{"metadata": {"vulnerability": "CVE-2022-41040", "count": 177, "kinds": {"milestone": 9, "sighting": 120, "kev": 11, "other": 37}}, "data": [{"timestamp": "2022-09-13T07:00:00Z", "date_only": false, "value": "2022-09-13T07:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-09-19T00:00:00Z", "date_only": false, "value": "2022-09-19T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-41040", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-09-29T00:00:00Z", "date_only": true, "value": "2022-09-29", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-41040", "field": "timestamps.asserted_at", "uuid": "5ccf9785-4e89-421a-bdae-8ba3124d1532", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2022-41040", "field": "timestamps.asserted_at", "uuid": "6ee2bc0c-b675-412a-8174-44dbe23f196c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": true, "value": "2022-09-30", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-41040", "field": "containers.adp.1.metrics.1.other.content.dateAdded"}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2022-41040", "field": "evidence.0.details.added_date", "uuid": "6ee2bc0c-b675-412a-8174-44dbe23f196c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": true, "value": "2022-09-30", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2022-41040", "field": "evidence.0.details.date_added", "uuid": "5ccf9785-4e89-421a-bdae-8ba3124d1532", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2022-41040", "field": "timestamps.first_seen_at", "uuid": "5ccf9785-4e89-421a-bdae-8ba3124d1532", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2022-41040", "field": "timestamps.first_seen_at", "uuid": "6ee2bc0c-b675-412a-8174-44dbe23f196c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "initial_release_date"}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.0.revision_date"}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2022-41040", "field": "status.status_updated_at", "uuid": "5ccf9785-4e89-421a-bdae-8ba3124d1532", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2022-41040", "field": "status.status_updated_at", "uuid": "6ee2bc0c-b675-412a-8174-44dbe23f196c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-30T00:00:00Z", "date_only": false, "value": "2022-09-30T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-41040", "field": "containers.adp.1.timeline.0.time"}, {"timestamp": "2022-09-30T04:00:00Z", "date_only": false, "value": "2022-09-30T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=883", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "a37e6d2d-4b51-41fe-9854-f1ff6e92d354", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=883"}, {"timestamp": "2022-09-30T05:00:00Z", "date_only": false, "value": "2022-09-30T05:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://msrc.microsoft.com/blog/2022/09/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "4f3b0151-1fc7-4d1d-8ff5-fc20efbe331c", "url": "https://msrc.microsoft.com/blog/2022/09/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/"}, {"timestamp": "2022-09-30T07:00:00Z", "date_only": false, "value": "2022-09-30T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-09-30T07:00:00Z", "date_only": false, "value": "2022-09-30T07:00:00.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-09-30T07:00:00Z", "date_only": false, "value": "2022-09-30T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2022-41040", "field": "containers.cna.datePublic"}, {"timestamp": "2022-09-30T07:47:10Z", "date_only": false, "value": "2022-09-30T07:47:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2022/11/0-day-exploit-remote-code-execution-in-microsoft-exchange-on-premise-workaround-verfugbar", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "919ed270-faf6-4ac8-a182-1eaf1f79681c", "url": "https://www.cert.at/de/warnungen/2022/11/0-day-exploit-remote-code-execution-in-microsoft-exchange-on-premise-workaround-verfugbar"}, {"timestamp": "2022-09-30T08:40:20Z", "date_only": false, "value": "2022-09-30T08:40:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_14/2022", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "a7ac574f-402b-4472-bc24-9cbac9e5b356", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_14/2022"}, {"timestamp": "2022-09-30T11:06:08Z", "date_only": false, "value": "2022-09-30T11:06:08.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/2619", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "485a130a-253e-4509-926a-cd1169f47def", "content": "Microsoft confirms that 2 new zero-day vulnerabilities (CVE-2022-41040, CVE-2022-41082) affecting Exchange Server 2013, 2016 and 2019 are being exploited in the wild to take over systems.\n\nRead: https://thehackernews.com/2022/09/microsoft-confirms-2-new-exchange-zero.html", "url": "https://t.me/thehackernews/2619"}, {"timestamp": "2022-09-30T11:57:01Z", "date_only": false, "value": "2022-09-30T11:57:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/alexmakus/4821", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "09e9eb54-8949-4daa-a9ef-276c9d8efb15", "content": "\u0418 \u043f\u043e \u043d\u0430\u0432\u043e\u0434\u043a\u0435 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044f, \u043d\u043e\u0432\u044b\u0439 zero-day \u0432 Exchange \n\nhttps://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html\n\nhttps://www.helpnetsecurity.com/2022/09/30/cve-2022-41040-cve-2022-41082/\n\nhttps://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/", "url": "https://t.me/alexmakus/4821"}, {"timestamp": "2022-09-30T12:16:59Z", "date_only": false, "value": "2022-09-30T12:16:59.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/66530", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "ecdc91dc-c457-4636-b2d7-e54f7d35ce8c", "content": "Two Microsoft Exchange zero-days exploited by attackers (CVE-2022-41040, CVE-2022-41082)\n\nhttps://ift.tt/gc8yB5j", "url": "https://t.me/ctinow/66530"}, {"timestamp": "2022-09-30T18:49:22Z", "date_only": false, "value": "2022-09-30T18:49:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MrVGunz/494", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "020cb39e-d77f-400a-90a4-b43dae1118dc", "content": "\u062a\u06a9\u0645\u06cc\u0644\u06cc:\n\n\u0634\u0631\u06a9\u062a \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0634\u0646\u0627\u0633\u0647 \u0647\u0627\u06cc \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u062f\u0648 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u0639\u0631\u0641\u06cc \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a:\nCVE-2022-41040 flaw could only be exploited by authenticated attackers. Successful exploitation then allows them to trigger the CVE-2022-41082 RCE vulnerability.\n\n\u062a\u0627 \u0632\u0645\u0627\u0646 \u0627\u0646\u062a\u0634\u0627\u0631 \u0628\u0647 \u0631\u0648\u0632 \u0631\u0633\u0627\u0646\u06cc \u0631\u0633\u0645\u06cc \u0645\u06cc \u062a\u0648\u0627\u0646 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u06a9\u0627\u0647\u0634 \u062e\u0637\u0631 \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u0628\u0647 \u06a9\u0627\u0631 \u0628\u0633\u062a:\n\"The current mitigation is to add a blocking rule in \"IIS Manager -> Default Web Site -> Autodiscover -> URL Rewrite -> Actions\" to block the known attack patterns.\"\n\n1.\u00a0 Open the IIS Manager.\n2.\u00a0 Expand the Default Web Site.\n3.\u00a0 Select Autodiscover.\n4.\u00a0 In the Feature View, click URL Rewrite.\n5.\u00a0 In the Actions pane on the right-hand side, click Add Rules.\n6.\u00a0 Select Request Blocking and click OK.\n7.\u00a0 Add String \u201c.*autodiscover\\.json.*\\@.*Powershell.*\u201d (excluding quotes) and click OK.\n8.\u00a0 Expand the rule and select the rule with the Pattern \".*autodiscover\\.json.*\\@.*Powershell.*\" and click Edit under Conditions.\n9.\u00a0 Change the condition input from {URL} to {REQUEST_URI{\n10.\u00a0 Block HTTP:5985 and HTTPS:5986 ports\n11.\u00a0 For check compromised server can use below PowerShell command to scan IIS logs file\nc:\\>Get-ChildItem -Recurse -Path  -Filter \"*.log\" | Select-String -Pattern 'powershell.*autodiscover\\.json.*\\@.*200'", "url": "https://t.me/MrVGunz/494"}, {"timestamp": "2022-10-01T06:36:14Z", "date_only": false, "value": "2022-10-01T06:36:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/66711", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "2a9a7a55-b067-45cc-9c5d-2e1c8d09078e", "content": "Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082\n\nhttps://ift.tt/PewulYV", "url": "https://t.me/ctinow/66711"}, {"timestamp": "2022-10-02T18:41:44Z", "date_only": false, "value": "2022-10-02T18:41:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/intelexch/25064", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "51fa402f-4b21-49c2-ad8f-02efdffb682d", "content": "https://github.com/numanturle/CVE-2022-41040", "url": "https://t.me/intelexch/25064"}, {"timestamp": "2022-10-03T00:00:00Z", "date_only": false, "value": "2022-10-03T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-876", "record": "CERTFR-2022-AVI-876", "field": "last_revision_date"}, {"timestamp": "2022-10-03T00:00:00Z", "date_only": false, "value": "2022-10-03T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-876", "record": "CERTFR-2022-AVI-876", "field": "initial_release_date"}, {"timestamp": "2022-10-03T00:00:00Z", "date_only": false, "value": "2022-10-03T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-41040", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-10-03T00:00:00Z", "date_only": false, "value": "2022-10-03T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.1.revision_date"}, {"timestamp": "2022-10-03T00:00:00Z", "date_only": false, "value": "2022-10-03T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-876", "record": "CERTFR-2022-AVI-876", "field": "revisions.0.revision_date"}, {"timestamp": "2022-10-03T01:15:00Z", "date_only": false, "value": "2022-10-03T01:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6PH7-8WXV-6GF2", "record": "GHSA-6PH7-8WXV-6GF2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-10-03T01:15:08.753Z", "date_only": false, "value": "2022-10-03T01:15:08.753", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-41040", "record": "FKIE_CVE-2022-41040", "field": "published"}, {"timestamp": "2022-10-03T01:15:08.753Z", "date_only": false, "value": "2022-10-03T01:15:08.753", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2022-41040", "record": "GSD-2022-41040", "field": "namespaces.nvd.nist.gov.cve.published"}, {"timestamp": "2022-10-03T07:00:00Z", "date_only": false, "value": "2022-10-03T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2022-10-03T15:00:52Z", "date_only": false, "value": "2022-10-03T15:00:52.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/13803", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "5243b38f-9c30-44a3-aeff-3b36d65e6cd6", "content": "\u200aMicrosoft Exchange server zero-day mitigation can be bypassed\n\nMicrosoft has shared mitigations for two new Microsoft Exchange zero-day vulnerabilities tracked as CVE-2022-41040 and CVE-2022-41082, but researchers warn that the mitigation for on-premise servers is far from enough. [...]\n\nhttps://www.bleepingcomputer.com/news/security/microsoft-exchange-server-zero-day-mitigation-can-be-bypassed/", "url": "https://t.me/BleepingComputer/13803"}, {"timestamp": "2022-10-03T17:05:41Z", "date_only": false, "value": "2022-10-03T17:05:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/BleepingComputer/13806", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "e96f041b-d36d-436f-9409-a4a3b35e3474", "content": "Latest news and stories from BleepingComputer.com\nMicrosoft Exchange server zero-day mitigation can be bypassed\n\nMicrosoft has shared mitigations for two new Microsoft Exchange zero-day vulnerabilities tracked as CVE-2022-41040 and CVE-2022-41082, but researchers warn that the mitigation for on-premise servers is far from enough. [...]", "url": "https://t.me/BleepingComputer/13806"}, {"timestamp": "2022-10-04T00:00:00Z", "date_only": false, "value": "2022-10-04T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.2.revision_date"}, {"timestamp": "2022-10-04T00:00:25Z", "date_only": false, "value": "2022-10-04T00:00:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6PH7-8WXV-6GF2", "record": "GHSA-6PH7-8WXV-6GF2", "field": "published"}, {"timestamp": "2022-10-04T08:15:00Z", "date_only": false, "value": "2022-10-04T08:15:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/10273", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "db6ca9be-db95-46fb-aeb6-c1c0072ba6da", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 CVE-2022-41040 \n\nffuf -w \"urllist.txt:URL\" -u \"https://URL/autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL\" -mr \"IIS Web Core\" -r\n\n404 --> vulnerable\n\nSource: Twitter.", "url": "https://t.me/cKure/10273"}, {"timestamp": "2022-10-04T14:10:44Z", "date_only": false, "value": "2022-10-04T14:10:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/secmedia/660", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "5c8851c4-aa9d-4768-ab5d-40a0399270bc", "content": "\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u0430\u0436\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432. \u041c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Github, \u0433\u0434\u0435 \u044f\u043a\u043e\u0431\u044b \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Microsoft Exchange CVE-2022-41040 \u0438 CVE-2022-41082.", "url": "https://t.me/secmedia/660"}, {"timestamp": "2022-10-04T14:23:49Z", "date_only": false, "value": "2022-10-04T14:23:49.