "date_only": false, "value": "2026-01-22T14:43:48.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ryukk33/79a78fbc75ee9f3cf3a6fc1504681717", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "1525ceba-0f6e-43cb-a192-a64c7736e043", "url": "https://gist.github.com/ryukk33/79a78fbc75ee9f3cf3a6fc1504681717"}, {"timestamp": "2026-02-02T12:28:09.350Z", "date_only": false, "value": "2026-02-02T12:28:09.350381Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/50426b7b-c26f-4856-b7f1-a705b31d2b9e", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "dcdff0e3-1fcb-44cf-ab1e-06c40c8b3d6c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/50426b7b-c26f-4856-b7f1-a705b31d2b9e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-17T02:09:01.233Z", "date_only": false, "value": "2026-06-17T02:09:01.233", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2019-0841", "record": "FKIE_CVE-2019-0841", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:47:28.953Z", "date_only": false, "value": "2026-06-19T12:47:28.953794Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/18fc3924-12ac-4710-b521-2cae06b7f479", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "ab1c8729-88a3-48f2-be02-a9eaf5ae27e0", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/18fc3924-12ac-4710-b521-2cae06b7f479", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2019-0841", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "a486d1ed-ba6d-45ce-b258-951aa8675493", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:05:07.386Z", "date_only": false, "value": "2026-06-23T14:05:07.386632Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a486d1ed-ba6d-45ce-b258-951aa8675493", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "962b64dd-c076-421c-960c-cba2384b1fb2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a486d1ed-ba6d-45ce-b258-951aa8675493", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-29T12:03:22.348Z", "date_only": false, "value": "2026-07-29T12:03:22.348085Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/sysadm_in_up/672", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "0b77754b-6946-4e4a-a581-e151e2993f1b", "content": "DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841)\nhttps://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/", "url": "https://t.me/sysadm_in_up/672"}, {"timestamp": "2026-08-04T05:00:04.583Z", "date_only": false, "value": "2026-08-04T05:00:04.583798Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/sysadm_in_up/672", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "bb4aef2b-f593-4f25-9ae9-b413f818746b", "content": "DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841)\nhttps://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/", "url": "https://t.me/sysadm_in_up/672", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-05T05:00:09.952Z", "date_only": false, "value": "2026-08-05T05:00:09.952507Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/timcore_hacking/493", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "0cc6015f-b7f6-45e1-8c5d-aec1597ca605", "content": "\u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0431\u0435\u0449\u0430\u043d\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Windows\n\n\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0442\u0440\u0438 \u0434\u043d\u044f SandboxEscaper \u0443\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043b\u0430 \u0442\u0440\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430.\n\n\u041d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u0430\u044f \u0418\u0411-\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u0438\u0446\u0430, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0432 \u0421\u0435\u0442\u0438 \u043f\u043e\u0434 \u043f\u0441\u0435\u0432\u0434\u043e\u043d\u0438\u043c\u043e\u043c SandboxEscaper, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0435\u0449\u0435 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Windows. \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0442\u0440\u0438 \u0434\u043d\u044f SandboxEscaper \u0443\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043b\u0430 \u0442\u0440\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0435\u0449\u0435 \u0434\u0432\u0443\u0445 \u0431\u0430\u0433\u0430\u0445.