{"metadata": {"vulnerability": "CVE-2024-38023", "count": 63, "kinds": {"milestone": 9, "sighting": 29, "kev": 0, "other": 25}}, "data": [{"timestamp": "2024-06-11T18:18:00.681Z", "date_only": false, "value": "2024-06-11T18:18:00.681Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-38023", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-07-09T00:00:00Z", "date_only": true, "value": "2024-07-09", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0560", "record": "CERTFR-2024-AVI-0560", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2024-07-09T07:00:00Z", "date_only": false, "value": "2024-07-09T07:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-38023", "record": "MSRC_CVE-2024-38023", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-07-09T07:00:00Z", "date_only": false, "value": "2024-07-09T07:00:00.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-38023", "record": "MSRC_CVE-2024-38023", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2024-07-09T07:00:00Z", "date_only": false, "value": "2024-07-09T07:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2024-38023", "field": "containers.cna.datePublic"}, {"timestamp": "2024-07-09T07:00:00Z", "date_only": false, "value": "2024-07-09T07:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-38023", "record": "MSRC_CVE-2024-38023", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-07-09T07:00:00Z", "date_only": false, "value": "2024-07-09T07:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-38023", "record": "MSRC_CVE-2024-38023", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-07-09T17:02:23.908Z", "date_only": false, "value": "2024-07-09T17:02:23.908Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-38023", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-07-09T17:15:28Z", "date_only": false, "value": "2024-07-09T17:15:28Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-24WV-53MH-2995", "record": "GHSA-24WV-53MH-2995", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-07-09T17:15:28.760Z", "date_only": false, "value": "2024-07-09T17:15:28.760", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-38023", "record": "FKIE_CVE-2024-38023", "field": "published"}, {"timestamp": "2024-07-09T17:36:11.010Z", "date_only": false, "value": "2024-07-09T17:36:11.010472Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-38023", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-07-09T17:36:11.010Z", "date_only": false, "value": "2024-07-09T17:36:11.010472Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-38023", "record": "FKIE_CVE-2024-38023", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-07-09T18:30:51Z", "date_only": false, "value": "2024-07-09T18:30:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-24WV-53MH-2995", "record": "GHSA-24WV-53MH-2995", "field": "published"}, {"timestamp": "2024-07-09T18:30:51Z", "date_only": false, "value": "2024-07-09T18:30:51Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-24WV-53MH-2995", "record": "GHSA-24WV-53MH-2995", "field": "modified"}, {"timestamp": "2024-07-09T19:37:26.015Z", "date_only": false, "value": "2024-07-09T19:37:26.015768Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2024-0284", "record": "NCSC-2024-0284", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-07-09T19:37:26.015Z", "date_only": false, "value": "2024-07-09T19:37:26.015768Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2024-0284", "record": "NCSC-2024-0284", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-07-09T19:37:26.015Z", "date_only": false, "value": "2024-07-09T19:37:26.015768Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2024-0284", "record": "NCSC-2024-0284", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-07-09T22:00:00Z", "date_only": false, "value": "2024-07-09T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1584", "record": "WID-SEC-W-2024-1584", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-07-09T22:00:00Z", "date_only": false, "value": "2024-07-09T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1584", "record": "WID-SEC-W-2024-1584", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-07-09T22:00:00Z", "date_only": false, "value": "2024-07-09T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1584", "record": "WID-SEC-W-2024-1584", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2024-07-10T00:00:00Z", "date_only": false, "value": "2024-07-10T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0560", "record": "CERTFR-2024-AVI-0560", "field": "last_revision_date"}, {"timestamp": "2024-07-10T00:00:00Z", "date_only": false, "value": "2024-07-10T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0560", "record": "CERTFR-2024-AVI-0560", "field": "initial_release_date"}, {"timestamp": "2024-07-10T00:00:00Z", "date_only": false, "value": "2024-07-10T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0560", "record": "CERTFR-2024-AVI-0560", "field": "revisions.0.revision_date"}, {"timestamp": "2024-07-10T04:00:00Z", "date_only": false, "value": "2024-07-10T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1324", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "fbfd0880-8463-4787-9714-58eccdfa1274", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1324"}, {"timestamp": "2024-07-10T09:41:41Z", "date_only": false, "value": "2024-07-10T09:41:41.