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/48620", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "4ef9f270-6e2f-418e-92e5-a72150800881", "content": "Mitigation for ProxyNotShell Exchange Vulnerabilities Easily Bypassed\nhttps://www.securityweek.com/mitigation-proxynotshell-exchange-vulnerabilities-easily-bypassed\n\nA mitigation proposed by Microsoft and others for the new Exchange Server zero-day vulnerabilities named ProxyNotShell can be easily bypassed, researchers warn.\nThe security holes, officially tracked as CVE-2022-41040 and CVE-2022-41082, can allow an attacker to remotely execute arbitrary code with elevated privileges.\nread more (https://www.securityweek.com/mitigation-proxynotshell-exchange-vulnerabilities-easily-bypassed)", "url": "https://t.me/information_security_channel/48620"}, {"timestamp": "2022-10-04T17:28:01Z", "date_only": false, "value": "2022-10-04T17:28:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/3513", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "5dd9e7cc-2d03-4789-93de-d72dce54bda5", "content": "\u041d\u043e\u0432\u044b\u0435 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0435 o-day \u0432 Microsoft Exchange, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u043a CVE-2022-41040 \u0438 CVE-2022-41082, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 ProxyNotShell, \u0432 \u0441\u0438\u043b\u0443 \u0441\u0445\u043e\u0434\u0441\u0442\u0432\u0430 \u0441 ProxyShell, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0431\u043e\u043b\u0435\u0435 \u0433\u043e\u0434\u0430. \u0418 \u0434\u0435\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u044d\u0442\u043e\u043c.\n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u0447\u0442\u043e \u043f\u0430\u0442\u0447\u0438 Microsoft \u0434\u043b\u044f ProxyShell \u043d\u0435 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438. \u041e\u0448\u0438\u0431\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u041e\u0434\u043d\u0430\u043a\u043e, \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 ProxyShell, \u043d\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0445\u043e\u0442\u044f \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u0430\u0436\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b.\n\n\u042d\u0442\u0438\u043c \u0438 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u0410\u0420\u0422, \u0430 \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e \u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435, \u0447\u0438\u0442\u044b\u0432\u0430\u044f, \u0447\u0442\u043e \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u043d\u0433 \u043d\u0430 10 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u043e\u0432\u044b\u0445 ProxyNotShell \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0441\u0430\u043c\u0430 \u0436\u0435 Microsoft. \u0418\u043d\u0444\u043e\u0441\u0435\u043a \u0436\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u0442, \u043a\u043e\u0433\u0434\u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u043d\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0438 Exchange Server \u0432 \u0441\u0432\u043e\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u0447\u0442\u043e \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0435\u0449\u0435 \u043d\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b, \u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 Microsoft \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439, \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438.\n\n\u041f\u0435\u0440\u0432\u044b\u043c \u043e\u0431 \u044d\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Janggggg. \u041e\u043d \u043e\u0442\u043c\u0435\u0442\u0438\u043b, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043d\u0435\u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u0438 \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043b\u0435\u0433\u043a\u043e \u043e\u0431\u043e\u0439\u0442\u0438, \u043d\u0435 \u043f\u0440\u0438\u043b\u0430\u0433\u0430\u044f \u043e\u0441\u043e\u0431\u044b\u0445 \u0443\u0441\u0438\u043b\u0438\u0439. \u041f\u043e\u0437\u0436\u0435 \u043a \u043d\u0435\u043c\u0443 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u0438\u043b\u0441\u044f \u0441\u0442\u0430\u0440\u0448\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0432 ANALYGENCE \u0423\u0438\u043b\u043b \u0414\u043e\u0440\u043c\u0430\u043d\u043d. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e \u043d\u0435\u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043c\u0435\u0440 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u044f\u0432\u0438\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0435 ProxyNotShell \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b GTSC. \n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 Microsoft \u043f\u043e \u044d\u0442\u0438\u043c \u0434\u0432\u0443\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u00a0\u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Exchange, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c Exchange Online, \u043f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430, \u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430, \u0438 \u0432\u00a0\u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u043c \u0432\u0438\u0434\u0435\u043e\u00a0\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u041a\u0435\u0432\u0438\u043d \u0411\u043e\u043c\u043e\u043d\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u043b, \u0447\u0442\u043e \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Exchange \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0430\u0445, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u0432, \u0447\u0442\u043e \u0434\u043e \u0442\u0435\u0445 \u043f\u043e\u0440, \u043f\u043e\u043a\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 Exchange Server, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043d\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u044b, GitHub \u0437\u0430\u043f\u043e\u043b\u043e\u043d\u0438\u043b\u0438 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 PoC \u0434\u043b\u044f ProxyNotShell \u043f\u043e \u0446\u0435\u043d\u0435 \u0432 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \u041f\u0440\u0430\u0432\u0434\u0430, \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0442\u043e\u0433\u043e \u0436\u0435 \u0411\u043e\u043c\u043e\u043d\u0442\u0430, \u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0435\u0439 \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u0438 \u0438\u043d\u0444\u043e\u0441\u0435\u043a \u0432\u0441\u0435 \u0436\u0435 \u0435\u0441\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u0430 \u0434\u0430\u043d\u043d\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u043c\u0430\u043b\u043e\u0432\u0435\u0440\u043e\u044f\u0442\u043d\u0430, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0447\u0435\u043d\u044c \u0446\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u0438\u043d\u0444\u043e\u0441\u0435\u043a-\u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0441\u00a0\u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c,\u00a0\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e\u00a0\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u00a0\u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.", "url": "https://t.me/true_secator/3513"}, {"timestamp": "2022-10-05T00:00:00Z", "date_only": false, "value": "2022-10-05T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.3.revision_date"}, {"timestamp": "2022-10-05T07:00:00Z", "date_only": false, "value": "2022-10-05T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2022-10-05T11:43:50Z", "date_only": false, "value": "2022-10-05T11:43:50.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/3516", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "37d742c5-f859-4e89-80a4-821b9290d30a", "content": "\u041f\u043e\u0441\u043b\u0435 \u043e\u0431\u0440\u0443\u0448\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0440\u0438\u0442\u0438\u043a\u0438 \u043d\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 Microsoft \u043c\u0435\u0440\u044b \u043f\u043e \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u044e ProxyNotShell, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d\u044b \u0438\u0441\u043a\u0430\u0442\u044c \u043d\u043e\u0432\u044b\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 Exchange Zero-Days, \u0432\u0435\u0434\u044c \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u0441\u043c\u043e\u0433\u043b\u0438 \u0431\u0435\u0437 \u0442\u0440\u0443\u0434\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0445.\n\n\u0418, \u0443\u0436\u0435 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u043e, Microsoft \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u044b\u0435 \u043f\u0443\u0442\u0438 \u043f\u043e \u0441\u0432\u043e\u0435\u0439 \u043d\u0430\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u00ab\u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u0442\u0447\u0430\u00bb.\n\nMicrosoft \u043f\u0435\u0440\u0435\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0430 \u0441\u0432\u043e\u0438 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 CVE-2022-41040 \u0438 CVE-2022-41082 \u0432 Exchange Server, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u0432 \u043d\u043e\u0432\u044b\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 URL-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 (\u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0435 \u0432 \u0432\u0438\u0434\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e\u00a0\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f PowerShell).\n\n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, \u0430\u0442\u0430\u043a\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435\u00a0\u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0442\u0441\u044f \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f RCE \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a.\n\n\u041f\u043e\u043a\u0430 \u043d\u0435\u044f\u0441\u043d\u043e, \u043a\u043e\u0433\u0434\u0430 Microsoft \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u043e \u0432\u043f\u043e\u043b\u043d\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 Patch Tuesday \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0435, 11 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0411\u0443\u0434\u0435\u043c \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c.", "url": "https://t.me/true_secator/3516"}, {"timestamp": "2022-10-05T13:37:55Z", "date_only": false, "value": "2022-10-05T13:37:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/BleepingComputer/13830", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "2a814648-e9d4-41fd-846d-ad67c4d8c7ba", "content": "Latest news and stories from BleepingComputer.com\nMicrosoft updates mitigation for ProxyNotShell Exchange zero days\n\nMicrosoft has updated the mitigation for the latest Exchange zero-day vulnerabilities tracked as CVE-2022-41040 and CVE-2022-41082, also referred to ProxyNotShell. [...]", "url": "https://t.me/BleepingComputer/13830"}, {"timestamp": "2022-10-05T14:05:01Z", "date_only": false, "value": "2022-10-05T14:05:01.