{"vulnerability": "cve-2019-18935", "sightings": [{"uuid": "c443c85d-3bef-4848-ab1b-78e694453530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/48e15610-a505-4067-8dec-4627e36bcbe7", "content": "", "creation_timestamp": "2020-10-14T09:36:45.000000Z"}, {"uuid": "4ab71848-632b-49f3-85bc-0678aacbecbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/f971bfc7-39b9-48fe-aa93-786fdb990b7d", "content": "", "creation_timestamp": "2020-07-31T14:12:17.000000Z"}, {"uuid": "efa6bb66-956c-4f19-90ba-221addd7a005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/5f850411-c103-491f-abff-9421425403cf", "content": "", "creation_timestamp": "2020-10-21T08:19:10.000000Z"}, {"uuid": "ded3f630-be3e-49a4-b157-b7fde597fb46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/42d04e94-bf5b-427d-acc8-f5d740675941", "content": "", "creation_timestamp": "2020-10-20T15:57:21.000000Z"}, {"uuid": "08ae1c69-4afa-4c72-aa5c-295b6649f213", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "7b0aac54-48a5-4c7b-8dd5-977d9d5e8530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:19.000000Z"}, {"uuid": "25dd632f-cf9c-4a5c-939a-b6a90a9bbc38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/2eb940ea-6344-4f7b-b5a8-9b67270786a7", "content": "", "creation_timestamp": "2020-10-09T13:49:45.000000Z"}, {"uuid": "43683733-cc6d-4cc4-8b5c-fd2e29c2c7aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/d925a2ee-e7cf-46f6-bec1-ad8e19122730", "content": "", "creation_timestamp": "2020-10-20T15:58:04.000000Z"}, {"uuid": "2cddd899-c810-4baf-a770-da96f47d6a05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/2f70ea6d-175a-4b62-bedf-8d927dc7ab91", "content": "", "creation_timestamp": "2024-11-14T06:10:06.000000Z"}, {"uuid": "3b6da3ef-79a6-468b-93a1-847d5a2ad429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://bsky.app/profile/jaiminton.com/post/3ldpgzso3322f", "content": "", "creation_timestamp": "2024-12-20T03:29:05.576281Z"}, {"uuid": "52292ea7-ee4d-4c95-bcea-56c1e0d75617", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970955", "content": "", "creation_timestamp": "2024-12-24T20:22:16.234714Z"}, {"uuid": "58ee484f-7e13-47f6-a956-cc2a8f5443e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "204f6559-6522-4606-ab14-b0a0d6783a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-29)", "content": "", "creation_timestamp": "2025-03-29T00:00:00.000000Z"}, {"uuid": "27e2a7d9-8eeb-4b1a-9016-869b9e43d93f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3lhgctkwwpd2s", "content": "", "creation_timestamp": "2025-02-05T10:00:48.382776Z"}, {"uuid": "2d183d01-b58e-45c3-ae77-5298285aba1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://bsky.app/profile/hackingne.ws/post/3lhgoqzjp462e", "content": "", "creation_timestamp": "2025-02-05T13:34:07.265692Z"}, {"uuid": "9ba09902-d980-4530-b171-5ac1c7b3817b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2024-12-13)", "content": "", "creation_timestamp": "2024-12-13T00:00:00.000000Z"}, {"uuid": "beb2063e-196b-4022-9ff2-f37f51f6157a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://bsky.app/profile/dinosn.bsky.social/post/3lhfm5fj7z22f", "content": "", "creation_timestamp": "2025-02-05T03:14:44.223219Z"}, {"uuid": "ce7a5817-943b-4593-8fa0-10d9badd88de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-30)", "content": "", "creation_timestamp": "2025-03-30T00:00:00.000000Z"}, {"uuid": "51d3a3b9-0258-43b4-ba49-ebf465860662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:14.000000Z"}, {"uuid": "e7922850-e2f5-4dfd-a0d5-36a50129328a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-18)", "content": "", "creation_timestamp": "2025-03-18T00:00:00.000000Z"}, {"uuid": "240d1312-5e7b-4c3a-9309-416bc97c95bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-25)", "content": "", "creation_timestamp": "2025-03-25T00:00:00.000000Z"}, {"uuid": "b5473e03-c6db-4eed-a94b-5cddb0db580c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-07)", "content": "", "creation_timestamp": "2025-03-07T00:00:00.000000Z"}, {"uuid": "87b5de82-476e-47d2-b128-a6aa977f5b77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-20)", "content": "", "creation_timestamp": "2025-03-20T00:00:00.000000Z"}, {"uuid": "cd81942d-f32b-481f-9766-46b200ac0a9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-07)", "content": "", "creation_timestamp": "2025-03-07T00:00:00.000000Z"}, {"uuid": "e881ab6a-e9d3-40d2-a784-c54abeaf803d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-26)", "content": "", "creation_timestamp": "2025-03-26T00:00:00.000000Z"}, {"uuid": "b531e76b-4316-45f9-a62e-ccd0d0dee401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-25)", "content": "", "creation_timestamp": "2025-03-25T00:00:00.000000Z"}, {"uuid": "4af1a695-65ed-4768-aabd-55b16b99dd24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:43.000000Z"}, {"uuid": "1ba8c800-bf74-48cf-b5a4-3c98b7409933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-22)", "content": "", "creation_timestamp": "2025-03-22T00:00:00.000000Z"}, {"uuid": "b40e7673-e9f6-4cbe-adf8-ac142e641e88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-21)", "content": "", "creation_timestamp": "2025-03-21T00:00:00.000000Z"}, {"uuid": "d76545ce-b120-49a4-b482-a2f2406f3a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-27)", "content": "", "creation_timestamp": "2025-03-27T00:00:00.000000Z"}, {"uuid": "8c8126b4-4788-4c3c-a06c-ac454560feb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-28)", "content": "", "creation_timestamp": "2025-03-28T00:00:00.000000Z"}, {"uuid": "92608288-208a-4758-949a-527b0cd3eda2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-02)", "content": "", "creation_timestamp": "2025-04-02T00:00:00.000000Z"}, {"uuid": "16b20967-3a4c-43e8-a36b-633e0e1431bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-04)", "content": "", "creation_timestamp": "2025-04-04T00:00:00.000000Z"}, {"uuid": "d7c760c5-b083-42e0-8bb8-4cab64680d9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-05)", "content": "", "creation_timestamp": "2025-04-05T00:00:00.000000Z"}, {"uuid": "dab2ad14-95bb-4618-a3bd-f63045ef5b18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-06)", "content": "", "creation_timestamp": "2025-04-06T00:00:00.000000Z"}, {"uuid": "49686c1a-26ba-4b94-9e45-005bbe4cc73a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-18)", "content": "", "creation_timestamp": "2025-05-18T00:00:00.000000Z"}, {"uuid": "f253ae22-0d1c-4ea4-aa82-d3414e025e29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-07)", "content": "", "creation_timestamp": "2025-04-07T00:00:00.000000Z"}, {"uuid": "4e126471-2f88-4cc4-8c69-56fff88e1381", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-08)", "content": "", "creation_timestamp": "2025-04-08T00:00:00.000000Z"}, {"uuid": "df7f000a-39fd-4ee5-8820-a179510c5f62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-09)", "content": "", "creation_timestamp": "2025-04-09T00:00:00.000000Z"}, {"uuid": "e3f86f57-ac0b-48fd-9de0-15f2229f07c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "http://www.zerodayinitiative.com/advisories/ZDI-25-468/", "content": "", "creation_timestamp": "2025-07-03T03:00:00.000000Z"}, {"uuid": "2f12188b-cb2a-4348-b78d-6596e5c5646d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-10)", "content": "", "creation_timestamp": "2025-04-10T00:00:00.000000Z"}, {"uuid": "740792a3-7ce8-44b1-990e-19e2b923e9f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-11)", "content": "", "creation_timestamp": "2025-04-11T00:00:00.000000Z"}, {"uuid": "f6aaa46f-7e99-4397-b5d6-02b75d4ca6bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-07)", "content": "", "creation_timestamp": "2025-06-07T00:00:00.000000Z"}, {"uuid": "d5f090fa-bfbf-4d89-a560-a1f8475e52fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-12)", "content": "", "creation_timestamp": "2025-04-12T00:00:00.000000Z"}, {"uuid": "caa21eba-7bd1-47af-be1c-417495c6426d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-14)", "content": "", "creation_timestamp": "2025-04-14T00:00:00.000000Z"}, {"uuid": "930a9ce9-18a8-48c9-a037-7212efc298e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-13)", "content": "", "creation_timestamp": "2025-06-13T00:00:00.000000Z"}, {"uuid": "1728f30a-1f85-419f-93ce-bc1de205e399", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-15)", "content": "", "creation_timestamp": "2025-04-15T00:00:00.000000Z"}, {"uuid": "28851395-c552-41ac-a56d-20f423f7ce17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-11)", "content": "", "creation_timestamp": "2025-06-11T00:00:00.000000Z"}, {"uuid": "96836479-58b9-4b54-915d-3b14530034e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-03)", "content": "", "creation_timestamp": "2025-06-03T00:00:00.000000Z"}, {"uuid": "02a207d3-97fb-4e3f-b3fc-b7e49f892f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-16)", "content": "", "creation_timestamp": "2025-04-16T00:00:00.000000Z"}, {"uuid": "660eb500-d053-4e90-8848-c2355fb7be5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-16)", "content": "", "creation_timestamp": "2025-04-16T00:00:00.000000Z"}, {"uuid": "d1007428-ad03-4aa9-b799-aac35e46a1ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-17)", "content": "", "creation_timestamp": "2025-04-17T00:00:00.000000Z"}, {"uuid": "66454ccd-087b-40e6-a6e9-5528a9926e8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-18)", "content": "", "creation_timestamp": "2025-04-18T00:00:00.000000Z"}, {"uuid": "6c48adfb-5e25-4a96-a91f-e5b346813b8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-19)", "content": "", "creation_timestamp": "2025-04-19T00:00:00.000000Z"}, {"uuid": "2f7973ff-6141-4b57-9d91-4e1763cfa8da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-20)", "content": "", "creation_timestamp": "2025-04-20T00:00:00.000000Z"}, {"uuid": "ab13b110-bfe6-4b75-ba32-ee5989266c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-20)", "content": "", "creation_timestamp": "2025-04-20T00:00:00.000000Z"}, {"uuid": "d1f28519-7d17-435e-8f57-83be0a799b23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-30)", "content": "", "creation_timestamp": "2025-05-30T00:00:00.000000Z"}, {"uuid": "58b9cec1-6834-4c19-b758-2a973ea834fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-16)", "content": "", "creation_timestamp": "2025-06-16T00:00:00.000000Z"}, {"uuid": "587bfe0e-1d69-4c6d-9d73-37231133b680", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-22)", "content": "", "creation_timestamp": "2025-04-22T00:00:00.000000Z"}, {"uuid": "233884ca-b3d5-4a38-acc0-1e5e1b4ad888", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-16)", "content": "", "creation_timestamp": "2025-05-16T00:00:00.000000Z"}, {"uuid": "9725240b-8a8b-4fde-a02d-5739080b00b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-23)", "content": "", "creation_timestamp": "2025-04-23T00:00:00.000000Z"}, {"uuid": "84bb0647-5884-4bd4-9cca-e05b94e9961c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-08)", "content": "", "creation_timestamp": "2025-06-08T00:00:00.000000Z"}, {"uuid": "023a7081-0f93-42c4-adb1-89338e33104a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-14)", "content": "", "creation_timestamp": "2025-06-14T00:00:00.000000Z"}, {"uuid": "7fc82735-e393-4902-b7a0-8b0ec4436d9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-02)", "content": "", "creation_timestamp": "2025-06-02T00:00:00.000000Z"}, {"uuid": "4ef795c5-32c9-4be7-9cb2-df2acd8e7d37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-29)", "content": "", "creation_timestamp": "2025-04-29T00:00:00.000000Z"}, {"uuid": "8e6200e2-7edd-4acb-91a9-c626f9794215", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-30)", "content": "", "creation_timestamp": "2025-04-30T00:00:00.000000Z"}, {"uuid": "3005771d-dab3-4a20-a5ce-0e752186a3e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-01)", "content": "", "creation_timestamp": "2025-05-01T00:00:00.000000Z"}, {"uuid": "e58d288f-4a56-4a56-8bdd-1afad932399c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-01)", "content": "", "creation_timestamp": "2025-05-01T00:00:00.000000Z"}, {"uuid": "85451f8b-5826-4295-b948-ee5645f58a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-02)", "content": "", "creation_timestamp": "2025-05-02T00:00:00.000000Z"}, {"uuid": "8c317be0-b6a0-469d-9ff7-c6ea3118e792", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-31)", "content": "", "creation_timestamp": "2025-05-31T00:00:00.000000Z"}, {"uuid": "f498b342-4c66-423a-827f-d3028bc25cd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-10)", "content": "", "creation_timestamp": "2025-06-10T00:00:00.000000Z"}, {"uuid": "57e39cd4-6aa9-493f-962d-afe76362891a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-03)", "content": "", "creation_timestamp": "2025-05-03T00:00:00.000000Z"}, {"uuid": "7e8b9869-9ebf-4bc3-9c79-ce43552dbf17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-04)", "content": "", "creation_timestamp": "2025-05-04T00:00:00.000000Z"}, {"uuid": "f82d4d