{"vulnerability": "cve-2021-2109", "sightings": [{"uuid": "f8f6689a-8d72-4109-b142-6ba5e83bd7f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "MISP/5e6a7080-af48-4d95-ba3e-03ad60728fc8", "content": "", "creation_timestamp": "2024-11-14T06:07:38.000000Z"}, {"uuid": "dae1749f-57ab-4d7c-bf05-1718a0006a20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/281", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-2109 basic scanner\nURL\uff1ahttps://github.com/dinosn/CVE-2021-2109", "creation_timestamp": "2021-08-09T11:06:06.000000Z"}, {"uuid": "aa058eb5-fa1a-4574-89b7-d454f511d310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/v3n0mhack/301", "content": "https://github.com/sp4zcmd/WeblogicExploit-GUI\nWeblogic\u6f0f\u6d1e\u5229\u7528\u56fe\u5f62\u5316\u5de5\u5177\n\nCVE-2020-2551\nCVE-2020-2555\nCVE-2020-2883\nCVE-2016-3510\nCVE-2016-0638\nCVE-2017-10271\nJdk7u21\nCVE-2017-3248\uff08JRMP\uff09\nCVE-2018-2628\uff08JRMP\uff09\nCVE-2018-2893\uff08JRMP\uff09\nCVE-2018-3245\uff08JRMP\uff09\nCVE-2018-3181\uff08JNDI\uff09\nCVE-2020-14882\u672a\u6388\u6743\u8bbf\u95ee+CVE-2021-2109\uff08JNDI\uff09", "creation_timestamp": "2023-11-11T07:49:11.000000Z"}, {"uuid": "79fd728a-f9ef-4ff7-b9c1-352a67386b2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/reconshell/420", "content": "CVE-2021-2109 Weblogic Server Remote Code Execution vulnerability analysis\n\n#WeblogicRCE #CVE-2021-2109 #vulnerability #InfoSec #CyberSecurity #RCE\n\nhttps://reconshell.com/cve-2021-2109-weblogic-server-remote-code-execution-vulnerability-analysis/", "creation_timestamp": "2021-02-07T20:56:01.000000Z"}, {"uuid": "f21ce3ca-0bfa-447c-9923-c2aa3e586831", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21090", "type": "seen", "source": "https://t.me/cibsecurity/25741", "content": "\u203c CVE-2021-21090 \u203c\n\nAdobe InCopy version 16.0 (and earlier) is affected by an path traversal vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-06-28T18:27:18.000000Z"}, {"uuid": "2af5b799-327e-4a8e-9d38-4f9b3907accb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "Telegram/HEqho0Owx0a9R4QYf6O-zBOL1L6vXz0vX86o8vEe9Eh0Pg", "content": "", "creation_timestamp": "2026-08-03T02:07:04.025388Z"}, {"uuid": "dfafcf59-8d37-4555-9597-bd63eb902856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/cibsecurity/22389", "content": "\u203c CVE-2021-2109 \u203c\n\nVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-20T18:37:43.000000Z"}, {"uuid": "f4e15ab4-081a-4505-aec8-568c8a229b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/1479", "content": "https://github.com/sp4zcmd/WeblogicExploit-GUI\nWeblogic\u6f0f\u6d1e\u5229\u7528\u56fe\u5f62\u5316\u5de5\u5177\n\nCVE-2020-2551\nCVE-2020-2555\nCVE-2020-2883\nCVE-2016-3510\nCVE-2016-0638\nCVE-2017-10271\nJdk7u21\nCVE-2017-3248\uff08JRMP\uff09\nCVE-2018-2628\uff08JRMP\uff09\nCVE-2018-2893\uff08JRMP\uff09\nCVE-2018-3245\uff08JRMP\uff09\nCVE-2018-3181\uff08JNDI\uff09\nCVE-2020-14882\u672a\u6388\u6743\u8bbf\u95ee+CVE-2021-2109\uff08JNDI\uff09\n\n#github #tools #exploit", "creation_timestamp": "2023-11-10T15:34:11.000000Z"}, {"uuid": "60fbfc2c-9a6a-4ba4-b9d2-0f3e3d9e2e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/2562", "content": "#Analytics\n10 most exploited vulnerabilities of the week (january 18-24)\nCVE-2020-14882/883:\nhttps://t.me/cybersecuritytechnologies/2004\nCVE-2021-2109:\nhttps://t.me/cybersecuritytechnologies/2540\nCVE-2020-6207:\nhttps://t.me/cybersecuritytechnologies/2506\nCVE-2021-3114/3115:\nArbitrary command execution in