{"vulnerability": "cve-2022-2450", "sightings": [{"uuid": "7b0b39e2-b767-4b23-aeaa-d6d1b51030e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "MISP/4d9e0694-2872-4bfc-8eee-f1ab846c5ab0", "content": "", "creation_timestamp": "2025-08-16T01:45:14.000000Z"}, {"uuid": "2bc2c090-8d9c-4489-a857-d85f31be9328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "MISP/4d9e0694-2872-4bfc-8eee-f1ab846c5ab0", "content": "", "creation_timestamp": "2025-08-19T04:06:32.000000Z"}, {"uuid": "45c0ad2f-99b5-4592-adfd-42be48a56c48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-24508", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=752", "content": "", "creation_timestamp": "2022-03-09T04:00:00.000000Z"}, {"uuid": "c72cd6b6-ae5e-47f0-bf31-99c1403116dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2227", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-24500 RCE Exploit\nURL\uff1ahttps://github.com/rkxxz/CVE-2022-24500\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-05-19T03:36:25.000000Z"}, {"uuid": "b18d514e-7ef1-4c42-9df1-9a5c4521ed1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2945", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-24500 Windows SMB Unauthenticated Remote Code Execution Vulnerability\nURL\uff1ahttps://github.com/Daro1967/CVE-2022-24500-MASS-RCE\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-08-15T07:59:30.000000Z"}, {"uuid": "315840f7-92e0-45cb-af7c-2160f887c403", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2726", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-24500 Windows SMB Remote Code Execution Vulnerability\nURL\uff1ahttps://github.com/Daro1967/CVE-2022-24500-RCE\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-07-17T11:26:18.000000Z"}, {"uuid": "6daf8153-37a5-4db2-aa3c-76d8af6f802f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "https://t.me/itsec_news/474", "content": "\u200b\u2705 Microsoft \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 128 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0430\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\ud83d\udcac \u0412\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a, 12-\u0433\u043e \u0430\u043f\u0440\u0435\u043b\u044f, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u043b\u0430\u043d\u043e\u0432\u044b\u0435 \u0435\u0436\u0435\u043c\u0435\u0441\u044f\u0447\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432. \u0410\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u043f\u0430\u0442\u0447\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442 128 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Windows, \u0417\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0435, Office, Exchange Server, Visual Studio, \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 \u0438 \u043f\u0440.\n\n\u0414\u0435\u0441\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u044b \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435. 115 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043e\u043f\u0430\u0441\u043d\u044b\u0435, \u0438 3 \u2014 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041e\u0434\u043d\u0430 \u0438\u0437 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438. \u0420\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Windows Common Log File System, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 \u0438 \u0418\u0411-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 CrowdStrike. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2022-24521 \u0438 \u043e\u0446\u0435\u043d\u043a\u0443 7,8 \u0431\u0430\u043b\u043b\u0430 \u0438\u0437 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 10.\n\n\u0415\u0449\u0451 \u043e\u0434\u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430 \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0441\u0442\u0438, \u0442\u0430\u043a \u043a\u0430\u043a \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0440\u0430\u043d\u0435\u0435. CVE-2022-26904 (7.0 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Windows User Profile Service.\n\n\u0414\u0440\u0443\u0433\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 Runtime Library (CVE-2022-26809), Windows Network File System (CVE-2022-24491 \u0438 CVE-2022-24497), Windows Server Service (CVE-2022-24541), Windows SMB (CVE-2022-24500) \u0438 Microsoft Dynamics 365 (CVE-2022-23259).\n\nMicrosoft \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 18 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Windows DNS Server, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043e\u0434\u043d\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 17 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430. \u0415\u0449\u0451 15 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438.