3c-2d7d-4a09-a130-da986af962bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-04)", "content": "", "creation_timestamp": "2025-05-04T00:00:00.000000Z"}, {"uuid": "4bf5f71b-0bb2-4971-8caa-b4e41b7ce3af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-05)", "content": "", "creation_timestamp": "2025-05-05T00:00:00.000000Z"}, {"uuid": "2fa3b968-5ada-4002-ae01-a43438c43784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-06)", "content": "", "creation_timestamp": "2025-05-06T00:00:00.000000Z"}, {"uuid": "d556541f-419b-46fe-acd3-c732820ac1da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-06)", "content": "", "creation_timestamp": "2025-05-06T00:00:00.000000Z"}, {"uuid": "bce452e0-ad76-44a0-8400-ef4aa823860e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-07)", "content": "", "creation_timestamp": "2025-05-07T00:00:00.000000Z"}, {"uuid": "88cd4d52-30d1-4646-8e7b-88bea34adfae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-07)", "content": "", "creation_timestamp": "2025-05-07T00:00:00.000000Z"}, {"uuid": "0d7c642d-efa9-417b-9316-4d6c20338e1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-17)", "content": "", "creation_timestamp": "2025-05-17T00:00:00.000000Z"}, {"uuid": "4d607a43-7354-4ba5-9001-092df19ff231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-08)", "content": "", "creation_timestamp": "2025-05-08T00:00:00.000000Z"}, {"uuid": "ae227764-5d81-4bd9-8d0e-05fa71f0b364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-08)", "content": "", "creation_timestamp": "2025-05-08T00:00:00.000000Z"}, {"uuid": "cecafaa6-c679-4b35-bd5f-e26e60e3847a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-09)", "content": "", "creation_timestamp": "2025-05-09T00:00:00.000000Z"}, {"uuid": "0b785789-1195-4341-bbe7-be1209de31e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-10)", "content": "", "creation_timestamp": "2025-05-10T00:00:00.000000Z"}, {"uuid": "82b52848-326d-4e0c-b625-7513d170c14e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-10)", "content": "", "creation_timestamp": "2025-05-10T00:00:00.000000Z"}, {"uuid": "70e50971-80c2-404d-84d3-7d7946018015", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-11)", "content": "", "creation_timestamp": "2025-05-11T00:00:00.000000Z"}, {"uuid": "4d11b5f5-b231-4aa7-91c8-c997d776653a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-12)", "content": "", "creation_timestamp": "2025-05-12T00:00:00.000000Z"}, {"uuid": "f76f89fb-b563-4037-a5ed-bd754c261dc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-15)", "content": "", "creation_timestamp": "2025-06-15T00:00:00.000000Z"}, {"uuid": "5d0be7c1-8838-4720-b5fb-b58292c3abaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-06)", "content": "", "creation_timestamp": "2025-06-06T00:00:00.000000Z"}, {"uuid": "9a69c482-bf1f-4df2-a458-6e84e8be3225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-29)", "content": "", "creation_timestamp": "2025-05-29T00:00:00.000000Z"}, {"uuid": "715e1429-95d7-4e0a-a4c4-6e880c782118", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-04)", "content": "", "creation_timestamp": "2025-06-04T00:00:00.000000Z"}, {"uuid": "cf3420ee-f486-45b1-92a7-a7af829848b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-13)", "content": "", "creation_timestamp": "2025-05-13T00:00:00.000000Z"}, {"uuid": "8b112dad-261f-4f2c-85fc-be2df9849e43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-14)", "content": "", "creation_timestamp": "2025-05-14T00:00:00.000000Z"}, {"uuid": "4f85d06c-b950-47b2-a1b1-73661d3be7f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-09)", "content": "", "creation_timestamp": "2025-06-09T00:00:00.000000Z"}, {"uuid": "bafe668b-3f81-4a95-b59c-ea8e702c5a08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-01)", "content": "", "creation_timestamp": "2025-06-01T00:00:00.000000Z"}, {"uuid": "38a6432e-1335-4666-95e8-cbceb50c8aa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/telerik_rau_deserialization.rb", "content": "", "creation_timestamp": "2020-10-20T18:32:21.000000Z"}, {"uuid": "2edb3fbb-427a-406b-86a3-f90dfcdb35f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-01)", "content": "", "creation_timestamp": "2025-10-01T00:00:00.000000Z"}, {"uuid": "37fc2c92-0f42-4f87-90c3-c5bcba4cd1f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-18)", "content": "", "creation_timestamp": "2025-10-18T00:00:00.000000Z"}, {"uuid": "630794ab-ab86-4de9-bd6a-8e70d2afbe9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-12)", "content": "", "creation_timestamp": "2025-09-12T00:00:00.000000Z"}, {"uuid": "e993753c-f5b7-497c-ac7c-522e11879106", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-29)", "content": "", "creation_timestamp": "2025-10-29T00:00:00.000000Z"}, {"uuid": "c9cc9648-159d-4ea5-bdeb-171b3846856b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-02)", "content": "", "creation_timestamp": "2025-10-02T00:00:00.000000Z"}, {"uuid": "4b47d491-76b8-4d5c-a686-268ea7eadcd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-02)", "content": "", "creation_timestamp": "2025-10-02T00:00:00.000000Z"}, {"uuid": "16a16523-6741-47f5-b2c7-ac64210da921", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-13)", "content": "", "creation_timestamp": "2025-09-13T00:00:00.000000Z"}, {"uuid": "4325b955-270e-4eb0-b91e-6bd499af3468", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-08)", "content": "", "creation_timestamp": "2025-10-08T00:00:00.000000Z"}, {"uuid": "b7e7eb70-b769-48ca-b5c7-c0f9bd246f16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-01)", "content": "", "creation_timestamp": "2025-11-01T00:00:00.000000Z"}, {"uuid": "a130c401-00ca-45b7-8f6e-b6cae5444581", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-09-07)", "content": "", "creation_timestamp": "2025-09-07T00:00:00.000000Z"}, {"uuid": "24181899-7796-4e4c-b18a-9902f838f684", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-03)", "content": "", "creation_timestamp": "2025-10-03T00:00:00.000000Z"}, {"uuid": "114b8cde-7c3e-4015-9aba-56029f36f599", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-14)", "content": "", "creation_timestamp": "2025-09-14T00:00:00.000000Z"}, {"uuid": "989383ee-ff30-4dd4-a20d-9867b6d25608", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-11)", "content": "", "creation_timestamp": "2025-10-11T00:00:00.000000Z"}, {"uuid": "a58067e4-9c0e-4183-878b-a2ffe9ac0db0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-28)", "content": "", "creation_timestamp": "2025-10-28T00:00:00.000000Z"}, {"uuid": "31f60b3e-d796-485d-bd42-eee52315259b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-24)", "content": "", "creation_timestamp": "2025-11-24T00:00:00.000000Z"}, {"uuid": "118f1e6f-78b7-478d-a693-b029a7cae4da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-24)", "content": "", "creation_timestamp": "2025-11-24T00:00:00.000000Z"}, {"uuid": "a09f96d8-aae5-445e-a521-9f8d15ccd36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-12)", "content": "", "creation_timestamp": "2025-10-12T00:00:00.000000Z"}, {"uuid": "93e54ce5-b31b-4287-af6b-367858fdd46d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-12)", "content": "", "creation_timestamp": "2025-10-12T00:00:00.000000Z"}, {"uuid": "42df2d00-13dc-471a-b7a6-f9f2bed00c68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-09-11)", "content": "", "creation_timestamp": "2025-09-11T00:00:00.000000Z"}, {"uuid": "800afa3e-d7cb-465f-bac0-7ba4ec3e9b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:12:39.000000Z"}, {"uuid": "95212882-8a42-4187-b9aa-f8f00403c634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-30)", "content": "", "creation_timestamp": "2025-09-30T00:00:00.000000Z"}, {"uuid": "04aee12f-be62-4e3e-a265-a50a026e28f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:48.000000Z"}, {"uuid": "a691b66a-aeb7-485c-badd-a2626867760b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-30)", "content": "", "creation_timestamp": "2025-11-30T00:00:00.000000Z"}, {"uuid": "07e6dc30-a46d-44c3-a774-e1e070a04060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-07)", "content": "", "creation_timestamp": "2026-02-07T00:00:00.000000Z"}, {"uuid": "3b91f55a-5f5f-4903-877b-b2242cdc193b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-18)", "content": "", "creation_timestamp": "2025-12-18T00:00:00.000000Z"}, {"uuid": "bba272f8-4ee6-4c34-86c1-3e9dd03d688c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-18)", "content": "", "creation_timestamp": "2025-12-18T00:00:00.000000Z"}, {"uuid": "2a1b2fc9-167e-4a6b-b1ae-d6f9cb338b18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-19)", "content": "", "creation_timestamp": "2025-12-19T00:00:00.000000Z"}, {"uuid": "0a207665-d24a-45ce-9b56-b51c2b7166f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-20)", "content": "", "creation_timestamp": "2025-12-20T00:00:00.000000Z"}, {"uuid": "f69e5db0-37db-41aa-8940-0c91239eb273", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-23)", "content": "", "creation_timestamp": "2025-12-23T00:00:00.000000Z"}, {"uuid": "95fc8997-520f-4626-9cb3-eea73baec2eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-24)", "content": "", "creation_timestamp": "2025-12-24T00:00:00.000000Z"}, {"uuid": "f00e0d3c-ea5c-4d40-b2b0-cda2b55483e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-24)", "content": "", "creation_timestamp": "2025-12-24T00:00:00.000000Z"}, {"uuid": "e3468057-bfe9-414d-8b5d-9d959dedc07a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-25)", "content": "", "creation_timestamp": "2025-12-25T00:00:00.000000Z"}, {"uuid": "3f8e14e0-5762-4e0a-8058-0c894b8959da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-06)", "content": "", "creation_timestamp": "2026-02-06T00:00:00.000000Z"}, {"uuid": "acdc9331-07ea-4e8b-9379-bd0146717e3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-25)", "content": "", "creation_timestamp": "2025-12-25T00:00:00.000000Z"}, {"uuid": "d3287c83-ece4-4f4b-9275-6d64ba2b10e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-26)", "content": "", "creation_timestamp": "2025-12-26T00:00:00.000000Z"}, {"uuid": "4ab637d6-3cc6-4e87-a391-787ea807fad0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-01)", "content": "", "creation_timestamp": "2026-01-01T00:00:00.000000Z"}, {"uuid": "150a77d5-d55d-4a04-9497-bba478156157", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-01)", "content": "", "creation_timestamp": "2026-01-01T00:00:00.000000Z"}, {"uuid": "4541a967-059a-4a62-97aa-0149dd482620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-02)", "content": "", "creation_timestamp": "2026-01-02T00:00:00.000000Z"}, {"uuid": "1ccc0230-7c21-4d80-8bf1-b162780ae38c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-02)", "content": "", "creation_timestamp": "2026-01-02T00:00:00.000000Z"}, {"uuid": "444a9469-9618-4360-ae2b-231204dfe1a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-03)", "content": "", "creation_timestamp": "2026-01-03T00:00:00.000000Z"}, {"uuid": "f4bdc3c7-042c-40c3-8ef0-7dc2e6653729", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-03)", "content": "", "creation_timestamp": "2026-01-03T00:00:00.000000Z"}, {"uuid": "89c33ede-7495-459e-99a1-95871a433d1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-05)", "content": "", "creation_timestamp": "2026-01-05T00:00:00.000000Z"}, {"uuid": "877146a1-0d42-49da-be10-66ed22e536f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-26)", "content": "", "creation_timestamp": "2026-03-26T00:00:00.000000Z"}, {"uuid": "d1e17e23-cbb3-4153-95c1-1dbeab218391", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-25)", "content": "", "creation_timestamp": "2026-03-25T00:00:00.000000Z"}, {"uuid": "e76c2dd3-e06e-48db-be49-e04c6dddc027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-11)", "content": "", "creation_timestamp": "2026-01-11T00:00:00.000000Z"}, {"uuid": "0155e737-55fe-4836-bc1a-0f62b756558b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-11)", "content": "", "creation_timestamp": "2026-01-11T00:00:00.000000Z"}, {"uuid": "46d16e75-a993-4e52-a96b-ad9173422c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-12)", "content": "", "creation_timestamp": "2026-01-12T00:00:00.000000Z"}, {"uuid": "33924dbc-0cfa-47f2-ac3a-fc6efb7e4bc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-12)", "content": "", "creation_timestamp": "2026-01-12T00:00:00.000000Z"}, {"uuid": "2f9c4d7a-c088-4a85-9779-c6fe62953f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-12)", "content": "", "creation_timestamp": "2026-03-12T00:00:00.000000Z"}, {"uuid": "2dd08e86-757d-4ee5-82dd-e7266ff37811", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-26)", "content": "", "creation_timestamp": "2026-03-26T00:00:00.000000Z"}, {"uuid": "8a287f7c-02db-4c2e-8d57-3baf18e6066f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-27)", "content": "", "creation_timestamp": "2026-03-27T00:00:00.000000Z"}, {"uuid": "158633a8-360a-4667-9ba8-d352c010de86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-15)", "content": "", "creation_timestamp": "2026-01-15T00:00:00.000000Z"}, {"uuid": "9c259af4-d646-499d-9571-5b22ae567d8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/a4c1e6ab-1786-4631-8cc9-dfa00c7171a6", "content": "", "creation_timestamp": "2025-02-03T13:12:08.204190Z"}, {"uuid": "ff529367-cfd3-4533-9f53-ed8ee2cfbb43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-27)", "content": "", "creation_timestamp": "2026-01-27T00:00:00.000000Z"}, {"uuid": "58f6433e-27be-4347-93bc-0f48336e19ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b0fff777-8964-4197-9f78-a8e013eed297", "content": "", "creation_timestamp": "2026-02-02T12:28:59.836851Z"}, {"uuid": "731daa6b-d052-45cc-ab44-fc6b6b097ee3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-31)", "content": "", "creation_timestamp": "2026-03-31T00:00:00.000000Z"}, {"uuid": "490cb982-86c9-4c7f-beb0-5cea70e8f9a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-02)", "content": "", "creation_timestamp": "2026-04-02T00:00:00.000000Z"}, {"uuid": "7e039e3a-de7c-4d28-a56d-bf4900438348", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "Telegram/s4SFrZETX55Vz0AEABFukDsDKEgJ63gg9pr90OmwdpY3jCQ", "content": "", "creation_timestamp": "2025-10-24T03:00:06.000000Z"}, {"uuid": "9fc0b87f-cbbd-44bd-85f4-d5b49fdfb39f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/antichat/7389", "content": "CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI\nhttps://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui", "creation_timestamp": "2019-12-17T21:25:58.000000Z"}, {"uuid": "8014ada3-30be-4fcf-97fc-fdf6b608c784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://t.me/ics_cert/719", "content": "\u062d\u0645\u0644\u0647 