Go\nhttps://blog.golang.org/path-security\nCVE-2019-8791:\nhttps://t.me/cybersecuritytechnologies/2535\nCVE-2021-3129:\nhttps://t.me/cybersecuritytechnologies/2557\nCVE-2020-1033:\nhttps://t.me/cybersecuritytechnologies/2528\nCVE-2019-8792:\nhttps://t.me/cybersecuritytechnologies/2535", "creation_timestamp": "2021-01-24T14:36:01.000000Z"}, {"uuid": "0e8f84c7-93e4-4818-a813-cb822497a473", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2540", "content": "#exploit\nCVE-2021-2109:\nWeblogic Server RCE involving HTTP protocol and JNDI injection gadget\nhttps://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw", "creation_timestamp": "2024-10-09T19:55:22.000000Z"}, {"uuid": "daca1861-1129-468c-850e-4ff6e81ab245", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/2605", "content": "#Analytics\nTop 10 Most Used Vulnerabilities of the Month (january 1-31)\nCVE-2021-3156:\nhttps://t.me/cybersecuritytechnologies/2577\nCVE-2020-16875:\nhttps://t.me/cybersecuritytechnologies/1751\nCVE-2020-29583:\nhttps://t.me/cybersecuritytechnologies/2386\nCVE-2021-2109:\nhttps://t.me/cybersecuritytechnologies/2540\nCVE-2020-17519:\nhttps://t.me/cybersecuritytechnologies/2473\nCVE-2020-25684/25685/25686:\nhttps://t.me/cybersecuritytechnologies/2534\nCVE-2021-3011:\nhttps://t.me/cybersecuritytechnologies/2447", "creation_timestamp": "2025-01-04T20:01:45.000000Z"}, {"uuid": "57c8dc5a-e724-4a7a-85d8-0e838944dc06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/1992", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2021-2109\nGithub: https://github.com/Vulnmachines/oracle-weblogic-CVE-2021-2109\nDescribe: \nVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).", "creation_timestamp": "2026-08-02T00:01:17.235475Z"}, {"uuid": "d03084a7-ac9f-437b-bef6-c2d108c1a2ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1461", "content": "CVE-2021-2109: Oracle Weblogic/Peoplesoft Malware attack and Analysis https://digitalitskills.com/cve-2021-2109-oracle-weblogic-peoplesoft-malware-attack-and-analysis/", "creation_timestamp": "2026-08-03T08:00:04.966700Z"}, {"uuid": "ef00522f-6fee-4caa-8667-c36b1ab88ff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "Telegram/HEqho0Owx0a9R4QYf6O-zBOL1L6vXz0vX86o8vEe9Eh0Pg", "content": "", "creation_timestamp": "2026-08-02T14:34:21.603289Z"}, {"uuid": "1d521e8f-c929-46cc-9b44-9549de4e2f58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/1992", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2021-2109\nGithub: https://github.com/Vulnmachines/oracle-weblogic-CVE-2021-2109\nDescribe: \nVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).", "creation_timestamp": "2026-08-01T05:00:05.806965Z"}, {"uuid": "325531e3-fd16-4be2-9b3c-bf7c8f07f6a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1461", "content": "CVE-2021-2109: Oracle Weblogic/Peoplesoft Malware attack and Analysis https://digitalitskills.com/cve-2021-2109-oracle-weblogic-peoplesoft-malware-attack-and-analysis/", "creation_timestamp": "2026-08-04T00:00:46.333695Z"}, {"uuid": "6c82f8ff-0361-4c47-a74c-124b04e74fdd", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/10433a5e-c941-4f72-ae1d-40c385ef3dae", "content": "", "creation_timestamp": "2026-08-16T11:00:35.206979Z"}, {"uuid": "8ae4e85d-c8ba-4d1e-a277-58e63e72f253", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8e00f2cb-c30e-4370-a944-a8e6d1d15b70", "content": "", "creation_timestamp": "2026-08-17T01:00:56.917974Z"}, {"uuid": "f24121c8-b773-4b7b-b554-dcd64ae3cbc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-20)", "content": "", "creation_timestamp": "2026-08-21T10:15:09.330622Z"}, {"uuid": "76ad674b-cd80-42df-a610-7f0bc98f887c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-18)", "content": "", "creation_timestamp": "2026-08-19T10:15:18.524894Z"}, {"uuid": "b4b1cc93-94d6-49bf-898d-ef18c54fd868", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/CVEhub/1992", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2021-2109\nGithub: https://github.com/Vulnmachines/oracle-weblogic-CVE-2021-2109\nDescribe: \nVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).", "creation_timestamp": "2026-07-29T12:01:01.975157Z"}, {"uuid": "8a1dae21-e697-4a1c-af5a-6f32e9e6c1cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/reverseame/1461", "content": "CVE-2021-2109: Oracle Weblogic/Peoplesoft Malware attack and Analysis https://digitalitskills.com/cve-2021-2109-oracle-weblogic-peoplesoft-malware-attack-and-analysis/", "creation_timestamp": "2026-07-29T12:02:54.894980Z"}, {"uuid": "1fbac226-b784-45ef-9905-486d5740c6e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/CVEhub/1992", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2021-2109\nGithub: https://github.com/Vulnmachines/oracle-weblogic-CVE-2021-2109\nDescribe: \nVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).", "creation_timestamp": "2026-07-30T00:01:42.238614Z"}, {"uuid": "43157f37-eaeb-43e5-b473-ac66eef0977a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/reverseame/1461", "content": "CVE-2021-2109: Oracle Weblogic/Peoplesoft Malware attack and Analysis https://digitalitskills.com/cve-2021-2109-oracle-weblogic-peoplesoft-malware-attack-and-analysis/", "creation_timestamp": "2026-07-30T00:02:45.201174Z"}, {"uuid": "5b01d52a-b21e-4125-8e03-dfc5271dab4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/cissp/2180", "content": "Auditing AWS PassRole: A Problematic Privilege Escalation Permission\nhttps://ermetic.com/whats-new/blog/auditing-passrole-a-problematic-privilege-escalation-permission\n\nExploiting CVE-2020-15994 Chrome WebAssembly Engine UAF Vulnerability (PoC)\nhttps://blog.br0vvnn.io/pages/blogpost.aspx?id=5\n\n1. Going Rogue - a Mastermind behind Android Malware Returns with a New RAT\nhttps://research.checkpoint.com/2021/going-rogue-a-mastermind-behind-android-malware-returns-with-a-new-rat\n2. Arbitrium-RAT: remote access trojan, Fully Undetectable\nhttps://securityonline.info/arbitrium-rat-remote-access-trojan-fully-undetectable\n3. Linux.Midrashim: Assembly x64 ELF virus\nhttps://www.guitmz.com/linux-midrashim-elf-virus\n4. FreakOut - Leveraging Newest Vulnerabilities for creating a Botnet\nhttps://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet\n\n\"Detecting Use-After-Free vulnerabilities using REVEN\", 2020.\nhttps://blog.tetrane.com/2020/vulnerability-detection-use-after-free.html\n]-> UAF vulnerabilities detection algorithm:\nhttps://github.com/tetrane/reven2-resources/blob/master/automation/analysis/vulnerability_detection/detect_use_after_free_2.6.ipynb\n\nWebRTC and State Machines.\n// Investigation of state machines signaling seven video conferencing applications (Signal, JioChat, Mocha, Google Duo, Facebook Messenger, Telegram, Viber): five vulnerabilities that could allow the calling device to force the called device to transmit audio or video data\nhttps://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.html?m=1\n\nCVE-2021-2109:\nWeblogic Server Remote Code Execution involving HTTP protocol and JNDI injection gadget (PoC)\nhttps://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw\n\n1. Shellcode Injection using Nim and Syscalls\nhttps://ajpc500.github.io/nim/Shellcode-Injection-using-Nim-and-Syscalls\n2. Bad Pods: Kubernetes Pod Privilege Escalation\nhttps://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation\n3 Hijacking connections without injections: a ShadowMoving approach to the art of pivoting\nhttps://adepts.of0x.cc/shadowmove-hijack-socket\n4 . Abusing CVE-2019-8791, CVE-2019-8792 in Shazam (iOS/Android)\nhttps://ash-king.co.uk/blog/Shazlocate-abusing-CVE-2019-8791-CVE-2019-8792\n\n1. An Incorrect Calculation Bug in the Linux Kernel (4.9-4.13) eBPF Verifier (PoC)\nhttps://www.thezdi.com/blog/2021/1/18/zdi-20-1440-an-incorrect-calculation-bug-in-the-linux-kernel-ebpf-verifier\n2. Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452\nhttps://www.fireeye.com/blog/threat-research/2021/01/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452.html", "creation_timestamp": "2026-09-01T17:01:05.147381Z"}, {"uuid": "fa52abf5-a87e-4467-acb5-a7c840637b84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2109", "type": "seen", "source": "https://t.me/cissp/2180", "content": "Auditing AWS PassRole: A Problematic Privilege Escalation Permission\nhttps://ermetic.com/whats-new/blog/auditing-passrole-a-problematic-privilege-escalation-permission\n\nExploiting CVE-2020-15994 Chrome WebAssembly Engine UAF Vulnerability (PoC)\nhttps://blog.br0vvnn.io/pages/blogpost.aspx?id=5\n\n1. Going Rogue - a Mastermind behind Android Malware Returns with a New RAT\nhttps://research.checkpoint.com/2021/going-rogue-a-mastermind-behind-android-malware-returns-with-a-new-rat\n2. Arbitrium-RAT: remote access trojan, Fully Undetectable\nhttps://securityonline.info/arbitrium-rat-remote-access-trojan-fully-undetectable\n3. Linux.Midrashim: Assembly x64 ELF virus\nhttps://www.guitmz.com/linux-midrashim-elf-virus\n4. FreakOut - Leveraging Newest Vulnerabilities for creating a Botnet\nhttps://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet\n\n\"Detecting Use-After-Free vulnerabilities using REVEN\", 2020.\nhttps://blog.tetrane.com/2020/vulnerability-detection-use-after-free.html\n]-> UAF vulnerabilities detection algorithm:\nhttps://github.com/tetrane/reven2-resources/blob/master/automation/analysis/vulnerability_detection/detect_use_after_free_2.6.ipynb\n\nWebRTC and State Machines.\n// Investigation of state machines signaling seven video conferencing applications (Signal, JioChat, Mocha, Google Duo, Facebook Messenger, Telegram, Viber): five vulnerabilities that could allow the calling device to force the called device to transmit audio or video data\nhttps://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.html?m=1\n\nCVE-2021-2109:\nWeblogic Server Remote Code Execution involving HTTP protocol and JNDI injection gadget (PoC)\nhttps://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw\n\n1. Shellcode Injection using Nim and Syscalls\nhttps://ajpc500.github.io/nim/Shellcode-Injection-using-Nim-and-Syscalls\n2. Bad Pods: Kubernetes Pod Privilege Escalation\nhttps://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation\n3 Hijacking connections without injections: a ShadowMoving approach to the art of pivoting\nhttps://adepts.of0x.cc/shadowmove-hijack-socket\n4 . Abusing CVE-2019-8791, CVE-2019-8792 in Shazam (iOS/Android)\nhttps://ash-king.co.uk/blog/Shazlocate-abusing-CVE-2019-8791-CVE-2019-8792\n\n1. An Incorrect Calculation Bug in the Linux Kernel (4.9-4.13) eBPF Verifier (PoC)\nhttps://www.thezdi.com/blog/2021/1/18/zdi-20-1440-an-incorrect-calculation-bug-in-the-linux-kernel-ebpf-verifier\n2. Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452\nhttps://www.fireeye.com/blog/threat-research/2021/01/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452.html", "creation_timestamp": "2026-09-02T01:04:54.904917Z"}]}