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/13828", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "d5339bf7-e7dc-4297-9c3b-588b1be25516", "content": "\u200aMicrosoft updates mitigation for ProxyNotShell Exchange zero days\n\nMicrosoft has updated the mitigation for the latest Exchange zero-day vulnerabilities tracked as CVE-2022-41040 and CVE-2022-41082, also referred to ProxyNotShell. [...]\n\nhttps://www.bleepingcomputer.com/news/security/microsoft-updates-mitigation-for-proxynotshell-exchange-zero-days/", "url": "https://t.me/BleepingComputer/13828"}, {"timestamp": "2022-10-06T13:37:37Z", "date_only": false, "value": "2022-10-06T13:37:37.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/xakep_ru/13024", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "8f284a89-b238-475c-b3a6-122cb2d697d0", "content": "Microsoft \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0430 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyNotShell\n\n\u0418\u043d\u0436\u0435\u043d\u0435\u0440\u044b Microsoft \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u043e\u0442 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Exchange (CVE-2022-41040 \u0438 CVE-2022-41082), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c ProxyNotShell. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0430\u0442\u0447\u0435\u0439 \u0434\u043b\u044f \u044d\u0442\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432\u0441\u0435 \u0435\u0449\u0435 \u043d\u0435\u0442, \u0430 \u0418\u0411-\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438, \u0447\u0442\u043e \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0435 \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043b\u0435\u0433\u043a\u043e \u043e\u0431\u043e\u0439\u0442\u0438.\n\nhttps://xakep.ru/2022/10/06/proxynotshell-mitigation/", "url": "https://t.me/xakep_ru/13024"}, {"timestamp": "2022-10-07T00:00:00Z", "date_only": false, "value": "2022-10-07T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.4.revision_date"}, {"timestamp": "2022-10-07T07:00:00Z", "date_only": false, "value": "2022-10-07T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2022-10-08T00:00:00Z", "date_only": true, "value": "2022-10-08", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2022-67837", "record": "CNVD-2022-67837", "field": "submitTime"}, {"timestamp": "2022-10-08T07:36:47Z", "date_only": false, "value": "2022-10-08T07:36:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/2650", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "a6a12a5e-dc5f-4b01-ac9d-85788014f09b", "content": "Microsoft has released an improved mitigation method to prevent exploitation attempts against recently disclosed unpatched Exchange server vulnerabilities (CVE-2022-41040 and CVE-2022-41082).\n\nRead: https://thehackernews.com/2022/10/microsoft-issues-improved-mitigations.html", "url": "https://t.me/thehackernews/2650"}, {"timestamp": "2022-10-09T09:50:18.511Z", "date_only": false, "value": "2022-10-09T09:50:18.511745266Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-41040", "record": "GSD-2022-41040", "field": "gsd.modified"}, {"timestamp": "2022-10-10T00:00:00Z", "date_only": true, "value": "2022-10-10", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2022-67837", "record": "CNVD-2022-67837", "field": "openTime"}, {"timestamp": "2022-10-11T00:00:00Z", "date_only": false, "value": "2022-10-11T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.6.revision_date"}, {"timestamp": "2022-10-12T00:00:00Z", "date_only": false, "value": "2022-10-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.7.revision_date"}, {"timestamp": "2022-10-12T13:56:02Z", "date_only": false, "value": "2022-10-12T13:56:02.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/3547", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "b26c0c6c-8da5-4446-88d7-3f2de295b418", "content": "Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 Patch Tuesday, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0432 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 84 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Microsoft Windows \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u0432 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0434\u0432\u0435 0-day.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u043e \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044f\u043c: 39 - \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, 2 - \u043e\u0431\u0445\u043e\u0434 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, 20 - RCE, 11 - \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, 8 - \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438, 4 - \u0441\u043f\u0443\u0444\u0438\u043d\u0433. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c 30 \u0438\u0437 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435.\n\n\u041e\u0434\u043d\u0430 \u0438\u0437 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 0-day \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445, \u0430 \u0434\u0440\u0443\u0433\u0430\u044f \u2014 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430.\n\n\u041e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 Microsoft Office \u0438 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430\u00a0\u041a\u043e\u0434\u0438 \u0422\u043e\u043c\u0430\u0441\u043e\u043c\u00a0\u0438\u0437 SpecterOps. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0442\u043e\u043a\u0435\u043d\u0430\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\nCVE-2022-41033 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u043b\u0443\u0436\u0431\u0443 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 Windows COM+ \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0446\u0435\u043b\u044c\u044e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 Active Directory, Azure, Microsoft Office, SharePoint, Hyper-V \u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Windows \u00ab\u0442\u043e\u0447\u043a\u0430-\u0442\u043e\u0447\u043a\u0430\u00bb.\n\n\u0412\u0441\u0435 \u0431\u044b \u043d\u0438\u0447\u0435\u0433\u043e, \u0434\u0430 \u0432\u043e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u043e\u043f\u0440\u043e\u0441 \u0441 ProxyNotShell \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c.\n\n\u0414\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Exchange Server CVE-2022-41040 (\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 (SSRF), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439) \u0438 CVE-2022-21082 (\u043e\u0448\u0438\u0431\u043a\u0430 RCE) \u043d\u0435 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0432\u044b\u0448\u0435\u0434\u0448\u0435\u0433\u043e Patch Tuesday. \n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0420\u0435\u0434\u043c\u043e\u043d\u0434 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043b \u0434\u0430\u0436\u0435 \u0441\u0440\u043e\u043a\u0430, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Windows \u043c\u043e\u0433\u0443\u0442 \u043e\u0436\u0438\u0434\u0430\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f Exchange Server.\n\n\u0412 \u0442\u043e\u0436\u0435 \u0432\u0440\u0435\u043c\u044f, \u0441\u0430\u043c\u0430 Microsoft \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e ProxyNotShell \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0435 \u0410\u0420\u0422 \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u043d\u0430 10 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0447\u0435\u043d\u044c \u0441 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u043a\u0430\u0436\u0434\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0437\u0434\u0435\u0441\u044c.", "url": "https://t.me/true_secator/3547"}, {"timestamp": "2022-10-13T20:16:35Z", "date_only": false, "value": "2022-10-13T20:16:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/69007", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "f3ce014a-072b-471d-9f0b-46f70b08c5b7", "content": "Acronis: mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040\n\nhttps://ift.tt/ZODHqWa", "url": "https://t.me/ctinow/69007"}, {"timestamp": "2022-10-16T16:51:05Z", "date_only": false, "value": "2022-10-16T16:51:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FYOK069r3dGPVzNRW2ebZQAxTJIkZliqhtT2JhgHyCLvq90", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "21e35582-288a-4426-b44e-9f3e7c52a040"}, {"timestamp": "2022-10-20T17:20:10Z", "date_only": false, "value": "2022-10-20T17:20:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/crackcodes/1261", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "6e6586f0-f9ef-4733-a76e-b7dc3b67127f", "content": "\u200b\u200bCVE-2022-41040-metasploit-ProxyNotShell\n\nthe metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated attacker can use the vulnerability to elevate privileges.\n\nhttps://github.com/TaroballzChen/CVE-2022-41040-metasploit-ProxyNotShell", "url": "https://t.me/crackcodes/1261"}, {"timestamp": "2022-10-21T00:00:00Z", "date_only": true, "value": "2022-10-21", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2022-41040", "field": "evidence.0.details.due_date", "uuid": "5ccf9785-4e89-421a-bdae-8ba3124d1532", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-10-21T10:54:19Z", "date_only": false, "value": "2022-10-21T10:54:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/arm1tage/382", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "6554ca93-6119-4f88-8f09-ec0328ff88bd", "content": "\u200b\u200bCVE-2022-41040-metasploit-ProxyNotShell\n\nthe metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated attacker can use the vulnerability to elevate privileges.\n\nhttps://github.com/TaroballzChen/CVE-2022-41040-metasploit-ProxyNotShell", "url": "https://t.me/arm1tage/382"}, {"timestamp": "2022-10-23T03:21:15Z", "date_only": false, "value": "2022-10-23T03:21:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/3095", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "7c1aa923-51ae-426f-bf2f-25030ac0ffbf", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1awriteup and PoC for (CVE-2022-41082/CVE-2022-41040) aka ProxyNotShell\nURL\uff1ahttps://github.com/stat1st1c/CVE-2022-41082-RCE-POC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/3095"}, {"timestamp": "2022-10-27T08:14:30Z", "date_only": false, "value": "2022-10-27T08:14:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thebugbountyhunter/6581", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "c5bda223-aa1a-45a6-be53-e43250a3009f", "content": "mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040\n\nhttps://hackerone.com/reports/1719719", "url": "https://t.me/thebugbountyhunter/6581"}, {"timestamp": "2022-11-08T08:00:00Z", "date_only": false, "value": "2022-11-08T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2022-11-08T08:00:00Z", "date_only": false, "value": "2022-11-08T08:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "document.tracking.current_release_date"}, {"timestamp": "2022-11-09T00:00:00Z", "date_only": false, "value": "2022-11-09T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.8.revision_date"}, {"timestamp": "2022-11-09T04:00:00Z", "date_only": false, "value": "2022-11-09T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=913", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "b12a10b8-cedc-4739-ae6d-64396dd476f0", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=913"}, {"timestamp": "2022-11-09T14:40:05Z", "date_only": false, "value": "2022-11-09T14:40:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/3680", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "e7e22dfe-1683-4355-ba0f-abecfbc76089", "content": "\u041d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u0438\u0439 Patch Tuesday \u043e\u0442 Microsoft \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 68 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Windows, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438 6 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 0-day.\n\n\u0421\u0440\u0435\u0434\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445: 12 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435, 2 -\u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u0438 55 - \u0432\u0430\u0436\u043d\u044b\u0435.\n\n\u041f\u043e \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044f\u043c: 27 - \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, 4 - \u043e\u0431\u0445\u043e\u0434 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, 16 - RCE, 11 - \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, 6 - DoS, 3 - \u0441\u043f\u0443\u0444\u0438\u043d\u0433.