{"metadata": {"vulnerability": "cve-2016-0189", "count": 96, "kinds": {"milestone": 6, "sighting": 56, "kev": 11, "other": 23}}, "data": [{"timestamp": "2015-12-04T00:00:00Z", "date_only": false, "value": "2015-12-04T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2016-0189", "field": "cveMetadata.dateReserved"}, {"timestamp": "2016-05-10T00:00:00Z", "date_only": false, "value": "2016-05-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2016-0189", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2016-05-11T00:00:00Z", "date_only": false, "value": "2016-05-11T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2016-AVI-164", "record": "CERTFR-2016-AVI-164", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2016-05-11T00:00:00Z", "date_only": false, "value": "2016-05-11T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2016-AVI-164", "record": "CERTFR-2016-AVI-164", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2016-05-11T00:00:00Z", "date_only": false, "value": "2016-05-11T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2016-AVI-164", "record": "CERTFR-2016-AVI-164", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2016-05-11T01:00:00Z", "date_only": false, "value": "2016-05-11T01:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2016-0189", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2016-05-11T01:59:00Z", "date_only": false, "value": "2016-05-11T01:59:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QW68-VQP7-FF9R", "record": "GHSA-QW68-VQP7-FF9R", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2016-05-11T01:59:00Z", "date_only": false, "value": "2016-05-11T01:59Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2016-0189", "record": "GSD-2016-0189", "field": "namespaces.nvd.nist.gov.publishedDate", "linked_record": true}, {"timestamp": "2016-05-11T01:59:30.537Z", "date_only": false, "value": "2016-05-11T01:59:30.537", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2016-0189", "record": "FKIE_CVE-2016-0189", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2016-05-12T00:00:00Z", "date_only": false, "value": "2016-05-12T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2016-AVI-169", "record": "CERTFR-2016-AVI-169", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2016-05-12T00:00:00Z", "date_only": false, "value": "2016-05-12T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2016-AVI-169", "record": "CERTFR-2016-AVI-169", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2016-05-12T00:00:00Z", "date_only": false, "value": "2016-05-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2016-AVI-169", "record": "CERTFR-2016-AVI-169", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2016-05-12T00:00:00Z", "date_only": true, "value": "2016-05-12", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2016-03119", "record": "CNVD-2016-03119", "field": "submitTime", "linked_record": true}, {"timestamp": "2016-05-13T00:00:00Z", "date_only": true, "value": "2016-05-13", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2016-03119", "record": "CNVD-2016-03119", "field": "openTime", "linked_record": true}, {"timestamp": "2016-10-02T16:51:25Z", "date_only": false, "value": "2016-10-02T16:51:25.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/57f12c6a-5864-4abb-8207-5a60646d1a36", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "840fe0b1-790f-4b6f-ad82-95d665ea1243"}, {"timestamp": "2017-08-23T20:52:05Z", "date_only": false, "value": "2017-08-23T20:52:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/SHATOOB/1973", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "2e5a757e-6e59-445f-816b-84ee36b90e79", "content": "\ud83c\udd94 @SHATOOB\n\n#Security_Patch_Reverse\n#PATCH_ANALYSIS_OF_CVE_2016_0189\n\n\ud83d\udd3a\u0645\u0647\u0646\u062f\u0633\u06cc \u0645\u0639\u0643\u0648\u0633 \u0648\u0635\u0644\u0647 \u0647\u0627\u064a \u0627\u0645\u0646\u064a\u062a\u064a\n\n\u0632\u0645\u0627\u0646\u064a \u0643\u0647 \u064a\u0643 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u064a\u062a\u064a \u0628\u0631\u0627\u064a \u0645\u062d\u0635\u0648\u0644\u064a \u0627\u0631\u0627\u0626\u0647 \u0645\u064a \u0634\u0648\u062f \u060c \u0631\u0642\u0627\u0628\u062a \u0628\u064a\u0646 \u0634\u0645\u0627 \u0628\u0631\u0627\u064a \u0646\u0635\u0628 \u0648 \u0646\u0641\u0648\u0630\u06af\u0631 \u0628\u0631\u0627\u064a \u0628\u0647\u0631\u0647 \u0648\u0631\u064a \u0627\u0632 \u0622\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u064a \u0634\u0648\u062f . \u0646\u0645\u0648\u0646\u0647 \u0627\u064a \u0627\u0632 \u062a\u062d\u064a\u0644\u064a \u0643\u0647 \u0628\u0631\u0627\u064a \u0627\u064a\u0646 \u0648\u0635\u0644\u0647 \u0647\u0627 \u0627\u0645\u0646\u064a\u062a\u064a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u064a \u0634\u0648\u062f \u062a\u0627 \u0639\u0645\u0644\u0643\u0631\u062f \u0622\u0646 \u0631\u0627 \u067e\u064a\u062f\u0627 \u0643\u0646\u0646\u062f \u062f\u0631 \u0644\u064a\u0646\u0643 \u0632\u064a\u0631 \u0622\u0645\u062f\u0647 \u0627\u0633\u062a .\n\n\n\ud83c\udf10 http://theori.io/research/cve-2016-0189\n\n\u269c\ufe0f\u269c\ufe0f  \u0634\u0627\u062a\u0648\u0628 \u062f\u0631\u06cc\u0686\u0647 \u0627\u06cc \u0628\u0647 \u062f\u0646\u06cc\u0627\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647 \u269c\ufe0f\u269c\ufe0f\n\n\ud83c\udd94 @SHATOOB", "url": "https://t.me/SHATOOB/1973", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2017-08-30T07:57:15Z", "date_only": false, "value": "2017-08-30T07:57:15.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/59a66b5f-28b0-45c2-8bf6-06bcbce2ab96", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "105bb85a-0fbb-4d5d-87ce-ff9a284228cd"}, {"timestamp": "2018-03-27T17:55:16Z", "date_only": false, "value": "2018-03-27T17:55:16.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/15310", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "74fda8d4-b037-4089-a689-7ee7049d1c94", "content": "At the micro level, the big takeaway from this report is the anomalous position of CVE-2017-0022. It is the third most discussed vulnerability on the dark web forums, yet in relation to just two pieces of malware: exploit kits Astrum (aka Stegano) and Neutrino. This is the lowest number of associated malware in the top ten vulnerabilities -- both of the two more popular vulnerabilities are associated with ten different peices of malware. CVE-2017-0199 is associated with malware including Hancitor, Dridex (https://www.securityweek.com/dridex-campaign-abuses-ftp-servers)\u00a0and FinFisher (https://www.securityweek.com/net-zero-day-flaw-exploited-deliver-finfisher-spyware), while CVE-2016-0189 is associated with nine different exploit kits and the Magniber (https://www.securityweek.com/new-magniber-ransomware-emerges) ransomware.