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0435\u0439 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2019-0841, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 Microsoft \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2019 \u0433\u043e\u0434\u0430. \u0411\u0430\u0433 \u0441\u0432\u044f\u0437\u0430\u043d \u0441\u043e \u0441\u043b\u0443\u0436\u0431\u043e\u0439 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Windows AppX Deployment Service (AppXSVC) \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0412\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u043b\u0443\u0436\u0431\u0443 Windows Installer (C:\\Windows\\Installer). \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043a\u0440\u0430\u0442\u043a\u043e\u043c\u0443 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044e, \u0432 \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u043e\u0442\u0440\u0435\u0437\u043e\u043a \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438\u0437-\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0433\u043e\u043d\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Windows \u0438 \u043f\u043e\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043d\u0435\u0434\u043e\u0437\u0432\u043e\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u041e\u0421. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 msiexec /fa (\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438) \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c. \u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\nMicrosoft \u0443\u0436\u0435 \u043f\u0440\u043e\u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u043d\u043e \u043f\u043e\u043a\u0430 \u043d\u0438\u043a\u0430\u043a \u043d\u0435 \u043f\u0440\u043e\u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e. \u041a\u043e\u0433\u0434\u0430 \u0431\u0443\u0434\u0443\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043a\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0432\u043f\u043e\u043b\u043d\u0435 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043e\u043d\u0438 \u043f\u043e\u044f\u0432\u044f\u0442\u0441\u044f \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u043f\u043b\u0430\u043d\u043e\u0432\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securitylab.ru/news/499219.php", "url": "https://t.me/timcore_hacking/493"}, {"timestamp": "2026-08-06T00:00:48.556Z", "date_only": false, "value": "2026-08-06T00:00:48.556415Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/timcore_hacking/493", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "d47b5bdf-c365-43da-9db8-393ba352a47a", "content": "\u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0431\u0435\u0449\u0430\u043d\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Windows\n\n\u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0442\u0440\u0438 \u0434\u043d\u044f SandboxEscaper \u0443\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043b\u0430 \u0442\u0440\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430.\n\n\u041d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u0430\u044f \u0418\u0411-\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u0438\u0446\u0430, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0432 \u0421\u0435\u0442\u0438 \u043f\u043e\u0434 \u043f\u0441\u0435\u0432\u0434\u043e\u043d\u0438\u043c\u043e\u043c SandboxEscaper, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0435\u0449\u0435 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Windows. \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0442\u0440\u0438 \u0434\u043d\u044f SandboxEscaper \u0443\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043b\u0430 \u0442\u0440\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0435\u0449\u0435 \u0434\u0432\u0443\u0445 \u0431\u0430\u0433\u0430\u0445.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0435\u0439 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2019-0841, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 Microsoft \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2019 \u0433\u043e\u0434\u0430. \u0411\u0430\u0433 \u0441\u0432\u044f\u0437\u0430\u043d \u0441\u043e \u0441\u043b\u0443\u0436\u0431\u043e\u0439 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Windows AppX Deployment Service (AppXSVC) \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0412\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u043b\u0443\u0436\u0431\u0443 Windows Installer (C:\\Windows\\Installer). \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043a\u0440\u0430\u0442\u043a\u043e\u043c\u0443 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044e, \u0432 \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u043e\u0442\u0440\u0435\u0437\u043e\u043a \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438\u0437-\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0433\u043e\u043d\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Windows \u0438 \u043f\u043e\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043d\u0435\u0434\u043e\u0437\u0432\u043e\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u041e\u0421. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 msiexec /fa (\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438) \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c. \u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\nMicrosoft \u0443\u0436\u0435 \u043f\u0440\u043e\u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u043d\u043e \u043f\u043e\u043a\u0430 \u043d\u0438\u043a\u0430\u043a \u043d\u0435 \u043f\u0440\u043e\u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e. \u041a\u043e\u0433\u0434\u0430 \u0431\u0443\u0434\u0443\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043a\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0432\u043f\u043e\u043b\u043d\u0435 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043e\u043d\u0438 \u043f\u043e\u044f\u0432\u044f\u0442\u0441\u044f \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u043f\u043b\u0430\u043d\u043e\u0432\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.securitylab.ru/news/499219.php", "url": "https://t.me/timcore_hacking/493", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-01T20:02:47.231Z", "date_only": false, "value": "2026-09-01T20:02:47.231084Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/4649", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "9a93bc5c-bb18-4eb2-bc55-217e6c6970f3", "content": "Kali Linux Tutorials\nWatson : Enumerate Missing KBs & Suggest Exploits For Useful Privilege Escalation Vulnerabilities\n\nWatson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities. Supported Versions Windows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004 Server 2016 & 2019 Usage \u2013 OS Build Number: 14393>>Enumerating installed KBs\u2026 \u2013 CVE-2019-0836 : VULNERABLE>>https://exploit-db.com/exploits/46718>>https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/ \u2013 CVE-2019-0841 : VULNERABLE>>https://github.com/rogue-kdc/CVE-2019-0841>>https://rastamouse.me/tags/cve-2019-0841/ \u2013 CVE-2019-1064 : VULNERABLE>>https://www.rythmstick.net/posts/cve-2019-1064/ [\u2026]\n\nThe post Watson : Enumerate Missing KBs & Suggest Exploits For Useful Privilege Escalation Vulnerabilities appeared first on Kali Linux Tutorials.", "url": "https://t.me/hacking_Attack/4649"}, {"timestamp": "2026-09-01T20:02:48.093Z", "date_only": false, "value": "2026-09-01T20:02:48.093608Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/3668", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "270c11e4-21c0-4777-9674-1808a15c0f0f", "content": "KitPloit - PenTest Tools!\nWatson - Enumerate Missing KBs And Suggest Exploits For Useful Privilege Escalation Vulnerabilities\n\nhttps://1.bp.blogspot.com/-of7mBTen-mk/YGKeTq2QQiI/AAAAAAAAVwA/-paRxYr-yvES1HxqVwS_uS4YoNPRqUAfwCNcBGAsYHQ/w640-h316/Privilege%2BEscalation.png \nWatson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.\nSupported Versions\n\n* Windows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004\n* Server 2016 & 2019\n\nUsage\nC:\\> Watson.exe\n__    __      _\n/ / /\\ \\ \\__ _| |_ ___  ___  _ __\n\\ \\/  \\/ / _` | __/ __|/ _ \\| '_ \\\n\\  /\\  / (_| | |_\\__ \\ (_) | | | |\n\\/  \\/ \\__,_|\\__|___/\\___/|_| |_|\n\nv2.0\n\n@_RastaMouse\n\n[*] OS Build Number: 14393\n[*] Enumerating installed KBs...\n\n[!] CVE-2019-0836 : VULNERABLE\n[>] https://exploit-db.com/exploits/46718\n[>] https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/\n\n[!] CVE-2019-0841 : VULNERABLE\n[>] https://github.com/rogue-kdc/CVE-2019-0841\n[>] https://rastamouse.me/tags/cve-2019-0841/\n\n[!] CVE-2019-1064 : VULNERABLE\n[>] https://www.rythmstick.net/posts/cve-2019-1064/\n\n[!] CVE-2019-1130 : VULNERABLE\n[>] https://github.com/S3cur3Th1sSh1t/SharpByeBear\n\n[!] CVE-   2019-1253 : VULNERABLE\n[>] https://github.com/padovah4ck/CVE-2019-1253\n\n[!] CVE-2019-1315 : VULNERABLE\n[>] https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html\n\n[*] Finished. Found 6 potential vulnerabilities.\n\nIssues\n\n* \nI try to update Watson after every Patch Tuesday, but for potential false positives check the latest supersedence information in the Windows Update Catalog.  If you still think there's an error, raise an Issue with the Buglabel.\n\n* \nIf there's a particular vulnerability that you want to see in Watson that's not already included, raise an Issue with the Vulnerability Requestlabel and include the CVE number.\n\n* \nIf you know of a good exploit for any of the vulnerabilities in Watson, raise an Issue with the Exploit Suggestionlabel and provide a URL to the exploit.