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/4205", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "76cb6c76-8b18-4c82-a64f-acddbd2d5953", "content": "\ud83d\uddbc\ufe0f Microsoft SharePoint Server 20219 \u2014 RCE \n\nPoC for: \n\u2014 CVE-2024-38094\n\u2014 CVE-2024-38024\n\u2014 CVE-2024-38023\n\n\ud83d\udd17 Source:\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC\n\n#sharepoint #poc #rce #cve", "url": "https://t.me/poxek/4205"}, {"timestamp": "2024-07-10T11:35:17Z", "date_only": false, "value": "2024-07-10T11:35:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/RalfHackerChannel/1509", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "2d1b0b9c-d198-4d47-86a2-e8b9e31f9128", "content": "\ud83d\uddbc\ufe0f Microsoft SharePoint Server 20219 \u2014 RCE \n\nPoC for: \n\u2014 CVE-2024-38094\n\u2014 CVE-2024-38024\n\u2014 CVE-2024-38023\n\n\ud83d\udd17 Source:\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC\n\n#sharepoint #poc #rce #cve", "url": "https://t.me/RalfHackerChannel/1509"}, {"timestamp": "2024-07-10T11:45:05Z", "date_only": false, "value": "2024-07-10T11:45:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/2156", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "3dc088de-5571-4e02-9ce4-4b8120b40612", "content": "CVE-2024-38094 / CVE-2024-38024 / CVE-2024-38023\n*\nMicrosoft SharePoint RCE\n*\nVIDEO\n*\nPOC exploit", "url": "https://t.me/proxy_bar/2156"}, {"timestamp": "2024-07-10T13:41:51Z", "date_only": false, "value": "2024-07-10T13:41:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/rootdr_research/19", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "55372ad2-981b-4029-8fd0-0a1831e18e65", "content": "CVE-2024-38094 / CVE-2024-38024 / CVE-2024-38023\n\nMicrosoft SharePoint RCE\n\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC\n\nFor more join to channel (:\nhttps://t.me/rootdr_research\n\n#CVE \n#Exploit", "url": "https://t.me/rootdr_research/19"}, {"timestamp": "2024-07-11T03:45:26Z", "date_only": false, "value": "2024-07-11T03:45:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/zer0day1ab/44", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "89f49906-7c16-4eae-98ae-51308af080af", "content": "Microsoft SharePoint Server 2019 \u2014 RCE \n\nPoC for: \n\u2014 CVE-2024-38094\n\u2014 CVE-2024-38024\n\u2014 CVE-2024-38023\n\nSource:\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC\n\n#sharepoint #poc #rce #cve", "url": "https://t.me/zer0day1ab/44"}, {"timestamp": "2024-07-11T11:22:38Z", "date_only": false, "value": "2024-07-11T11:22:38.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/sycebrex/191", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "b55b8561-05be-426f-9013-37e8168cdc75", "content": "\u0414\u0430\u0432\u0435\u0447\u0430 \u0437\u0430\u043b\u0438\u043b\u0438 \u043d\u0430 GitHub \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043b\u044f \nMicrosoft SharePoint Server 2019\n\n\u0417\u0430\u043b\u0438\u0432\u0448\u0438\u0439 \u043f\u043e\u043a\u0430\u0437\u0430\u043b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0440\u0430\u0437\u0443 \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \n\ud83c\udf53 CVE-2024-38094\n\ud83c\udf53 CVE-2024-38024\n\ud83c\udf53 CVE-2024-38023\n\n\u0428\u0442\u043e\u0448. \u041d\u0435 \u0443\u0434\u0438\u0432\u043b\u044e\u0441\u044c, \u0435\u0441\u043b\u0438 \u0443\u0436\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0433\u0434\u0435-\u0442\u043e \u0447\u0442\u043e-\u0442\u043e \u0442\u044b\u043a\u0430\u0442\u044c \u0431\u0435\u0437\u0431\u043e\u0436\u043d\u043e. \u0410 \u043a\u0442\u043e-\u0442\u043e \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u0436\u0435 \u00ab\u0437\u0430\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u00bb \u044d\u0442\u043e \u0432 \u0431\u043e\u0435\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442. \u0414\u0443\u043c\u0430\u044e, \u0447\u0442\u043e \u0441\u043a\u043e\u0440\u043e \u0431\u0443\u0434\u0435\u0442 \u0432 \u043d\u043e\u0432\u043e\u0441\u0442\u044f\u0445 \n\n\u041c\u043e\u0436\u0435\u0442\u0435 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043d\u0430 \u0432\u0438\u0434\u0435\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u043b\u0438 \u0441\u0442\u0430\u0440\u044b\u0439 \u043f\u0441\u0438\u0445\u043e\u0434\u0435\u043b\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u0438\u043f Chemical Brothers \u043d\u0430 \u043e\u0434\u0438\u043d \u0438\u0437 \u043b\u044e\u0431\u0438\u043c\u0435\u0439\u0448\u0438\u0445 \u0442\u0440\u0435\u043a\u043e\u0432 The Test (\u0442\u0430\u043c \u043a\u0441\u0442\u0430\u0442\u0438 \u0432\u043e\u043a\u0430\u043b \u0420\u0438\u0447\u0430\u0440\u0434\u0430 \u042d\u0448\u043a\u0440\u043e\u0444\u0442\u0430 \u0438\u0437 The Verve)", "url": "https://t.me/sycebrex/191"}, {"timestamp": "2024-07-11T14:59:04.458Z", "date_only": false, "value": "2024-07-11T14:59:04.458Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-38023", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-07-12T00:00:00Z", "date_only": true, "value": "2024-07-12", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2024-39671", "record": "CNVD-2024-39671", "field": "submitTime"}, {"timestamp": "2024-07-12T13:22:56Z", "date_only": false, "value": "2024-07-12T13:22:56.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/10820", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "6d01f3ce-a89e-4fd5-a9e6-62763760d368", "content": "#exploit\n1. CVE-2024-38094,\nCVE-2024-38024,\nCVE-2024-38023:\nMS SharePoint RCE\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC\n\n2. CVE-2024-33327:\nLumisXP XSS\nhttps://seclists.org/fulldisclosure/2024/Jul/9\n\n3. Evernote RCE: From PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge RCE\nhttps://0reg.dev/blog/evernote-rce", "url": "https://t.me/CyberSecurityTechnologies/10820"}, {"timestamp": "2024-07-17T13:08:33Z", "date_only": false, "value": "2024-07-17T13:08:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/true_secator/5978", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "c988ac10-8b38-40be-85b3-487c20851e26", "content": "\u041f\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043a\u0443\u0447\u043d\u043e.\n\n\u041a\u043e\u043c\u0430\u043d\u0434\u0430 WPScan \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u00a0\u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Profile Builder \u0438 Profile Builder Pro.\n\n\u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0431\u0435\u0437 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0446\u0435\u043d\u043a\u0443 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 9,8/10.\n\nClaroty\u00a0\u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430\u00a0\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 IP-\u043a\u0430\u043c\u0435\u0440\u0430\u0445 Synology BC500, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0441 WAN \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 LAN.