\nBut it's not just in malware associations that CVE-2017-0022 is anomalous. It has a Common Vulnerability Scoring System (CVSS) rating of just 4.3. The next lowest rating in the top ten vulnerabilities is 7.6, while the top two are rated at 9.3 and 7.6. CVSS defines a 4.3 score as medium risk; and yet Recorded Future's research shows it to be the third most exploited vulnerability, commenting, \"'In the wild' severity does not always correlate with the Common Vulnerability Scoring System (CVSS) score.\"\nThis is a prime example of the reason for the analysis. Security teams could check the CVSS score and conclude on this evidence alone that the vulnerability does not require expedited remediation or patching. As the third most exploited vulnerability, Recorded Future's latest threat analysis suggests otherwise.\nBoston, Mass.-based Recorded Future raised $25 million in a Series E funding round led by Insight Venture Partners in October 2017 -- bringing the total funding raised to $57.9 million.\nRelated: Use of Fake Code Signing Certificates in Malware Surges (https://www.securityweek.com/use-fake-code-signing-certificates-malware-surges)\u00a0\nRelated: Researchers Warn Against Knee-Jerk Attribution of 'Olympic Destroyer' Attack (https://www.securityweek.com/researchers-warn-against-knee-jerk-attribution-olympic-destroyer-attack)\n\n                         \n            \n            \n  \n        \n                         \n            \n                \n            \n            \n            \n                Tweet (http://twitter.com/share)", "url": "https://t.me/information_security_channel/15310", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2018-05-29T15:50:33Z", "date_only": false, "value": "2018-05-29T15:50:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms16_051_vbscript.rb", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "b1f3f06c-e0e9-4b21-94c7-1fa2a76a0558", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms16_051_vbscript.rb"}, {"timestamp": "2018-09-26T14:29:36Z", "date_only": false, "value": "2018-09-26T14:29:36.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/5bab9721-28ac-48c4-845a-28f70a021402", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "e9c78110-b212-4ab6-911d-bc00c828beab"}, {"timestamp": "2018-10-12T19:57:01Z", "date_only": false, "value": "2018-10-12T19:57:01.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "cve-2016-0189", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2018-10-12T22:11:00Z", "date_only": false, "value": "2018-10-12T22:11Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2016-0189", "record": "GSD-2016-0189", "field": "namespaces.nvd.nist.gov.lastModifiedDate", "linked_record": true}, {"timestamp": "2018-11-23T14:09:10Z", "date_only": false, "value": "2018-11-23T14:09:10.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/5bf7fa3d-4308-4042-b09d-2176ac12042b", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "5c7a49dd-f8f8-42ed-b14d-557a619582fe"}, {"timestamp": "2019-09-11T01:05:52Z", "date_only": false, "value": "2019-09-11T01:05:52.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/15595", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "ff2c0fb7-c427-45b6-8889-3312f322427d", "content": "RT @tkanalyst: #Malvertsng -> #RadioEK (#CVE-2016-0189) -> #NEMTY (#Ransomware)\n\nLanding Domain Change\n\n[Extention]\n._NEMTY_KaVLdwZ_\n\n[Example Payload]\nhttps://t.co/jMwv0nhbU5\n\nSpotted by @nao_sec(https://t.co/0DY5sOtFfP)\n\n(cc:@BleepinComputer  @adrian__luca @jeromesegura @david_jursa) https://t.co/ZdvA1DwYfI http://twitter.com/BleepinComputer/status/1171558198182141952", "url": "https://t.me/ctinow/15595", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2020-10-09T15:57:20Z", "date_only": false, "value": "2020-10-09T15:57:20.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3662e234-ff72-4608-be6d-59e5352154c4", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "16f605ad-7e66-462f-9af3-5bc90d8d29d4"}, {"timestamp": "2020-10-09T16:17:11Z", "date_only": false, "value": "2020-10-09T16:17:11.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/37eaa589-7c2e-4382-839f-c4e33c5645e7", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "6023bbed-49f9-47ed-9096-2fcb9d39b4d4"}, {"timestamp": "2020-10-09T16:18:45Z", "date_only": false, "value": "2020-10-09T16:18:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/875dbc76-9a9c-462d-a103-2f3a09499a11", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "89fdc4a8-2863-4a5f-a455-97bea9c2084a"}, {"timestamp": "2020-10-09T16:28:35Z", "date_only": false, "value": "2020-10-09T16:28:35.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/4237df88-801e-41e4-87f5-3fe3881b5e79", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "6eb9b3dd-3a2b-402a-83cb-8ca208b10226"}, {"timestamp": "2020-10-09T16:41:28Z", "date_only": false, "value": "2020-10-09T16:41:28.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/aaef44e8-30e4-4ef5-abab-fecb28a147c1", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "e68d5afa-8ddc-44db-8ebb-ed204f698231"}, {"timestamp": "2020-10-09T17:15:00Z", "date_only": false, "value": "2020-10-09T17:15:00.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/2a8c4e25-ae93-4460-b536-9e67f38a9a51", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "e62d1c7d-8c55-49bf-bb20-0ac4e57699f7"}, {"timestamp": "2020-10-09T17:19:51Z", "date_only": false, "value": "2020-10-09T17:19:51.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/15c96c9f-9459-461d-b9d3-e5a16ff303a6", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "3e3ed790-4b50-4d92-8d66-b046c45e04f7"}, {"timestamp": "2020-10-09T17:22:27Z", "date_only": false, "value": "2020-10-09T17:22:27.