\nDownload Watson", "url": "https://t.me/hacking_Attack/3668"}, {"timestamp": "2026-09-01T20:02:49.278Z", "date_only": false, "value": "2026-09-01T20:02:49.278325Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/3666", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "b6804ce8-9628-4c7c-a0e1-4e8fedd2e021", "content": "Watson - Enumerate Missing KBs And Suggest Exploits For Useful Privilege Escalation Vulnerabilities\n\n Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.Supported Versions Windows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004 Server 2016 & 2019 Usage C:\\> Watson.exe _ _ _ / / /\\ \\ \\_ _| |_ _ _ _ _ \\ \\/ \\/ / _` | _/ _|/ _ \\| '_ \\ \\ /\\ / (_| | |_\\_ \\ () | | | | \\/ \\/ \\\\,_|\\_|_/\\_/|_| |_| v2.0 @_RastaMouse \\* OS Build Number: 14393 \\* Enumerating installed KBs... ! CVE-2019-0836 : VULNERABLE > https://exploit-db.com/exploits/46718 > https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/ ! CVE-2019-0841 : VULNERABLE > https://github.com/rogue-kdc/CVE-2019-0841 > https://rastamouse.me/tags/cve-2019-0841/ ! CVE-2019-1064 : VULNERABLE > https://www.rythmstick.net/posts/cve-2019-1064/ ! CVE-2019-1130 : VULNERABLE > https://github.com/S3cur3Th1sSh1t/SharpByeBear ! CVE- 2019-1253 : VULNERABLE > https://github.com/padovah4ck/CVE-2019-1253 ! CVE-2019-1315 : VULNERABLE > https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html \\* Finished. Found 6 potential vulnerabilities. Issues I try to update Watson after every Patch Tuesday, but for potential false positives check the latest supersedence information in the Windows Update Catalog. If you still think there's an error, raise an Issue with the Bug label. If there's a particular vulnerability that you want to see in Watson that's not already included, raise an Issue with the Vulnerability Request label and include the CVE number. If you know of a good exploit for any of the vulnerabilities in Watson, raise an Issue with the Exploit Suggestion label and provide a URL to the exploit. Download Watson\nRead more...", "url": "https://t.me/hacking_Attack/3666"}, {"timestamp": "2026-09-01T20:02:49.362Z", "date_only": false, "value": "2026-09-01T20:02:49.362036Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/3655", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "0c60bae5-d247-4d47-83b8-bf25eaa30788", "content": "Watson is a .NET tool designed to enumerate missing KBs and suggest exploits (https://www.kitploit.com/search/label/Exploits) for Privilege Escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) vulnerabilities.\nSupported Versions\nWindows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004  Server 2016 & 2019  \nUsage\nC:\\> Watson.exe\n  __    __      _\n / / /\\ \\ \\__ _| |_ ___  ___  _ __\n \\ \\/  \\/ / _` | __/ __|/ _ \\| '_ \\\n  \\  /\\  / (_| | |_\\__ \\ (_) | | | |\n   \\/  \\/ \\__,_|\\__|___/\\___/|_| |_|\n\n                           v2.0\n\n                   @_RastaMouse\n\n [*] OS Build Number: 14393\n [*] Enumerating installed KBs...\n\n [!] CVE-2019-0836 : VULNERABLE\n  [>] https://exploit-db.com/exploits/46718\n  [>] https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/\n\n [!] CVE-2019-0841 : VULNERABLE\n  [>] https://github.com/rogue-kdc/CVE-2019-0841\n  [>] https://rastamouse.me/tags/cve-2019-0841/\n\n [!] CVE-2019-1064 : VULNERABLE\n  [>] https://www.rythmstick.net/posts/cve-2019-1064/\n\n [!] CVE-2019-1130 : VULNERABLE\n  [>] https://github.com/S3cur3Th1sSh1t/SharpByeBear\n\n [!] CVE-   2019-1253 : VULNERABLE\n  [>] https://github.com/padovah4ck/CVE-2019-1253\n\n [!] CVE-2019-1315 : VULNERABLE\n  [>] https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html\n\n [*] Finished. Found 6 potential vulnerabilities.\n  \nIssues\n  I try to update Watson after every Patch Tuesday, but for potential false positives check the latest supersedence information in the Windows Update Catalog (https://www.catalog.update.microsoft.com/Home.aspx).  If you still think there's an error, raise an Issue with the Bug label.      If there's a particular vulnerability (https://www.kitploit.com/search/label/Vulnerability) that you want to see in Watson that's not already included, raise an Issue with the Vulnerability Request label and include the CVE number.      If you know of a good exploit for any of the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in Watson, raise an Issue with the Exploit Suggestion label and provide a URL to the exploit.    \n\nDownload Watson (https://github.com/rasta-mouse/Watson)", "url": "https://t.me/hacking_Attack/3655"}, {"timestamp": "2026-09-08T11:00:05.609Z", "date_only": false, "value": "2026-09-08T11:00:05.609798Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/4649", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "c60ebfb0-710a-49fb-99da-6a690f727e20", "content": "Kali Linux Tutorials\nWatson : Enumerate Missing KBs & Suggest Exploits For Useful Privilege Escalation Vulnerabilities\n\nWatson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities. Supported Versions Windows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004 Server 2016 & 2019 Usage \u2013 OS Build Number: 14393>>Enumerating installed KBs\u2026 \u2013 CVE-2019-0836 : VULNERABLE>>https://exploit-db.com/exploits/46718>>https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/ \u2013 CVE-2019-0841 : VULNERABLE>>https://github.com/rogue-kdc/CVE-2019-0841>>https://rastamouse.me/tags/cve-2019-0841/ \u2013 CVE-2019-1064 : VULNERABLE>>https://www.rythmstick.net/posts/cve-2019-1064/ [\u2026]\n\nThe post Watson : Enumerate Missing KBs & Suggest Exploits For Useful Privilege Escalation Vulnerabilities appeared first on Kali Linux Tutorials.", "url": "https://t.me/hacking_Attack/4649", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-08T12:00:04.672Z", "date_only": false, "value": "2026-09-08T12:00:04.672165Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/3655", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "4328d81a-84ed-4c77-b3ae-a9e2f4843a90", "content": "Watson is a .NET tool designed to enumerate missing KBs and suggest exploits (https://www.kitploit.com/search/label/Exploits) for Privilege Escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) vulnerabilities.\nSupported Versions\nWindows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004  Server 2016 & 2019  \nUsage\nC:\\> Watson.exe\n  __    __      _\n / / /\\ \\ \\__ _| |_ ___  ___  _ __\n \\ \\/  \\/ / _` | __/ __|/ _ \\| '_ \\\n  \\  /\\  / (_| | |_\\__ \\ (_) | | | |\n   \\/  \\/ \\__,_|\\__|___/\\___/|_| |_|\n\n                           v2.0\n\n                   @_RastaMouse\n\n [*] OS Build Number: 14393\n [*] Enumerating installed KBs...\n\n [!] CVE-2019-0836 : VULNERABLE\n  [>] https://exploit-db.com/exploits/46718\n  [>] https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/\n\n [!] CVE-2019-0841 : VULNERABLE\n  [>] https://github.com/rogue-kdc/CVE-2019-0841\n  [>] https://rastamouse.me/tags/cve-2019-0841/\n\n [!] CVE-2019-1064 : VULNERABLE\n  [>] https://www.rythmstick.net/posts/cve-2019-1064/\n\n [!] CVE-2019-1130 : VULNERABLE\n  [>] https://github.com/S3cur3Th1sSh1t/SharpByeBear\n\n [!] CVE-   2019-1253 : VULNERABLE\n  [>] https://github.com/padovah4ck/CVE-2019-1253\n\n [!] CVE-2019-1315 : VULNERABLE\n  [>] https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html\n\n [*] Finished. Found 6 potential vulnerabilities.\n  \nIssues\n  I try to update Watson after every Patch Tuesday, but for potential false positives check the latest supersedence information in the Windows Update Catalog (https://www.catalog.update.microsoft.com/Home.aspx).  If you still think there's an error, raise an Issue with the Bug label.      If there's a particular vulnerability (https://www.kitploit.com/search/label/Vulnerability) that you want to see in Watson that's not already included, raise an Issue with the Vulnerability Request label and include the CVE number.      If you know of a good exploit for any of the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in Watson, raise an Issue with the Exploit Suggestion label and provide a URL to the exploit.    \n\nDownload Watson (https://github.com/rasta-mouse/Watson)", "url": "https://t.me/hacking_Attack/3655", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-08T12:00:04.981Z", "date_only": false, "value": "2026-09-08T12:00:04.981611Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/3666", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "3f670bd6-796d-44d8-8f38-7d38cce93893", "content": "Watson - Enumerate Missing KBs And Suggest Exploits For Useful Privilege Escalation Vulnerabilities\n\n Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.Supported Versions Windows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004 Server 2016 & 2019 Usage C:\\> Watson.exe _ _ _ / / /\\ \\ \\_ _| |_ _ _ _ _ \\ \\/ \\/ / _` | _/ _|/ _ \\| '_ \\ \\ /\\ / (_| | |_\\_ \\ () | | | | \\/ \\/ \\\\,_|\\_|_/\\_/|_| |_| v2.0 @_RastaMouse \\* OS Build Number: 14393 \\* Enumerating installed KBs... ! CVE-2019-0836 : VULNERABLE > https://exploit-db.com/exploits/46718 > https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/ ! CVE-2019-0841 : VULNERABLE > https://github.com/rogue-kdc/CVE-2019-0841 > https://rastamouse.me/tags/cve-2019-0841/ ! CVE-2019-1064 : VULNERABLE > https://www.rythmstick.net/posts/cve-2019-1064/ ! CVE-2019-1130 : VULNERABLE > https://github.com/S3cur3Th1sSh1t/SharpByeBear ! CVE- 2019-1253 : VULNERABLE > https://github.com/padovah4ck/CVE-2019-1253 ! CVE-2019-1315 : VULNERABLE > https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html \\* Finished. Found 6 potential vulnerabilities. Issues I try to update Watson after every Patch Tuesday, but for potential false positives check the latest supersedence information in the Windows Update Catalog. If you still think there's an error, raise an Issue with the Bug label. If there's a particular vulnerability that you want to see in Watson that's not already included, raise an Issue with the Vulnerability Request label and include the CVE number. If you know of a good exploit for any of the vulnerabilities in Watson, raise an Issue with the Exploit Suggestion label and provide a URL to the exploit. Download Watson\nRead more...", "url": "https://t.me/hacking_Attack/3666", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-08T12:00:05.335Z", "date_only": false, "value": "2026-09-08T12:00:05.335301Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/3668", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "69186ead-e4bc-4a00-8ed3-73e3a475c7f0", "content": "KitPloit - PenTest Tools!