\n\n#Microsoft #\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-04-13T08:18:48.000000Z"}, {"uuid": "390a1877-6e63-4a58-a82f-bc46119849e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/cybersecplayground/131", "content": "\ud83d\udea8 CVE-2022-24500: Windows SMB RCE Vulnerability \ud83d\udea8\n\n\ud83d\udc80 Critical Windows SMB Remote Code Execution \ud83d\udc80\n\n\u26a1\ufe0f A severe vulnerability in Windows SMB allows remote code execution, potentially leading to full system compromise. Attackers can exploit this flaw to execute arbitrary commands on vulnerable systems.\n\n\ud83d\udd0e Exploit & Proof-of-Concept\n\ud83d\udd17 GitHub PoC: CVE-2022-24500 Exploit\n\n\ud83d\udcd6 Vulnerability Details:\n\nType: Remote Code Execution (RCE)\nAffected Systems: Windows versions with unpatched SMB service\nImpact: System takeover, privilege escalation, malware deployment\n\n\ud83d\udee1 Mitigation Steps:\n\u2705 Apply Microsoft security patches immediately\n\u2705 Disable SMBv1 if not needed\n\u2705 Restrict access to SMB services via firewall rules\n\n\u26a0\ufe0f Unpatched systems are at risk\u2014update now!\n\n\ud83d\udd17 Stay ahead in cybersecurity\u2014join us! @cybersecplayground \ud83d\ude80", "creation_timestamp": "2025-03-12T09:12:12.000000Z"}, {"uuid": "519d04e6-7640-43e3-94cc-fe1348accaf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/malwar3s/18", "content": "https://github.com/Daro1967/CVE-2022-24500-RCE", "creation_timestamp": "2022-07-18T10:03:13.000000Z"}, {"uuid": "ab6b06e0-dc43-4e6c-99fd-efab95601c6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "Telegram/57IuuNEdwF3ljWg8cWFUAt0EiC-URygGEXcqHEyn1fRKEEE", "content": "", "creation_timestamp": "2025-03-12T10:12:01.000000Z"}, {"uuid": "2a19f32a-cae7-4cd8-b601-3f5c8f7d9b40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "Telegram/zlr8uFjICy2bMuMFnSkr4pwsAb5JGAUjW7rzdG9qFkW9CA", "content": "", "creation_timestamp": "2022-05-20T14:20:51.000000Z"}, {"uuid": "9bd34fe3-0551-49cd-8143-2ba019e8a100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/839", "content": "\u043d\u0430\u0448\u0443\u043c\u0435\u0432\u0448\u0438\u0439 CVE-2022-24500 RCE exploit \u0440\u0430\u0441\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c (\u043a\u0442\u043e \u0431\u044b \u043c\u043e\u0433 \u043f\u043e\u0434\u0443\u043c\u0430\u0442\u044c ?)))\n\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0434\u044b\u0440\u044b \u0442\u0443\u0442\n\u041f\u0441\u0435\u0432\u0434\u043e \u0441\u043f\u043b\u043e\u0438\u0442  - \u0442\u0443\u0442  (\u0443\u0436\u0435 \u0443\u0434\u0430\u043b\u0438\u043b\u0438) \u0442\u0430\u043c \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a \u0431\u044b\u043b.\n\u0410 \u0432 \u0431\u0438\u043d\u0430\u0440\u0435 \u0431\u044b\u043b beacon )))) \n\n#rce #exploit #windows", "creation_timestamp": "2022-05-20T12:30:53.000000Z"}, {"uuid": "76289698-83dd-4c13-a1df-70e2c07afd34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "Telegram/y_9DD7_K3jT5WlptKIQXRuPTPceVX5FKmlGBoaHyNk40jw", "content": "", "creation_timestamp": "2022-05-21T05:45:56.000000Z"}, {"uuid": "bc0a554b-05c2-4c4a-9c52-de7a96b15b4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "Telegram/nuTGdprKllrU0CiecpY0i0e--qdufSOGANsh6ZG3WqezTg", "content": "", "creation_timestamp": "2022-05-19T06:21:08.000000Z"}, {"uuid": "29038b53-1b07-4154-b1b9-a4caec46deb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "https://t.me/crackcodes/559", "content": "\u200bCVE-2022-24500 RCE Exploit\n\nWindows SMB Remote Code Execution Vulnerability\n\nVulnerability: Windows 7 - Windows 2022 \nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24500\n\n#cve #smb #exploit #rce", "creation_timestamp": "2022-05-20T14:09:37.000000Z"}, {"uuid": "6494a2dc-3f2f-4a4b-afda-21b92b3bf1df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/2968", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Cyble \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0435\u0439 Infosec-\u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u043c PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 Cobalt Strike.\n\n\u0412\u0441\u0435 \u043d\u0430\u0447\u0430\u043b\u043e\u0441\u044c \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 Twitter, \u0430\u0432\u0442\u043e\u0440 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u043b \u043c\u0430\u043b\u0432\u0430\u0440\u044c, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 Proof of Concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 RPC Runtime Library (CVE-2022-26809 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS 9.8), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0438 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0447\u0435\u0440\u0435\u0437 GitHub.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u0448\u0435\u043b\u0441\u044f \u0438 \u0434\u0440\u0443\u0433\u043e\u0439 \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u0434 POC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f CVE-2022-24500 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437\u0435\u0446, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u043b\u0441\u044f \u0432 GitHub. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0431\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u0438 \u0442\u043e\u043c\u0443 \u0436\u0435 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0443, \u044f\u0432\u043b\u044f\u044e\u0449\u0435\u043c\u0443\u0441\u044f \u0433\u043b\u0430\u0432\u043d\u044b\u043c \u0430\u043a\u0442\u043e\u0440\u043e\u043c \u0432\u0441\u0435\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043e\u0442\u0441\u043b\u0435\u0434\u0438\u043b\u0438 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430 \u0418\u0411\u044d\u0448\u043d\u044b\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e \u043f\u043e\u0434 \u0432\u0438\u0434\u043e\u043c PoC.\n\n\u0410\u043d\u0430\u043b\u0438\u0437 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u041f\u041e \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0431\u043e\u0439 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b .Net, \u0443\u043f\u0430\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0439\u00a0ConfuserEX, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0438\u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043d\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0432 \u043a\u043e\u0434\u0435 \u043d\u0438 \u0441\u0442\u0440\u043e\u0447\u043a\u0438 \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0445 \u0432 PoC \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041f\u043e \u0444\u0430\u043a\u0442\u0443 \u043c\u0430\u043b\u0432\u0430\u0440\u044c \u0432\u0438\u0437\u0443\u0430\u043b\u044c\u043d\u043e \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u0435\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438,  \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044f \u0432 \u0444\u043e\u043d\u0435 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434.\n\n\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 PowerShell \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e cmd.exe \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 Cobalt-Strike.\u00a0\u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u043e\u043a\u043e\u0432\u044b\u0445 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0439.\n\n\u041f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u043c\u0441\u044f \u043a Cyble \u0438 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0430\u0441\u0442\u0430\u0438\u0432\u0430\u0435\u043c \u043d\u0430 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u043e\u0441\u0442\u0438 \u0438 \u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u0412 \u044d\u0442\u043e\u043c \u043f\u043b\u0430\u043d\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043e\u0442\u0447\u0435\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043e\u0431\u0449\u0438\u0445 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u043d\u0435\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 (IoC) \u043a\u0430\u0441\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438.", "creation_timestamp": "2022-05-23T13:28:32.000000Z"}, {"uuid": "61adbb4c-98ba-483f-ba3c-0b2ca99aa9bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2450", "type": "seen", "source": "https://t.me/cibsecurity/52965", "content": "\u203c CVE-2022-2450 \u203c\n\nThe reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-16T07:51:30.000000Z"}, {"uuid": "71efd8a8-30af-4b59-9603-3261311a68dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24504", "type": "seen", "source": "https://t.me/cibsecurity/51161", "content": "\u203c CVE-2022-41081 \u203c\n\nWindows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22035, CVE-2022-24504, CVE-2022-30198, CVE-2022-33634, CVE-2022-38000, CVE-2022-38047.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-11T22:32:09.000000Z"}, {"uuid": "fddc028b-fe29-427b-8808-c79fd9579406", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24506", "type": "seen", "source": "https://t.me/cibsecurity/38613", "content": "\u203c CVE-2022-24469 \u203c\n\nAzure Site Recovery Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24506, CVE-2022-24515, CVE-2022-24518, CVE-2022-24519.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-09T20:18:20.000000Z"}, {"uuid": "1f82cf10-29e4-4e80-9e2c-193af13a20e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24502", "type": "seen", "source": "https://t.me/cibsecurity/38591", "content": "\u203c CVE-2022-24502 \u203c\n\nWindows HTML Platforms Security Feature Bypass Vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-09T20:12:19.000000Z"}, {"uuid": "0f870a90-154e-48e7-8310-6d6e8aaf103c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24505", "type": "seen", "source": "https://t.me/cibsecurity/38603", "content": "\u203c CVE-2022-23283 \u203c\n\nWindows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23287, CVE-2022-24505.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-09T20:18:06.000000Z"}, {"uuid": "adc3955c-a89e-4fdc-b85e-1a51e2cf5955", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24509", "type": "seen", "source": "https://t.me/cibsecurity/38584", "content": "\u203c CVE-2022-24510 \u203c\n\nMicrosoft Office Visio Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24461, CVE-2022-24509.