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0627\u062e\u062a\u0635\u0627\u0635\u06cc \u0628\u0647 \u062f\u0648\u0644\u062a \u0641\u062f\u0631\u0627\u0644 \u0627\u06cc\u0627\u0644\u0627\u062a \u0645\u062a\u062d\u062f\u0647\n\n \u062f\u0648\u0644\u062a \u0641\u062f\u0631\u0627\u0644 \u0627\u06cc\u0627\u0644\u0627\u062a \u0645\u062a\u062d\u062f\u0647 \u0645\u0648\u0631\u062f \u062d\u0645\u0644\u0647 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0627\u062a \u0646\u062a \u062f\u0631 \u0633\u0631\u0648\u0631 IIS Telerik \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.  \u0647\u06a9\u0631\u0647\u0627 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc deserialization .NET (CVE-2019-18935) \u0628\u0631\u0627\u06cc \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0646 \u062f\u0631 \u0645\u0639\u0631\u0636 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0648\u062c\u0648\u062f\u00a0CVE-2017-11317 \u0634\u0646\u0627\u062e\u062a\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0646\u062f.\n\n \u0639\u0645\u0644\u06cc\u0627\u062a \u0645\u0634\u062a\u0631\u06a9\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 DHS\u060c FCEB \u0648 CISA \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u060c \u0686\u0646\u062f\u06cc\u0646 \u062a\u0644\u0627\u0634 \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0647 \u0633\u0627\u06cc\u0628\u0631\u06cc \u0628\u0647 \u0633\u0631\u0648\u0631 IIS \u062f\u0648\u0644\u062a \u0627\u06cc\u0627\u0644\u0627\u062a \u0645\u062a\u062d\u062f\u0647 \u0631\u0627 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Telerik deserialization \u062f\u0627\u062a \u0646\u062a \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f.\n\n \u0686\u0646\u062f\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0647\u06a9\u0631 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0631\u0627 \u0622\u063a\u0627\u0632 \u06a9\u0631\u062f\u0646\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0628\u0627\u0632\u06cc\u06af\u0631\u0627\u0646 APT.  \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u0648\u0641\u0642\u06cc\u062a \u0622\u0645\u06cc\u0632 \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc \u062f\u0647\u062f \u062a\u0627 \u06cc\u06a9 \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062f\u0631 \u0634\u0628\u06a9\u0647 \u0622\u0698\u0627\u0646\u0633 \u0634\u0639\u0628\u0647 \u0627\u062c\u0631\u0627\u06cc\u06cc \u063a\u06cc\u0631\u0646\u0638\u0627\u0645\u06cc \u0641\u062f\u0631\u0627\u0644 (FCEB) \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f\u060c \u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0631\u0627\u0628\u0637 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 Telerik (UI) \u062f\u0631 \u0648\u0628 \u0633\u0631\u0648\u0631 IIS \u0627\u0631\u0627\u0626\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n IOC \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0622\u0698\u0627\u0646\u0633\u200c\u0647\u0627\u06cc \u0641\u062f\u0631\u0627\u0644 \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647\u200c\u0627\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0631\u0627\u0628\u0637 \u06a9\u0627\u0631\u0628\u0631\u06cc Telerik \u0631\u0627 \u0628\u0631\u0627\u06cc \u0633\u0627\u062e\u062a\u200c\u0647\u0627\u06cc ASP.NET AJAX \u0642\u0628\u0644 \u0627\u0632 R1 2020 (2020.1.114) \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n \u0627\u06cc\u0646 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u06cc\u0627\u0628\u06cc \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062f\u0631 \u0633\u0631\u0648\u0631 IIS \u06a9\u0647 Windows Server 2003 SP2 \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc \u06a9\u0646\u062f\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f.  \u0628\u0631\u062f\u0627\u0631 \u062d\u0645\u0644\u0647 \u0627\u0632 \u0637\u0631\u06cc\u0642 Telerik UI \u0628\u0631\u0627\u06cc \u0633\u0627\u062e\u062a\u200c\u0647\u0627\u06cc ASP.NET AJAX \u0642\u0628\u0644 \u0627\u0632 R1 2020 (2020.1.114) \u0645\u0648\u0631\u062f \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a.\n\n \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u062a\u0627\u0628\u0639 deserialization.NET \u0627\u0632 \u06a9\u0644\u0627\u0633 RadAsyncUpload Telerik \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0646\u062f\u060c \u06a9\u0647 \u0627\u0632 \u0622\u0646 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9 \u062d\u0645\u0644\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0631 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 IIS \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u062a\u0627\u0628\u0639 deserialization.NET \u0627\u0632 Telerik's RadA.\n\n \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0633\u0637 \u0686\u0646\u062f\u06cc\u0646 \u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0645\u0644\u06cc \u0637\u06cc \u06cc\u06a9 \u0639\u0645\u0644\u06cc\u0627\u062a \u0628\u06cc\u0646 \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0628\u0647 \u0646\u0627\u0645 Operation Pacifier \u06a9\u0647 \u0628\u06cc\u0646 \u0646\u0648\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f2 \u062a\u0627 \u0627\u0648\u0627\u06cc\u0644 \u0698\u0627\u0646\u0648\u06cc\u0647 \u06f2\u06f0\u06f2\u06f3 \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u060c \u0628\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc deserialization .NET (CVE-2019-18935) \u062f\u0631 \u062a\u0627\u0628\u0639 RadAsyncUpload \u067e\u06cc\u062f\u0627 \u0634\u062f.  \u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0648\u062c\u0648\u062f CVE-2017-11317 \u0634\u0646\u0627\u062e\u062a\u0647 \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0646 \u062f\u0631 \u0645\u0639\u0631\u0636 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f.\n\n \u0627\u06cc\u0646 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u0646\u062c\u0631 \u0628\u0647 \u062f\u0633\u062a\u0631\u0633\u06cc \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0628\u0647 \u0641\u0627\u06cc\u0644 \u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0622\u0633\u06cc\u0628 \u062f\u06cc\u062f\u0647 \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0646\u0627\u062f\u0631\u0633\u062a \u062f\u0627\u062f\u0647 \u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0634\u062f.  \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0686\u0646\u062f\u06cc\u0646 \u0633\u0627\u0632\u0645\u0627\u0646 \u062f\u0631 \u0633\u0631\u0627\u0633\u0631 \u0627\u06cc\u0627\u0644\u0627\u062a \u0645\u062a\u062d\u062f\u0647\u060c \u06a9\u0627\u0646\u0627\u062f\u0627 \u0648 \u0627\u0631\u0648\u067e\u0627 \u06a9\u0647 \u0634\u0628\u06a9\u0647\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u062d\u06cc\u0627\u062a\u06cc \u062f\u0631 \u0622\u0646 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0646\u062f.\n\n \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0645\u0627\u0631\u0633 2023 \u06a9\u0634\u0641 \u0648 \u062a\u0648\u0633\u0637 \u0645\u0631\u06a9\u0632 \u067e\u0627\u0633\u062e\u06af\u0648\u06cc\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0645\u0646\u062a\u0634\u0631 \u0634\u062f.\n\n \u0627\u06cc\u0646 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u0628\u0647 \u062f\u0633\u062a \u0622\u0648\u0631\u062f\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u062f\u0631 \u0633\u0631\u0648\u0631 IIS \u062f\u0648\u0644\u062a \u0627\u06cc\u0627\u0644\u0627\u062a \u0645\u062a\u062d\u062f\u0647 \u0628\u0627 \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc Telerik deserialization .NET (CVE-2019-18935) \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f.  \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0646\u0627\u0645 CVE-2019-18935\u060c \u062a\u0627\u0628\u0639 RadAsyncUpload \u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u06a9\u0647 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0648\u062c\u0648\u062f CVE-2017-11317\u060c \u0627\u0632 \u0646\u0648\u0631\u062f\u0647\u06cc \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u0646\u062f\u060c \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0634\u0646\u0627\u062e\u062a\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f.\n\n \u0628\u0631\u0627\u06cc \u062c\u0632\u0626\u06cc\u0627\u062a \u0628\u06cc\u0634\u062a\u0631: - https://lnkd.in/dSM-di75\n\n#infosec #websecurity #pentesting #securitysearch #ethicalhacking #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc \n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83c\udfed\u0648\u0628\u0633\u0627\u06cc\u062a \u0648 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n\n\u0627\u062f\u0645\u06cc\u0646:\nhttps://t.me/pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u062a\u0648\u06cc\u06cc\u062a\u0631:\nhttps://twitter.com/icscerti", "creation_timestamp": "2023-03-17T15:50:29.000000Z"}, {"uuid": "c9e43a49-399e-4b5e-90bd-feeb23e737f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "Telegram/kbwvMEYxNMTUq0MoPBZhBxwW65HhDCC2hCGDcY8gOyB2buw", "content": "", "creation_timestamp": "2025-09-11T21:00:04.000000Z"}, {"uuid": "f968ba40-51e3-42be-8192-f51ec8ea5b96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/349", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935", "creation_timestamp": "2022-05-12T22:17:01.000000Z"}, {"uuid": "3893aa6c-9475-4c74-a73e-7544ab0bddce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "Telegram/ea_a2WJ5ZawcwwTWBTWJ-9q1uFbOm9w5Cyd5YntgPenIWhM", "content": "", "creation_timestamp": "2025-08-23T03:00:05.000000Z"}, {"uuid": "a259d036-1211-4b99-862b-0e88e883fea2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/350", "content": "(https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui))  C1 CMS (CVE-2019-18211 (https://medium.com/@frycos/yet-another-net-deserialization-35f6ce048df7))  Jenkins (CVE-2016-9299 (https://nvd.nist.gov/vuln/detail/CVE-2016-9299))  What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability. (https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/) \u2013 @breenmachine, FoxGloveSecurity (2015)    Talks and Write-Ups    PSA: Log4Shell and the current state of JNDI injection (https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) - Moritz Bechler (2021)  This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits (https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits) \u2013 Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020)  Deep Dive into .NET ViewState deserialization and its exploitation (https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) \u2013 Swapneil Dash (2019)  Exploiting  (https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)Deserialization (https://www.kitploit.com/search/label/Deserialization) in ASP.NET via ViewState \u2013 Soroush Dalili (2019)  Use of Deserialization in .NET Framework Methods and Classes (https://research.nccgroup.com/wp-content/uploads/2020/07/whitepaper-new.pdf) \u2013 Soroush Dalili(2018)  Friday the 13th, JSON Attacks (https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf) \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2017)  Exploiting .NET Managed DCOM (https://googleprojectzero.blogspot.com/2017/04/exploiting-net-managed-dcom.html) \u2013 James Forshaw, Project Zero (2017)  Java Unmarshaller Security (https://github.com/frohoff/marshalsec/blob/master/marshalsec.pdf) \u2013 Moritz Bechler (2017)  Deserialize My Shorts (https://www.slideshare.net/frohoff1/deserialize-my-shorts-or-how-i-learned-to-start-worrying-and-hate-java-object-deserialization) \u2013 Chris Frohoff (2016)  Pwning Your Java Messaging with Deserialization Vulnerabilities (https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf) \u2013 Matthias Kaiser (2016)  Journey from JNDI/LDAP  (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)Manipulation (https://www.kitploit.com/search/label/Manipulation) to Remote Code Execution (https://www.kitploit.com/search/label/Remote%20Code%20Execution) Dream Land \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2016)  Marshalling Pickles (https://www.youtube.com/watch?v=KSA7vUkXGSg) \u2013 Chris Frohoff and Gabriel Lawrence (2015)  Are you my Type? Breaking .NET Through Serialization (https://github.com/VulnerableGhost/.Net-Sterilized--Deserialization-Exploitation/blob/master/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf) \u2013 James Forshaw (2012)  A Spirited Peek into ViewState (https://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/) \u2013 Mike Shema (2011)    \nAuthor:\u00a0Alyssa Rahman @ramen0x3fCreated:\u00a02021-10-27Last Updated:\u00a02021-12-02Blog:\u00a0https://www.mandiant.com/resources/hunting-deserialization-exploitsFor more details on this tool and the research process behind it, check out\u00a0our blog (https://www.mandiant.com/resources/hunting-deserialization-exploits)!