\nWatson - Enumerate Missing KBs And Suggest Exploits For Useful Privilege Escalation Vulnerabilities\n\nhttps://1.bp.blogspot.com/-of7mBTen-mk/YGKeTq2QQiI/AAAAAAAAVwA/-paRxYr-yvES1HxqVwS_uS4YoNPRqUAfwCNcBGAsYHQ/w640-h316/Privilege%2BEscalation.png \nWatson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.\nSupported Versions\n\n* Windows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004\n* Server 2016 & 2019\n\nUsage\nC:\\> Watson.exe\n__    __      _\n/ / /\\ \\ \\__ _| |_ ___  ___  _ __\n\\ \\/  \\/ / _` | __/ __|/ _ \\| '_ \\\n\\  /\\  / (_| | |_\\__ \\ (_) | | | |\n\\/  \\/ \\__,_|\\__|___/\\___/|_| |_|\n\nv2.0\n\n@_RastaMouse\n\n[*] OS Build Number: 14393\n[*] Enumerating installed KBs...\n\n[!] CVE-2019-0836 : VULNERABLE\n[>] https://exploit-db.com/exploits/46718\n[>] https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/\n\n[!] CVE-2019-0841 : VULNERABLE\n[>] https://github.com/rogue-kdc/CVE-2019-0841\n[>] https://rastamouse.me/tags/cve-2019-0841/\n\n[!] CVE-2019-1064 : VULNERABLE\n[>] https://www.rythmstick.net/posts/cve-2019-1064/\n\n[!] CVE-2019-1130 : VULNERABLE\n[>] https://github.com/S3cur3Th1sSh1t/SharpByeBear\n\n[!] CVE-   2019-1253 : VULNERABLE\n[>] https://github.com/padovah4ck/CVE-2019-1253\n\n[!] CVE-2019-1315 : VULNERABLE\n[>] https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html\n\n[*] Finished. Found 6 potential vulnerabilities.\n\nIssues\n\n* \nI try to update Watson after every Patch Tuesday, but for potential false positives check the latest supersedence information in the Windows Update Catalog.  If you still think there's an error, raise an Issue with the Buglabel.\n\n* \nIf there's a particular vulnerability that you want to see in Watson that's not already included, raise an Issue with the Vulnerability Requestlabel and include the CVE number.\n\n* \nIf you know of a good exploit for any of the vulnerabilities in Watson, raise an Issue with the Exploit Suggestionlabel and provide a URL to the exploit.\nDownload Watson", "url": "https://t.me/hacking_Attack/3668", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-04T13:31:51Z", "date_only": false, "value": "2026-11-04T13:31:51+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2019-0841", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "50426b7b-c26f-4856-b7f1-a705b31d2b9e", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-14T16:50:12.633Z", "anchors": {"origin": {"timestamp": "2019-04-09T20:18:32Z", "date_only": false, "value": "2019-04-09T20:18:32.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2019-04-09T20:18:32Z", "date_only": false, "value": "2019-04-09T20:18:32.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2019-04-10T08:14:06Z", "date_only": false, "value": "2019-04-10T08:14:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ExcreamOnSecurity/40", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "d75a0e6a-80dd-4cb7-8e02-9f866bb266b9", "content": "DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841)\n\nThis vulnerability allows low privileged users to hijack file that are owned by NT AUTHORITY\\SYSTEM by overwriting permissions on the targeted file. Successful exploitation results in \"Full Control\" permissions for the low privileged user. \n\nhttps://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/\n\n#privesc #windows", "url": "https://t.me/ExcreamOnSecurity/40", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2019-06-07T10:54:13Z", "date_only": false, "value": "2019-06-07T10:54:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/antichat/5312", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "e92c8130-29f4-4b98-ac93-7e8d00e74ce4", "content": "Hacker going by the name of SandboxEscaper today discloses a second zero-day exploit that apparently bypasses Microsoft's patch for a Windows EoP vulnerability (CVE-2019-0841)\n\nhttps://thehackernews.com/2019/06/windows-eop-exploit.html", "url": "https://t.me/antichat/5312", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 5063741.0, "hours": 1406.5947222222221, "days": 58.60811342592593, "min_seconds": 5063741.0, "max_seconds": 5063741.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2019-04-09T20:18:32Z", "date_only": false, "value": "2019-04-09T20:18:32.