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-09T20:12:06.000000Z"}, {"uuid": "cf108d89-fd5f-427a-a4d9-21da9e5ad413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24507", "type": "seen", "source": "https://t.me/cibsecurity/38581", "content": "\u203c CVE-2022-24507 \u203c\n\nWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-09T20:12:00.000000Z"}, {"uuid": "df79c46e-aeb4-40c3-b7eb-25a371a19abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24508", "type": "seen", "source": "https://t.me/cibsecurity/38615", "content": "\u203c CVE-2022-24508 \u203c\n\nWindows SMBv3 Client/Server Remote Code Execution Vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-09T21:11:25.000000Z"}, {"uuid": "108f9d40-10c1-48b1-b19c-729659c939c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24503", "type": "seen", "source": "https://t.me/cibsecurity/38594", "content": "\u203c CVE-2022-24503 \u203c\n\nRemote Desktop Protocol Client Information Disclosure Vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-09T20:12:25.000000Z"}, {"uuid": "36c4d2f0-7ee1-4a03-a53b-eaf01396bcf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/2308", "content": "#CVE-2022\n\nCVE-2022-24500 Windows SMB Unauthenticated Remote Code Execution Vulnerability\n\nhttps://github.com/Daro1967/CVE-2022-24500-MASS-RCE\n\n@BlueRedTeam", "creation_timestamp": "2022-08-15T16:16:53.000000Z"}, {"uuid": "d6e9fcc2-3164-456d-af1b-e93e2c8e1760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "exploited", "source": "https://t.me/BlueRedTeam/2238", "content": "#CVE-2022\n\nCVE-2022-24500 Windows SMB Remote Code Execution Vulnerability\n\nhttps://github.com/Daro1967/CVE-2022-24500-RCE\n\n@BlueRedTeam", "creation_timestamp": "2022-07-18T04:41:54.000000Z"}, {"uuid": "97c36cad-3937-4d4c-8af1-c5753d68eb7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24504", "type": "seen", "source": "https://t.me/VulnerabilityNews/30351", "content": "Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24504, CVE-2022-30198, CVE-2022-33634, CVE-2022-38000, CVE-2022-38047, CVE-2022-41081.\nPublished at: October 11, 2022 at 09:15PM\nView on website", "creation_timestamp": "2022-10-11T22:42:23.000000Z"}, {"uuid": "cb801a8d-ef77-405f-85cd-7ac49a9186e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "https://t.me/EchelonEyes/296", "content": "\u0424\u0435\u0439\u043a\u043e\u0432\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0418\u0411-\u043a\u043e\u043c\u043c\u044c\u044e\u043d\u0438\u0442\u0438\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043d\u0430\u0446\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0432 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b Windows, \u043f\u043e\u0434 \u0432\u0438\u0434\u043e\u043c \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u043b\u043e\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e. \u0422\u043e\u0442, \u043a\u0442\u043e \u0441\u0442\u043e\u0438\u0442 \u0437\u0430 \u044d\u0442\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Windows \u2013 CVE-2022-24500 \u0438 CVE-2022-26809. \u041e\u0431\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u041a\u043e\u0433\u0434\u0430 Microsoft \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u044b\u0447\u043d\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043d\u0430 GitHub. \u042d\u0442\u0438\u043c-\u0442\u043e \u0438 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0432 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u00abrkxxz\u00bb \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 GitHub \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043f\u043e\u0434 \u0432\u0438\u0434\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u043b\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 Cobalt Strike (beacon) \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0436\u0435\u0440\u0442\u0432. \u041f\u0440\u0438 \u0442\u043e\u043c, \u0447\u0442\u043e Cobalt Strike \u2013 \u044d\u0442\u043e \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0438\u043d\u0433\u0430, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0435\u0440\u0435\u0434\u043a\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \n\n\u0423\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043d\u0430 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u0430 \u0441 GitHub.\n\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043d\u0430\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0418\u0411, \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0441\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0435 Lazarus.