\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0438\u0437\u044e\u043c\u0438\u043d\u043a\u0430 \u043f\u0430\u0442\u0447\u0430 - \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0434\u0432\u0443\u0445 CVE \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 Exchange Server, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043a\u0430\u043a ProxyNotShell.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u0436\u0435, \u0441\u043f\u0438\u0441\u043e\u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 0-day \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c:\n\n- CVE-2022-41128: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u044f\u0437\u044b\u043a\u0430\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 Windows, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u041a\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u043c \u041b\u0435\u0441\u0438\u043d\u0435\u043c \u0438\u0437 \u0433\u0440\u0443\u043f\u043f\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0433\u0440\u043e\u0437 Google. \u0411\u0430\u0433\u0430 \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 Windows \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443.\n\n- CVE-2022-41091: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Windows Mark of the Web Security Bypass. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 MOTW, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0432 Microsoft Office. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0434\u0432\u0430 \u043e\u0431\u0445\u043e\u0434\u0430 Mark of the Web, \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0423\u0438\u043b\u043b\u043e\u043c \u0414\u043e\u0440\u043c\u0430\u043d\u043d\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 Zip-\u0444\u0430\u0439\u043b \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Windows.\n\n- CVE-2022-41073: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0430\u0432, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0446\u0435\u043d\u0442\u0440\u043e\u043c Microsoft Threat Intelligence Center (MSTIC). \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n- CVE-2022-41125: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 Windows CNG, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 Microsoft Threat Intelligence Center (MSTIC) \u0438 Microsoft Security Response Center (MSRC).\n\n- CVE-2022-41040: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Microsoft Exchange Server, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0430\u0432, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 GTSC \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b Zero Dat. \u041f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0431\u0443\u0434\u0443\u0442 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0442\u044c\u0441\u044f \u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c PowerShell \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n- CVE-2022-41082: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 GTSC \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b Zero Dat. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043c\u043e\u0436\u0435\u0442 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0421\u0440\u0435\u0434\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u043f\u0430\u0442\u0447\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u2014 \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Windows\u00a0Kerberos (CVE-2022-37967),\u00a0Kerberos RC4-HMAC (CVE-2022-37966) \u0438 Microsoft Exchange Server (CVE-2022-41080) \u0438 \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0439 Windows Hyper-V (CVE-2022-38015).\n\n\u0412 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u044d\u0442\u0438\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0440\u044f\u0434 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u043e\u0447\u043a\u0430-\u0442\u043e\u0447\u043a\u0430 (PPTP), Microsoft Excel, Word, \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 ODBC, Office Graphics, SharePoint Server, JScript9, Chakra \u0438 Visual Studio, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u044f\u0434 \u043e\u0448\u0438\u0431\u043e\u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Win32k, Overlay Filter \u0438 Group Policy.\n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u0432 Patch Tuesday \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0437\u0434\u0435\u0441\u044c.", "url": "https://t.me/true_secator/3680"}, {"timestamp": "2022-11-17T16:12:03Z", "date_only": false, "value": "2022-11-17T16:12:03.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/breachdetector/143691", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "be95e237-ab7a-4be0-86e5-80be27dc79c1", "content": "{\n  \"Source\": \"https://t.me/documentors\",\n  \"Content\": \"poc_aug3.py 20.1 kB \ud83d\udd25\ud83d\udd25\ud83d\udd25PoC for ProxyNotShell(CVE-2022-41040 & CVE-2022-41082) \u26a0\ufe0frequirements: requests_ntlm2, requests (pip/pip3 install requests_ntlm2 requests) Usage: python poc_aug3.py \ud83d\udcbePoC from here\", \n  \"author\": \"\u2693\ufe0f\ud835\udd07\ud835\udd2c\ud835\udd20\ud835\udd32\ud835\udd2a\ud835\udd22\ud835\udd2b\ud835\udd31\ud835\udd2c\ud835\udd2f\",\n  \"Detection Date\": \"17 Nov 2022\",\n  \"Type\": \"Data leak\"\n}\n\ud83d\udd39 Data Leak monitoring system\ud83d\udd39", "url": "https://t.me/breachdetector/143691"}, {"timestamp": "2022-11-18T07:18:00Z", "date_only": false, "value": "2022-11-18T07:18:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/10436", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "03e56d78-00f5-4ae7-92ee-0baf6720e674", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 Working PoC for CVE-2022-41040 and CVE-2022-41082 (A.K.A ProxyNotShell).\n\nhttps://github.com/testanull/ProxyNotShell-PoC", "url": "https://t.me/cKure/10436"}, {"timestamp": "2022-11-18T10:37:53Z", "date_only": false, "value": "2022-11-18T10:37:53.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/1174", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "6c6302bc-49bb-4889-8700-a19f8843737b", "content": "\u0420\u0430\u0431\u043e\u0447\u0438\u0439 PoC \u0434\u043b\u044f CVE-2022-41040 and CVE-2022-41082 (A.K.A ProxyNotShell)\n*\npython poc_aug3.py    \n*\ndownload POC", "url": "https://t.me/proxy_bar/1174"}, {"timestamp": "2022-11-20T16:38:05Z", "date_only": false, "value": "2022-11-20T16:38:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/3P4-ui2ZGCcEh2qykYXdRFkjV42_EU3Ipg1j8nJzP_-5Jeo", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "cfc42aa2-3bec-4c01-b604-f935011ba043"}, {"timestamp": "2022-11-21T11:24:55Z", "date_only": false, "value": "2022-11-21T11:24:55.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/3728", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "4866c902-2ecf-46a8-a51e-e5123e6030b1", "content": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC \u0434\u043b\u044f \u0434\u0432\u0443\u0445 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 Microsoft Exchange, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043a\u0430\u043a ProxyNotShell.\n\n\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e,\u00a0CVE-2022-41082 \u0438 CVE-2022-41040 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 Microsoft Exchange Server 2013, 2016 \u0438 2019 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 PowerShell \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c RCE \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b.\n\nMicrosoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f ProxyNotShell \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e PatchTuesday.\n\n\u0418 \u0443\u0436\u0435 \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043f\u0430\u0442\u0447\u0430, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Janggggg\u00a0\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b PoC \u0434\u043b\u044f ProxyNotShell, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Exchange.\n\n\u0410\u0432\u0442\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u044b\u0439 \u0423\u0438\u043b\u043b \u0414\u043e\u0440\u043c\u0430\u043d\u043d \u0438\u0437 ANALYGENCE \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0438\u00a0\u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u00a0\u0435\u0433\u043e \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Exchange Server 2016 \u0438 2019.\n\n\u041f\u0440\u0430\u0432\u0434\u0430 \u0434\u043e\u0431\u0430\u0432\u0438\u043b, \u0447\u0442\u043e \u043a\u043e\u0434 \u043d\u0443\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0434\u043b\u044f \u0435\u0433\u043e \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043d\u0430 Exchange Server 2013.\n\nGreyNoise \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 ProxyNotShell \u0441 \u043a\u043e\u043d\u0446\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430\u00a0\u0441\u043f\u0438\u0441\u043e\u043a IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u044d\u0442\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438.\n\n\u041a\u0430\u043a \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a Chopper \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0438 \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0431\u043e\u043a\u043e\u0432\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0432 \u0441\u0435\u0442\u044f\u0445 \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432.\n\n\u0420\u0435\u0434\u043c\u043e\u043d\u0434 \u0442\u0430\u043a\u0436\u0435\u00a0\u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b, \u0447\u0442\u043e 30 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u043e\u043d\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u043b\u0438\u0441\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u044f\u043c, \u0437\u0430\u044f\u0432\u0438\u0432, \u0447\u0442\u043e \u0437\u043d\u0430\u0435\u0442 \u043e\u0431 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u043c\u0438 \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u044b Exchange Online \u0443\u0436\u0435 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u044b \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0438\u043c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u043a\u0440\u043e\u043c\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Exchange \u0432 \u0441\u0432\u043e\u0435\u0439 \u0441\u0440\u0435\u0434\u0435.", "url": "https://t.me/true_secator/3728"}, {"timestamp": "2022-11-29T06:36:16Z", "date_only": false, "value": "2022-11-29T06:36:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/1190", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "520c9897-9a0b-4560-8bac-11fe170d3a0e", "content": "\u0420\u0430\u043d\u043e\u0432\u0430\u0442\u043e, \u043d\u043e \u0442\u0430\u043a\u0438 \u0434\u0430\n\u0422\u041e\u041f 10 \u0438\u0437 2022\n\n1. Follina (CVE-2022-30190)\n2. Log4Shell (CVE-2021-44228)\n3. Spring4Shell (CVE-2022-22965)\n4. F5 BIG-IP (CVE-2022-1388)\n5. Google Chrome zero-day (CVE-2022-0609)\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n10. Zyxel RCE vulnerability (CVE-2022-30525)", "url": "https://t.me/proxy_bar/1190"}, {"timestamp": "2022-11-29T07:00:36Z", "date_only": false, "value": "2022-11-29T07:00:36.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/monkey_hacker/28", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "e4c13500-7e7b-4471-bde6-4dd9262f28fb", "content": "\u0420\u0430\u043d\u043e\u0432\u0430\u0442\u043e, \u043d\u043e \u0442\u0430\u043a\u0438 \u0434\u0430\n\u0422\u041e\u041f 10 \u0438\u0437 2022\n\n1. Follina (CVE-2022-30190)\n2. Log4Shell (CVE-2021-44228)\n3. Spring4Shell (CVE-2022-22965)\n4. F5 BIG-IP (CVE-2022-1388)\n5. Google Chrome zero-day (CVE-2022-0609)\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n10. Zyxel RCE vulnerability (CVE-2022-30525)", "url": "https://t.me/monkey_hacker/28"}, {"timestamp": "2022-11-30T17:43:21Z", "date_only": false, "value": "2022-11-30T17:43:21.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxynotshell_rce.rb", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "d93675b4-60b8-4796-9444-161ab8de509a", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxynotshell_rce.rb"}, {"timestamp": "2022-12-05T04:24:48Z", "date_only": false, "value": "2022-12-05T04:24:48.