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f987ff0f-3a4b-486a-b97a-ce21374d80c8", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "f2cfd7a1-e953-4ea4-9525-29c62a757809"}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2016-0189", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "200ef744-7e61-45f1-b8bf-f12871591f66", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2016-0189", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "70f3fc2b-1ed9-490b-add6-5b34f38e9550", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2016-0189", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2016-0189", "record": "GSD-2016-0189", "field": "namespaces.cisa.gov.dateAdded", "linked_record": true}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2016-0189", "field": "evidence.0.details.added_date", "uuid": "70f3fc2b-1ed9-490b-add6-5b34f38e9550", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2016-0189", "field": "evidence.0.details.date_added", "uuid": "200ef744-7e61-45f1-b8bf-f12871591f66", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2016-0189", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "200ef744-7e61-45f1-b8bf-f12871591f66", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2016-0189", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "70f3fc2b-1ed9-490b-add6-5b34f38e9550", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2016-0189", "field": "status.status_updated_at", "uuid": "200ef744-7e61-45f1-b8bf-f12871591f66", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2016-0189", "field": "status.status_updated_at", "uuid": "70f3fc2b-1ed9-490b-add6-5b34f38e9550", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "cve-2016-0189", "field": "containers.adp.1.timeline.0.time", "text": "CVE-2016-0189 added to CISA KEV"}, {"timestamp": "2022-04-18T00:00:00Z", "date_only": true, "value": "2022-04-18", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2016-0189", "field": "evidence.0.details.due_date", "uuid": "200ef744-7e61-45f1-b8bf-f12871591f66", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-18T00:00:00Z", "date_only": true, "value": "2022-04-18", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2016-0189", "record": "GSD-2016-0189", "field": "namespaces.cisa.gov.dueDate", "linked_record": true}, {"timestamp": "2022-05-14T02:25:01Z", "date_only": false, "value": "2022-05-14T02:25:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QW68-VQP7-FF9R", "record": "GHSA-QW68-VQP7-FF9R", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2022-06-10T23:02:10Z", "date_only": false, "value": "2022-06-10T23:02:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/37", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "e9bc389e-2869-494c-995f-9a0f6dbdcd84", "content": "#exploit\n1. CVE-2016-0189:\nVBScript Memory Corruption in IE11\nhttps://github.com/theori-io/cve-2016-0189\n\n2. CVE-2018-4901:\nAdobe Acrobat Reader DC Document ID RCE Vulnerability\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2017-0505\n\n3. CVE-2017-15397:\nChromeOS Doesn\u2019t Always Use SSL During Startup\nhttps://seclists.org/fulldisclosure/2018/Jan/7", "url": "https://t.me/CyberSecurityTechnologies/37", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2022-11-11T10:05:08Z", "date_only": false, "value": "2022-11-11T10:05:08.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/itsec_news/1735", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "916b57c4-7d8b-4985-8913-e5d314bc58c8", "content": "\u200b\ud83d\udde1 \u041d\u043e\u0432\u044b\u0439 \u0431\u043e\u0442\u043d\u0435\u0442 Cloud9 \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0442\u044b\u0441\u044f\u0447\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n\ud83d\udcac \u041e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b Zimperium, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u0435\u0433\u043e Cloud9. \u041a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441 \u0443\u043c\u0435\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c cookie-\u0444\u0430\u0439\u043b\u044b, \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0430\u0436\u0430\u0442\u0438\u044f \u043a\u043b\u0430\u0432\u0438\u0448, \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 JavaScript-\u043a\u043e\u0434, \u043c\u0430\u0439\u043d\u0438\u0442\u044c \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u0443 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a. \u041f\u043e\u043c\u0438\u043c\u043e \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0431\u043e\u0442\u043d\u0435\u0442 \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0436\u0435\u0440\u0442\u0432\u044b, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0437\u0436\u0435 \u0432\u0437\u044f\u0442\u044c \u0435\u0433\u043e \u043f\u043e\u0434 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0430\u0434\u0434\u043e\u043d \u043d\u0435 \u043d\u0430\u0439\u0442\u0438 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u0434\u043b\u044f Chrome \u0438\u043b\u0438 Edge, \u043e\u043d \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u044b, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0441\u043a\u0430\u0447\u0430\u0442\u044c Cloud9, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u0434 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Adobe Flash Player.\n\n\u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0436\u0435\u0440\u0442\u0432\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435, \u043e\u043d\u043e \u0441\u0440\u0430\u0437\u0443 \u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 JS-\u0444\u0430\u0439\u043b \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \"campaign.js\" \u043d\u0430 \u0432\u0441\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u043c\u0430\u0439\u043d\u0438\u0442\u044c \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u0443 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0436\u0435\u0440\u0442\u0432\u044b, \u0430 \u0437\u0430\u0442\u0435\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0441\u043a\u0440\u0438\u043f\u0442 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \"cthulhu.js\".\n\n\u0412\u0442\u043e\u0440\u043e\u0439 \u0441\u043a\u0440\u0438\u043f\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 Mozilla Firefox ( CVE-2019-11708, CVE-2019-9810 ), Internet Explorer ( CVE-2014-6332 , CVE-2016-0189 ) \u0438 Edge ( CVE-2016-7200 ), \u0447\u0442\u043e\u0431\u044b \u0441\u0431\u0435\u0436\u0430\u0442\u044c \u0438\u0437 \u201c\u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b\u201d \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0441\u043a\u0440\u0438\u043f\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u043a\u0430\u043a \u043a\u0435\u0439\u043b\u043e\u0433\u0433\u0435\u0440 \u0438 \u043a\u0430\u043d\u0430\u043b \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0435\u043c\u0443 \u043a\u0440\u0430\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430, cookie-\u0444\u0430\u0439\u043b\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c DDoS-\u0430\u0442\u0430\u043a\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Zimperium \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0447\u0442\u043e \u0437\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 Cloud9 \u0441\u0442\u043e\u0438\u0442 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Keksec (\u043e\u043d\u0430 \u0436\u0435 Kek Security, Necro \u0438 FreakOut), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u043f\u044b\u0442 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432. \u041e\u0434\u043d\u043e \u0438\u0437 \u0435\u0435 \u0442\u0432\u043e\u0440\u0435\u043d\u0438\u0439 \u2013 \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 EnemyBot, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442 \u0438 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a.