{"vulnerability": "CVE-2021-3198", "sightings": [{"uuid": "e1423c83-99d4-4403-a259-68dbdde4d467", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31985", "type": "seen", "source": "Telegram/sbShMy_szHcFFDz5Gues9pVb1XSeSp4jYH2MnsGjWmhzjQNb", "content": "", "creation_timestamp": "2023-01-16T13:03:00.000000Z"}, {"uuid": "4c0ad501-3872-4339-ba30-a16634344fcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31982", "type": "seen", "source": "https://t.me/cibsecurity/65842", "content": "\u203c CVE-2021-31982 \u203c\n\nMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-01T07:15:50.000000Z"}, {"uuid": "6fc23eba-4f01-4a25-8097-8504b50b67b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31985", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3055", "content": "CVE-2021-31985: Exploiting the Windows Defender AsProtect Heap Overflow Vulnerability https://www.pixiepointsecurity.com/blog/nday-cve-2021-31985.html", "creation_timestamp": "2026-08-02T20:15:15.210916Z"}, {"uuid": "286a0803-2166-4077-8f96-e07880e8f403", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31987", "type": "seen", "source": "https://t.me/cibsecurity/30017", "content": "\u203c CVE-2021-31987 \u203c\n\nA user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-06T02:30:54.000000Z"}, {"uuid": "b9b32072-3317-4e59-99f4-1baa58e31b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31988", "type": "seen", "source": "https://t.me/cibsecurity/30025", "content": "\u203c CVE-2021-31988 \u203c\n\nA user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary SMTP headers in the generated test email.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-06T02:31:05.000000Z"}, {"uuid": "c9cc7cc2-559a-4ab6-b4d8-8584e47d2508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31986", "type": "seen", "source": "https://t.me/cibsecurity/30023", "content": "\u203c CVE-2021-31986 \u203c\n\nUser controlled parameters related to SMTP notifications are not correctly validated. This can lead to a buffer overflow resulting in crashes and data leakage.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-06T02:31:03.000000Z"}, {"uuid": "cf4e4c70-e38e-4a4b-8e60-91ff02321d29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31985", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3055", "content": "CVE-2021-31985: Exploiting the Windows Defender AsProtect Heap Overflow Vulnerability https://www.pixiepointsecurity.com/blog/nday-cve-2021-31985.html", "creation_timestamp": "2026-08-03T01:09:18.687834Z"}, {"uuid": "a1a8bbe0-25c7-4877-a7e3-cb9f6b6e2716", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31985", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3793", "content": "CVE-2021-31985:\nWindows Defender Antivirus - asprotect embedded runtime dll memory corruption\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2189", "creation_timestamp": "2021-07-08T12:27:01.000000Z"}, {"uuid": "de7080cb-7141-404f-9fe8-98cf380b36ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31985", "type": "seen", "source": "https://t.me/reverseame/3055", "content": "CVE-2021-31985: Exploiting the Windows Defender AsProtect Heap Overflow Vulnerability https://www.pixiepointsecurity.com/blog/nday-cve-2021-31985.html", "creation_timestamp": "2026-07-29T12:02:34.526057Z"}, {"uuid": "18c439d1-7f67-4bca-826f-fccfb43b6a9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31985", "type": "seen", "source": "https://t.me/reverseame/3055", "content": "CVE-2021-31985: Exploiting the Windows Defender AsProtect Heap Overflow Vulnerability https://www.pixiepointsecurity.com/blog/nday-cve-2021-31985.html", "creation_timestamp": "2026-07-30T00:02:32.798309Z"}, {"uuid": "2997842c-f1d0-46b2-beaa-651edb168170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31985", "type": "seen", "source": "https://t.me/hacking_Attack/12054", "content": "Black Hat Ethical Hacking\nMicrosoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 Flaws\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 FlawsPost Views: 53 \nReading Time: 2 Minutes\nResearchers discovered a highly targeted malware campaign launched in April, in which a new, unknown threat actor used two of the vulnerabilities that Microsoft said are under active attack.\nMicrosoft jumped on 50 vulnerabilities in this month\u2019s Patch Tuesday update, issuing fixes for CVEs in Microsoft Windows, .NET Core and Visual Studio, Microsoft Office, Microsoft Edge (Chromium-based and EdgeHTML), SharePoint Server, Hyper-V, Visual Studio Code \u2013 Kubernetes Tools, Windows HTML Platform, and Windows Remote Desktop.\n\nFive of the CVEs are rated Critical and 45 are rated Important in severity. Microsoft reported that six of the bugs are currently under active attack, while three are publicly known at the time of release.\n\nThe number might seem light \u2013 it represents six fewer patches than Microsoft released in May \u2013 but the number of critical vulnerabilities ticked up to five month-over-month.\n\nThose actively exploited vulnerabilities can enable an attacker to hijack a system. They have no workarounds, so some security experts are recommending that they be patched as the highest priority.\n\nThe six CVEs under active attack in the wild include four elevation of privilege vulnerabilities, one information disclosure vulnerability and one remote code execution (RCE) vulnerability.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries Critical Bugs of NoteCVE-2021-31985\u00a0is a critical RCE vulnerability in Microsoft\u2019s Defender antimalware software that should grab attention. A similar, critical bug in Defender was patched in January. The most serious of the year\u2019s first Patch Tuesday, that earlier Defender bug was an RCE vulnerability that came under active exploit.