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Al5s1pu9DlCNMnH7rJt2q5NFKP_tt6i0TJLpRuR3HfdnDhA", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "eb73ac00-a927-4de9-b925-791035e88e0a"}, {"timestamp": "2022-12-06T17:10:12Z", "date_only": false, "value": "2022-12-06T17:10:12.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8yasABRsBeQ7_fA7ekcVN5-Bf6YalSSK4RwFtvSF2nNKkrM", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "a6543f34-8b76-4bc1-9417-41554c2f7dc8"}, {"timestamp": "2022-12-14T08:46:29Z", "date_only": false, "value": "2022-12-14T08:46:29.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/2523", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "fa48e12e-c33a-4d3d-95ca-341e33cae394", "content": "#CVE-2022\nA Zeek CVE-2022-24491 detector.\n\nhttps://github.com/corelight/CVE-2022-24491\n\n\nwriteup and PoC for (CVE-2022-41082/CVE-2022-41040) aka ProxyNotShell\nhttps://github.com/Adynervi/CVE-2022-41082-RCE-PoC\n\nPython Exploit for CVE-2022-0739\n\nhttps://github.com/BKreisel/CVE-2022-0739\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/2523"}, {"timestamp": "2022-12-16T15:56:36Z", "date_only": false, "value": "2022-12-16T15:56:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/package_security/17", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "df289d72-2699-4c34-b203-1261572f026b", "content": "\u200b\ud83c\udfc6 \u0418\u0442\u043e\u0433\u0438 \u0433\u043e\u0434\u0430\n\n\u041d\u0430\u0441\u0442\u0430\u043b\u043e \u0432\u0440\u0435\u043c\u044f \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0440\u0430\u0431\u043e\u0447\u0435\u043c \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u0435.\n2\u043a22 \u0433\u043e\u0434 \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0438\u0442 \u043a \u043a\u043e\u043d\u0446\u0443, \u0430 \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u043f\u043e\u0434\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u0442\u043e\u0433\u0438.\n\n\u0423 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u043e\u0432, \u043a\u0430\u043a \u0438 \u0432\u0441\u0435\u0433\u0434\u0430, \u0438\u0442\u043e\u0433\u0438 \u0441\u0432\u043e\u0438. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u0435\u0440\u0436\u0438\u0442\u0435 \u0422\u041e\u041f-10 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 Cyber Threat Intelligence:\n\n1. Follina (CVE-2022-30190) \n\n2. Log4Shell (CVE-2021-44228) \n\n3. Spring4Shell (CVE-2022-22965) \n\n4. F5 BIG-IP (CVE-2022-1388) \n\n5. Google Chrome zero-day (CVE-2022-0609) \n\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882) \n\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040) \n\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352) \n\n9. Atlassian Confluence RCE flaw (CVE-2022-26134) \n\n10. Zyxel RCE vulnerability (CVE-2022-30525)\n\n\u0411\u0443\u0434\u044c\u0442\u0435 \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u044b, \u0431\u0435\u0440\u0435\u0433\u0438\u0442\u0435 \u0441\u0435\u0431\u044f \u0438 \u0432\u0430\u0448\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b.\nP.S. \u041d\u0438\u0436\u0435 \u0435\u0441\u0442\u044c \u043f\u0438\u043a\u0447\u0430 \u0441 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u044b\u043c\u0438 \u0438\u043a\u043e\u043d\u043a\u0430\u043c\u0438\n\n#\u041f\u043e\u043b\u0435\u0437\u043d\u043e\u0435\n\n\u041f\u0430\u043a\u0435\u0442 \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438", "url": "https://t.me/package_security/17"}, {"timestamp": "2022-12-18T11:13:39Z", "date_only": false, "value": "2022-12-18T11:13:39.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/2528", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "abe8e8d2-f340-41e8-b96a-db8730753af5", "content": "#CVE-2022\nwriteup and PoC for (CVE-2022-41082/CVE-2022-41040) aka ProxyNotShell\nhttps://github.com/Adynervi/CVE-2022-41082-RCE-PoC\n\n\nPython Exploit for CVE-2022-0739\nhttps://github.com/BKreisel/CVE-2022-0739\n\n\nAll details about CVE-2022-43097\n\nhttps://github.com/nibin-m/CVE-2022-43097\n\nCVE-2022-24112_POC\nhttps://github.com/Acczdy/CVE-2022-24112_POC\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/2528"}, {"timestamp": "2022-12-19T17:21:10Z", "date_only": false, "value": "2022-12-19T17:21:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/82459", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "7bb70dc1-6929-4b39-bdd2-283acd9781c6", "content": "CVE-2022-41040 and CVE-2022-41082 \u2013 zero-days in MS Exchange\n\nhttps://ift.tt/rXF7j6W", "url": "https://t.me/ctinow/82459"}, {"timestamp": "2022-12-20T06:40:25Z", "date_only": false, "value": "2022-12-20T06:40:25.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/_jhMJ6Qkr3NTkSODz-2VARevQ2RaVWFw4ZEApyjVaOKsVoQ", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "5b29cbda-ca3f-40ee-93f0-e7274f9b260d"}, {"timestamp": "2022-12-20T07:13:25Z", "date_only": false, "value": "2022-12-20T07:13:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2631", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "cb69269e-3442-4eb5-b1af-e17aed3c0386", "content": "\u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0436\u0434\u0430\u043b \u0438 \u0432\u043e\u0442 \u043e\u043f\u044f\u0442\u044c!\n\nMicrosoft Exchange 0days:\nCVE-2022-41040\nCVE-2022-41082\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n#CVE", "url": "https://t.me/poxek/2631"}, {"timestamp": "2022-12-20T15:12:58Z", "date_only": false, "value": "2022-12-20T15:12:58.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/C7iwmx_eFokPE00SVB2436VPb_V05wOtPI1YPd39rvPO6JA", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "6c588011-9d93-4f4c-8442-83b953f6c3cd"}, {"timestamp": "2022-12-21T16:27:48Z", "date_only": false, "value": "2022-12-21T16:27:48.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/crackcodes/1915", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "26320cd8-51b4-48fd-affd-712071c87c8c", "content": "#Analytics\nTop 10 most exploited vulnerabilities in 2022\n\n1. CVE-2022-30190: MS Office \"Follina\"\n\n2. CVE-2021-44228: Apache Log4Shell\n\n3. CVE-2022-22965: Spring4Shell\n\n4. CVE-2022-1388: F5 BIG-IP\n\n5. CVE-2022-0609: Google Chrome zero-day\nhttps://blog.google/threat-analysis-group/countering-threats-north-korea\n6. CVE-2017-11882: Old but not forgotten - MS Office bug\n\n7. CVE-2022-41082, CVE-2022-41040: ProxyNotShell\n\n8. CVE-2022-27925, CVE-2022-41352: Zimbra Collaboration Suite bugs\n\n\n9. CVE-2022-26134: Atlassian Confluence RCE flaw  \n\n10. CVE-2022-30525: Zyxel RCE vulnerability", "url": "https://t.me/crackcodes/1915"}, {"timestamp": "2023-01-04T10:02:37Z", "date_only": false, "value": "2023-01-04T10:02:37.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/LearnExploit/4335", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "06554710-d5cc-4594-b282-b1ca329a3e2f", "content": "CVE-2022-41040 and CVE-2022-41082 (A.K.A ProxyNotShell)\n\nGithub\n\n#POC #Exploit \n\u2014\u2014\u2014\u2014\u2014\u2014\n0Day.Today\n@LearnExploit\n@Tech_Army", "url": "https://t.me/LearnExploit/4335"}, {"timestamp": "2023-01-04T10:02:38Z", "date_only": false, "value": "2023-01-04T10:02:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/LearnExploit/4351", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "6068fdef-6169-4cc5-b4a3-6a475593dbed", "content": "1. Follina (CVE-2022-30190)\n\n2. Log4Shell (CVE-2021-44228)\n\n3. Spring4Shell (CVE-2022-22965)\n\n4. F5 BIG-IP (CVE-2022-1388)\n\n5. Google Chrome zero-day (CVE-2022-0609)\n\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n\n10. Zyxel RCE vulnerability (CVE-2022-30525)\n\n#Exploit \n\u2014\u2014\u2014\u2014\u2014\u2014\n0Day.Today\n@LearnExploit\n@Tech_Army", "url": "https://t.me/LearnExploit/4351"}, {"timestamp": "2023-01-09T09:22:44Z", "date_only": false, "value": "2023-01-09T09:22:44.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/Web_Security_Live/46", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "0fdd9073-2952-4fdd-9ad8-97b246e9cd31", "content": "\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u043a\u0438\u0431\u0435\u0440\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 Play \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0430 \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 Rackspace\n\nRackspace \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 , \u0447\u0442\u043e \u0437\u0430 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0443, \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u0434\u0448\u0443\u044e 2 \u0434\u0435\u043a\u0430\u0431\u0440\u044f, \u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Play. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b Rackspace Hosted Exchange, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f.\n\n\u041a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441\u0432\u044f\u0437\u0430\u043d \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043f\u043e\u0434 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c CVE-2022-41080 . \u0420\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u043d\u043e\u0435 Rackspace, \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0441\u0443\u043c\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0435, \u043a\u0430\u043b\u0435\u043d\u0434\u0430\u0440\u044f\u043c-\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430\u043c, \u0441\u043f\u0438\u0441\u043a\u0430\u043c \u0437\u0430\u0434\u0430\u0447, \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0439 \u043a\u043d\u0438\u0433\u0435 \u0438 \u043f\u0440\u043e\u0447\u0438\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0432 PST-\u0444\u0430\u0439\u043b\u0430\u0445 (Personal Storage Table) 27 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 Rackspace. \u041e\u0434\u043d\u0430\u043a\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043d\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u044d\u0442\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0421\u0435\u0439\u0447\u0430\u0441 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u0441\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0441\u0435\u0440\u0432\u0438\u0441 Hosted Exchange \u0438 \u043f\u0435\u0440\u0435\u0432\u0435\u0441\u0442\u0438 30 000 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 Microsoft 365.\n\n\u041f\u043e\u043a\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0437\u0430\u043f\u043b\u0430\u0442\u0438\u043b\u0430 \u043b\u0438 Rackspace \u0432\u044b\u043a\u0443\u043f \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u0434\u0448\u0435\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u043e \u0437\u0430 \u043e\u0442\u0447\u0435\u0442\u043e\u043c \u0418\u0411-\u0444\u0438\u0440\u043c\u044b Crowdstrike, \u043f\u0440\u043e\u043b\u0438\u0432\u0448\u0435\u0439 \u0441\u0432\u0435\u0442 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 Play. \u0422\u0435\u0445\u043d\u0438\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 OWASSRF, \u043e\u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Exchange, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u044b \u043f\u0430\u0442\u0447\u0438, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-41040 \u0438 CVE-2022-41082 . \u041a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b, \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 CVE-2022-41080 \u0438 CVE-2022-41082, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043e\u0431\u0445\u043e\u0434 \u043f\u0440\u0430\u0432\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 Outlook Web Access (OWA).\n\n\ud83d\udd18 https://t.me/web_security_live", "url": "https://t.me/Web_Security_Live/46"}, {"timestamp": "2023-01-10T18:22:25Z", "date_only": false, "value": "2023-01-10T18:22:25.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/arm1tage/385", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "a1c95acd-a050-4ce7-ae45-526dd9b04420", "content": "\ud83d\udca3 ProxyNotShell PoC\n\nProxyNotShell this is a new exploit used in the wild takes advantage of the recently published Microsoft Server-Side Request Forgery vulnerability (CVE-2022-41040) and a second vulnerability that allows Remote Code Execution (CVE-2022-41082) when PowerShell is available on the Exchange Server.