\n\nDownload Heyserial (https://github.com/mandiant/heyserial)", "creation_timestamp": "2022-05-12T22:17:01.000000Z"}, {"uuid": "61008fee-a407-4d94-a15b-f9bae3874845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://t.me/cyberbannews_ir/730", "content": "\u200d \ud83d\uded1\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u062d\u0645\u0644\u0627\u062a \u06af\u0631\u0648\u0647 \u0647\u06a9\u0631\u06cc Blue Mockingbird\n\n\u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0634\u0631\u06a9\u062a\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0631\u062e\u06cc \u062d\u0645\u0644\u0627\u062a \u06af\u0631\u0648\u0647 \u0647\u06a9\u0631\u06cc \u00abBlue Mockingbird\u00bb \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0631\u062f\u0646\u062f.\n\n\u0628\u0647 \u06af\u0632\u0627\u0631\u0634 \u06a9\u0627\u0631\u06af\u0631\u0648\u0647 \u062d\u0645\u0644\u0627\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0633\u0627\u06cc\u0628\u0631\u0628\u0627\u0646\u061b \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u00abRed Canary\u00bb \u0628\u0627 \u0627\u0646\u062a\u0634\u0627\u0631 \u06af\u0632\u0627\u0631\u0634\u06cc \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0646\u062f \u06af\u0631\u0648\u0647 \u0647\u06a9\u0631\u06cc \u0628\u0644\u0648\u0645\u0627\u06a9\u06cc\u0646\u06af\u200c\u0628\u0631\u062f (Blue Mockingbird) \u0647\u0632\u0627\u0631\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \n\n\u06af\u0631\u0648\u0647 \u0628\u0644\u0648\u0645\u0627\u06a9\u06cc\u0646\u06af\u200c\u0628\u0631\u062f \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u0645\u062c\u0647\u0632 \u0628\u0647 \u0628\u0631\u0646\u0627\u0645\u0647 ASP.NET \u0631\u0627 \u06a9\u0647 \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0641\u0631\u06cc\u0645\u200c\u0648\u0631\u06a9 Telerik \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u060c \u0645\u0648\u0631\u062f\u062a\u0647\u0627\u062c\u0645 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a. \n\n\u0647\u06a9\u0631\u0647\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2019-18935 \u0628\u0647 \u0627\u06cc\u0646 \u0633\u0631\u0648\u0631\u0647\u0627 \u0646\u0641\u0648\u0630 \u06a9\u0631\u062f\u0647 \u0648 \u062f\u0631 \u0622\u0646\u200c\u0647\u0627 \u0648\u0628 \u0634\u0644\u200c\u0647\u0627\u06cc\u06cc \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u0633\u067e\u0633 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062a\u06a9\u0646\u06cc\u06a9 \u00abJuicy Potato\u00bb \u0627\u0645\u062a\u06cc\u0627\u0632 \u0627\u062f\u0645\u06cc\u0646 \u0631\u0627 \u0628\u0647 \u062f\u0633\u062a \u0622\u0648\u0631\u062f\u0647 \u0648 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0633\u0631\u0648\u0631 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u062a\u0627 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0645\u0627\u0646\u062f\u06af\u0627\u0631 \u200c\u0634\u0648\u0646\u062f. \n\n\u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u062f\u0631 \u0645\u0631\u062d\u0644\u0647 \u067e\u0627\u06cc\u0627\u0646\u06cc \u0622\u0644\u0648\u062f\u06af\u06cc \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0647\u06a9 \u0634\u062f\u0647 \u0645\u0627\u06cc\u0646\u0631 XMRRig \u0631\u0627 \u062c\u0647\u062a \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0631\u0632 \u0645\u0648\u0646\u0631\u0648 \u0646\u0635\u0628 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \n\n\u0647\u06a9\u0631\u0647\u0627\u06cc \u0628\u0644\u0648\u0645\u0627\u06a9\u06cc\u0646\u06af\u200c\u0628\u0631\u062f \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc IIS \u0639\u0645\u0648\u0645\u06cc \u0628\u0647 \u0634\u0628\u06a9\u0647 \u062f\u0627\u062e\u0644\u06cc \u0634\u0631\u06a9\u062a \u0645\u062a\u0635\u0644 \u0628\u0627\u0634\u0646\u062f\u060c \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u067e\u0631\u0648\u062a\u06a9\u0644\u200c\u0647\u0627\u06cc \u0636\u0639\u06cc\u0641 \u00abRDP\u00bb \u0648 \u00abSMB\u00bb \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u0631\u0627 \u0646\u06cc\u0632 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \n\n\u067e\u06cc\u0634\u062a\u0631 \u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0645\u0644\u06cc \u0622\u0645\u0631\u06cc\u06a9\u0627 \u062f\u0631 \u062e\u0635\u0648\u0635 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06cc\u0627\u062f\u0634\u062f\u0647 \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f\u0647 \u0628\u0648\u062f \u0648 \u0622\u0646 \u0631\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u067e\u0631\u0627\u0633\u062a\u0641\u0627\u062f\u0647\u200c\u062a\u0631\u06cc\u0646 \u0646\u0642\u0635 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0631\u0627\u06cc \u0646\u0635\u0628 \u0648\u0628\u200c\u0634\u0644 \u062a\u0648\u0635\u06cc\u0641 \u06a9\u0631\u062f\u0647 \u0628\u0648\u062f. \n\n\u0645\u0631\u06a9\u0632 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0627\u0633\u062a\u0631\u0627\u0644\u06cc\u0627 \u0646\u06cc\u0632 \u062f\u0631 \u0645\u0627\u0647 \u0645\u06cc 2020 \u0627\u06cc\u0646 \u062d\u0641\u0631\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u0627 \u062f\u0631 \u0644\u06cc\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9\u06cc \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0628\u0648\u062f \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0637\u06cc \u0633\u0627\u0644\u200c\u0647\u0627\u06cc 2019 \u062a\u0627 2020 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0622\u0646\u200c\u0647\u0627 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u0627\u06cc\u0646 \u06a9\u0634\u0648\u0631 \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0628\u0648\u062f\u0646\u062f. \n\n#\u062c\u0631\u0645_\u0633\u0627\u06cc\u0628\u0631\u06cc \n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc \n\n@cyberbannews_ir", "creation_timestamp": "2020-05-27T12:19:57.000000Z"}, {"uuid": "14b331f4-d9b2-4b0d-9dc3-24d5ae13e9fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/is_n3ws/36", "content": "\u0410\u041d\u0411 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u043e \u0430\u0442\u0430\u043a\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0432\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u043e \u043e\u0442\u0447\u0435\u0442. Top-20 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\nhttps://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF\n\nGaining Remote Access: \n-----------------------------\nCVE-2019-11510: Arbitrary file read/Pulse Secure VPN\nCVE-2019-19781: RCE/Citrix ADC\nCVE-2020-8195/3/6: Unauthenticated access\nCVE-2019-0708: RCE on RDP server\nCVE-2020-5902: RCE in F5 BIG-IP\n\nAD:\n----\nCVE-2020-1472: #ZeroLogon\nCVE-2019-1040: NTLM relay bypass\n\nMDM: \n------\nCVE-2020-15505: MobileIron device management\n\nExploiting Public Facing Services:\n---------------- \nCVE-2020-1350: RCE/ DNS Servers #SigRed\nCVE-2018-6789: RCE/ Exim mail transfer\nCVE-2018-4939: RCE/ Adobe's Cold Fusion\n\nWorkstation Local Privilege Escalation:\n-------------------------\nCVE-2020-0601: ECC spoofing #CurveBall\nCVE-2019-0803: Win32k Elevation of Privilege\n\nInternal Applications:\n--------------------\nCVE-2020-0688: RCE/MS Exchange\nCVE-2020-2555: RCE/Oracle Weblogic\nCVE-2019-11580: RCE/Atlassian Crowd\nCVE-2019-18935: RCE/ASP.Net\nCVE-2015-4852: RCE/Apache\nCVE-2019-3396: Unauthorized Access/Confluence\nCVE-2020-10189: RCE/Desktop Central", "creation_timestamp": "2020-11-06T22:00:17.000000Z"}, {"uuid": "3c318699-639a-4f2e-98d9-6a5518d9e569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://t.me/CyberBulletin/2257", "content": "\u26a1Threat Actors Exploit CVE-2019-18935 to Gain Remote Access and Elevate Privileges.\n\n#CyberBulletin", "creation_timestamp": "2025-02-06T04:32:12.000000Z"}, {"uuid": "515fdced-3d96-4030-952d-a8b34ee7c677", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/hackerlibrary/266", "content": "Photos from National Cyber Security Services's post\n\n\nCVE-2019-18935:-- #RCE #exploit for a .NET #deserialization #vulnerability in #Telerik UI for ASP.NET AJAX.\n\nThis exploit leverages #encryption logic from RAU_crypto. The RAUCipher class within RAU_crypto.py depends on PyCryptodome, a drop-in replacement for the dead PyCrypto module. #PyCryptodome and #PyCrypto create problems when installed in the same environment, so the best way to satisfy this dependency is to install the module within a virtual environment, as shown above.\n\n#Download #Link:-\n\nhttps://github.com/noperator/CVE-2019-18935", "creation_timestamp": "2019-12-18T17:10:59.000000Z"}, {"uuid": "3613d8c4-89ce-4542-9315-e47abd8900e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "Telegram/QxUmQQxHqCkxTaysLBNBbpuc19gaa6hhliNR9D5GoirJ5b8y", "content": "", "creation_timestamp": "2025-02-06T02:42:30.000000Z"}, {"uuid": "6aff5eb6-f278-4f6c-b694-84e544380f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "Telegram/g5dnSKFfRiVqVOSRBmM4iv0zdPT4UndMYFcD4S5T3oiUYT0", "content": "", "creation_timestamp": "2025-03-01T10:00:05.000000Z"}, {"uuid": "ad3c2742-51bb-415d-90ce-0bcd81e9f4db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/sxcteam/12", "content": "https://youtu.be/8CXW2XbDRAU        Generate security keys for RadAsyncUpload (Telerik UI for ASP.NET AJAX). Prevent CVE-2019-18935.", "creation_timestamp": "2020-08-08T08:31:30.000000Z"}, {"uuid": "1178f0d7-62b2-49b7-9862-377a27670dee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://t.me/true_secator/4174", "content": "\u0412\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Internet Information Services (IIS) \u043d\u0435\u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u0421\u0428\u0410 \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433. \u043f\u043e \u043d\u0430\u0447\u0430\u043b\u043e \u044f\u043d\u0432\u0430\u0440\u044f 2023 \u0433. \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d, \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c, \u0434\u0432\u0443\u043c\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 (\u043e\u0434\u0438\u043d \u0438\u0437 \u043d\u0438\u0445 \u2014 \u0432\u044c\u0435\u0442\u043d\u0430\u043c\u0441\u043a\u0430\u044f\u00a0XE Group), \u0430 \u043f\u043e\u043c\u043e\u0433\u043b\u0430 \u0438\u043c RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0440\u0435\u0445\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044e CISA, \u0424\u0411\u0420 \u0438 MS-ISAC, \u0445\u0430\u043a\u0435\u0440\u044b \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c  \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 CVE-2019-18935 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 .NET \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Progress Telerik \u0434\u043b\u044f AJAX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 ASP.NET \u0434\u043b\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0441\u0435\u0442\u044c \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430.\n\n\u041f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043e\u043d\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0432 \u043f\u0430\u043f\u043a\u0435 C:\\Windows\\Temp\\ \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043d\u0430 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 IIS, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u043b\u0430 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0438\u0437\u0431\u0435\u0433\u0430\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0443\u0434\u0430\u043b\u044f\u044f \u0441\u0432\u043e\u0438 \u0441\u043b\u0435\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044f \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0435 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u0438.