\n\n#Cloud9 #\u0411\u043e\u0442\u043d\u0435\u0442 #\u0425\u0430\u043a\u0435\u0440\u044b\n\n\ud83d\udd14 ITsec NEWS", "url": "https://t.me/itsec_news/1735", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2023-06-14T21:10:03Z", "date_only": false, "value": "2023-06-14T21:10:03.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "91857a97-866d-4acc-bfac-99125fbdf913"}, {"timestamp": "2023-12-13T01:21:17.876Z", "date_only": false, "value": "2023-12-13T01:21:17.876598Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2016-0189", "record": "GSD-2016-0189", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-08-05T22:08:13.349Z", "date_only": false, "value": "2024-08-05T22:08:13.349Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2016-0189", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-12-24T20:29:49.405Z", "date_only": false, "value": "2024-12-24T20:29:49.405740Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971471", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "1984d116-abf2-4125-a54a-bc2b17ff888a", "url": "https://feedsin.space/feed/CISAKevBot/items/2971471"}, {"timestamp": "2025-02-06T03:13:42Z", "date_only": false, "value": "2025-02-06T03:13:42.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "95738fe2-b222-47d0-9451-c1e7aec914b6"}, {"timestamp": "2025-02-10T16:48:02.330Z", "date_only": false, "value": "2025-02-10T16:48:02.330536Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2016-0189", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-02-10T16:48:02.330Z", "date_only": false, "value": "2025-02-10T16:48:02.330536Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2016-0189", "record": "FKIE_CVE-2016-0189", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-14T10:00:27Z", "date_only": false, "value": "2025-02-14T10:00:27.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/S2HmWEqRY4GoHPWGfRPLsw-pKHEn5AVQa7xglmB25ee-4FOy", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "d3b12871-85cc-4151-98df-941fe3d85b0b"}, {"timestamp": "2025-02-23T02:10:10Z", "date_only": false, "value": "2025-02-23T02:10:10.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "0e0040bc-44f5-4437-835f-068ee32a8bca"}, {"timestamp": "2025-02-23T04:09:44Z", "date_only": false, "value": "2025-02-23T04:09:44.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "7e020441-95af-4631-8161-ff760ede3d38"}, {"timestamp": "2025-08-31T03:00:56Z", "date_only": false, "value": "2025-08-31T03:00:56.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "479602b7-b5a5-484f-9cd1-4e878ee5983b"}, {"timestamp": "2025-10-21T23:55:52.367Z", "date_only": false, "value": "2025-10-21T23:55:52.367Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2016-0189", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:55:52.367Z", "date_only": false, "value": "2025-10-21T23:55:52.367Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2016-0189", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:31:14Z", "date_only": false, "value": "2025-10-22T00:31:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QW68-VQP7-FF9R", "record": "GHSA-QW68-VQP7-FF9R", "field": "modified", "linked_record": true}, {"timestamp": "2026-02-02T12:27:56.719Z", "date_only": false, "value": "2026-02-02T12:27:56.719618Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/02639c5d-a9ec-4fd6-9193-4da67889e2ee", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "1bdb7a80-53bc-416d-96f3-a8d8b6414a1d", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/02639c5d-a9ec-4fd6-9193-4da67889e2ee", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-02-02T12:27:56.719Z", "date_only": false, "value": "2026-02-02T12:27:56.719618Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/02639c5d-a9ec-4fd6-9193-4da67889e2ee", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "792f8a84-9d9f-466b-a347-5d4d6ff2c7b8", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/02639c5d-a9ec-4fd6-9193-4da67889e2ee", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-17T00:37:05.163Z", "date_only": false, "value": "2026-06-17T00:37:05.163", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2016-0189", "record": "FKIE_CVE-2016-0189", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:47:22.185Z", "date_only": false, "value": "2026-06-19T12:47:22.185815Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8a16281c-8790-4962-ad88-b910cc7ee93f", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "9ba997e2-8690-4c64-bfe9-f7fc12696af6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8a16281c-8790-4962-ad88-b910cc7ee93f", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2016-0189", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "70f3fc2b-1ed9-490b-add6-5b34f38e9550", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:13:45.812Z", "date_only": false, "value": "2026-06-23T11:13:45.812009Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/70f3fc2b-1ed9-490b-add6-5b34f38e9550", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "02d1d015-aa12-45ac-a3bd-bb8bdbf261c5", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/70f3fc2b-1ed9-490b-add6-5b34f38e9550", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:05:15.094Z", "date_only": false, "value": "2026-06-23T14:05:15.094627Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/76d94bf5-8de7-4a22-a18b-dfd425aeead5", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "966b6181-0f80-4725-9247-24ffe12a1cb2", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/76d94bf5-8de7-4a22-a18b-dfd425aeead5", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-26T07:01:58.098Z", "date_only": false, "value": "2026-07-26T07:01:58.098197Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5964", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "42a40bbe-5615-4ab3-9664-b84323fe893e", "url": "https://t.me/KaitNews/5964"}, {"timestamp": "2026-07-26T07:01:58.280Z", "date_only": false, "value": "2026-07-26T07:01:58.280186Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5957", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "58b30a40-688b-4825-b3bc-6079bdade7d3", "url": "https://t.me/KaitNews/5957"}, {"timestamp": "2026-07-26T07:01:58.754Z", "date_only": false, "value": "2026-07-26T07:01:58.754772Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5828", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "fcf2b3a0-16b2-4fad-8afc-b9efa4e9fc57", "url": "https://t.me/KaitNews/5828"}, {"timestamp": "2026-07-26T07:01:59.386Z", "date_only": false, "value