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u043c \u043a\u043e\u043d\u043a\u0443\u0440\u0441\u0435 Pwn2Own Toronto \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0438\u044e\u043d\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430.\n\n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u00a0\u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0431\u0430\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 Apache HugeGraph.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043a\u0430\u043a CVE-2024-27348, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 9,8/10 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430\u00a0\u0432 \u0430\u043f\u0440\u0435\u043b\u0435.\n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0441\u044f\u0446 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u0438\u043f\u0442 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u00a0\u0438\u00a0PoC\u00a0\u043d\u0430 GitHub.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u041d\u0433\u0443\u0435\u043d \u0414\u0436\u0430\u043d\u0433 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u00a0\u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438\u00a0\u0434\u043b\u044f \u0442\u0440\u0435\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 Microsoft SharePoint (CVE-2024-38023, CVE-2024-38024 \u0438 CVE-2024-38094).\n\nSonicwall \u0432\u0442\u0430\u0439\u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0432\u043e\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 SMA100. \n\n\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 SSD \u0437\u0430\u044f\u0432\u043b\u044f\u0435\u0442, \u0447\u0442\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 SMA100 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Classic Mode, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f RCE-\u0430\u0442\u0430\u043a \u043d\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e Sonicwall \u0443\u0434\u0430\u043b\u0438\u043b\u0430 Classic Mode \u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 SMA100 \u0432 \u043d\u043e\u044f\u0431\u0440\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430, \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0438\u0432 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0439 \u0443\u0433\u0440\u043e\u0437\u0435.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u0442 Sonicwall \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0432 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u044f \u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e, \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0438\u043b\u0430 CVE \u0434\u043b\u044f \u043e\u0448\u0438\u0431\u043a\u0438 \u0438 \u043d\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u0432\u0441\u0435 \u0435\u0449\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u0440\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443.\n\n\u0422\u0435\u043f\u0435\u0440\u044c \u0436\u0435 SSD \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u00a0\u0438 \u043a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430.", "url": "https://t.me/true_secator/5978"}, {"timestamp": "2024-07-17T19:33:17Z", "date_only": false, "value": "2024-07-17T19:33:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/S_E_Reborn/4953", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "fbb4ebcc-e2f9-41ec-ab3d-fc17c58c3502", "content": "\u041f\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043a\u0443\u0447\u043d\u043e.\n\n\u041a\u043e\u043c\u0430\u043d\u0434\u0430 WPScan \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u00a0\u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Profile Builder \u0438 Profile Builder Pro.\n\n\u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0431\u0435\u0437 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0446\u0435\u043d\u043a\u0443 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 9,8/10.\n\nClaroty\u00a0\u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430\u00a0\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 IP-\u043a\u0430\u043c\u0435\u0440\u0430\u0445 Synology BC500, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0441 WAN \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 LAN.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u043c \u043a\u043e\u043d\u043a\u0443\u0440\u0441\u0435 Pwn2Own Toronto \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0438\u044e\u043d\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430.\n\n\u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u00a0\u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0431\u0430\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 Apache HugeGraph.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043a\u0430\u043a CVE-2024-27348, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 9,8/10 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430\u00a0\u0432 \u0430\u043f\u0440\u0435\u043b\u0435.\n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0441\u044f\u0446 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u0438\u043f\u0442 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u00a0\u0438\u00a0PoC\u00a0\u043d\u0430 GitHub.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u041d\u0433\u0443\u0435\u043d \u0414\u0436\u0430\u043d\u0433 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u00a0\u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438\u00a0\u0434\u043b\u044f \u0442\u0440\u0435\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 Microsoft SharePoint (CVE-2024-38023, CVE-2024-38024 \u0438 CVE-2024-38094).\n\nSonicwall \u0432\u0442\u0430\u0439\u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0432\u043e\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 SMA100. \n\n\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 SSD \u0437\u0430\u044f\u0432\u043b\u044f\u0435\u0442, \u0447\u0442\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 SMA100 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Classic Mode, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f RCE-\u0430\u0442\u0430\u043a \u043d\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e Sonicwall \u0443\u0434\u0430\u043b\u0438\u043b\u0430 Classic Mode \u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 SMA100 \u0432 \u043d\u043e\u044f\u0431\u0440\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430, \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0438\u0432 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0439 \u0443\u0433\u0440\u043e\u0437\u0435.