\n\n\u041c\u0430\u043b\u044c\u0432\u0430\u0440\u044c \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431 ASPX, \u043a\u043e\u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0434\u043b\u044f \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0432\u044b\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u041e\u0434\u043d\u0430\u043a\u043e, \u043a\u0430\u043a \u0443\u043a\u0430\u0437\u0430\u043d\u043e \u0432 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435, \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043d\u0435 \u0431\u044b\u043b\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u044b \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0438\u0437-\u0437\u0430 \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e, \u0438\u043c\u0435\u044e\u0449\u0435\u0439 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c.\n\n\u041f\u0440\u0438 \u0432\u0441\u0435\u043c \u043f\u0440\u0438 \u044d\u0442\u043e\u043c, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 Telerik CVE-2019-18935 \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0430 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0432\u00a0\u0441\u043f\u0438\u0441\u043e\u043a 25 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438,\u00a0\u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044e\u0442 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u044b, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 \u0410\u041d\u0411, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0424\u0411\u0420.\n\n\u0412 \u043d\u043e\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 CISA \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 Progress Telerik CVE-2019-18935 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (KEV).\n\n\u0412 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 (BOD 22-01) \u043e\u0442 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430, \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0435 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430, \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a KEV CISA, \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0431\u0430\u0433\u0443 \u0434\u043e 3 \u043c\u0430\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u041e\u0434\u043d\u0430\u043a\u043e, \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u044f\u0441\u044c \u043d\u0430 IOC, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u044d\u0442\u0438\u043c \u0432\u0437\u043b\u043e\u043c\u043e\u043c, \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0435 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u0421\u0428\u0410 \u0442\u0430\u043a \u0438 \u043d\u0435 \u0441\u043c\u043e\u0433\u043b\u043e (\u0438\u043b\u0438 \u043d\u0435 \u0437\u0430\u0445\u043e\u0442\u0435\u043b\u043e) \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 Microsoft IIS.\n\n\u041f\u043e\u0436\u0430\u043b\u0443\u0439, \u0442\u0430\u043a\u043e\u0439 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e \u0434\u043e\u0441\u0442\u043e\u0438\u043d \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u0445\u0443\u0434\u0448\u0438\u0445 \u0438\u043d\u0444\u043e\u0441\u0435\u043a-\u043f\u0440\u0430\u043a\u0442\u0438\u043a \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 \u043a\u0430\u043d\u0430\u043b\u0430 SecAtor.", "creation_timestamp": "2023-03-16T11:53:10.000000Z"}, {"uuid": "85469087-897b-46ae-8454-924014bfab57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/true_secator/6026", "content": "Progress Software \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Telerik Report Server, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nTelerik Report Server \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043e\u0442\u0447\u0435\u0442\u043e\u0432 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u0438\u0445 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f, \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f, \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043c\u0438 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0432\u0441\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,\u00a0\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a\u00a0CVE-2024-6327 \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0435\u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Report Server 2024 Q2 (10.1.24.514) \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438\u00a02024 Q2 (10.1.24.709), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 - \u044d\u0442\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\n\nProgress \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439 \u0434\u043b\u044f \u0442\u0435\u0445, \u043a\u0442\u043e \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f Report Server Application Pool \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438, \u043b\u0438\u0431\u043e \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e\u043c\u0443 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0443.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e Progress \u043f\u043e\u043a\u0430 \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2024-6327, \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Telerik \u0443\u0436\u0435 \u043d\u0435 \u0440\u0430\u0437 \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u043b\u0438\u0441\u044c \u0430\u0442\u0430\u043a\u0430\u043c.\n\n\u041a\u0440\u0430\u0439\u043d\u0438\u0439 \u043d\u0435\u0443\u0434\u0430\u0447\u043d\u044b\u0439 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u043b \u0432 2022 \u0433\u043e\u0434\u0443, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440 Microsoft Internet Information Services (IIS) \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u0421\u0428\u0410\u00a0\u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 Progress Telerik CVE-2019-18935.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0441\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435  \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 PoC \u0434\u043b\u044f RCE \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Telerik Report \u043f\u0443\u0442\u0435\u043c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CVE-2024-4358) \u0438 RCE \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CVE-2024-1800).", "creation_timestamp": "2024-07-26T16:32:28.000000Z"}, {"uuid": "314cb02f-34e7-40d3-8142-3f360953cf5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/DailyToolz/373", "content": "3k telerik vuln url [ CVE-2019-18935 ]\n~ @DailyToolz", "creation_timestamp": "2022-07-05T15:09:20.000000Z"}, {"uuid": "3978d998-7d6b-40aa-8604-9c4153bcf6d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/ctinow/159202", "content": "https://ift.tt/5EFjo3e\nCVE-2019-18935 Exploit", "creation_timestamp": "2023-12-25T15:16:47.000000Z"}, {"uuid": "aad2c925-1020-4561-939e-639552972fbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/purp_sec/249", "content": "\u0421\u043e\u0431\u0440\u0430\u043b \u0434\u043b\u044f \u0432\u0430\u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e CVE, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435.\n\n\ud83d\udd35CVE-2024-57968 \u0438 CVE-2025-25181 \u2014 0day-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 VeraCore, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 XE Group. \u041f\u0435\u0440\u0432\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043d\u0435\u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043f\u0430\u043f\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 upload.aspx. \u0412\u0442\u043e\u0440\u0430\u044f \u2014 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b SQL \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 PmSess1.\n\n\ud83d\udd35CVE-2025-24860 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Cassandra, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0435\u0439. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0426\u041e\u0414 \u0438\u043b\u0438 \u0433\u0440\u0443\u043f\u043f\u0430\u043c IP/CIDR \u0447\u0435\u0440\u0435\u0437 CassandraNetworkAuthorizer \u0438\u043b\u0438 CassandraCIDRAuthorizer. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0426\u041e\u0414 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e data control language (DCL) \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445.\n\n\ud83d\udd35CVE-2025-24964 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Cross-site WebSocket Hijacking (CSWSH) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 API Vitest. \u041a\u043e\u0433\u0434\u0430 \u043e\u043f\u0446\u0438\u044f api \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430, Vitest \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440 WebSocket \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 Origin \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430\u043c\u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f.\n\n\ud83d\udd35CVE-2025-20124 \u0438 CVE-2025-20125 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Cisco, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 API ISE. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043f\u043e\u0434 \u043f\u0440\u043e\u0444\u0438\u043b\u0435\u043c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 read-only \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n\ud83d\udd35CVE-2019-18935 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Progress Telerik UI \u0434\u043b\u044f ASP.NET AJAX, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n#blue_team #CVE_\u0434\u043d\u044f", "creation_timestamp": "2026-08-05T00:00:21.231278Z"}, {"uuid": "f2d87c01-355f-4684-82a4-afbe6b7b33bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://t.me/thehackernews/3154", "content": "CVE-2019-18935 strikes again!\n\nA critical security flaw in Progress Telerik UI for ASP AJAX was exploited by multiple threat actors, including a nation-state group, to breach a U.S. federal agency's web server.\n\nLearn more: https://thehackernews.com/2023/03/multiple-hacker-groups-exploit-3-year.html", "creation_timestamp": "2023-03-16T07:40:19.000000Z"}, {"uuid": "b04eb112-51e3-44db-aa2b-dd72ffb3f0de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/6196", "content": "CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI\nhttps://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui", "creation_timestamp": "2019-12-17T22:22:18.000000Z"}, {"uuid": "c6d528c2-3c84-46ec-bda9-24dc23047910", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/3527", "content": "CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI\nhttps://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui", "creation_timestamp": "2019-12-16T10:28:50.000000Z"}, {"uuid": "9f644133-a068-4655-89de-ceab4a8d02e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/492", "content": "#exploit\n1. CVE-2019-18935:\nRCE exploit for a .NET JSON deserialization in Telerik UI for ASP NET AJAX\nhttps://github.com/noperator/CVE-2019-18935\n\n2. CVE-2019-6800:\nRCE in SpamTitan\nhttps://write-up.github.io/CVE-2019-6800\n\n3. CVE-2019-7192:\nQNAP Pre-Auth Root RCE\nhttps://github.com/th3gundy/CVE-2019-7192_QNAP_Exploit", "creation_timestamp": "2024-10-14T21:11:22.000000Z"}, {"uuid": "86287832-9e9f-41f2-8df0-3ea525b89beb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/bugpoint/623", "content": "Remote Code Execution via CVE-2019-18935\n\n\ud83d\udc49 https://hackerone.com/reports/913695\n\n\ud83d\udd39 Severity: Critical\n\ud83d\udd39 Reported To: U.S. Dept Of Defense\n\ud83d\udd39 Reported By: #un4gi\n\ud83d\udd39 State: \ud83d\udfe2 Resolved\n\ud83d\udd39 Disclosed: August 13, 2020, 6:11pm (UTC)", "creation_timestamp": "2020-08-13T20:14:02.000000Z"}, {"uuid": "51a54908-d246-4ea7-9858-2f7a2ebef00b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "Telegram/0sD_EyHySREvSWLaWKL-XHqTqDduPkHhIy1vEKF4pCPQbv8", "content": "", "creation_timestamp": "2020-10-28T02:58:38.000000Z"}, {"uuid": "8703d8ca-92cd-4f72-bd8b-e00f4a2c794e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/cibsecurity/11931", "content": "\u274c Blue Mockingbird Monero-Mining Campaign Exploits Web Apps \u274c\n\nThe cybercriminals are using a deserialization vulnerability, CVE-2019-18935, to achieve remote code execution before moving laterally through the enterprise.\n\n\ud83d\udcd6 Read\n\nvia \"Threatpost\".", "creation_timestamp": "2020-05-07T23:04:02.000000Z"}, {"uuid": "d5d2eb99-8f67-4c3d-a8c8-cfba751949f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/48e15610-a505-4067-8dec-4627e36bcbe7", "content": "", "creation_timestamp": "2026-05-07T22:16:32.000000Z"}, {"uuid": "b98432b3-c7b9-4f15-9124-c50f42f6af2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/purp_sec/249", "content": "\u0421\u043e\u0431\u0440\u0430\u043b \u0434\u043b\u044f \u0432\u0430\u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e CVE, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435.