": "2026-07-26T07:01:59.386061Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5745", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "5577ffec-7738-4ee6-ba90-b80c50ced7c1", "url": "https://t.me/KaitNews/5745"}, {"timestamp": "2026-07-26T07:02:14.267Z", "date_only": false, "value": "2026-07-26T07:02:14.267570Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/2081", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "15d9aef0-4a33-4848-9cd1-1771fe95aab4", "url": "https://t.me/KaitNews/2081"}, {"timestamp": "2026-07-26T07:02:15.788Z", "date_only": false, "value": "2026-07-26T07:02:15.788176Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/1250", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "5e4eb45d-711d-4cec-ad08-ce7ac35ec5f2", "url": "https://t.me/KaitNews/1250"}, {"timestamp": "2026-07-27T00:01:39.491Z", "date_only": false, "value": "2026-07-27T00:01:39.491970Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5964", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "9ff381c0-033d-4377-a6bc-e435aa316a8b", "url": "https://t.me/KaitNews/5964"}, {"timestamp": "2026-07-27T00:01:39.665Z", "date_only": false, "value": "2026-07-27T00:01:39.665511Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5957", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "7ea4a0e7-7d89-4f88-8b10-d4cffc97da70", "url": "https://t.me/KaitNews/5957"}, {"timestamp": "2026-07-27T00:01:40.107Z", "date_only": false, "value": "2026-07-27T00:01:40.107001Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5828", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "d54afbe9-859b-4cc2-bd1c-d4d8d0e29a07", "url": "https://t.me/KaitNews/5828"}, {"timestamp": "2026-07-27T00:01:41.363Z", "date_only": false, "value": "2026-07-27T00:01:41.363549Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5745", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "a554c9a8-3537-4b7b-acfb-81423d87f43b", "url": "https://t.me/KaitNews/5745"}, {"timestamp": "2026-07-27T00:01:51.935Z", "date_only": false, "value": "2026-07-27T00:01:51.935104Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/2081", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "86d3c6bb-3c00-4059-a81f-45974b749ad1", "url": "https://t.me/KaitNews/2081"}, {"timestamp": "2026-07-27T00:01:53.314Z", "date_only": false, "value": "2026-07-27T00:01:53.314766Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/1250", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "80eca0b2-4c2b-48a6-93fc-fd203e09ad8b", "url": "https://t.me/KaitNews/1250"}, {"timestamp": "2026-07-29T12:03:25.074Z", "date_only": false, "value": "2026-07-29T12:03:25.074881Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KaitNews/5957", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "b63587f8-440a-4e6b-8b99-0d2a8013b496", "url": "https://t.me/KaitNews/5957", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-29T12:03:25.265Z", "date_only": false, "value": "2026-07-29T12:03:25.265848Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5964", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "f00fc6c5-b4d9-4715-bc7a-a44f3536ce6f", "url": "https://t.me/KaitNews/5964"}, {"timestamp": "2026-07-30T00:03:10.668Z", "date_only": false, "value": "2026-07-30T00:03:10.668021Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KaitNews/5957", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "65dd7fff-9526-4eff-b1e5-04b3a22b81c0", "url": "https://t.me/KaitNews/5957", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-30T00:03:11.188Z", "date_only": false, "value": "2026-07-30T00:03:11.188278Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/KaitNews/5964", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "105d62e7-bf1d-4e96-aab2-e2e020db01fd", "url": "https://t.me/KaitNews/5964"}, {"timestamp": "2026-08-04T07:00:03.935Z", "date_only": false, "value": "2026-08-04T07:00:03.935665Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KaitNews/5745", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "639e631c-c09d-4173-8a65-4617080f233c", "url": "https://t.me/KaitNews/5745", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-04T07:00:04.281Z", "date_only": false, "value": "2026-08-04T07:00:04.281939Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KaitNews/5828", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "07e6baf6-d7b3-41e3-85a9-846bbe54590d", "url": "https://t.me/KaitNews/5828", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-05T00:00:52.125Z", "date_only": false, "value": "2026-08-05T00:00:52.125661Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KaitNews/5745", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "a0f81e26-6fb2-455a-855e-02aee3bf11ba", "url": "https://t.me/KaitNews/5745", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-05T00:00:52.448Z", "date_only": false, "value": "2026-08-05T00:00:52.448009Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KaitNews/5828", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "e8d60822-1b0d-4491-a3d8-86c16d7524ba", "url": "https://t.me/KaitNews/5828", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-05T20:00:04.427Z", "date_only": false, "value": "2026-08-05T20:00:04.427908Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KaitNews/2081", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "8d4c8153-1dc3-4be8-8e93-815db99bd919", "url": "https://t.me/KaitNews/2081", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-05T22:00:07.299Z", "date_only": false, "value": "2026-08-05T22:00:07.299240Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/KaitNews/1250", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "edef5ab3-12fd-43b1-a583-8c76aede754a", "url": "https://t.me/KaitNews/1250", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-06T00:00:08.165Z", "date_only": false, "value": "2026-08-06T00:00:08.165309Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/KaitNews/1250", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "40cae298-568a-402b-ae1e-38b8ea8bf597", "url": "https://t.me/KaitNews/1250", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-06T00:00:24.574Z", "date_only": false, "value": "2026-08-06T00:00:24.574214Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/KaitNews/2081", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "1bf278bf-ca61-44cf-93b8-15d410f0439a", "url": "https://t.me/KaitNews/2081", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-16T02:00:29.075Z", "date_only": false, "value": "2026-08-16T02:00:29.075327Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mt63pjcup22m", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "3e5aa641-9de6-4cdd-96df-15241c9f5eae", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mt63pjcup22m"}, {"timestamp": "2026-09-01T20:00:59.528Z", "date_only": false, "value": "2026-09-01T20:00:59.528015Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/98318", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "446826ec-eb84-4f7a-acba-1f737460db2c", "url": "https://t.me/hacking_Attack/98318"}, {"timestamp": "2026-11-04T13:00:01Z", "date_only": false, "value": "2026-11-04T13:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2016-0189", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "200ef744-7e61-45f1-b8bf-f12871591f66", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-11T17:33:48.511Z", "anchors": {"origin": {"timestamp": "2016-05-10T00:00:00Z", "date_only": false, "value": "2016-05-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2016-0189", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2016-05-10T00:00:00Z", "date_only": false, "value": "2016-05-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2016-0189", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2017-08-23T20:52:05Z", "date_only": false, "value": "2017-08-23T20:52:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/SHATOOB/1973", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "2e5a757e-6e59-445f-816b-84ee36b90e79", "content": "\ud83c\udd94 @SHATOOB\n\n#Security_Patch_Reverse\n#PATCH_ANALYSIS_OF_CVE_2016_0189\n\n\ud83d\udd3a\u0645\u0647\u0646\u062f\u0633\u06cc \u0645\u0639\u0643\u0648\u0633 \u0648\u0635\u0644\u0647 \u0647\u0627\u064a \u0627\u0645\u0646\u064a\u062a\u064a\n\n\u0632\u0645\u0627\u0646\u064a \u0643\u0647 \u064a\u0643 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u064a\u062a\u064a \u0628\u0631\u0627\u064a \u0645\u062d\u0635\u0648\u0644\u064a \u0627\u0631\u0627\u0626\u0647 \u0645\u064a \u0634\u0648\u062f \u060c \u0631\u0642\u0627\u0628\u062a \u0628\u064a\u0646 \u0634\u0645\u0627 \u0628\u0631\u0627\u064a \u0646\u0635\u0628 \u0648 \u0646\u0641\u0648\u0630\u06af\u0631 \u0628\u0631\u0627\u064a \u0628\u0647\u0631\u0647 \u0648\u0631\u064a \u0627\u0632 \u0622\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u064a \u0634\u0648\u062f . \u0646\u0645\u0648\u0646\u0647 \u0627\u064a \u0627\u0632 \u062a\u062d\u064a\u0644\u064a \u0643\u0647 \u0628\u0631\u0627\u064a \u0627\u064a\u0646 \u0648\u0635\u0644\u0647 \u0647\u0627 \u0627\u0645\u0646\u064a\u062a\u064a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u064a \u0634\u0648\u062f \u062a\u0627 \u0639\u0645\u0644\u0643\u0631\u062f \u0622\u0646 \u0631\u0627 \u067e\u064a\u062f\u0627 \u0643\u0646\u0646\u062f \u062f\u0631 \u0644\u064a\u0646\u0643 \u0632\u064a\u0631 \u0622\u0645\u062f\u0647 \u0627\u0633\u062a .\n\n\n\ud83c\udf10 http://theori.io/research/cve-2016-0189\n\n\u269c\ufe0f\u269c\ufe0f  \u0634\u0627\u062a\u0648\u0628 \u062f\u0631\u06cc\u0686\u0647 \u0627\u06cc \u0628\u0647 \u062f\u0646\u06cc\u0627\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647 \u269c\ufe0f\u269c\ufe0f\n\n\ud83c\udd94 @SHATOOB", "url": "https://t.me/SHATOOB/1973", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2018-03-27T17:55:16Z", "date_only": false, "value": "2018-03-27T17:55:16.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/15310", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "74fda8d4-b037-4089-a689-7ee7049d1c94", "content": "At the micro level, the big takeaway from this report is the anomalous position of CVE-2017-0022. It is the third most discussed vulnerability on the dark web forums, yet in relation to just two pieces of malware: exploit kits Astrum (aka Stegano) and Neutrino. This is the lowest number of associated malware in the top ten vulnerabilities -- both of the two more popular vulnerabilities are associated with ten different peices of malware. CVE-2017-0199 is associated with malware including Hancitor, Dridex (https://www.securityweek.com/dridex-campaign-abuses-ftp-servers)\u00a0and FinFisher (https://www.securityweek.com/net-zero-day-flaw-exploited-deliver-finfisher-spyware), while CVE-2016-0189 is associated with nine different exploit kits and the Magniber (https://www.securityweek.com/new-magniber-ransomware-emerges) ransomware.\nBut it's not just in malware associations that CVE-2017-0022 is anomalous. It has a Common Vulnerability Scoring System (CVSS) rating of just 4.3. The next lowest rating in the top ten vulnerabilities is 7.6, while the top two are rated at 9.3 and 7.6. CVSS defines a 4.3 score as medium risk; and yet Recorded Future's research shows it to be the third most exploited vulnerability, commenting, \"'In the wild' severity does not always correlate with the Common Vulnerability Scoring System (CVSS) score.\"\nThis is a prime example of the reason for the analysis. Security teams could check the CVSS score and conclude on this evidence alone that the vulnerability does not require expedited remediation or patching. As the third most exploited vulnerability, Recorded Future's latest threat analysis suggests otherwise.\nBoston, Mass.-based Recorded Future raised $25 million in a Series E funding round led by Insight Venture Partners in October 2017 -- bringing the total funding raised to $57.9 million.\nRelated: Use of Fake Code Signing Certificates in Malware Surges (https://www.securityweek.com/use-fake-code-signing-certificates-malware-surges)\u00a0\nRelated: Researchers Warn Against Knee-Jerk Attribution of 'Olympic Destroyer' Attack (https://www.securityweek.com/researchers-warn-against-knee-jerk-attribution-olympic-destroyer-attack)\n\n                         \n            \n            \n  \n        \n                         \n            \n                \n            \n            \n            \n                Tweet (http://twitter.com/share)", "url": "https://t.me/information_security_channel/15310", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 59334916.0, "hours": 16481.92111111111, "days": 686.746712962963, "min_seconds": 59248516.0, "max_seconds": 59334916.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2016-05-10T00:00:00Z", "date_only": false, "value": "2016-05-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2016-0189", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2018-03-27T17:55:16Z", "date_only": false, "value": "2018-03-27T17:55:16.