\n\nResearch:\nhttps://www.zerodayinitiative.com/blog/2022/11/14/control-your-types-or-get-pwned-remote-code-execution-in-exchange-powershell-backend\n\nNmap Checker:\nhttps://github.com/CronUp/Vulnerabilidades/blob/main/proxynotshell_checker.nse\n\nPoC:\nhttps://github.com/testanull/ProxyNotShell-PoC\n\n#exchange #proxynotshell #ssrf #rce", "url": "https://t.me/arm1tage/385"}, {"timestamp": "2023-03-14T00:00:00Z", "date_only": false, "value": "2023-03-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "last_revision_date"}, {"timestamp": "2023-03-14T00:00:00Z", "date_only": false, "value": "2023-03-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2022-ALE-008", "record": "CERTFR-2022-ALE-008", "field": "revisions.9.revision_date"}, {"timestamp": "2023-06-14T21:10:04Z", "date_only": false, "value": "2023-06-14T21:10:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "67e4dd95-e88d-4575-814b-c46bccfab5a0"}, {"timestamp": "2023-06-23T06:19:27Z", "date_only": false, "value": "2023-06-23T06:19:27.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ad5af8e7-0c4c-4b64-b36d-1c80910c1140", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "b8b11a36-9e33-42fa-ba5a-aba6b7e72104"}, {"timestamp": "2023-12-13T01:19:33.110Z", "date_only": false, "value": "2023-12-13T01:19:33.110014Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-41040", "record": "GSD-2022-41040", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-18T11:47:27Z", "date_only": false, "value": "2023-12-18T11:47:27.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1975", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "d0ae9306-0570-4432-8928-352483ba094f", "content": "#ExploitObserverAlert\n\nCVE-2022-41040\n\nDESCRIPTION: Exploit Observer has 99 entries related to CVE-2022-41040. Microsoft Exchange Server Elevation of Privilege Vulnerability.\n\nFIRST-EPSS: 0.965310000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/1975"}, {"timestamp": "2023-12-20T20:15:18.393Z", "date_only": false, "value": "2023-12-20T20:15:18.393", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-41040", "record": "GSD-2022-41040", "field": "namespaces.nvd.nist.gov.cve.lastModified"}, {"timestamp": "2024-02-23T21:11:09.910Z", "date_only": false, "value": "2024-02-23T21:11:09.910371Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-41040", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2024-02-23T21:11:09.910Z", "date_only": false, "value": "2024-02-23T21:11:09.910371Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-41040", "record": "FKIE_CVE-2022-41040", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-06-29T09:46:10Z", "date_only": false, "value": "2024-06-29T09:46:10.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/GithubRedTeam/3511", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "1fb69d21-f494-4192-920a-6c1f91525e68", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1awriteup and PoC for (CVE-2022-41082/CVE-2022-41040) aka ProxyNotShell\nURL\uff1ahttps://github.com/Adynervi/CVE-2022-41082-RCE-PoC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/3511"}, {"timestamp": "2024-08-03T12:35:49.189Z", "date_only": false, "value": "2024-08-03T12:35:49.189Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-41040", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-05T15:39:37Z", "date_only": false, "value": "2024-09-05T15:39:37.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.thezdi.com/blog/2024/9/4/exploiting-exchange-powershell-after-proxynotshell-part-1-multivaluedproperty", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "1e638b75-8c4a-4602-865e-08974f465f33", "url": "https://www.thezdi.com/blog/2024/9/4/exploiting-exchange-powershell-after-proxynotshell-part-1-multivaluedproperty"}, {"timestamp": "2024-10-11T03:03:25Z", "date_only": false, "value": "2024-10-11T03:03:25.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberSecurityTechnologies/7395", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "80aa1674-07a9-45c9-84d6-8476839c5ea7", "content": "#Analytics\nTop 10 most exploited vulnerabilities in 2022\n\n1. CVE-2022-30190: MS Office \"Follina\"\n2. CVE-2021-44228: Apache Log4Shell\n3. CVE-2022-22965: Spring4Shell\n4. CVE-2022-1388: F5 BIG-IP\n5. CVE-2022-0609: Google Chrome 0-day\n6. CVE-2017-11882: MS Office RCE\n7. CVE-2022-41082, CVE-2022-41040: ProxyNotShell\n8. CVE-2022-27925, CVE-2022-41352: Zimbra Collaboration Suite bugs\n9. CVE-2022-26134: Atlassian Confluence RCE\n10. CVE-2022-30525: Zyxel RCE vulnerability", "url": "https://t.me/CyberSecurityTechnologies/7395"}, {"timestamp": "2024-12-24T20:33:13.920Z", "date_only": false, "value": "2024-12-24T20:33:13.920712Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971720", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "c792aeb9-5002-41f1-8d26-b18f4d552f05", "url": "https://feedsin.space/feed/CISAKevBot/items/2971720"}, {"timestamp": "2024-12-24T20:33:14.710Z", "date_only": false, "value": "2024-12-24T20:33:14.710897Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971721", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "a9d69f2b-c0dd-4fe6-8a76-44122718d40d", "url": "https://feedsin.space/feed/CISAKevBot/items/2971721"}, {"timestamp": "2025-01-17T05:54:36Z", "date_only": false, "value": "2025-01-17T05:54:36.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/6952", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "42520988-75a2-41bb-8c8d-1d9ba9f03881", "content": "#exploit\n1. CVE-2022-41040:\nSSRF in Microsoft Exchange Server\nhttps://github.com/kljunowsky/CVE-2022-41040-POC\n]-> https://github.com/TaroballzChen/CVE-2022-41040-metasploit-ProxyNotShell\n\n2. CVE-2022-40684:\nCritical Authentication Bypass in FortiOS and FortiProxy\nhttps://github.com/horizon3ai/CVE-2022-40684", "url": "https://t.me/CyberSecurityTechnologies/6952"}, {"timestamp": "2025-02-06T03:13:45Z", "date_only": false, "value": "2025-02-06T03:13:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "0bde2c8e-a2be-4f8d-a303-a8b85ea5d5c8"}, {"timestamp": "2025-02-23T02:10:39Z", "date_only": false, "value": "2025-02-23T02:10:39.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "b0b66544-4bd1-4a36-b1a1-43037a243b8a"}, {"timestamp": "2025-02-23T04:10:49Z", "date_only": false, "value": "2025-02-23T04:10:49.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "12d26dab-811c-4a34-a88a-f51229ff42f5"}, {"timestamp": "2025-02-28T23:49:13.272Z", "date_only": false, "value": "2025-02-28T23:49:13.272798Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/fdda4963-0aa7-4d15-8a8f-969db8f304ca", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "b3cc28ee-37d5-460e-b648-14266431d79b", "url": "https://vulnerability.circl.lu/bundle/fdda4963-0aa7-4d15-8a8f-969db8f304ca"}, {"timestamp": "2025-03-11T16:10:09.697Z", "date_only": false, "value": "2025-03-11T16:10:09.697Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2022-41040", "record": "MSRC_CVE-2022-41040", "field": "document.tracking.generator.date"}, {"timestamp": "2025-03-11T16:10:48.981Z", "date_only": false, "value": "2025-03-11T16:10:48.981Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2022-41040", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-11T16:40:29Z", "date_only": false, "value": "2025-03-11T16:40:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/7175", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "1f525c2e-4c3c-4ad5-a0d6-4161a6a5874b", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-41040\n\ud83d\udd25 CVSS Score: 8.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)\n\ud83d\udd39 Description: Microsoft Exchange Server Elevation of Privilege Vulnerability\n\ud83d\udccf Published: 2022-10-03T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-11T16:10:48.981Z\n\ud83d\udd17 References:\n1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040", "url": "https://t.me/DarkWebInformer_CVEAlerts/7175"}, {"timestamp": "2025-04-22T02:52:21Z", "date_only": false, "value": "2025-04-22T02:52:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/AGENTZSECURITY/1245", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "9e13c0dd-873d-4d3c-be2a-3e5f200fdf93", "content": "https://github.com/attacker-codeninja/My-Nuclei-Templates-2\nhttps://github.com/badboy-sft/badboy_17-Nuclei-Templates-Collection\nhttps://github.com/bhataasim1/PersonalTemplates\nhttps://github.com/bjhulst/nuclei-custom-templates\nhttps://github.com/bufferbandit/gitScanNucleiTemplate\nhttps://github.com/bugbountydude/Nuclei-TamplatesBackup\nhttps://github.com/c3l3si4n/malicious_nuclei_templates\nhttps://github.com/chouaibhm/foulenzer-templates\nhttps://github.com/cipher387/juicyinfo-nuclei-templates\nhttps://github.com/compr00t/nuclei-templates\nhttps://github.com/e1abrador/SpringCorePoC.sh\nhttps://github.com/emadshanab/nucleiDB\nhttps://github.com/ibaiw/nuclei_templates\nhttps://github.com/kh4sh3i/Nextcloud-Pentesting\nhttps://github.com/kh4sh3i/Webmin-CVE\nhttps://github.com/learnerboy88/CVE-2023-29489\nhttps://github.com/lliwi/nuclei-repo-hunter\nhttps://github.com/manasmbellani/nuclei-templates\nhttps://github.com/marcositu/nuclei-custom-templates\nhttps://github.com/mertugur/nuclei-templates\nhttps://github.com/milo2012/nuclei-templates-others\nhttps://github.com/narasimha5x5/nuclei-templates\nhttps://github.com/nullfuzz-pentest/custom-nuclei-templates\nhttps://github.com/numanturle/CVE-2022-41040\nhttps://github.com/p0ch4t/nuclei-special-templates\nhttps://github.com/p3n73st3r/Nuclei-Templates\nhttps://github.com/pentest-dev/Profesional-Nuclei-Templates\nhttps://github.com/psc4re/nuclei-templates\nhttps://github.com/rahul-nakum14/Recon\nhttps://github.com/rutgerhrm/valid8\nhttps://github.com/samy1937/mynuclei_templates\nhttps://github.com/shubham-rooter/Nuclei-custom-templates\nhttps://github.com/sl4x0/NC-Templates\nhttps://github.com/sudouday/nuclei-templates\nhttps://github.com/sushant-kamble/mynuclei-template\nhttps://github.com/tamimhasan404/Open-Source-Nuclei-Templates-Downloader\nhttps://github.com/thecyberneh/nuclei-templatess\nhttps://github.com/thecybertix/Nuclei-templates\nhttps://github.com/themoonbaba/private_templates\nhttps://github.com/twseptian/custom-nuclei-templates\nhttps://github.com/vidocsecurity/templates\nhttps://github.com/vishal12300/all_nuclei_templatess\nhttps://github.com/vulnspace/nuclei-templates\nhttps://github.com/websecresearch/nucleirecordloginsession\nhttps://github.com/windyGarlic/nuclei-templates\nhttps://github.com/xinZa1/template\nhttps://github.com/yarovit-developer/nuclei-templates\nhttps://github.com/vsh00t/nuclei-templates\nhttps://github.com/nikhilhvr/nuclei-templates\nhttps://github.com/ed-red/redmc_custom_templates_nuclei\nhttps://github.com/DrakenKun-cyber/Templates\nhttps://github.com/Dalaho-bangin/nuclei-templates2\nhttps://github.com/Mr-xn/CVE-2023-23333\nhttps://github.com/boobooHQ/private_templates\nhttps://github.com/Erenlancaster/CVE-2021-46704\nhttps://github.com/stevemason/nuclei-template-forked-daapd-path-traversal\nhttps://github.com/topscoder/nuclei-zero-day\nhttps://github.com/mdube99/nuclei-templates\nhttps://github.com/nuts7/CVE-2023-27372\nhttps://github.com/k00kx/nuclei-templates\nhttps://github.com/YashVardhanTrip/nuclei-templates\nhttps://github.com/Deep2142004/Nuclei-Templates\nhttps://github.com/RajaUzairAbdullah/nuclei-templates\nhttps://github.com/mdube99/custom-nuclei-templates\nhttps://github.com/Esonhugh/public-nuclei-template\nhttps://github.com/Rabb1ter/nuclei-templates\nhttps://github.com/zodmagus/z0ds3c-Nuclei-Templates\nhttps://github.com/thefool45/nuclei-templates\nhttps://github.com/SumedhDawadi/Nuclei_Template_Subdomain_Takeover\nhttps://github.com/r3dcl1ff/Symfony-Fuck\nhttps://github.com/polling-repo-continua/KozinTemplates\nhttps://github.com/b4dboy17/badboy_17-Nuclei-Templates-Collection\nhttps://github.com/narasimhareddy5x5/nuclei-templates\nhttps://github.com/baharebenesbordi/Nuclei-Templates\nhttps://github.com/v3l4r10/Nuclei-Templates\nhttps://github.com/Deepparasiya/Nuclei-Templates\nhttps://github.com/valaDevs/env-js-nuclei", "url": "https://t.me/AGENTZSECURITY/1245"}, {"timestamp": "2025-04-22T02:52:21Z", "date_only": false, "value": "2025-04-22T02:52:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/AGENTZSECURITY/1247", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "51573969-dea2-444b-b584-595bc453ebb4", "content": "https://github.com/exploit-io/nuclei-fuzz-templates\nhttps://github.com/yashrupavatiya26/custom-nuclei-template\nhttps://github.com/ts4rin4/templates4nuclei\nhttps://github.com/Caddyshack2175/nuclei-custom-templates\nhttps://github.com/0xr2r/templates-nucleir2r\nhttps://github.com/pushpak-11/customTemplates\nhttps://github.com/Christbowel/CVE-