\n\n\ud83d\udd35CVE-2024-57968 \u0438 CVE-2025-25181 \u2014 0day-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 VeraCore, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 XE Group. \u041f\u0435\u0440\u0432\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043d\u0435\u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043f\u0430\u043f\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 upload.aspx. \u0412\u0442\u043e\u0440\u0430\u044f \u2014 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b SQL \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 PmSess1.\n\n\ud83d\udd35CVE-2025-24860 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Cassandra, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0435\u0439. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0426\u041e\u0414 \u0438\u043b\u0438 \u0433\u0440\u0443\u043f\u043f\u0430\u043c IP/CIDR \u0447\u0435\u0440\u0435\u0437 CassandraNetworkAuthorizer \u0438\u043b\u0438 CassandraCIDRAuthorizer. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0426\u041e\u0414 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e data control language (DCL) \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445.\n\n\ud83d\udd35CVE-2025-24964 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Cross-site WebSocket Hijacking (CSWSH) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 API Vitest. \u041a\u043e\u0433\u0434\u0430 \u043e\u043f\u0446\u0438\u044f api \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430, Vitest \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440 WebSocket \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 Origin \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430\u043c\u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f.\n\n\ud83d\udd35CVE-2025-20124 \u0438 CVE-2025-20125 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Cisco, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 API ISE. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043f\u043e\u0434 \u043f\u0440\u043e\u0444\u0438\u043b\u0435\u043c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 read-only \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n\ud83d\udd35CVE-2019-18935 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Progress Telerik UI \u0434\u043b\u044f ASP.NET AJAX, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n#blue_team #CVE_\u0434\u043d\u044f", "creation_timestamp": "2026-08-04T13:00:13.403377Z"}, {"uuid": "0c2e8208-675e-4c68-a63c-2c18cbd22089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-21)", "content": "", "creation_timestamp": "2026-05-21T00:00:00.000000Z"}, {"uuid": "5e528923-a820-4014-834f-a3a07daf2f31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1651", "content": "\u2623\ufe0f \u041e\u0434\u0438\u043d HTTP-\u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u043b\u044f DoS, \u0438\u043b\u0438 \u043a\u0430\u043a CVE-2025-3600 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0435\u0432\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u0432 RCE\n\n\u0412\u0447\u0435\u0440\u0430 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441\u0432\u0435\u0436\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2025-3600 \u0432 Progress Telerik UI \u0434\u043b\u044f ASP.NET AJAX \u2014 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0434\u043b\u044f \u0432\u0435\u0431-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043d\u0430 .NET. \u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u044d\u0442\u043e DoS, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u0443\u0434\u0430 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0435\u0435.\n\n\ud83d\udd0e \u0412 \u0447\u0435\u043c \u0441\u0443\u0442\u044c? \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0430 Unsafe Reflection \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 prtype \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435 \u043a /Telerik.Web.UI.WebResource.axd. \u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442 \u044d\u0442\u043e\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0432 Type.GetType() \u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 \u0447\u0435\u0440\u0435\u0437 \u0435\u0433\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u043e\u0440 \u0431\u0435\u0437 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432. \u0417\u0432\u0443\u0447\u0438\u0442 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u043e? \u041d\u0435 \u0441\u043e\u0432\u0441\u0435\u043c.\n\n\ud83d\udca5 DoS \u0438\u0437 \u043a\u043e\u0440\u043e\u0431\u043a\u0438: \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0433\u0430\u0434\u0436\u0435\u0442 \u0438\u0437 .NET Framework (System.Management.Automation.Remoting.WSManPluginManagedEntryInstanceWrapper), \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043a\u0440\u0430\u0448 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043e\u0434\u043d\u0438\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041a\u043e\u0433\u0434\u0430 Garbage Collector \u0441\u043e\u0431\u0435\u0440\u0435\u0442 \u043e\u0431\u044a\u0435\u043a\u0442, \u0444\u0438\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440 \u043f\u043e\u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0441\u0432\u043e\u0431\u043e\u0434\u0438\u0442\u044c \u043d\u0435\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 handle \u2014 \u043d\u0435\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435, \u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u0430\u0434\u0430\u0435\u0442. \u041e\u0434\u0438\u043d \u0437\u0430\u043f\u0440\u043e\u0441 \u043a\u0430\u0436\u0434\u044b\u0435 2 \u043c\u0438\u043d\u0443\u0442\u044b \u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u0435\u0440\u0432\u0438\u0441 \u0432 \u043e\u0444\u043b\u0430\u0439\u043d\u0435.\n\n\u26a1\ufe0f \u041d\u043e \u044d\u0442\u043e \u043d\u0435 \u0432\u0441\u0451! \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a Remote Code Execution. \u041a\u0430\u043a? \u041a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u043e\u0440\u044b \u0431\u0435\u0437 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043c\u043e\u0433\u0443\u0442:\n- \u0427\u0438\u0442\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 query-\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432, cookies \u0438\u043b\u0438 headers\n- \u0414\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0438\u0437 \u043f\u0440\u0435\u0434\u0441\u043a\u0430\u0437\u0443\u0435\u043c\u044b\u0445 \u043f\u0443\u0442\u0435\u0439\n- \u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0435 assembly resolvers \u0432 AppDomain.AssemblyResolve\n\n\ud83c\udfaf \u0416\u0438\u0432\u043e\u0439 \u043f\u0440\u0438\u043c\u0435\u0440: watchTowr \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 pre-auth RCE-\u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0432 Sitecore Experience Platform. CVE-2025-3600 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e assembly resolver, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e DLL \u0441 path traversal. \u0412 \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u0438 \u0441 CVE-2025-34509 (bypass \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438) \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 RCE \u0431\u0435\u0437 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\ud83d\udcca \u041c\u0430\u0441\u0448\u0442\u0430\u0431 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u044b: \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430\u043c\u0438 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443. \u041f\u0440\u043e\u0441\u0442\u043e\u0439 \u043f\u043e\u0438\u0441\u043a \u0432 FOFA \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 ~185,000 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 14 \u043b\u0435\u0442. Telerik UI \u0443\u0436\u0435 \u0438\u043c\u0435\u0435\u0442 \u0438\u0441\u0442\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0431\u0430\u0433\u043e\u0432 (CVE-2017-9248, CVE-2019-18935), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f.\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c? Progress \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447. \u041f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043b\u0438 Telerik UI \u0432 \u0432\u0430\u0448\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 (\u0437\u0430\u043f\u0440\u043e\u0441 \u043a /Telerik.Web.UI.WebResource.axd \u043f\u043e\u043a\u0430\u0436\u0435\u0442 \u044d\u0442\u043e), \u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435\u0441\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435.\n\n\ud83d\udcd6 \u0425\u043e\u0442\u0438\u0442\u0435 \u0443\u0437\u043d\u0430\u0442\u044c \u0432\u0441\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u0443\u0432\u0438\u0434\u0435\u0442\u044c PoC \u0438 \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c RCE-\u0446\u0435\u043f\u043e\u0447\u043a\u0443? \u041f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0434\u0438\u0430\u0433\u0440\u0430\u043c\u043c\u0430\u043c\u0438 \u0438 \u043a\u043e\u0434\u043e\u043c \u0436\u0434\u0435\u0442 \u0432\u0430\u0441 \u0432 PDF-\u0444\u0430\u0439\u043b\u0435!\n\n\ud83d\udd17 \u041e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435: https://labs.watchtowr.com/more-than-dos-progress-telerik-ui-for-asp-net-ajax-unsafe-reflection-cve-2025-3600/", "creation_timestamp": "2025-10-11T12:01:40.000000Z"}, {"uuid": "effbb603-1bf5-468a-8bfb-d898a1149317", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9b7d57a9-94e5-4e93-bd6a-1f2917d8cb56", "content": "", "creation_timestamp": "2026-06-19T12:48:02.475473Z"}, {"uuid": "4bac3fbf-6056-4723-889b-40aa6eb82db7", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8ab36029-097c-417c-b6d1-aae00730d838", "content": "", "creation_timestamp": "2026-06-23T14:04:31.846279Z"}, {"uuid": "1e6090b2-8d61-4ec5-9dda-a0c0355ec683", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/56325e47-4f1d-48e1-9ac0-4c8b1addf48e", "content": "", "creation_timestamp": "2026-06-30T09:42:12.140958Z"}, {"uuid": "a185568b-624d-4754-9fda-a9c62e82fec8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "MISP/48e15610-a505-4067-8dec-4627e36bcbe7", "content": "", "creation_timestamp": "2026-07-10T00:15:03.661939Z"}, {"uuid": "0e5ebad3-4c5a-41fd-85bc-eed7a052378b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-15)", "content": "", "creation_timestamp": "2026-07-16T10:15:08.737450Z"}, {"uuid": "c31b72bf-54c0-404f-b2a1-a3d3f3ace66f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-17)", "content": "", "creation_timestamp": "2026-07-18T10:15:09.386698Z"}, {"uuid": "b50cdfe0-df2e-43ba-b998-7df34fcd124a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/EchelonEyes/1308", "content": "\u0412\u0441\u0435 \u043a\u043e\u043c\u0443 \u043d\u0435 \u043b\u0435\u043d\u044c \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u043b\u0438 \u043e\u0434\u043d\u043e \u0438\u0437 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432 \u0421\u0428\u0410, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0442\u0440\u0435\u0445\u043b\u0435\u0442\u043d\u044e\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043f\u043e\u043d\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u043d\u043e\u0441\u0442\u0440\u0430\u043d\u043d\u044b\u043c \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u043e\u043c, \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Progress Telerik \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u0421\u0428\u0410, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e. \u041a\u0430\u043a\u043e\u0435 \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u043e, \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u043d\u043e, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u043c\u0443 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044e \u0424\u0411\u0420, CISA \u0438 \u041c\u0435\u0436\u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0426\u0435\u043d\u0442\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (MS-ISAC), \u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0438 \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u043f\u043e \u044f\u043d\u0432\u0430\u0440\u044c 2023.