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.bleepingcomputer.com/news/security/fake-windows-exploits-target-infosec-community-with-cobalt-strike/\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442", "creation_timestamp": "2026-07-17T05:00:04.794829Z"}, {"uuid": "007a0ce5-4b79-415e-844a-fad7c2c61c7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/296", "content": "\u0424\u0435\u0439\u043a\u043e\u0432\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0418\u0411-\u043a\u043e\u043c\u043c\u044c\u044e\u043d\u0438\u0442\u0438\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043d\u0430\u0446\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0432 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b Windows, \u043f\u043e\u0434 \u0432\u0438\u0434\u043e\u043c \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u043b\u043e\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e. \u0422\u043e\u0442, \u043a\u0442\u043e \u0441\u0442\u043e\u0438\u0442 \u0437\u0430 \u044d\u0442\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Windows \u2013 CVE-2022-24500 \u0438 CVE-2022-26809. \u041e\u0431\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u041a\u043e\u0433\u0434\u0430 Microsoft \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u044b\u0447\u043d\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043d\u0430 GitHub. \u042d\u0442\u0438\u043c-\u0442\u043e \u0438 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0432 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u00abrkxxz\u00bb \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 GitHub \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043f\u043e\u0434 \u0432\u0438\u0434\u043e\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u043b\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 Cobalt Strike (beacon) \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0436\u0435\u0440\u0442\u0432. \u041f\u0440\u0438 \u0442\u043e\u043c, \u0447\u0442\u043e Cobalt Strike \u2013 \u044d\u0442\u043e \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0438\u043d\u0433\u0430, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0435\u0440\u0435\u0434\u043a\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \n\n\u0423\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043d\u0430 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u0430 \u0441 GitHub.\n\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043d\u0430\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0418\u0411, \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0441\u0435\u0432\u0435\u0440\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0435 Lazarus.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://www.bleepingcomputer.com/news/security/fake-windows-exploits-target-infosec-community-with-cobalt-strike/\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442", "creation_timestamp": "2026-07-18T00:00:39.358564Z"}, {"uuid": "3ad8dcfa-4deb-42da-b7e1-8147557083ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "https://t.me/CVEhub/18328", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24500*\nGithub: https://github.com/yusufazizmustofa/CVE-2022-24500", "creation_timestamp": "2026-07-29T12:00:09.886262Z"}, {"uuid": "0c1958b8-f89d-423a-b52a-43dcb1d0dcb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/18328", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24500*\nGithub: https://github.com/yusufazizmustofa/CVE-2022-24500", "creation_timestamp": "2026-07-30T00:00:22.517094Z"}, {"uuid": "ab616411-1fd6-4ac4-b62b-e1f9ae083ed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "https://t.me/hacking_Attack/49993", "content": "nctionality, which is used primarily for file-sharing and inter-process communication, including Remote Procedure Calls. RPC is a communication mechanism that allows for one program to request a service or functionality from another program located on the network (internet and/or intranet). RPCs can be used in technologies like storage replica or managing shared volumes.\n\n\u201cThis vulnerability is another example of an attacker taking advantage of legitimate functionality for malicious gain,\u201d he said via email. \u201cUsing the vulnerability, an attacker can create a specially crafted RPC to execute code on the remote server with the same permissions as the RPC service.\u201d\n\nThe bug could be used to create especially virulent threats, according to Childs.\n\n\u201cSince no user interaction is required, these factors combine to make this wormable, at least between machines where RPC can be reached,\u201d Childs noted.\n\nMicrosoft recommends configuring firewall rules to help prevent this vulnerability from being exploited; the static port used (TCP port 135) can be blocked at the network perimeter.\n\n\u201cStill, this bug could be used for lateral movement by an attacker,\u201d Childs warned. \u201cDefinitely test and deploy this one quickly.\u201d\n\nNext up are CVE-2022-24491/24497, two RCE bugs that affect the Windows Network File System (NFS). Both also have CVSS scores of 9.8, and both are listed as exploitation more likely. They also allow the potential for worming exploits, Childs warned.