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u0442 Sonicwall \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0432 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u044f \u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e, \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0438\u043b\u0430 CVE \u0434\u043b\u044f \u043e\u0448\u0438\u0431\u043a\u0438 \u0438 \u043d\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u0432\u0441\u0435 \u0435\u0449\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u0440\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443.\n\n\u0422\u0435\u043f\u0435\u0440\u044c \u0436\u0435 SSD \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u00a0\u0438 \u043a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430.", "url": "https://t.me/S_E_Reborn/4953"}, {"timestamp": "2024-07-20T19:49:10Z", "date_only": false, "value": "2024-07-20T19:49:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/mLuXIhkdQoQwPvwhDsS4ApxxO_4ER5M9JWf4bsHNwYwF5rU", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "b287e6ff-fe4b-4228-be20-47db797122e5"}, {"timestamp": "2024-07-23T18:28:14Z", "date_only": false, "value": "2024-07-23T18:28:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/veIOHsbV5kLZGnQksJSl1JOrCFYfC-6sYrwF7hGdBF9KK0en", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "d5533131-632b-4eb2-aee6-12f53df9ab7a"}, {"timestamp": "2024-08-02T04:04:24.714Z", "date_only": false, "value": "2024-08-02T04:04:24.714Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2024-38023", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-06T17:12:22Z", "date_only": false, "value": "2024-08-06T17:12:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/RalfHackerChannel/1516", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "2fa4f388-5368-468f-a15c-8c556f817b5b", "content": "RCE \u0447\u0435\u0440\u0435\u0437 Microsoft SharePoint Server 2019\n\nMicrosoft SharePoint \u2014 \u0432\u0435\u0431-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0434\u043b\u044f \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.\n\n\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 CVE \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u044d\u0442\u0443 \u0432\u0435\u0431-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443: \n\nCVE-2024-38094 \nCVE-2024-38024\nCVE-2024-38023\n\n\u0427\u0442\u043e\u0431\u044b \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c RCE, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e\n1) \u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 SharePoint.\n2) \u0423\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 (\u043b\u043e\u0433/\u043f\u0430\u0441\u0441) \u0434\u043b\u044f NTLM \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 + \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0434\u043e\u043b\u0436\u043d\u0430 \u0438\u043c\u0435\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043f\u0430\u043f\u043e\u043a.\n\n\u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430: poc_filtered.py, poc_specific.py \u0438 poc_sub.py. \u0421\u0435\u0439\u0447\u0430\u0441 \u043a\u043e\u0440\u043e\u0442\u043a\u043e \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c \u0441\u0443\u0442\u044c \u0438 \u043a\u0430\u043a \u043e\u043d\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442. \n\n\u0412\u0441\u0435 \u0442\u0440\u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 NTLM \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API SharePoint \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442 \u0441\u0445\u043e\u0436\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f: \n\n\u0421\u043a\u0440\u0438\u043f\u0442\u044b \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 SharePoint \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0417\u0430\u0442\u0435\u043c \u043e\u043d\u0438 \u0441\u043e\u0437\u0434\u0430\u044e\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u043f\u0430\u043f\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a BusinessDataMetadataCatalog, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044f POST-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a API SharePoint \u043f\u043e \u043f\u0443\u0442\u0438 /api/web/Folders.\n\n\u0414\u0430\u043b\u0435\u0435 \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0444\u0430\u0439\u043b \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 BDCMetadata.bdcm, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 SharePoint, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a GetCreatorView, GetDefaultValues, GetFilters \u0438 FindFiltered. \u042d\u0442\u0438 \u043c\u0435\u0442\u043e\u0434\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0441 \u043e\u0431\u044a\u0435\u043a\u0442\u0430\u043c\u0438 \u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 SharePoint, \u0447\u0442\u043e \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434. \n\n\u0422\u043e \u0435\u0441\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 poc_filtered.py \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u043d\u043e\u0432\u0430\u044f \u043f\u0430\u043f\u043a\u0430 BusinessDataMetadataCatalog, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0441\u043a\u0440\u0438\u043f\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 X-RequestDigest \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. X-RequestDigest \u2014 \u044d\u0442\u043e \u0442\u043e\u043a\u0435\u043d, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0449\u0438\u0439, \u0447\u0442\u043e \u0437\u0430\u043f\u0440\u043e\u0441 \u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043e\u0442 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u042d\u0442\u043e\u0442 \u0442\u043e\u043a\u0435\u043d \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0438\u0445 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438. \u0417\u0430\u0442\u0435\u043c \u0441\u043a\u0440\u0438\u043f\u0442 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0444\u0430\u0439\u043b \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 BDCMetadata.bdcm \u0432 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0430\u043f\u043a\u0443. \u042d\u0442\u043e\u0442 \u0444\u0430\u0439\u043b \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u0443\u0434\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u043a\u043e\u043d\u0446\u0435, \u0441\u043a\u0440\u0438\u043f\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 XML-\u0437\u0430\u043f\u0440\u043e\u0441 \u043a API SharePoint \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u041d\u043e \u043c\u0435\u0436\u0434\u0443 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0435\u0441\u0442\u044c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0440\u0430\u0437\u043d\u0438\u0446\u0430, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u0430\u0445. \n\n1) poc_filtered.py \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434 FindFiltered \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043e\u0431\u044a\u0435\u043a\u0442\u0430\u043c\u0438 SharePoint.\n2) poc_specific.py \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434 FindSpecific \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u0438 \u043a\u043e\u043c\u0430\u043d\u0434.\n3) poc_sub.py \u0432 \u044d\u0442\u043e\u043c \u0441\u043a\u0440\u0438\u043f\u0442\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043c\u0435\u0442\u043e\u0434 Subscribe \u0434\u043b\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0438 \u043d\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u044f \u0438\u043b\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f.\n\nPoC \nPoC Video", "url": "https://t.me/RalfHackerChannel/1516"}, {"timestamp": "2024-08-07T05:34:10Z", "date_only": false, "value": "2024-08-07T05:34:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerArsenal/123", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "cbdc23a6-13c0-46e6-adee-bccbc615863c", "content": "#exploit\n1. CVE-2024-39877:\nApache Airflow Arbitrary Code Execution\nhttps://blog.securelayer7.net/arbitrary-code-execution-in-apache-airflow\n\n2. CVE-2024-7395,\nCVE-2024-7396,\nCVE-2024-7397:\nInsufficient Authentication, Plaintext Communication, Unauthenticated CI\u00a0in Korenix JetPort\nhttps://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetport/index.html\n\n3. CVE-2024-38094,\nCVE-2024-38023,\nCVE-2024-38024:\nMS SharePoint RCEs\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC", "url": "https://t.me/HackerArsenal/123"}, {"timestamp": "2024-08-07T05:34:27Z", "date_only": false, "value": "2024-08-07T05:34:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Kelvinseccommunity/706", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "a1bc8985-d032-4e36-b531-dcaa3727f94d", "content": "#exploit\n1. CVE-2024-39877:\nApache Airflow Arbitrary Code Execution\nhttps://blog.securelayer7.net/arbitrary-code-execution-in-apache-airflow\n\n2. CVE-2024-7395,\nCVE-2024-7396,\nCVE-2024-7397:\nInsufficient Authentication, Plaintext Communication, Unauthenticated CI\u00a0in Korenix JetPort\nhttps://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetport/index.html\n\n3. CVE-2024-38094,\nCVE-2024-38023,\nCVE-2024-38024:\nMS SharePoint RCEs\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC", "url": "https://t.me/Kelvinseccommunity/706"}, {"timestamp": "2024-08-07T06:18:21Z", "date_only": false, "value": "2024-08-07T06:18:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/2958", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "6728b586-f9a5-4f95-9b96-5afa436d2d33", "content": "https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC\n\nCVE-2024-38094\nCVE-2024-38024\nCVE-2024-38023\n#github #poc", "url": "https://t.me/CNArsenal/2958"}, {"timestamp": "2024-08-09T09:36:15Z", "date_only": false, "value": "2024-08-09T09:36:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/JdMoVB3Dk4QWIjoir-XpoF425YxCOG6rpGYbwBE_Oz6Y8AE", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "a237d5ec-30e5-44b6-8248-ea42825cbd5f"}, {"timestamp": "2024-08-15T04:59:17Z", "date_only": false, "value": "2024-08-15T04:59:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/dc_main/6434", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "061de3e5-9403-44b0-9634-99fdff2334cd", "content": "Microsoft SharePoint Server 2019 \u2014 RCE \n\nPoC for: \n\u2014 CVE-2024-38094\n\u2014 CVE-2024-38024\n\u2014 CVE-2024-38023\n\nSource:\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC\n\n#sharepoint #poc #rce #cve", "url": "https://t.me/dc_main/6434"}, {"timestamp": "2024-08-16T11:16:24Z", "date_only": false, "value": "2024-08-16T11:16:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Rootsec_2/3410", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "a347596a-be7a-428b-88e7-d11025d8a063", "content": "#exploit\n1. CVE-2024-38094,\nCVE-2024-38024,\nCVE-2024-38023:\nMS SharePoint RCE\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC\n\n2. CVE-2024-33327:\nLumisXP XSS\nhttps://seclists.org/fulldisclosure/2024/Jul/9\n\n3. Evernote RCE: From PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge RCE\nhttps://0reg.dev/blog/evernote-rce", "url": "https://t.me/Rootsec_2/3410"}, {"timestamp": "2024-08-16T11:23:44Z", "date_only": false, "value": "2024-08-16T11:23:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Rootsec_2/3733", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "d1d05f06-ed73-4d5b-a66b-932ee3391b2a", "content": "#exploit\n1. CVE-2024-39877:\nApache Airflow Arbitrary Code Execution\nhttps://blog.securelayer7.net/arbitrary-code-execution-in-apache-airflow\n\n2. CVE-2024-7395,\nCVE-2024-7396,\nCVE-2024-7397:\nInsufficient Authentication, Plaintext Communication, Unauthenticated CI\u00a0in Korenix JetPort\nhttps://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetport/index.html\n\n3. CVE-2024-38094,\nCVE-2024-38023,\nCVE-2024-38024:\nMS SharePoint