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043f\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 CVE-2019-18935 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8), \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0434\u0438\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 .NET \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Progress Telerik \u0434\u043b\u044f ASP .NET AJAX, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Microsoft Internet Information Services \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e CVE-2019-18935 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u041a\u0438\u0442\u0430\u044f. \u0412 2020 \u0433\u043e\u0434\u0443 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432\u043e\u0448\u043b\u0430 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a 25 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0442\u0435\u0439 \u0438 \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0421\u0428\u0410", "creation_timestamp": "2026-07-26T02:02:29.278631Z"}, {"uuid": "cc6c7e22-d768-4b9d-a48a-a2d3af88bf98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/EchelonEyes/1308", "content": "\u0412\u0441\u0435 \u043a\u043e\u043c\u0443 \u043d\u0435 \u043b\u0435\u043d\u044c \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u043b\u0438 \u043e\u0434\u043d\u043e \u0438\u0437 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432 \u0421\u0428\u0410, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0442\u0440\u0435\u0445\u043b\u0435\u0442\u043d\u044e\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043f\u043e\u043d\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u043d\u043e\u0441\u0442\u0440\u0430\u043d\u043d\u044b\u043c \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u043e\u043c, \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Progress Telerik \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u0421\u0428\u0410, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e. \u041a\u0430\u043a\u043e\u0435 \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u043e, \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u043d\u043e, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u043c\u0443 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044e \u0424\u0411\u0420, CISA \u0438 \u041c\u0435\u0436\u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0426\u0435\u043d\u0442\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (MS-ISAC), \u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0438 \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u043f\u043e \u044f\u043d\u0432\u0430\u0440\u044c 2023.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043f\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 CVE-2019-18935 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8), \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0434\u0438\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 .NET \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Progress Telerik \u0434\u043b\u044f ASP .NET AJAX, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Microsoft Internet Information Services \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e CVE-2019-18935 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u041a\u0438\u0442\u0430\u044f. \u0412 2020 \u0433\u043e\u0434\u0443 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432\u043e\u0448\u043b\u0430 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a 25 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0442\u0435\u0439 \u0438 \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0421\u0428\u0410", "creation_timestamp": "2026-07-27T00:01:06.039908Z"}, {"uuid": "e67f536c-1cd7-4e23-a4f3-e2e1ab11de55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "exploited", "source": "https://t.me/EchelonEyes/1308", "content": "\u0412\u0441\u0435 \u043a\u043e\u043c\u0443 \u043d\u0435 \u043b\u0435\u043d\u044c \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u043b\u0438 \u043e\u0434\u043d\u043e \u0438\u0437 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432 \u0421\u0428\u0410, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u0442\u0440\u0435\u0445\u043b\u0435\u0442\u043d\u044e\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043f\u043e\u043d\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u043d\u043e\u0441\u0442\u0440\u0430\u043d\u043d\u044b\u043c \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u043e\u043c, \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Progress Telerik \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u0421\u0428\u0410, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e. \u041a\u0430\u043a\u043e\u0435 \u0438\u043c\u0435\u043d\u043d\u043e \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u043e, \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u043d\u043e, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u043c\u0443 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044e \u0424\u0411\u0420, CISA \u0438 \u041c\u0435\u0436\u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0426\u0435\u043d\u0442\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (MS-ISAC), \u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0438 \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u043f\u043e \u044f\u043d\u0432\u0430\u0440\u044c 2023.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043f\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 CVE-2019-18935 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8), \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0434\u0438\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 .NET \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Progress Telerik \u0434\u043b\u044f ASP .NET AJAX, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Microsoft Internet Information Services \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e CVE-2019-18935 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c \u041a\u0438\u0442\u0430\u044f. \u0412 2020 \u0433\u043e\u0434\u0443 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432\u043e\u0448\u043b\u0430 \u0432 \u0441\u043f\u0438\u0441\u043e\u043a 25 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0442\u0435\u0439 \u0438 \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0421\u0428\u0410", "creation_timestamp": "2026-07-28T00:00:06.917893Z"}, {"uuid": "8554fb7b-2290-4691-881b-1c75b52effec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:40.619844Z"}, {"uuid": "fd78c7c8-098c-49c8-8bda-4c3ba2d4b2f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/53232", "content": "(https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui))  C1 CMS (CVE-2019-18211 (https://medium.com/@frycos/yet-another-net-deserialization-35f6ce048df7))  Jenkins (CVE-2016-9299 (https://nvd.nist.gov/vuln/detail/CVE-2016-9299))  What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability. (https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/) \u2013 @breenmachine, FoxGloveSecurity (2015)    Talks and Write-Ups    PSA: Log4Shell and the current state of JNDI injection (https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) - Moritz Bechler (2021)  This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits (https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits) \u2013 Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020)  Deep Dive into .NET ViewState deserialization and its exploitation (https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) \u2013 Swapneil Dash (2019)  Exploiting  (https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)Deserialization (https://www.kitploit.com/search/label/Deserialization) in ASP.NET via ViewState \u2013 Soroush Dalili (2019)  Use of Deserialization in .NET Framework Methods and Classes (https://research.nccgroup.com/wp-content/uploads/2020/07/whitepaper-new.pdf) \u2013 Soroush Dalili(2018)  Friday the 13th, JSON Attacks (https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf) \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2017)  Exploiting .NET Managed DCOM (https://googleprojectzero.blogspot.com/2017/04/exploiting-net-managed-dcom.html) \u2013 James Forshaw, Project Zero (2017)  Java Unmarshaller Security (https://github.com/frohoff/marshalsec/blob/master/marshalsec.pdf) \u2013 Moritz Bechler (2017)  Deserialize My Shorts (https://www.slideshare.net/frohoff1/deserialize-my-shorts-or-how-i-learned-to-start-worrying-and-hate-java-object-deserialization) \u2013 Chris Frohoff (2016)  Pwning Your Java Messaging with Deserialization Vulnerabilities (https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf) \u2013 Matthias Kaiser (2016)  Journey from JNDI/LDAP  (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)Manipulation (https://www.kitploit.com/search/label/Manipulation) to Remote Code Execution (https://www.kitploit.com/search/label/Remote%20Code%20Execution) Dream Land \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2016)  Marshalling Pickles (https://www.youtube.com/watch?v=KSA7vUkXGSg) \u2013 Chris Frohoff and Gabriel Lawrence (2015)  Are you my Type? Breaking .NET Through Serialization (https://github.com/VulnerableGhost/.Net-Sterilized--Deserialization-Exploitation/blob/master/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf) \u2013 James Forshaw (2012)  A Spirited Peek into ViewState (https://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/) \u2013 Mike Shema (2011)    \nAuthor:\u00a0Alyssa Rahman @ramen0x3fCreated:\u00a02021-10-27Last Updated:\u00a02021-12-02Blog:\u00a0https://www.mandiant.com/resources/hunting-deserialization-exploitsFor more details on this tool and the research process behind it, check out\u00a0our blog (https://www.mandiant.com/resources/hunting-deserialization-exploits)!\n\nDownload Heyserial (https://github.com/mandiant/heyserial)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:40.786345Z"}, {"uuid": "36b2ec86-e675-44a6-8252-13a3b7432300", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:40.874252Z"}, {"uuid": "5d372999-aad5-4036-bfca-5b15c58f4557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/24366", "content": "and Altserialization Insecure Deserialization exploits, and a Telerik-UI Exploit (CVE-2019-18935, CVE-2017-11317).\nSee Also: Offensive Security Tool: SniperPhish \u201cThe operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment,\u201d the researchers said.\n\nPraying Mantis actors then used the access the hacked IIS servers provided to conduct additional malicious tasks, including credential harvesting, reconnaissance, and lateral movement on their targets\u2019 networks.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago\nThe post Hacked sites push TeamViewer using fake expired certificate alert first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:02:22.026582Z"}, {"uuid": "c287c04d-d1a4-4e2d-bdde-b850bcee2a78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:50.568570Z"}, {"uuid": "0d2d3843-fd50-432e-b531-cc29b00b07ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/53232", "content": "(https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui))  C1 CMS (CVE-2019-18211 (https://medium.com/@frycos/yet-another-net-deserialization-35f6ce048df7))  Jenkins (CVE-2016-9299 (https://nvd.nist.gov/vuln/detail/CVE-2016-9299))  What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability. (https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/) \u2013 @breenmachine, FoxGloveSecurity (2015)    Talks and Write-Ups    PSA: Log4Shell and the current state of JNDI injection (https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) - Moritz Bechler (2021)  This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits (https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits) \u2013 Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020)  Deep Dive into .NET ViewState deserialization and its exploitation (https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) \u2013 Swapneil Dash (2019)  Exploiting  (https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)Deserialization (https://www.kitploit.com/search/label/Deserialization) in ASP.NET via ViewState \u2013 Soroush Dalili (2019)  Use of Deserialization in .NET Framework Methods and Classes (https://research.nccgroup.com/wp-content/uploads/2020/07/whitepaper-new.pdf) \u2013 Soroush Dalili(2018)  Friday the 13th, JSON Attacks (https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf) \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2017)  Exploiting .NET Managed DCOM (https://googleprojectzero.blogspot.com/2017/04/exploiting-net-managed-dcom.html) \u2013 James Forshaw, Project Zero (2017)  Java Unmarshaller Security (https://github.com/frohoff/marshalsec/blob/master/marshalsec.pdf) \u2013 Moritz Bechler (2017)  Deserialize My Shorts (https://www.slideshare.net/frohoff1/deserialize-my-shorts-or-how-i-learned-to-start-worrying-and-hate-java-object-deserialization) \u2013 Chris Frohoff (2016)  Pwning Your Java Messaging with Deserialization Vulnerabilities (https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf) \u2013 Matthias Kaiser (2016)  Journey from JNDI/LDAP  (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)Manipulation (https://www.kitploit.com/search/label/Manipulation) to Remote Code Execution (https://www.kitploit.com/search/label/Remote%20Code%20Execution) Dream Land \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2016)  Marshalling Pickles (https://www.youtube.com/watch?v=KSA7vUkXGSg) \u2013 Chris Frohoff and Gabriel Lawrence (2015)  Are you my Type? Breaking .NET Through Serialization (https://github.com/VulnerableGhost/.Net-Sterilized--Deserialization-Exploitation/blob/master/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf) \u2013 James Forshaw (2012)  A Spirited Peek into ViewState (https://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/) \u2013 Mike Shema (2011)    \nAuthor:\u00a0Alyssa Rahman @ramen0x3fCreated:\u00a02021-10-27Last Updated:\u00a02021-12-02Blog:\u00a0https://www.mandiant.com/resources/hunting-deserialization-exploitsFor more details on this tool and the research process behind it, check out\u00a0our blog (https://www.mandiant.com/resources/hunting-deserialization-exploits)!