\n\n\u201cOn systems where the NFS role is enabled, a remote attacker could execute their code on an affected system with high privileges and without user interaction,\u201d Childs explained. \u201cAgain, that adds up to a wormable bug \u2013 at least between NFS servers. Similar to RPC, this is often blocked at the network perimeter.\u201d\n\nImmersive\u2019s Breen added, \u201cThese could be the kind of vulnerabilities which appeal to ransomware operators as they provide the potential to expose critical data.\u00a0 It is also important for security teams to note that NFS Role is not a default configuration for Windows devices.\u201d\n\nThe remaining critical vulnerabilities are as follows:\n\n* CVE-2022-23259: Microsoft Dynamics 365 (on-premises) (CVSS 8.8)\n* CVE-2022-22008: Windows Hyper-V (CVSS 7.7)\n* CVE-2022-23257: Windows Hyper-V (CVSS 8.6)\n* CVE-2022-24537: Windows Hyper-V (CVSS 7.7)\n* CVE-2022-26919: Windows LDAP (CVSS 8.1)\n* CVE-2022-24541: Windows Server (CVSS 8.8)\n* CVE-2022-24500: Windows SMB (CVSS 8.8) Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet Other Bugs of NoteAlso worth mentioning: Out of a whopping 18 bugs found in the Windows Domain Name Server (DNS), one (CVE-2022-26815) allows RCE and is listed as important, with a CVSS score of 7.2.\n\nMicrosoft noted that while attack complexity is low, \u201cthe attacker or targeted user would need specific elevated privileges [for successful exploitation]. As is best practice, regular validation and audits of administrative groups should be conducted.\u201d\n\nMeanwhile, \u201cthere are a couple of important mitigations to point out here,\u201d Childs noted. \u201cThe first is that dynamic updates must be enabled for a server to be affected by this bug. The CVSS also lists some level of privileges to exploit. Still, any chance of an attacker getting RCE on a DNS server is one too many, so get your DNS servers patched.\u201d\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-2-90x90.jpg Git security vulnerabilities prompt updates1 day ago\n* https://www.blackhatethicalhac[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:44.223030Z"}, {"uuid": "00233e02-7270-422a-ba1d-7a171ded6db1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24508", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:52.118672Z"}, {"uuid": "22d93499-9e5f-4db2-b09b-bb63cc5ab63d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24503", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:52.249435Z"}, {"uuid": "16c7ca8c-f5ac-4090-953e-d9c73f4c5d02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24507", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:52.379434Z"}, {"uuid": "e4599b44-95fa-4b89-9bcd-86f50209510e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24501", "type": "seen", "source": "https://t.me/hacking_Attack/45622", "content": "Black Hat Ethical Hacking\nMicrosoft Addresses 3 Zero-Days & 3 Critical Bugs for March\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for MarchPost Views: 29 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nMicrosoft patched 71 security vulnerabilities in an uncharacteristically light scheduled update, including its first Xbox bug.\nMicrosoft has addressed 71 security vulnerabilities in its scheduled March Patch Tuesday update \u2013 only three of which are rated critical in severity. The other 68 are all rated \u201cimportant.\u201d\n\nThree of the bugs are listed as publicly known zero-days, but none of them are listed as having been exploited in the wild (thus far).\n\nThe issues affect the gamut of the computing giant\u2019s portfolio, including Microsoft Windows and Windows Components, Azure Site Recovery, Microsoft Defender for Endpoint and IoT, Intune, Edge (Chromium-based), Windows HTML Platforms, Office and Office Components, Skype, .NET and Visual Studio, Windows RDP, SMB Server.\n\nNotably, the tranche also contains the first-ever patch for the Xbox gaming console.\n\nIt\u2019s worth noting that the update marks the second month in a row with a surprisingly low number of critical patches; in fact, February\u2019s Patch Tuesday update didn\u2019t list any.\n\n\u201cThe number of critical-rated patches is again strangely low for this number of bugs,\u201d Trend Micro Zero-Day Initiative researcher Dustin Childs noted in an email. \u201cIt\u2019s unclear if this low percentage of bugs is just a coincidence, or if Microsoft might be evaluating the severity using different calculus than in the past.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Critical-Rated Microsoft Security BugsThe three critical bugs, all of which could lead to remote code execution, are:\n\n* CVE-2022-22006: HEVC Video Extensions (CVSS rating of 7.8)\n* CVE-2022-24501: VP9 Video Extensions (CVSS rating of 7.8)\n* CVE-2022-23277: Microsoft Exchange Server (CVSS rating of 8.8)\n\nBoth video extensions bugs, in HEVC and VP9, require social engineering; an attacker would need to convince a victim to download and open a specially crafted file, which could lead to a crash, according to Microsoft\u2019s advisory.