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/15310", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "74fda8d4-b037-4089-a689-7ee7049d1c94", "content": "At the micro level, the big takeaway from this report is the anomalous position of CVE-2017-0022. It is the third most discussed vulnerability on the dark web forums, yet in relation to just two pieces of malware: exploit kits Astrum (aka Stegano) and Neutrino. This is the lowest number of associated malware in the top ten vulnerabilities -- both of the two more popular vulnerabilities are associated with ten different peices of malware. CVE-2017-0199 is associated with malware including Hancitor, Dridex (https://www.securityweek.com/dridex-campaign-abuses-ftp-servers)\u00a0and FinFisher (https://www.securityweek.com/net-zero-day-flaw-exploited-deliver-finfisher-spyware), while CVE-2016-0189 is associated with nine different exploit kits and the Magniber (https://www.securityweek.com/new-magniber-ransomware-emerges) ransomware.\nBut it's not just in malware associations that CVE-2017-0022 is anomalous. It has a Common Vulnerability Scoring System (CVSS) rating of just 4.3. The next lowest rating in the top ten vulnerabilities is 7.6, while the top two are rated at 9.3 and 7.6. CVSS defines a 4.3 score as medium risk; and yet Recorded Future's research shows it to be the third most exploited vulnerability, commenting, \"'In the wild' severity does not always correlate with the Common Vulnerability Scoring System (CVSS) score.\"\nThis is a prime example of the reason for the analysis. Security teams could check the CVSS score and conclude on this evidence alone that the vulnerability does not require expedited remediation or patching. As the third most exploited vulnerability, Recorded Future's latest threat analysis suggests otherwise.\nBoston, Mass.-based Recorded Future raised $25 million in a Series E funding round led by Insight Venture Partners in October 2017 -- bringing the total funding raised to $57.9 million.\nRelated: Use of Fake Code Signing Certificates in Malware Surges (https://www.securityweek.com/use-fake-code-signing-certificates-malware-surges)\u00a0\nRelated: Researchers Warn Against Knee-Jerk Attribution of 'Olympic Destroyer' Attack (https://www.securityweek.com/researchers-warn-against-knee-jerk-attribution-olympic-destroyer-attack)\n\n                         \n            \n            \n  \n        \n                         \n            \n                \n            \n            \n            \n                Tweet (http://twitter.com/share)", "url": "https://t.me/information_security_channel/15310", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 59334916.0, "hours": 16481.92111111111, "days": 686.746712962963, "min_seconds": 59248516.0, "max_seconds": 59334916.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2016-05-10T00:00:00Z", "date_only": false, "value": "2016-05-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2016-0189", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2018-03-27T17:55:16Z", "date_only": false, "value": "2018-03-27T17:55:16.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/15310", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "74fda8d4-b037-4089-a689-7ee7049d1c94", "content": "At the micro level, the big takeaway from this report is the anomalous position of CVE-2017-0022. It is the third most discussed vulnerability on the dark web forums, yet in relation to just two pieces of malware: exploit kits Astrum (aka Stegano) and Neutrino. This is the lowest number of associated malware in the top ten vulnerabilities -- both of the two more popular vulnerabilities are associated with ten different peices of malware. CVE-2017-0199 is associated with malware including Hancitor, Dridex (https://www.securityweek.com/dridex-campaign-abuses-ftp-servers)\u00a0and FinFisher (https://www.securityweek.com/net-zero-day-flaw-exploited-deliver-finfisher-spyware), while CVE-2016-0189 is associated with nine different exploit kits and the Magniber (https://www.securityweek.com/new-magniber-ransomware-emerges) ransomware.\nBut it's not just in malware associations that CVE-2017-0022 is anomalous. It has a Common Vulnerability Scoring System (CVSS) rating of just 4.3. The next lowest rating in the top ten vulnerabilities is 7.6, while the top two are rated at 9.3 and 7.6. CVSS defines a 4.3 score as medium risk; and yet Recorded Future's research shows it to be the third most exploited vulnerability, commenting, \"'In the wild' severity does not always correlate with the Common Vulnerability Scoring System (CVSS) score.\"\nThis is a prime example of the reason for the analysis. Security teams could check the CVSS score and conclude on this evidence alone that the vulnerability does not require expedited remediation or patching. As the third most exploited vulnerability, Recorded Future's latest threat analysis suggests otherwise.\nBoston, Mass.-based Recorded Future raised $25 million in a Series E funding round led by Insight Venture Partners in October 2017 -- bringing the total funding raised to $57.9 million.\nRelated: Use of Fake Code Signing Certificates in Malware Surges (https://www.securityweek.com/use-fake-code-signing-certificates-malware-surges)\u00a0\nRelated: Researchers Warn Against Knee-Jerk Attribution of 'Olympic Destroyer' Attack (https://www.securityweek.com/researchers-warn-against-knee-jerk-attribution-olympic-destroyer-attack)\n\n                         \n            \n            \n  \n        \n                         \n            \n                \n            \n            \n            \n                Tweet (http://twitter.com/share)", "url": "https://t.me/information_security_channel/15310", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 40683125.0, "hours": 11300.868055555555, "days": 470.86950231481484, "min_seconds": 40596725.0, "max_seconds": 40683125.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2016-05-10T00:00:00Z", "date_only": false, "value": "2016-05-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2016-0189", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2017-08-23T20:52:05Z", "date_only": false, "value": "2017-08-23T20:52:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/SHATOOB/1973", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "2e5a757e-6e59-445f-816b-84ee36b90e79", "content": "\ud83c\udd94 @SHATOOB\n\n#Security_Patch_Reverse\n#PATCH_ANALYSIS_OF_CVE_2016_0189\n\n\ud83d\udd3a\u0645\u0647\u0646\u062f\u0633\u06cc \u0645\u0639\u0643\u0648\u0633 \u0648\u0635\u0644\u0647 \u0647\u0627\u064a \u0627\u0645\u0646\u064a\u062a\u064a\n\n\u0632\u0645\u0627\u0646\u064a \u0643\u0647 \u064a\u0643 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u064a\u062a\u064a \u0628\u0631\u0627\u064a \u0645\u062d\u0635\u0648\u0644\u064a \u0627\u0631\u0627\u0626\u0647 \u0645\u064a \u0634\u0648\u062f \u060c \u0631\u0642\u0627\u0628\u062a \u0628\u064a\u0646 \u0634\u0645\u0627 \u0628\u0631\u0627\u064a \u0646\u0635\u0628 \u0648 \u0646\u0641\u0648\u0630\u06af\u0631 \u0628\u0631\u0627\u064a \u0628\u0647\u0631\u0647 \u0648\u0631\u064a \u0627\u0632 \u0622\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u064a \u0634\u0648\u062f . \u0646\u0645\u0648\u0646\u0647 \u0627\u064a \u0627\u0632 \u062a\u062d\u064a\u0644\u064a \u0643\u0647 \u0628\u0631\u0627\u064a \u0627\u064a\u0646 \u0648\u0635\u0644\u0647 \u0647\u0627 \u0627\u0645\u0646\u064a\u062a\u064a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u064a \u0634\u0648\u062f \u062a\u0627 \u0639\u0645\u0644\u0643\u0631\u062f \u0622\u0646 \u0631\u0627 \u067e\u064a\u062f\u0627 \u0643\u0646\u0646\u062f \u062f\u0631 \u0644\u064a\u0646\u0643 \u0632\u064a\u0631 \u0622\u0645\u062f\u0647 \u0627\u0633\u062a .