2024-25600_Nuclei-Template\nhttps://github.com/Shakilll/my_nuclei_templates\nhttps://github.com/xjhonly/nuclei-templates\nhttps://github.com/0x71rex/0-Nuclei-Templates\nhttps://github.com/0xPugal/my-nuclei-templates\nhttps://github.com/damon-sec/TCSZ-Nuclei\nhttps://github.com/qaisarafridi/MY-Nuclei-Templates\nhttps://github.com/badboycxcc/CVE-2023-24100\nhttps://github.com/umityn/my-nuclei-templates\nhttps://github.com/0xKayala/Custom-Nuclei-Templates\nhttps://github.com/thanhnx9/nuclei-templates-cutomer\nhttps://github.com/VulnExpo/nuclei-templates\nhttps://github.com/mdsabbirkhan/0xPugazh-my-nuclei-templates\nhttps://github.com/vulnspace/nuclei-templates\nhttps://github.com/microphone-mathematics/custom-nuclei-templates\nhttps://github.com/praetorian-inc/zeroqlik-detect\nhttps://github.com/hackerhijeck/Fuzzing_with_nuclei\nhttps://github.com/valaDevs/nuclei-backupfile-finder\nhttps://github.com/reewardius/interested-nuclei-templates\nhttps://github.com/zodmagus/z0ds3c-Nuclei-Templates\nhttps://github.com/Mr-xn/CVE-2023-23333\nhttps://github.com/bug-vs-me/WPML-XSS\nhttps://github.com/sudouday/nuclei-templates\nhttps://github.com/cyberheartmi9/Proxyshell-Scanner\nhttps://github.com/numanturle/CVE-2022-41040\nhttps://github.com/numanturle/Log4jNuclei\nhttps://github.com/CharanRayudu/Custom-Nuclei-Templates\nhttps://github.com/daffainfo/my-nuclei-templates\nhttps://github.com/thebrnwal/Content-Injection-Nuclei-Script\nhttps://github.com/ree4pwn/my-nuclei-templates\nhttps://github.com/peanuth8r/Nuclei_Templates\nhttps://github.com/pikpikcu/nuclei-templates\nhttps://github.com/esetal/nuclei-bb-templates\nhttps://github.com/ARPSyndicate/kenzer-templates\nhttps://github.com/medbsq/ncl\nhttps://github.com/notnotnotveg/nuclei-custom-templates\nhttps://github.com/clarkvoss/Nuclei-Templates\nhttps://github.com/z3bd/nuclei-templates\nhttps://github.com/peanuth8r/Nuclei_Templates\nhttps://github.com/thebrnwal/Content-Injection-Nuclei-Script\nhttps://github.com/ree4pwn/my-nuclei-templates\nhttps://github.com/im403/nuclei-temp\nhttps://github.com/System00-Security/backflow\nhttps://github.com/geeknik/nuclei-templates-1\nhttps://github.com/geeknik/the-nuclei-templates\nhttps://github.com/optiv/mobile-nuclei-templates\nhttps://github.com/obreinx/nuceli-templates\nhttps://github.com/randomstr1ng/nuclei-sap-templates\nhttps://github.com/CharanRayudu/Custom-Nuclei-Templates\nhttps://github.com/n1f2c3/mytemplates\nhttps://github.com/kabilan1290/templates\nhttps://github.com/smaranchand/nuclei-templates\nhttps://github.com/Saimonkabir/Nuclei-Templates\nhttps://github.com/yavolo/nuclei-templates\nhttps://github.com/sadnansakin/my-nuclei-templates\nhttps://github.com/5cr1pt/templates\nhttps://github.com/rahulkadavil/nuclei-templates\nhttps://github.com/shifa123/detections\nhttps://github.com/daffainfo/my-nuclei-templates\nhttps://github.com/javaongsan/nuclei-templates\nhttps://github.com/AshiqurEmon/nuclei_templates\nhttps://gist.github.com/ResistanceIsUseless/e46848f67706a8aa1205c9d2866bff31\nhttps://github.com/NitinYadav00/My-Nuclei-Templates\nhttps://github.com/sharathkramadas/k8s-nuclei-templates\nhttps://github.com/securitytest3r/nuclei_templates_work\nhttps://github.com/MR-pentestGuy/nuclei-templates\nhttps://github.com/thelabda/nuclei-templates\nhttps://github.com/1in9e/my-nuclei-templates\nhttps://github.com/redteambrasil/nuclei-templates\nhttps://github.com/Saptak9983/Nuclei-Template\nhttps://github.com/Harish4948/Nuclei-Templates\nhttps://github.com/R-s0n/Custom_Vuln_Scan_Templates", "url": "https://t.me/AGENTZSECURITY/1247"}, {"timestamp": "2025-04-22T02:52:22Z", "date_only": false, "value": "2025-04-22T02:52:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/AGENTZSECURITY/1252", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "defdfd47-c3ed-4ea2-a5c2-01e370f23cbc", "content": "https://github.com/mdsabbirkhan/0xPugazh-my-nuclei-templates\nhttps://github.com/mdube99/custom-nuclei-templates\nhttps://github.com/mdube99/nuclei-templates\nhttps://github.com/medbsq/ncl\nhttps://github.com/meme-lord/Custom-Nuclei-Templates\nhttps://github.com/mertugur/nuclei-templates\nhttps://github.com/microphone-mathematics/custom-nuclei-templates\nhttps://github.com/milo2012/nuclei-templates-others\nhttps://github.com/myuyu/nuclei-templates\nhttps://github.com/n1f2c3/mytemplates\nhttps://github.com/narasimha5x5/nuclei-templates\nhttps://github.com/narasimhareddy5x5/nuclei-templates\nhttps://github.com/nicholasaleks/NucleiGPT\nhttps://github.com/nikhilhvr/nuclei-templates\nhttps://github.com/notnotnotveg/nuclei-custom-templates\nhttps://github.com/nullfuzz-pentest/custom-nuclei-templates\nhttps://github.com/numanturle/CVE-2022-41040\nhttps://github.com/nuts7/CVE-2023-27372\nhttps://github.com/obreinx/nuceli-templates\nhttps://github.com/optiv/mobile-nuclei-templates\nhttps://github.com/p0ch4t/nuclei-special-templates\nhttps://github.com/p3n73st3r/Nuclei-Templates\nhttps://github.com/panch0r3d/nuclei-templates\nhttps://github.com/peanuth8r/Nuclei_Templates\nhttps://github.com/pentest-dev/Profesional-Nuclei-Templates\nhttps://github.com/pikpikcu/nuclei-templates\nhttps://github.com/ping-0day/templates\nhttps://github.com/polling-repo-continua/KozinTemplates\nhttps://github.com/praetorian-inc/chariot-launch-nuclei-templates\nhttps://github.com/praetorian-inc/zeroqlik-detect\nhttps://github.com/psc4re/nuclei-templates\nhttps://github.com/ptyspawnbinbash/template-enhancer\nhttps://github.com/qaisarafridi/MY-Nuclei-Templates\nhttps://github.com/r3dcl1ff/Symfony-Fuck\nhttps://github.com/rafaelcaria/Nuclei-Templates\nhttps://github.com/rafaelwdornelas/my-nuclei-templates\nhttps://github.com/rahul-nakum14/Recon\nhttps://github.com/rahulkadavil/nuclei-templates\nhttps://github.com/randomstr1ng/nuclei-sap-templates\nhttps://github.com/redteambrasil/nuclei-templates\nhttps://github.com/ree4pwn/my-nuclei-templates\nhttps://github.com/reewardius/mytemplates-log4shell\nhttps://github.com/reewardius/nuclei-special-templates\nhttps://github.com/reewardius/nuclei-templates\nhttps://github.com/reewardius/nuclei-templates-new\nhttps://github.com/ricardomaia/nuclei-template-generator-for-wordpress-plugins\nhttps://github.com/rutgerhrm/valid8\nhttps://github.com/sadnansakin/my-nuclei-templates\nhttps://github.com/samy1937/mynuclei_templates\nhttps://github.com/schooldropout1337/nuclei-templates\nhttps://github.com/securitytest3r/nuclei_templates_work\nhttps://github.com/sharathkramadas/k8s-nuclei-templates\nhttps://github.com/shifa123/detections\nhttps://github.com/shubham-rooter/Nuclei-custom-templates\nhttps://github.com/sl4x0/NC-Templates\nhttps://github.com/smaranchand/nuclei-templates\nhttps://github.com/soapffz/myown-nuclei-poc\nhttps://github.com/soumya123raj/Nuclei\nhttps://github.com/souzomain/mytemplates\nhttps://github.com/stevemason/nuclei-template-forked-daapd-path-traversal\nhttps://github.com/sudouday/nuclei-templates\nhttps://github.com/sushant-kamble/mynuclei-template\nhttps://github.com/szybnev/nuclei-custom\nhttps://github.com/tamimhasan404/Open-Source-Nuclei-Templates-Downloader\nhttps://github.com/test502git/log4j-fuzz-head-poc\nhttps://github.com/testtt3424/nuclei-templates\nhttps://github.com/th3-r3sistanc3/nuclei-templates\nhttps://github.com/th3r4id/nuclei-templates\nhttps://github.com/thebrnwal/Content-Injection-Nuclei-Script\nhttps://github.com/thecyberneh/nuclei-templatess\nhttps://github.com/thecybertix/Nuclei-templates\nhttps://github.com/thefool45/nuclei-templates\nhttps://github.com/thelabda/nuclei-templates\nhttps://github.com/themoonbaba/private_templates\nhttps://github.com/topscoder/nuclei-wordfence-cve\nhttps://github.com/topscoder/nuclei-zero-day\nhttps://github.com/toramanemre/apache-solr-log4j-CVE-2021-44228", "url": "https://t.me/AGENTZSECURITY/1252"}, {"timestamp": "2025-05-05T11:16:23.484Z", "date_only": false, "value": "2025-05-05T11:16:23.484290Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3logakjmvec2o", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "d9d7cfa8-85d0-46ed-84ee-b48326bf9ac9", "url": "https://bsky.app/profile/crowdsec.bsky.social/post/3logakjmvec2o"}, {"timestamp": "2025-05-05T11:16:24.666Z", "date_only": false, "value": "2025-05-05T11:16:24.666184Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3logaklhehc2o", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "9d6d90c8-a519-4330-9b33-dcc56218d6f4", "url": "https://bsky.app/profile/crowdsec.bsky.social/post/3logaklhehc2o"}, {"timestamp": "2025-05-05T11:16:25.804Z", "date_only": false, "value": "2025-05-05T11:16:25.804132Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3logaklulck2o", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "2efc2b87-f52c-4a77-8988-972d8e948e61", "url": "https://bsky.app/profile/crowdsec.bsky.social/post/3logaklulck2o"}, {"timestamp": "2025-05-05T11:16:26.927Z", "date_only": false, "value": "2025-05-05T11:16:26.927965Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3logaklunb22o", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "1964e5f7-b2ce-4710-bbf7-4e1c5b7e97b2", "url": "https://bsky.app/profile/crowdsec.bsky.social/post/3logaklunb22o"}, {"timestamp": "2025-05-05T11:16:28.092Z", "date_only": false, "value": "2025-05-05T11:16:28.092983Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3logakmi5bs2o", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "f37b0e11-1a93-42fc-9ae2-7936ef939625", "url": "https://bsky.app/profile/crowdsec.bsky.social/post/3logakmi5bs2o"}, {"timestamp": "2025-10-21T23:15:33.946Z", "date_only": false, "value": "2025-10-21T23:15:33.946Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-41040", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:15:33.946Z", "date_only": false, "value": "2025-10-21T23:15:33.946Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-41040", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:32:37Z", "date_only": false, "value": "2025-10-22T00:32:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6PH7-8WXV-6GF2", "record": "GHSA-6PH7-8WXV-6GF2", "field": "modified"}, {"timestamp": "2025-11-04T07:17:42Z", "date_only": false, "value": "2025-11-04T07:17:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/dcaddick/226adcebb2de27acf9f0c71fd785dc97", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "989c1a9d-4044-48a2-a25d-f768dc9e0995", "url": "https://gist.github.com/dcaddick/226adcebb2de27acf9f0c71fd785dc97"}, {"timestamp": "2026-02-02T12:27:12.085Z", "date_only": false, "value": "2026-02-02T12:27:12.085473Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/51242530-97c6-45a1-8bf8-51ba025e0039", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "37423d56-64b5-4f59-818f-67117f68e549", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/51242530-97c6-45a1-8bf8-51ba025e0039"}, {"timestamp": "2026-02-02T12:27:12.085Z", "date_only": false, "value": "2026-02-02T12:27:12.085473Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/51242530-97c6-45a1-8bf8-51ba025e0039", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "ef8b9d43-432b-4cf0-af4f-627ba60ea214", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/51242530-97c6-45a1-8bf8-51ba025e0039"}, {"timestamp": "2026-02-02T13:24:01Z", "date_only": false, "value": "2026-02-02T13:24:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2022-41040", "field": "timestamps.recorded_at", "uuid": "5ccf9785-4e89-421a-bdae-8ba3124d1532", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T05:02:28.500Z", "date_only": false, "value": "2026-06-17T05:02:28.500", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-41040", "record": "FKIE_CVE-2022-41040", "field": "lastModified"}, {"timestamp": "2026-06-19T12:47:03.109Z", "date_only": false, "value": "2026-06-19T12:47:03.109455Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7923ac3d-496d-4715-8790-db8feaf588a4", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "04ce7bc3-66eb-418b-aa57-d3bd87efed95", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7923ac3d-496d-4715-8790-db8feaf588a4"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2022-41040", "field": "timestamps.recorded_at", "uuid": "6ee2bc0c-b675-412a-8174-44dbe23f196c", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:14:01.220Z", "date_only": false, "value": "2026-06-23T11:14:01.220426Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/6ee2bc0c-b675-412a-8174-44dbe23f196c", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "f087c009-cc13-4ef1-b44b-972828053e61", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/6ee2bc0c-b675-412a-8174-44dbe23f196c"}, {"timestamp": "2026-06-23T14:05:33.744Z", "date_only": false, "value": "2026-06-23T14:05:33.744307Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3c292fed-4cbc-4c29-bae2-61c2d213217b", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "38908446-0b11-4a6c-9ce9-cb4b12e10ec9", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3c292fed-4cbc-4c29-bae2-61c2d213217b"}, {"timestamp": "2026-06-25T06:34:31.882Z", "date_only": false, "value": "2026-06-25T06:34:31.882959Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-998693a6-0c9cca46b62121bd", "record": "cve-2022-41040", "field": "creation_timestamp", "uuid": "37b2a94c-d83d-4b72-b8cb-0b7445020a13", "url": "https://poliverso.org/objects/0477a01e-998693a6-0c9cca46b62121bd"}, {"timestamp": "2026-07-26T02:02:35.802Z", "date_only": false, "value": "2026-07-26T02:02:35.802179Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/866", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "62ff0fe7-be8f-4ee5-a28f-04cf02be79e6", "url": "https://t.me/EchelonEyes/866"}, {"timestamp": "2026-07-26T02:02:37.776Z", "date_only": false, "value": "2026-07-26T02:02:37.776168Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/766", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "3962ae10-9a74-4a2b-ae96-e1b6bd1c7ea5", "url": "https://t.me/EchelonEyes/766"}, {"timestamp": "2026-07-26T02:02:38.125Z", "date_only": false, "value": "2026-07-26T02:02:38.125645Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/743", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "c651a5b1-4bf8-4e9a-b8c5-8cc5349b08d3", "url": "https://t.me/EchelonEyes/743"}, {"timestamp": "2026-07-26T07:01:45.305Z", "date_only": false, "value": "2026-07-26T07:01:45.305566Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Positive_Technologies/996", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "6c535920-cdbe-4404-83c0-73be580ca0ec", "url": "https://t.me/Positive_Technologies/996"}, {"timestamp": "2026-07-27T00:01:11.777Z", "date_only": false, "value": "2026-07-27T00:01:11.777332Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/866", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "8f2b3804-a7f6-4dfb-831b-10793a99e824", "url": "https://t.me/EchelonEyes/866"}, {"timestamp": "2026-07-27T00:01:14.748Z", "date_only": false, "value": "2026-07-27T00:01:14.748259Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/766", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "d1afcb92-e6c1-44ca-9b8c-da853f6744f8", "url": "https://t.me/EchelonEyes/766"}, {"timestamp": "2026-07-27T00:01:15.120Z", "date_only": false, "value": "2026-07-27T00:01:15.120526Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/743", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "92a7239f-3554-43ac-b69a-ba9eb025e411", "url": "https://t.me/EchelonEyes/743"}, {"timestamp": "2026-07-27T00:01:30.061Z", "date_only": false, "value": "2026-07-27T00:01:30.061501Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Positive_Technologies/996", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "da0c5e63-1298-40ac-ac3a-e5baa4e68f9b", "url": "https://t.me/Positive_Technologies/996"}, {"timestamp": "2026-07-28T05:00:04.587Z", "date_only": false, "value": "2026-07-28T05:00:04.587063Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/866", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "8604e2da-61b9-4eb2-b471-ac12ccf9160f", "url": "https://t.me/EchelonEyes/866"}, {"timestamp": "2026-07-28T07:00:06.935Z", "date_only": false, "value": "2026-07-28T07:00:06.935902Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/766", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "c95bbc66-d151-48e9-8fc5-858a3f23b43c", "url": "https://t.me/EchelonEyes/766"}, {"timestamp": "2026-07-28T08:00:06.455Z", "date_only": false, "value": "2026-07-28T08:00:06.455010Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/743", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "da4f580e-5835-4abc-bb86-705fe884d419", "url": "https://t.me/EchelonEyes/743"}, {"timestamp": "2026-07-28T20:00:08.446Z", "date_only": false, "value": "2026-07-28T20:00:08.446994Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/Positive_Technologies/996", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "21a8cb23-542e-4538-8a31-b9f728e7ca2f", "url": "https://t.me/Positive_Technologies/996"}, {"timestamp": "2026-07-29T00:00:27.456Z", "date_only": false, "value": "2026-07-29T00:00:27.456222Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/Positive_Technologies/996", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "c43da52f-be54-4bfe-8f1e-f7a5bba60241", "url": "https://t.me/Positive_Technologies/996"}, {"timestamp": "2026-07-29T00:00:44.122Z", "date_only": false, "value": "2026-07-29T00:00:44.122112Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/743", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "0b55eeb2-655c-49c2-a7f5-a340a0ed12f1", "url": "https://t.me/EchelonEyes/743"}, {"timestamp": "2026-07-29T00:00:44.425Z", "date_only": false, "value": "2026-07-29T00:00:44.425431Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/766", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "3419ac71-a367-4d10-9369-487bd604796d", "url": "https://t.me/EchelonEyes/766"}, {"timestamp": "2026-07-29T00:00:47.554Z", "date_only": false, "value": "2026-07-29T00:00:47.554317Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/866", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "e9b2b49f-37ae-4b40-9a07-226bcd374fe9", "url": "https://t.me/EchelonEyes/866"}, {"timestamp": "2026-07-29T12:00:59.046Z", "date_only": false, "value": "2026-07-29T12:00:59.046602Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/2964", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "e219f01b-d99d-4e49-b3a5-7cd56b3b4123", "url": "https://t.me/CVEhub/2964"}, {"timestamp": "2026-07-29T12:02:35.422Z", "date_only": false, "value": "2026-07-29T12:02:35.422728Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2972", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "867e9545-0588-4005-ad37-c92f90aac569", "url": "https://t.me/reverseame/2972"}, {"timestamp": "2026-07-29T12:02:38.485Z", "date_only": false, "value": "2026-07-29T12:02:38.485337Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2753", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "a23fe838-ec24-4798-b4d0-31a639a154ca", "url": "https://t.me/reverseame/2753"}, {"timestamp": "2026-07-30T00:01:38.187Z", "date_only": false, "value": "2026-07-30T00:01:38.187086Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/2964", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "ecca2001-2d31-482b-93f1-145b4d579903", "url": "https://t.me/CVEhub/2964"}, {"timestamp": "2026-07-30T00:02:33.406Z", "date_only": false, "value": "2026-07-30T00:02:33.406111Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2972", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "54c8c3b7-ee39-4ed8-ad97-ef5ac4335b93", "url": "https://t.me/reverseame/2972"}, {"timestamp": "2026-07-30T00:02:34.825Z", "date_only": false, "value": "2026-07-30T00:02:34.825130Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2753", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "d7a0cd97-9479-4b49-8d9f-28fd3702fa9e", "url": "https://t.me/reverseame/2753"}, {"timestamp": "2026-08-01T02:00:04.372Z", "date_only": false, "value": "2026-08-01T02:00:04.372966Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/2964", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "fe0a401c-bd8e-485a-b33b-25d777525c36", "url": "https://t.me/CVEhub/2964"}, {"timestamp": "2026-08-02T00:01:20.109Z", "date_only": false, "value": "2026-08-02T00:01:20.109153Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/2964", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "e9311a43-94cc-47eb-aefa-ebb9f65321b9", "url": "https://t.me/CVEhub/2964"}, {"timestamp": "2026-08-02T20:08:44.332Z", "date_only": false, "value": "2026-08-02T20:08:44.332110Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2972", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "8474731d-3ce7-4883-aec4-cfa246c105d5", "url": "https://t.me/reverseame/2972"}, {"timestamp": "2026-08-02T23:20:28.442Z", "date_only": false, "value": "2026-08-02T23:20:28.442701Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/2753", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "584d4b9f-403d-4daa-a3bd-627f22ca96da", "url": "https://t.me/reverseame/2753"}, {"timestamp": "2026-08-03T00:37:50.441Z", "date_only": false, "value": "2026-08-03T00:37:50.441568Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/2753", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "35a2f2a6-fc3e-4df7-b236-cd14d2e52589", "url": "https://t.me/reverseame/2753"}, {"timestamp": "2026-08-03T01:03:34.980Z", "date_only": false, "value": "2026-08-03T01:03:34.980598Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2972", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "c7ab1425-1e96-46d3-8fcc-18649a0001c9", "url": "https://t.me/reverseame/2972"}, {"timestamp": "2026-09-01T17:00:25.825Z", "date_only": false, "value": "2026-09-01T17:00:25.825707Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/6201", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "c65ac61f-47ab-4598-a566-a487738b5860", "url": "https://t.me/cissp/6201"}, {"timestamp": "2026-09-01T20:01:12.083Z", "date_only": false, "value": "2026-09-01T20:01:12.083484Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/83429", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "6c71f6df-1ac1-4b12-852d-ea50f512c297", "url": "https://t.me/hacking_Attack/83429"}, {"timestamp": "2026-09-01T20:01:12.613Z", "date_only": false, "value": "2026-09-01T20:01:12.613923Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/81456", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "7ca69118-30bb-4734-b6be-1699a9597d1a", "url": "https://t.me/hacking_Attack/81456"}, {"timestamp": "2026-09-01T20:01:20.585Z", "date_only": false, "value": "2026-09-01T20:01:20.585023Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/72594", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "31165f2d-b61c-4897-82e9-79cf11fb57d2", "url": "https://t.me/hacking_Attack/72594"}, {"timestamp": "2026-09-01T20:01:20.625Z", "date_only": false, "value": "2026-09-01T20:01:20.625718Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/72596", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "e51eef5d-7fa8-4c72-933a-f73d2dc8e1fc", "url": "https://t.me/hacking_Attack/72596"}, {"timestamp": "2026-09-01T20:01:21.145Z", "date_only": false, "value": "2026-09-01T20:01:21.145175Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/71626", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "67c107ce-7c9f-4ab9-a002-95cdc350ef2b", "url": "https://t.me/hacking_Attack/71626"}, {"timestamp": "2026-09-05T00:00:08.885Z", "date_only": false, "value": "2026-09-05T00:00:08.885990Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/81456", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "715fde38-e0a0-45f7-b689-7e2ff96e12b6", "url": "https://t.me/hacking_Attack/81456"}, {"timestamp": "2026-09-05T00:00:09.716Z", "date_only": false, "value": "2026-09-05T00:00:09.716442Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacking_Attack/83429", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "47ef99ac-46fb-45c4-a6e1-a1db3e8fdd5d", "url": "https://t.me/hacking_Attack/83429"}, {"timestamp": "2026-09-05T06:00:05.585Z", "date_only": false, "value": "2026-09-05T06:00:05.585915Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/72596", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "c17de2a2-e666-42f5-b593-6f6ae3f6c535", "url": "https://t.me/hacking_Attack/72596"}, {"timestamp": "2026-09-05T06:00:05.630Z", "date_only": false, "value": "2026-09-05T06:00:05.630566Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/72594", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "40b94e0f-2cca-4d3c-ac9d-e06ed1f580a9", "url": "https://t.me/hacking_Attack/72594"}, {"timestamp": "2026-09-05T07:00:05.774Z", "date_only": false, "value": "2026-09-05T07:00:05.774710Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacking_Attack/71626", "record": "CVE-2022-41040", "field": "creation_timestamp", "uuid": "30766284-59d9-4a7d-b195-e76a25964783", "url": "https://t.me/hacking_Attack/71626"}]}