RCEs\nhttps://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC", "url": "https://t.me/Rootsec_2/3733"}, {"timestamp": "2024-09-08T07:41:49Z", "date_only": false, "value": "2024-09-08T07:41:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/DOvVBYl81gcQnEx0SnDYShnK_l00AQ-j6ykpGr0q_-DsSYc", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "818cd8db-1028-4761-9754-baf0f63eaed7"}, {"timestamp": "2024-10-01T00:00:00Z", "date_only": true, "value": "2024-10-01", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2024-39671", "record": "CNVD-2024-39671", "field": "openTime"}, {"timestamp": "2024-10-22T22:00:00Z", "date_only": false, "value": "2024-10-22T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1584", "record": "WID-SEC-W-2024-1584", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2024-10-22T22:00:00Z", "date_only": false, "value": "2024-10-22T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1584", "record": "WID-SEC-W-2024-1584", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-10-23T08:06:21.392Z", "date_only": false, "value": "2024-10-23T08:06:21.392+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1584", "record": "WID-SEC-W-2024-1584", "field": "document.tracking.generator.date"}, {"timestamp": "2024-12-13T19:00:22Z", "date_only": false, "value": "2024-12-13T19:00:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyber_hsecurity/1610", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "6d8f43c8-81d8-4ce2-80af-336cb9400b76", "content": "(Photo by Tayfun Coskun/Anadolu via Getty Images)\n\u062d\u0634\u0648\u062f \u062e\u0627\u0631\u062c \u0645\u0642\u0631 \u0645\u064a\u062a\u0627 (\u0641\u064a\u0633\u0628\u0648\u0643) \u0644\u0644\u0627\u062d\u062a\u062c\u0627\u062c \u0639\u0644\u0649 \u0631\u0642\u0627\u0628\u0629 \u0645\u0627\u0631\u0643 \u0632\u0648\u0643\u0631\u0628\u064a\u0631\u063a \u0648\u0645\u064a\u062a\u0627 \u0639\u0644\u0649 \u0645\u0646\u0634\u0648\u0631\u0627\u062a \u0641\u0644\u0633\u0637\u064a\u0646 \u0639\u0644\u0649 \u0627\u0644\u0645\u0646\u0635\u0627\u062a \u0627\u0644\u0627\u062c\u062a\u0645\u0627\u0639\u064a\u0629 \u0641\u064a \u0645\u064a\u0646\u0644\u0648 \u0628\u0627\u0631\u0643\u060c \u0643\u0627\u0644\u064a\u0641\u0648\u0631\u0646\u064a\u0627 (\u0627\u0644\u0623\u0646\u0627\u0636\u0648\u0644)\n23/5/2024-\u0622\u062e\u0631 \u062a\u062d\u062f\u064a\u062b: 23/5/202403:28 \u0645 (\u0628\u062a\u0648\u0642\u064a\u062a \u0645\u0643\u0629 \u0627\u0644\u0645\u0643\u0631\u0645\u0629)\n\u0646\u0628\u0647 \u0645\u0648\u0642\u0639 \u0625\u0646\u062a\u0631\u0633\u0628\u062a \u0627\u0644\u0623\u0645\u064a\u0631\u0643\u064a \u0625\u0644\u0649 \u062b\u063a\u0631\u0629 \u0623\u0645\u0646\u064a\u0629 \u0645\u062c\u0647\u0648\u0644\u0629 \u0628\u062a\u0637\u0628\u064a\u0642 \u0648\u0627\u062a\u0633\u0627\u0628 \u062a\u0645\u0643\u0646 \u0627\u0644\u062d\u0643\u0648\u0645\u0627\u062a \u0645\u0646 \u0645\u0639\u0631\u0641\u0629 \u0645\u0646 \u062a\u0631\u0627\u0633\u0644\u0647\u060c \u0648\u062d\u0630\u0631 \u0627\u0644\u0645\u0647\u0646\u062f\u0633\u0648\u0646 \u0641\u064a \u0634\u0631\u0643\u0629 \u0645\u064a\u062a\u0627 (\u0641\u064a\u0633\u0628\u0648\u0643) \u0645\u0646 \u0623\u0646 \u0627\u0644\u062f\u0648\u0644 \u064a\u0645\u0643\u0646\u0647\u0627 \u0645\u0631\u0627\u0642\u0628\u0629 \u0627\u0644\u062f\u0631\u062f\u0634\u0627\u062a\u060c \u0648\u064a\u062e\u0634\u0649 \u0627\u0644\u0645\u0648\u0638\u0641\u0648\u0646 \u0623\u0646 \u062a\u0633\u062a\u063a\u0644 \u0625\u0633\u0631\u0627\u0626\u064a\u0644 \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0629 \u0644\u0627\u0646\u062a\u0642\u0627\u0621 \u0623\u0647\u062f\u0627\u0641 \u0627\u0644\u0627\u063a\u062a\u064a\u0627\u0644 \u0641\u064a \u063a\u0632\u0629.\n\n\u0648\u0630\u0643\u0631 \u0627\u0644\u0645\u0648\u0642\u0639 \u0623\u0646\u0647 \u0641\u064a \u0634\u0647\u0631 \u0645\u0627\u0631\u0633/\u0622\u0630\u0627\u0631\u060c \u0623\u0635\u062f\u0631 \u0641\u0631\u064a\u0642 \u0623\u0645\u0646 \u0648\u0627\u062a\u0633\u0627\u0628 \u062a\u062d\u0630\u064a\u0631\u0627 \u062f\u0627\u062e\u0644\u064a\u0627 \u0644\u0632\u0645\u0644\u0627\u0626\u0647 \u0628\u0623\u0646\u0647 \u0631\u063a\u0645 \u0627\u0644\u062a\u0634\u0641\u064a\u0631 \u0627\u0644\u0642\u0648\u064a \u0644\u0644\u0628\u0631\u0646\u0627\u0645\u062c\u060c \u0641\u0642\u062f \u0638\u0644 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u0648\u0646 \u0639\u0631\u0636\u0629 \u0644\u0634\u0643\u0644 \u062e\u0637\u064a\u0631 \u0645\u0646 \u0623\u0634\u0643\u0627\u0644 \u0627\u0644\u0645\u0631\u0627\u0642\u0628\u0629 \u0627\u0644\u062d\u0643\u0648\u0645\u064a\u0629.\n\n\u0648\u0648\u0641\u0642\u0627 \u0644\u062a\u0642\u064a\u064a\u0645 \u0627\u0644\u062a\u0647\u062f\u064a\u062f \u0627\u0644\u0630\u064a \u0644\u0645 \u064a\u064f\u0628\u0644\u063a \u0639\u0646\u0647 \u0645\u0633\u0628\u0642\u0627\u060c \u0648\u062d\u0635\u0644 \u0639\u0644\u064a\u0647 \u0627\u0644\u0645\u0648\u0642\u0639\u060c \u0641\u0625\u0646 \u0645\u062d\u062a\u0648\u064a\u0627\u062a \u0627\u0644\u0645\u062d\u0627\u062f\u062b\u0627\u062a \u0628\u064a\u0646 \u0645\u0633\u062a\u062e\u062f\u0645\u064a \u0627\u0644\u062a\u0637\u0628\u064a\u0642 \u0627\u0644\u0628\u0627\u0644\u063a \u0639\u062f\u062f\u0647\u0645 2 \u0645\u0644\u064a\u0627\u0631 \u0645\u0633\u062a\u062e\u062f\u0645 \u062a\u0638\u0644 \u0622\u0645\u0646\u0629\u060c \u0644\u0643\u0646 \u0627\u0644\u062f\u0648\u0627\u0626\u0631 \u0627\u0644\u062d\u0643\u0648\u0645\u064a\u0629\u060c \u0643\u0645\u0627 \u0643\u062a\u0628 \u0627\u0644\u0645\u0647\u0646\u062f\u0633\u0648\u0646\u060c \u0643\u0627\u0646\u062a \"\u062a\u062a\u062c\u0627\u0648\u0632 \u062a\u0634\u0641\u064a\u0631\u0646\u0627\" \u0644\u0645\u0639\u0631\u0641\u0629 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646 \u0627\u0644\u0630\u064a\u0646 \u064a\u062a\u0648\u0627\u0635\u0644\u0648\u0646 \u0645\u0639 \u0628\u0639\u0636\u0647\u0645 \u0627\u0644\u0628\u0639\u0636\u060c \u0648\u0639\u0636\u0648\u064a\u0629 \u0627\u0644\u0645\u062c\u0645\u0648\u0639\u0627\u062a \u0627\u0644\u062e\u0627\u0635\u0629\u060c \u0648\u0631\u0628\u0645\u0627 \u062d\u062a\u0649 \u0645\u0648\u0627\u0642\u0639\u0647\u0645. \u0648\u062d\u062b \u0627\u0644\u062a\u0642\u064a\u064a\u0645 \u0639\u0644\u0649 \u0623\u0646 \u064a\u062e\u0641\u0641 \u0648\u0627\u062a\u0633\u0627\u0628 \u0645\u0646 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0627\u0644\u0645\u0633\u062a\u0645\u0631 \u0644\u0646\u0642\u0627\u0637 \u0627\u0644\u0636\u0639\u0641 \u0641\u064a \u062a\u062d\u0644\u064a\u0644 \u062d\u0631\u0643\u0629 \u0627\u0644\u0645\u0631\u0648\u0631 \u0627\u0644\u062a\u064a \u062a\u0645\u0643\u0646 \u0627\u0644\u062f\u0648\u0644 \u0645\u0646 \u062a\u062d\u062f\u064a\u062f \u0645\u0646 \u064a\u062a\u062d\u062f\u062b \u0625\u0644\u0649 \u0645\u0646.