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2019-06-07T10:54:13Z", "date_only": false, "value": "2019-06-07T10:54:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/antichat/5312", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "e92c8130-29f4-4b98-ac93-7e8d00e74ce4", "content": "Hacker going by the name of SandboxEscaper today discloses a second zero-day exploit that apparently bypasses Microsoft's patch for a Windows EoP vulnerability (CVE-2019-0841)\n\nhttps://thehackernews.com/2019/06/windows-eop-exploit.html", "url": "https://t.me/antichat/5312", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 5063741.0, "hours": 1406.5947222222221, "days": 58.60811342592593, "min_seconds": 5063741.0, "max_seconds": 5063741.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2019-04-09T20:18:32Z", "date_only": false, "value": "2019-04-09T20:18:32.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2019-06-07T10:54:13Z", "date_only": false, "value": "2019-06-07T10:54:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/antichat/5312", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "e92c8130-29f4-4b98-ac93-7e8d00e74ce4", "content": "Hacker going by the name of SandboxEscaper today discloses a second zero-day exploit that apparently bypasses Microsoft's patch for a Windows EoP vulnerability (CVE-2019-0841)\n\nhttps://thehackernews.com/2019/06/windows-eop-exploit.html", "url": "https://t.me/antichat/5312", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 42934.0, "hours": 11.926111111111112, "days": 0.4969212962962963, "min_seconds": 42934.0, "max_seconds": 42934.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2019-04-09T20:18:32Z", "date_only": false, "value": "2019-04-09T20:18:32.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2019-04-10T08:14:06Z", "date_only": false, "value": "2019-04-10T08:14:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ExcreamOnSecurity/40", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "d75a0e6a-80dd-4cb7-8e02-9f866bb266b9", "content": "DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841)\n\nThis vulnerability allows low privileged users to hijack file that are owned by NT AUTHORITY\\SYSTEM by overwriting permissions on the targeted file. Successful exploitation results in \"Full Control\" permissions for the low privileged user. \n\nhttps://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/\n\n#privesc #windows", "url": "https://t.me/ExcreamOnSecurity/40", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 239833900.633942, "hours": 66620.52795387278, "days": 2775.855331411366, "min_seconds": 239833900.633942, "max_seconds": 239833900.633942, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2019-04-09T20:18:32Z", "date_only": false, "value": "2019-04-09T20:18:32.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2019-0841", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T16:50:12.633Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 234770159.633942, "hours": 65213.93323165056, "days": 2717.24721798544, "min_seconds": 234770159.633942, "max_seconds": 234770159.633942, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2019-06-07T10:54:13Z", "date_only": false, "value": "2019-06-07T10:54:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/antichat/5312", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "e92c8130-29f4-4b98-ac93-7e8d00e74ce4", "content": "Hacker going by the name of SandboxEscaper today discloses a second zero-day exploit that apparently bypasses Microsoft's patch for a Windows EoP vulnerability (CVE-2019-0841)\n\nhttps://thehackernews.com/2019/06/windows-eop-exploit.html", "url": "https://t.me/antichat/5312", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T16:50:12.633Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 239790966.633942, "hours": 66608.60184276167, "days": 2775.3584101150695, "min_seconds": 239790966.633942, "max_seconds": 239790966.633942, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2019-04-10T08:14:06Z", "date_only": false, "value": "2019-04-10T08:14:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ExcreamOnSecurity/40", "record": "CVE-2019-0841", "field": "creation_timestamp", "uuid": "d75a0e6a-80dd-4cb7-8e02-9f866bb266b9", "content": "DACL Permissions Overwrite Privilege Escalation (CVE-2019-0841)\n\nThis vulnerability allows low privileged users to hijack file that are owned by NT AUTHORITY\\SYSTEM by overwriting permissions on the targeted file. Successful exploitation results in \"Full Control\" permissions for the low privileged user. \n\nhttps://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/\n\n#privesc #windows", "url": "https://t.me/ExcreamOnSecurity/40", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T16:50:12.633Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}