\n\nThe video extensions are coding standards for video compression that Windows is able to run so that users can watch high-fidelity videos. Paul Laudanski, head of threat intelligence at Tessian, noted that the likelihood of compromise is low, thanks to the user-interaction requirement.\n\nThat said, the VP9 bug is more crucial for patching, he said: \u201cVP9 is supported by modern day browsers except for Internet Explorer, so it is critical for users to ensure they are updating them. While VP9 is open and royalty free, the other file code affected, HEVC, is one that users have to purchase a license for.\u201d\n\nThe vulnerability in Exchange Server meanwhile would allow an authenticated attacker to target server accounts with the aim of executing code with elevated privileges, through a network call. Laudanski added that the vulnerability arises from the server not correctly handling objects in memory, which can lead to code execution.\n\nHere, the attacker must be authenticated. Even so, \u201cthis is also listed as low complexity with exploitation more likely, so it wouldn\u2019t surprise me to see this bug exploited in the wild soon,\u201d Childs noted. \u201cTest and deploy this to your Exchange servers quickly.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Kevin Breen, director of cyber-threat research at Immersive Labs, agreed. \u201cWhile requiring authentication, this vul[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:52.637010Z"}, {"uuid": "492d8bb7-478e-4283-8a89-f6b90e2df689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24503", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:05.128042Z"}, {"uuid": "cc7b01c7-4d56-4912-bdcd-870e956d6571", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24507", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:05.253215Z"}, {"uuid": "9995dfe6-eb5d-49bf-b792-00fd260e6eea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24500", "type": "seen", "source": "https://t.me/hacking_Attack/49993", "content": "nctionality, which is used primarily for file-sharing and inter-process communication, including Remote Procedure Calls. RPC is a communication mechanism that allows for one program to request a service or functionality from another program located on the network (internet and/or intranet). RPCs can be used in technologies like storage replica or managing shared volumes.\n\n\u201cThis vulnerability is another example of an attacker taking advantage of legitimate functionality for malicious gain,\u201d he said via email. \u201cUsing the vulnerability, an attacker can create a specially crafted RPC to execute code on the remote server with the same permissions as the RPC service.\u201d\n\nThe bug could be used to create especially virulent threats, according to Childs.\n\n\u201cSince no user interaction is required, these factors combine to make this wormable, at least between machines where RPC can be reached,\u201d Childs noted.\n\nMicrosoft recommends configuring firewall rules to help prevent this vulnerability from being exploited; the static port used (TCP port 135) can be blocked at the network perimeter.\n\n\u201cStill, this bug could be used for lateral movement by an attacker,\u201d Childs warned. \u201cDefinitely test and deploy this one quickly.\u201d\n\nNext up are CVE-2022-24491/24497, two RCE bugs that affect the Windows Network File System (NFS). Both also have CVSS scores of 9.8, and both are listed as exploitation more likely. They also allow the potential for worming exploits, Childs warned.\n\n\u201cOn systems where the NFS role is enabled, a remote attacker could execute their code on an affected system with high privileges and without user interaction,\u201d Childs explained. \u201cAgain, that adds up to a wormable bug \u2013 at least between NFS servers. Similar to RPC, this is often blocked at the network perimeter.\u201d\n\nImmersive\u2019s Breen added, \u201cThese could be the kind of vulnerabilities which appeal to ransomware operators as they provide the potential to expose critical data.\u00a0 It is also important for security teams to note that NFS Role is not a default configuration for Windows devices.\u201d\n\nThe remaining critical vulnerabilities are as follows:\n\n* CVE-2022-23259: Microsoft Dynamics 365 (on-premises) (CVSS 8.8)\n* CVE-2022-22008: Windows Hyper-V (CVSS 7.7)\n* CVE-2022-23257: Windows Hyper-V (CVSS 8.6)\n* CVE-2022-24537: Windows Hyper-V (CVSS 7.7)\n* CVE-2022-26919: Windows LDAP (CVSS 8.1)\n* CVE-2022-24541: Windows Server (CVSS 8.8)\n* CVE-2022-24500: Windows SMB (CVSS 8.8) Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet Other Bugs of NoteAlso worth mentioning: Out of a whopping 18 bugs found in the Windows Domain Name Server (DNS), one (CVE-2022-26815) allows RCE and is listed as important, with a CVSS score of 7.2.