\n\nThe Smart Shadow:\n\u2206 \u0627\u0633\u062a\u063a\u0644\u0627\u0644\u0627\u062a \u0648\u0625\u062b\u0628\u0627\u062a\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645 (PoCs) \u0644\u0644\u062b\u063a\u0631\u0627\u062a \n\n\u2206 1. \u062b\u063a\u0631\u0629 Profile Builder \u0648 Profile Builder Pro\n- \u062e\u0637\u0648\u0631\u0629: 9.8/10\n- \u0627\u0644\u0648\u0635\u0641: \u062a\u0633\u0645\u062d \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0629 \u0644\u0644\u0645\u0647\u0627\u062c\u0645\u064a\u0646 \u0628\u0627\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 \u0648\u0635\u0648\u0644 \u0627\u0644\u0645\u0633\u0624\u0648\u0644 \u062f\u0648\u0646 \u0627\u0644\u062d\u0627\u062c\u0629 \u0625\u0644\u0649 \u062d\u0633\u0627\u0628 \u0639\u0644\u0649 \u0627\u0644\u0645\u0648\u0642\u0639.\n- \u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645: \u0644\u0627 \u064a\u0648\u062c\u062f \u0625\u062b\u0628\u0627\u062a \u0645\u0641\u0647\u0648\u0645 \u0645\u062d\u062f\u062f \u0641\u064a \u0642\u0648\u0627\u0639\u062f \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0639\u0627\u0645\u0629\u060c \u0648\u0644\u0643\u0646 \u062a\u0642\u0627\u0631\u064a\u0631 WPScan \u062a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 \u0633\u064a\u0646\u0627\u0631\u064a\u0648\u0647\u0627\u062a \u062a\u0641\u0635\u064a\u0644\u064a\u0629 \u0644\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644.\n- \u0645\u062b\u0627\u0644 \u0644\u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645:\n   \n    import requests\n\n    url = \"http://target-website/wp-login.php\"\n    payload = {\n        \"username\": \"attacker_username\",\n        \"password\": \"attacker_password\"\n    }\n    response = requests.post(url, data=payload)\n    print(response.text)\n    \n- \u0627\u0644\u062a\u062e\u0641\u064a\u0641: \u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0625\u0636\u0627\u0641\u0629 \u0625\u0644\u0649 \u0623\u062d\u062f\u062b \u0646\u0633\u062e\u0629 \u0643\u0645\u0627 \u064a\u0646\u0635\u062d \u0627\u0644\u0645\u0637\u0648\u0631\u0648\u0646.\n\n\u2206 2. \u062b\u063a\u0631\u0629 \u0643\u0627\u0645\u064a\u0631\u0627\u062a Synology BC500 IP\n- \u0627\u0644\u062a\u0641\u0627\u0635\u064a\u0644: \u062a\u0633\u0645\u062d \u0628\u0627\u0644\u062a\u0628\u062f\u064a\u0644 \u0645\u0646 WAN \u0625\u0644\u0649 LAN\u060c \u062a\u0645 \u0627\u0633\u062a\u062e\u062f\u0627\u0645\u0647\u0627 \u0641\u064a \u0645\u0633\u0627\u0628\u0642\u0629 Pwn2Own Toronto.\n- \u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645: \u0646\u0634\u0631\u062a Claroty \u062a\u0641\u0627\u0635\u064a\u0644 \u0641\u0646\u064a\u0629 \u062d\u0648\u0644 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644.\n- \u0645\u062b\u0627\u0644 \u0644\u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645:\n   \n    import requests\n\n    url = \"http://target-camera-ip/api/exploit\"\n    payload = {\"command\": \"switch_network\"}\n    response = requests.post(url, json=payload)\n    print(response.text)\n    \n- \u0627\u0644\u062a\u062e\u0641\u064a\u0641: \u062a\u062d\u062f\u064a\u062b \u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0627\u0644\u0643\u0627\u0645\u064a\u0631\u0627 \u0625\u0644\u0649 \u0623\u062d\u062f\u062b \u0625\u0635\u062f\u0627\u0631.\n\n#### 3. \u062b\u063a\u0631\u0629 Apache HugeGraph (CVE-2024-27348)\n- \u062e\u0637\u0648\u0631\u0629: 9.8/10\n- \u0627\u0644\u0648\u0635\u0641: \u062a\u0633\u0645\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645\u064a\u0646 \u0628\u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a \u062e\u0648\u0627\u062f\u0645 \u0642\u0627\u0639\u062f\u0629 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a.\n- \u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645: \u0645\u062a\u0627\u062d \u0639\u0644\u0649 GitHub \u0643\u0645\u0627 \u0630\u0643\u0631.\n- \u0645\u062b\u0627\u0644 \u0644\u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645:\n   \n    import requests\n\n    url = \"http://target-hugegraph-server\"\n    payload = {\"exploit\": \"malicious_code_here\"}\n    response = requests.post(url, json=payload)\n    print(response.text)\n    \n- \u0627\u0644\u062a\u062e\u0641\u064a\u0641: \u062a\u0637\u0628\u064a\u0642 \u0627\u0644\u062a\u0635\u062d\u064a\u062d \u0627\u0644\u0623\u0645\u0646\u064a \u0627\u0644\u0635\u0627\u062f\u0631 \u0641\u064a \u0623\u0628\u0631\u064a\u0644.\n\n\u2206 4. \u062b\u063a\u0631\u0627\u062a Microsoft SharePoint (CVE-2024-38023\u060c CVE-2024-38024\u060c CVE-2024-38094)\n- \u0627\u0644\u062a\u0641\u0627\u0635\u064a\u0644: \u062b\u063a\u0631\u0627\u062a \u0641\u064a \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u062a\u0639\u0644\u064a\u0645\u0627\u062a \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0629 \u0639\u0646 \u0628\u064f\u0639\u062f.\n- \u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645: \u0646\u0634\u0631\u0647 Nguyen Giang.\n- \u0645\u062b\u0627\u0644 \u0644\u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645:\n   \n    # \u0647\u0630\u0627 \u0645\u062b\u0627\u0644 \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u061b \u0642\u062f \u064a\u062e\u062a\u0644\u0641 \u0631\u0645\u0632 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0627\u0644\u0641\u0639\u0644\u064a.\n    Invoke-WebRequest -Uri \"http://target-sharepoint-server/exploit\" -Method GET\n    \n- \u0627\u0644\u062a\u062e\u0641\u064a\u0641: \u062a\u0637\u0628\u064a\u0642 \u0627\u0644\u062a\u0635\u062d\u064a\u062d\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0627\u0644\u0645\u0642\u062f\u0645\u0629 \u0645\u0646 Microsoft.