\n\n\n\ud83c\udf10 http://theori.io/research/cve-2016-0189\n\n\u269c\ufe0f\u269c\ufe0f  \u0634\u0627\u062a\u0648\u0628 \u062f\u0631\u06cc\u0686\u0647 \u0627\u06cc \u0628\u0647 \u062f\u0646\u06cc\u0627\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647 \u269c\ufe0f\u269c\ufe0f\n\n\ud83c\udd94 @SHATOOB", "url": "https://t.me/SHATOOB/1973", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 331580028.511236, "hours": 92105.56347534334, "days": 3837.731811472639, "min_seconds": 331493628.511236, "max_seconds": 331580028.511236, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2016-05-10T00:00:00Z", "date_only": false, "value": "2016-05-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2016-0189", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T17:33:48.511Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 272245112.511236, "hours": 75623.64236423222, "days": 3150.985098509676, "min_seconds": 272245112.511236, "max_seconds": 272245112.511236, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2018-03-27T17:55:16Z", "date_only": false, "value": "2018-03-27T17:55:16.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/15310", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "74fda8d4-b037-4089-a689-7ee7049d1c94", "content": "At the micro level, the big takeaway from this report is the anomalous position of CVE-2017-0022. It is the third most discussed vulnerability on the dark web forums, yet in relation to just two pieces of malware: exploit kits Astrum (aka Stegano) and Neutrino. This is the lowest number of associated malware in the top ten vulnerabilities -- both of the two more popular vulnerabilities are associated with ten different peices of malware. CVE-2017-0199 is associated with malware including Hancitor, Dridex (https://www.securityweek.com/dridex-campaign-abuses-ftp-servers)\u00a0and FinFisher (https://www.securityweek.com/net-zero-day-flaw-exploited-deliver-finfisher-spyware), while CVE-2016-0189 is associated with nine different exploit kits and the Magniber (https://www.securityweek.com/new-magniber-ransomware-emerges) ransomware.\nBut it's not just in malware associations that CVE-2017-0022 is anomalous. It has a Common Vulnerability Scoring System (CVSS) rating of just 4.3. The next lowest rating in the top ten vulnerabilities is 7.6, while the top two are rated at 9.3 and 7.6. CVSS defines a 4.3 score as medium risk; and yet Recorded Future's research shows it to be the third most exploited vulnerability, commenting, \"'In the wild' severity does not always correlate with the Common Vulnerability Scoring System (CVSS) score.\"\nThis is a prime example of the reason for the analysis. Security teams could check the CVSS score and conclude on this evidence alone that the vulnerability does not require expedited remediation or patching. As the third most exploited vulnerability, Recorded Future's latest threat analysis suggests otherwise.\nBoston, Mass.-based Recorded Future raised $25 million in a Series E funding round led by Insight Venture Partners in October 2017 -- bringing the total funding raised to $57.9 million.\nRelated: Use of Fake Code Signing Certificates in Malware Surges (https://www.securityweek.com/use-fake-code-signing-certificates-malware-surges)\u00a0\nRelated: Researchers Warn Against Knee-Jerk Attribution of 'Olympic Destroyer' Attack (https://www.securityweek.com/researchers-warn-against-knee-jerk-attribution-olympic-destroyer-attack)\n\n                         \n            \n            \n  \n        \n                         \n            \n                \n            \n            \n            \n                Tweet (http://twitter.com/share)", "url": "https://t.me/information_security_channel/15310", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T17:33:48.511Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 290896903.511236, "hours": 80804.69541978778, "days": 3366.8623091578243, "min_seconds": 290896903.511236, "max_seconds": 290896903.511236, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2017-08-23T20:52:05Z", "date_only": false, "value": "2017-08-23T20:52:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/SHATOOB/1973", "record": "CVE-2016-0189", "field": "creation_timestamp", "uuid": "2e5a757e-6e59-445f-816b-84ee36b90e79", "content": "\ud83c\udd94 @SHATOOB\n\n#Security_Patch_Reverse\n#PATCH_ANALYSIS_OF_CVE_2016_0189\n\n\ud83d\udd3a\u0645\u0647\u0646\u062f\u0633\u06cc \u0645\u0639\u0643\u0648\u0633 \u0648\u0635\u0644\u0647 \u0647\u0627\u064a \u0627\u0645\u0646\u064a\u062a\u064a\n\n\u0632\u0645\u0627\u0646\u064a \u0643\u0647 \u064a\u0643 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u064a\u062a\u064a \u0628\u0631\u0627\u064a \u0645\u062d\u0635\u0648\u0644\u064a \u0627\u0631\u0627\u0626\u0647 \u0645\u064a \u0634\u0648\u062f \u060c \u0631\u0642\u0627\u0628\u062a \u0628\u064a\u0646 \u0634\u0645\u0627 \u0628\u0631\u0627\u064a \u0646\u0635\u0628 \u0648 \u0646\u0641\u0648\u0630\u06af\u0631 \u0628\u0631\u0627\u064a \u0628\u0647\u0631\u0647 \u0648\u0631\u064a \u0627\u0632 \u0622\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u064a \u0634\u0648\u062f . \u0646\u0645\u0648\u0646\u0647 \u0627\u064a \u0627\u0632 \u062a\u062d\u064a\u0644\u064a \u0643\u0647 \u0628\u0631\u0627\u064a \u0627\u064a\u0646 \u0648\u0635\u0644\u0647 \u0647\u0627 \u0627\u0645\u0646\u064a\u062a\u064a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u064a \u0634\u0648\u062f \u062a\u0627 \u0639\u0645\u0644\u0643\u0631\u062f \u0622\u0646 \u0631\u0627 \u067e\u064a\u062f\u0627 \u0643\u0646\u0646\u062f \u062f\u0631 \u0644\u064a\u0646\u0643 \u0632\u064a\u0631 \u0622\u0645\u062f\u0647 \u0627\u0633\u062a .\n\n\n\ud83c\udf10 http://theori.io/research/cve-2016-0189\n\n\u269c\ufe0f\u269c\ufe0f  \u0634\u0627\u062a\u0648\u0628 \u062f\u0631\u06cc\u0686\u0647 \u0627\u06cc \u0628\u0647 \u062f\u0646\u06cc\u0627\u06cc \u0631\u0627\u06cc\u0627\u0646\u0647 \u269c\ufe0f\u269c\ufe0f\n\n\ud83c\udd94 @SHATOOB", "url": "https://t.me/SHATOOB/1973", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T17:33:48.511Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}