\n\nMicrosoft noted that while attack complexity is low, \u201cthe attacker or targeted user would need specific elevated privileges [for successful exploitation]. As is best practice, regular validation and audits of administrative groups should be conducted.\u201d\n\nMeanwhile, \u201cthere are a couple of important mitigations to point out here,\u201d Childs noted. \u201cThe first is that dynamic updates must be enabled for a server to be affected by this bug. The CVSS also lists some level of privileges to exploit. Still, any chance of an attacker getting RCE on a DNS server is one too many, so get your DNS servers patched.\u201d\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-2-90x90.jpg Git security vulnerabilities prompt updates1 day ago\n* https://www.blackhatethicalhac[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:57.059061Z"}, {"uuid": "30681de8-ac94-4add-a40a-0b97fa45661a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24501", "type": "seen", "source": "https://t.me/hacking_Attack/45622", "content": "Black Hat Ethical Hacking\nMicrosoft Addresses 3 Zero-Days & 3 Critical Bugs for March\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for MarchPost Views: 29 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nMicrosoft patched 71 security vulnerabilities in an uncharacteristically light scheduled update, including its first Xbox bug.\nMicrosoft has addressed 71 security vulnerabilities in its scheduled March Patch Tuesday update \u2013 only three of which are rated critical in severity. The other 68 are all rated \u201cimportant.\u201d\n\nThree of the bugs are listed as publicly known zero-days, but none of them are listed as having been exploited in the wild (thus far).\n\nThe issues affect the gamut of the computing giant\u2019s portfolio, including Microsoft Windows and Windows Components, Azure Site Recovery, Microsoft Defender for Endpoint and IoT, Intune, Edge (Chromium-based), Windows HTML Platforms, Office and Office Components, Skype, .NET and Visual Studio, Windows RDP, SMB Server.\n\nNotably, the tranche also contains the first-ever patch for the Xbox gaming console.\n\nIt\u2019s worth noting that the update marks the second month in a row with a surprisingly low number of critical patches; in fact, February\u2019s Patch Tuesday update didn\u2019t list any.\n\n\u201cThe number of critical-rated patches is again strangely low for this number of bugs,\u201d Trend Micro Zero-Day Initiative researcher Dustin Childs noted in an email. \u201cIt\u2019s unclear if this low percentage of bugs is just a coincidence, or if Microsoft might be evaluating the severity using different calculus than in the past.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Critical-Rated Microsoft Security BugsThe three critical bugs, all of which could lead to remote code execution, are:\n\n* CVE-2022-22006: HEVC Video Extensions (CVSS rating of 7.8)\n* CVE-2022-24501: VP9 Video Extensions (CVSS rating of 7.8)\n* CVE-2022-23277: Microsoft Exchange Server (CVSS rating of 8.8)\n\nBoth video extensions bugs, in HEVC and VP9, require social engineering; an attacker would need to convince a victim to download and open a specially crafted file, which could lead to a crash, according to Microsoft\u2019s advisory.\n\nThe video extensions are coding standards for video compression that Windows is able to run so that users can watch high-fidelity videos. Paul Laudanski, head of threat intelligence at Tessian, noted that the likelihood of compromise is low, thanks to the user-interaction requirement.\n\nThat said, the VP9 bug is more crucial for patching, he said: \u201cVP9 is supported by modern day browsers except for Internet Explorer, so it is critical for users to ensure they are updating them. While VP9 is open and royalty free, the other file code affected, HEVC, is one that users have to purchase a license for.\u201d\n\nThe vulnerability in Exchange Server meanwhile would allow an authenticated attacker to target server accounts with the aim of executing code with elevated privileges, through a network call. Laudanski added that the vulnerability arises from the server not correctly handling objects in memory, which can lead to code execution.\n\nHere, the attacker must be authenticated. Even so, \u201cthis is also listed as low complexity with exploitation more likely, so it wouldn\u2019t surprise me to see this bug exploited in the wild soon,\u201d Childs noted. \u201cTest and deploy this to your Exchange servers quickly.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Kevin Breen, director of cyber-threat research at Immersive Labs, agreed. \u201cWhile requiring authentication, this vul[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:05.509102Z"}, {"uuid": "d0cb0f45-a403-4cfa-bfb4-23f50595a61b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24508", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:04.987755Z"}]}