\n\n\u2206 5. \u062b\u063a\u0631\u0629 SonicWall SMA100\n- \u0627\u0644\u062a\u0641\u0627\u0635\u064a\u0644: \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0641\u064a \u0627\u0644\u0648\u0636\u0639 \u0627\u0644\u0643\u0644\u0627\u0633\u064a\u0643\u064a \u0644\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646 \u0627\u0644\u0645\u0635\u0627\u062f\u0642 \u0639\u0644\u064a\u0647\u0645.\n- \u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645: \u062a\u0645 \u0646\u0634\u0631\u0647 \u0628\u0648\u0627\u0633\u0637\u0629 SSD.\n- \u0645\u062b\u0627\u0644 \u0644\u0625\u062b\u0628\u0627\u062a \u0627\u0644\u0645\u0641\u0647\u0648\u0645:\n   \n    curl -k -X POST https://target-sma100-device -d \"exploit_payload_here\"\n    \n- \u0627\u0644\u062a\u062e\u0641\u064a\u0641: \u0625\u0632\u0627\u0644\u0629 \u0627\u0644\u0648\u0636\u0639 \u0627\u0644\u0643\u0644\u0627\u0633\u064a\u0643\u064a \u0648\u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0627\u0644\u062b\u0627\u0628\u062a\u0629.\n\n\u2206 \u0627\u0644\u062a\u0648\u0635\u064a\u0627\u062a \u0627\u0644\u0639\u0627\u0645\u0629\n- \u0625\u062f\u0627\u0631\u0629 \u0627\u0644\u062a\u0635\u062d\u064a\u062d\u0627\u062a: \u062a\u062d\u062f\u064a\u062b \u062c\u0645\u064a\u0639 \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0648\u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0627\u0644\u062b\u0627\u0628\u062a\u0629 \u0628\u0627\u0646\u062a\u0638\u0627\u0645 \u0625\u0644\u0649 \u0623\u062d\u062f\u062b \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a.\n- \u0641\u062d\u0635 \u0627\u0644\u062b\u063a\u0631\u0627\u062a: \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0623\u062f\u0648\u0627\u062a \u0645\u062b\u0644 Nessus \u0623\u0648 OpenVAS \u0644\u0641\u062d\u0635 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0645\u0639\u0631\u0648\u0641\u0629.\n- \u0627\u0644\u0645\u0631\u0627\u0642\u0628\u0629: \u062a\u0637\u0628\u064a\u0642 \u0623\u0646\u0638\u0645\u0629 \u0627\u0644\u0643\u0634\u0641 \u0639\u0646 \u0627\u0644\u062a\u0633\u0644\u0644 \u0648\u0645\u0646\u0639 \u0627\u0644\u062a\u0633\u0644\u0644 \u0644\u0645\u0631\u0627\u0642\u0628\u0629 \u0648\u0645\u0646\u0639 \u0645\u062d\u0627\u0648\u0644\u0627\u062a \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644.\n\n\u2206 \u0627\u0644\u0645\u0635\u0627\u062f\u0631\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-3352)\n- [Security-Database](https://www.security-database.com/detail.php?alert=CVE-2023-3352)\n- [Vulners](https://vulners.com/cve/CVE-2023-3352)\n\n## \u0634\u0631\u062d \u0648\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0629 CVE-2024-33352: \u062a\u0635\u0639\u064a\u062f \u0627\u0644\u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a \u0641\u064a BlueStacks \u0639\u0628\u0631 \u0632\u0631\u0639 \u0628\u0631\u0646\u0627\u0645\u062c \u0636\u0627\u0631 \u0641\u064a \u0627\u0644\u062c\u0647\u0627\u0632 \u0627\u0644\u0627\u0641\u062a\u0631\u0627\u0636\u064a\n\n### \u0646\u0638\u0631\u0629 \u0639\u0627\u0645\u0629", "url": "https://t.me/cyber_hsecurity/1610"}, {"timestamp": "2025-04-10T21:02:20.020Z", "date_only": false, "value": "2025-04-10T21:02:20.020111Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lmifne6cpg2t", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "1e63234d-5f0d-4500-aaf9-792f0928642b", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lmifne6cpg2t"}, {"timestamp": "2025-12-09T23:46:18.392Z", "date_only": false, "value": "2025-12-09T23:46:18.392Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-38023", "record": "MSRC_CVE-2024-38023", "field": "document.tracking.generator.date"}, {"timestamp": "2026-02-10T23:34:21.927Z", "date_only": false, "value": "2026-02-10T23:34:21.927Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-38023", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-02-10T23:34:21.927Z", "date_only": false, "value": "2026-02-10T23:34:21.927Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2024-38023", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T07:39:14.300Z", "date_only": false, "value": "2026-06-17T07:39:14.300", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-38023", "record": "FKIE_CVE-2024-38023", "field": "lastModified"}, {"timestamp": "2026-07-12T22:00:10.821Z", "date_only": false, "value": "2026-07-12T22:00:10.821235Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/950", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "5e0d4211-4343-4aff-bcf7-3130a5ac0a33", "url": "https://t.me/securixy_kz/950"}, {"timestamp": "2026-07-12T22:00:11.066Z", "date_only": false, "value": "2026-07-12T22:00:11.066324Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/909", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "5041632c-0743-4674-a7f1-1bef5979604d", "url": "https://t.me/securixy_kz/909"}, {"timestamp": "2026-07-13T00:00:35.069Z", "date_only": false, "value": "2026-07-13T00:00:35.069498Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/950", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "439b0c20-e74e-4792-8610-81b97efdb72c", "url": "https://t.me/securixy_kz/950"}, {"timestamp": "2026-07-13T00:00:35.298Z", "date_only": false, "value": "2026-07-13T00:00:35.298429Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/909", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "55ceb123-356d-4c92-8048-61e40927d9f9", "url": "https://t.me/securixy_kz/909"}, {"timestamp": "2026-07-14T00:00:58.090Z", "date_only": false, "value": "2026-07-14T00:00:58.090224Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/securixy_kz/909", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "d618c880-f5b6-4a3d-b65a-5025b2ebda80", "url": "https://t.me/securixy_kz/909"}, {"timestamp": "2026-07-14T00:00:58.658Z", "date_only": false, "value": "2026-07-14T00:00:58.658665Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/securixy_kz/950", "record": "CVE-2024-38023", "field": "creation_timestamp", "uuid": "0233e40b-d11b-4443-8318-a791160c32aa", "url": "https://t.me/securixy_kz/950"}]}