\n\nAnother critical flaw is CVE-2021-31963, a Microsoft SharePoint Server RCE vulnerability. Jay Goodman, director of product marketing at Automox, said in a blog post\u00a0that an attacker exploiting this vulnerability \u201ccould take control of a system where they would be free to install programs, view or change data, or create new accounts on the target system with full user rights.\u201d\nWhile Microsoft reports that this vulnerability is less likely to be exploited,Goodman suggested that organizations don\u2019t let it slide: \u201cPatching critical vulnerabilities in the 72-hour window before attackers can weaponize is an important first step to maintaining a safe and secure infrastructure,\u201d he observed. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/08141612/Sophos-impact-chart-June-21-patch-Tuesday-e1623176186946.png A year-to-date summary of 2021 Microsoft vulnerability releases as of June. Source: Sophos\nSee Also: Offensive Security Tool: Pacu \u2013 The Amazon Web Services Exploitation Framework Bugs Exploited in the WildMicrosoft fixed a total of seven zero-day vulnerabilities. One was CVE-2021-31968, Windows Remote Desktop Services Denial of Service Vulnerability that was publicly disclosed but hasn\u2019t been seen in attacks. It was issued a CVSS score of 7.5.\n\nThese are the six flaws that MIcrosoft said are under active attack, all of them also zero days.\n\n* CVE-2021-31955\u00a0\u2013 Windows Kernel Information Disclosure Vulnerability. Rating: Important. CVSS 5.5\n* CVE-2021-31956\u00a0\u2013 Windows NTFS Elevation of Privilege Vulnerability. Rating: Important. CVSS 7.8\n* CVE-2021-33739\u00a0\u2013 Microsoft DWM Core Library Elevation of Privilege Vulnerability. Rating: Importa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:38.224659Z"}, {"uuid": "f51dedf4-e6be-4b6a-93f4-928bb4367065", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31985", "type": "seen", "source": "https://t.me/hacking_Attack/12054", "content": "Black Hat Ethical Hacking\nMicrosoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 Flaws\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 FlawsPost Views: 53 \nReading Time: 2 Minutes\nResearchers discovered a highly targeted malware campaign launched in April, in which a new, unknown threat actor used two of the vulnerabilities that Microsoft said are under active attack.\nMicrosoft jumped on 50 vulnerabilities in this month\u2019s Patch Tuesday update, issuing fixes for CVEs in Microsoft Windows, .NET Core and Visual Studio, Microsoft Office, Microsoft Edge (Chromium-based and EdgeHTML), SharePoint Server, Hyper-V, Visual Studio Code \u2013 Kubernetes Tools, Windows HTML Platform, and Windows Remote Desktop.\n\nFive of the CVEs are rated Critical and 45 are rated Important in severity. Microsoft reported that six of the bugs are currently under active attack, while three are publicly known at the time of release.\n\nThe number might seem light \u2013 it represents six fewer patches than Microsoft released in May \u2013 but the number of critical vulnerabilities ticked up to five month-over-month.\n\nThose actively exploited vulnerabilities can enable an attacker to hijack a system. They have no workarounds, so some security experts are recommending that they be patched as the highest priority.\n\nThe six CVEs under active attack in the wild include four elevation of privilege vulnerabilities, one information disclosure vulnerability and one remote code execution (RCE) vulnerability.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries Critical Bugs of NoteCVE-2021-31985\u00a0is a critical RCE vulnerability in Microsoft\u2019s Defender antimalware software that should grab attention. A similar, critical bug in Defender was patched in January. The most serious of the year\u2019s first Patch Tuesday, that earlier Defender bug was an RCE vulnerability that came under active exploit.\n\nAnother critical flaw is CVE-2021-31963, a Microsoft SharePoint Server RCE vulnerability. Jay Goodman, director of product marketing at Automox, said in a blog post\u00a0that an attacker exploiting this vulnerability \u201ccould take control of a system where they would be free to install programs, view or change data, or create new accounts on the target system with full user rights.\u201d\nWhile Microsoft reports that this vulnerability is less likely to be exploited,Goodman suggested that organizations don\u2019t let it slide: \u201cPatching critical vulnerabilities in the 72-hour window before attackers can weaponize is an important first step to maintaining a safe and secure infrastructure,\u201d he observed. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/08141612/Sophos-impact-chart-June-21-patch-Tuesday-e1623176186946.png A year-to-date summary of 2021 Microsoft vulnerability releases as of June. Source: Sophos\nSee Also: Offensive Security Tool: Pacu \u2013 The Amazon Web Services Exploitation Framework Bugs Exploited in the WildMicrosoft fixed a total of seven zero-day vulnerabilities. One was CVE-2021-31968, Windows Remote Desktop Services Denial of Service Vulnerability that was publicly disclosed but hasn\u2019t been seen in attacks. It was issued a CVSS score of 7.5.\n\nThese are the six flaws that MIcrosoft said are under active attack, all of them also zero days.\n\n* CVE-2021-31955\u00a0\u2013 Windows Kernel Information Disclosure Vulnerability. Rating: Important. CVSS 5.5\n* CVE-2021-31956\u00a0\u2013 Windows NTFS Elevation of Privilege Vulnerability. Rating: Important. CVSS 7.8\n* CVE-2021-33739\u00a0\u2013 Microsoft DWM Core Library Elevation of Privilege Vulnerability. Rating: Importa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:13.946072Z"}]}