\n\nDownload Heyserial (https://github.com/mandiant/heyserial)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:50.466775Z"}, {"uuid": "e3772997-88be-4990-9bb4-9f254a63ed17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:50.028019Z"}, {"uuid": "4dab0a6d-c656-42a1-a389-7757f4a8f9f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/24366", "content": "and Altserialization Insecure Deserialization exploits, and a Telerik-UI Exploit (CVE-2019-18935, CVE-2017-11317).\nSee Also: Offensive Security Tool: SniperPhish \u201cThe operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment,\u201d the researchers said.\n\nPraying Mantis actors then used the access the hacked IIS servers provided to conduct additional malicious tasks, including credential harvesting, reconnaissance, and lateral movement on their targets\u2019 networks.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago\nThe post Hacked sites push TeamViewer using fake expired certificate alert first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:02:50.708319Z"}, {"uuid": "61fcd82a-5b4e-4375-9099-a169a52c8069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53232", "content": "(https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui))  C1 CMS (CVE-2019-18211 (https://medium.com/@frycos/yet-another-net-deserialization-35f6ce048df7))  Jenkins (CVE-2016-9299 (https://nvd.nist.gov/vuln/detail/CVE-2016-9299))  What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability. (https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/) \u2013 @breenmachine, FoxGloveSecurity (2015)    Talks and Write-Ups    PSA: Log4Shell and the current state of JNDI injection (https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) - Moritz Bechler (2021)  This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits (https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits) \u2013 Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020)  Deep Dive into .NET ViewState deserialization and its exploitation (https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) \u2013 Swapneil Dash (2019)  Exploiting  (https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)Deserialization (https://www.kitploit.com/search/label/Deserialization) in ASP.NET via ViewState \u2013 Soroush Dalili (2019)  Use of Deserialization in .NET Framework Methods and Classes (https://research.nccgroup.com/wp-content/uploads/2020/07/whitepaper-new.pdf) \u2013 Soroush Dalili(2018)  Friday the 13th, JSON Attacks (https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf) \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2017)  Exploiting .NET Managed DCOM (https://googleprojectzero.blogspot.com/2017/04/exploiting-net-managed-dcom.html) \u2013 James Forshaw, Project Zero (2017)  Java Unmarshaller Security (https://github.com/frohoff/marshalsec/blob/master/marshalsec.pdf) \u2013 Moritz Bechler (2017)  Deserialize My Shorts (https://www.slideshare.net/frohoff1/deserialize-my-shorts-or-how-i-learned-to-start-worrying-and-hate-java-object-deserialization) \u2013 Chris Frohoff (2016)  Pwning Your Java Messaging with Deserialization Vulnerabilities (https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf) \u2013 Matthias Kaiser (2016)  Journey from JNDI/LDAP  (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)Manipulation (https://www.kitploit.com/search/label/Manipulation) to Remote Code Execution (https://www.kitploit.com/search/label/Remote%20Code%20Execution) Dream Land \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2016)  Marshalling Pickles (https://www.youtube.com/watch?v=KSA7vUkXGSg) \u2013 Chris Frohoff and Gabriel Lawrence (2015)  Are you my Type? Breaking .NET Through Serialization (https://github.com/VulnerableGhost/.Net-Sterilized--Deserialization-Exploitation/blob/master/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf) \u2013 James Forshaw (2012)  A Spirited Peek into ViewState (https://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/) \u2013 Mike Shema (2011)    \nAuthor:\u00a0Alyssa Rahman @ramen0x3fCreated:\u00a02021-10-27Last Updated:\u00a02021-12-02Blog:\u00a0https://www.mandiant.com/resources/hunting-deserialization-exploitsFor more details on this tool and the research process behind it, check out\u00a0our blog (https://www.mandiant.com/resources/hunting-deserialization-exploits)!\n\nDownload Heyserial (https://github.com/mandiant/heyserial)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T21:00:05.744932Z"}, {"uuid": "5f9f7a26-35e5-4789-83f1-988c2ec5a7c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T21:00:05.504677Z"}, {"uuid": "b9b9302d-d3ec-4b99-b95e-183a28dd8ec3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T21:00:05.910931Z"}, {"uuid": "a9cd7ed1-c397-4329-8c2a-c474cb054a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53232", "content": "(https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui))  C1 CMS (CVE-2019-18211 (https://medium.com/@frycos/yet-another-net-deserialization-35f6ce048df7))  Jenkins (CVE-2016-9299 (https://nvd.nist.gov/vuln/detail/CVE-2016-9299))  What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability. (https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/) \u2013 @breenmachine, FoxGloveSecurity (2015)    Talks and Write-Ups    PSA: Log4Shell and the current state of JNDI injection (https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) - Moritz Bechler (2021)  This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits (https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits) \u2013 Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020)  Deep Dive into .NET ViewState deserialization and its exploitation (https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) \u2013 Swapneil Dash (2019)  Exploiting  (https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)Deserialization (https://www.kitploit.com/search/label/Deserialization) in ASP.NET via ViewState \u2013 Soroush Dalili (2019)  Use of Deserialization in .NET Framework Methods and Classes (https://research.nccgroup.com/wp-content/uploads/2020/07/whitepaper-new.pdf) \u2013 Soroush Dalili(2018)  Friday the 13th, JSON Attacks (https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf) \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2017)  Exploiting .NET Managed DCOM (https://googleprojectzero.blogspot.com/2017/04/exploiting-net-managed-dcom.html) \u2013 James Forshaw, Project Zero (2017)  Java Unmarshaller Security (https://github.com/frohoff/marshalsec/blob/master/marshalsec.pdf) \u2013 Moritz Bechler (2017)  Deserialize My Shorts (https://www.slideshare.net/frohoff1/deserialize-my-shorts-or-how-i-learned-to-start-worrying-and-hate-java-object-deserialization) \u2013 Chris Frohoff (2016)  Pwning Your Java Messaging with Deserialization Vulnerabilities (https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf) \u2013 Matthias Kaiser (2016)  Journey from JNDI/LDAP  (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)Manipulation (https://www.kitploit.com/search/label/Manipulation) to Remote Code Execution (https://www.kitploit.com/search/label/Remote%20Code%20Execution) Dream Land \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2016)  Marshalling Pickles (https://www.youtube.com/watch?v=KSA7vUkXGSg) \u2013 Chris Frohoff and Gabriel Lawrence (2015)  Are you my Type? Breaking .NET Through Serialization (https://github.com/VulnerableGhost/.Net-Sterilized--Deserialization-Exploitation/blob/master/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf) \u2013 James Forshaw (2012)  A Spirited Peek into ViewState (https://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/) \u2013 Mike Shema (2011)    \nAuthor:\u00a0Alyssa Rahman @ramen0x3fCreated:\u00a02021-10-27Last Updated:\u00a02021-12-02Blog:\u00a0https://www.mandiant.com/resources/hunting-deserialization-exploitsFor more details on this tool and the research process behind it, check out\u00a0our blog (https://www.mandiant.com/resources/hunting-deserialization-exploits)!\n\nDownload Heyserial (https://github.com/mandiant/heyserial)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:16.663852Z"}, {"uuid": "b43ef050-7215-4922-8556-8611c21cc9d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:16.417976Z"}, {"uuid": "eab77fb8-1c31-4a0e-bf90-284d8bd2bcc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:16.834275Z"}, {"uuid": "f0bd943d-5c87-4197-8e31-019d3bf1f8bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/24366", "content": "and Altserialization Insecure Deserialization exploits, and a Telerik-UI Exploit (CVE-2019-18935, CVE-2017-11317).\nSee Also: Offensive Security Tool: SniperPhish \u201cThe operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment,\u201d the researchers said.\n\nPraying Mantis actors then used the access the hacked IIS servers provided to conduct additional malicious tasks, including credential harvesting, reconnaissance, and lateral movement on their targets\u2019 networks.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago\nThe post Hacked sites push TeamViewer using fake expired certificate alert first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-07T14:00:04.983468Z"}, {"uuid": "3f2544bc-47df-4c16-81d1-9a6481d1257e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://t.me/hacking_Attack/24366", "content": "and Altserialization Insecure Deserialization exploits, and a Telerik-UI Exploit (CVE-2019-18935, CVE-2017-11317).\nSee Also: Offensive Security Tool: SniperPhish \u201cThe operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment,\u201d the researchers said.\n\nPraying Mantis actors then used the access the hacked IIS servers provided to conduct additional malicious tasks, including credential harvesting, reconnaissance, and lateral movement on their targets\u2019 networks.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago\nThe post Hacked sites push TeamViewer using fake expired certificate alert first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-08T00:00:43.888715Z"}, {"uuid": "d51c8acf-5d24-415d-a096-f6fca076e956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18935", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/telerik_rau_deserialization.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Spencer McIntyre\", \"Paul Taylor\", \"Markus Wulftange\", \"Caleb Gross\", \"Alvaro Mu\\u00f1oz\", \"Oleksandr Mirosh\", \"straightblast\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits the .NET deserialization vulnerability within the RadAsyncUpload (RAU) component of Telerik\\n          UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET\\n          assembly DLL which is then loaded through the deserialization flaw. Uploading the file requires knowledge of the\\n          cryptographic keys used by RAU. The default values used by this module are related to CVE-2017-11317, which once\\n          patched randomizes these keys. It is also necessary to know the version of Telerik UI ASP.NET that is running.\\n          This version number is in the format YYYY.#(.###)? where YYYY is the year of the release (e.g. '2020.3.915').\", \"disclosure_date\": \"2019-12-09\", \"fullname\": \"exploit/windows/http/telerik_rau_deserialization\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unreliable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/telerik_rau_deserialization.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/telerik_rau_deserialization\", \"references\": [\"CVE-2017-11317\", \"URL-https://github.com/bao7uo/RAU_crypto\", \"URL-https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/unrestricted-file-upload\", \"URL-https://github.com/straightblast/UnRadAsyncUpload/wiki\", \"CVE-2019-18935\", \"URL-https://github.com/noperator/CVE-2019-18935\", \"URL-https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization\", \"URL-https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html\", \"URL-https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Windows\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:00.926401Z"}]}