{"metadata": {"vulnerability": "CVE-2021-2109", "count": 51, "kinds": {"milestone": 4, "sighting": 21, "kev": 11, "other": 15}}, "data": [{"timestamp": "2020-12-09T00:00:00Z", "date_only": false, "value": "2020-12-09T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-2109", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-01-20T00:00:00Z", "date_only": false, "value": "2021-01-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-047", "record": "CERTFR-2021-AVI-047", "field": "revisions.0.revision_date"}, {"timestamp": "2021-01-20T00:00:00Z", "date_only": true, "value": "2021-01-20", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2021-05110", "record": "CNVD-2021-05110", "field": "submitTime"}, {"timestamp": "2021-01-20T14:50:11Z", "date_only": false, "value": "2021-01-20T14:50:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-2109", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-01-20T15:15:00Z", "date_only": false, "value": "2021-01-20T15:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WX9H-Q254-5W45", "record": "GHSA-WX9H-Q254-5W45", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-01-20T15:15:00Z", "date_only": false, "value": "2021-01-20T15:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-2109", "record": "GSD-2021-2109", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2021-01-20T15:15:52.753Z", "date_only": false, "value": "2021-01-20T15:15:52.753", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-2109", "record": "FKIE_CVE-2021-2109", "field": "published"}, {"timestamp": "2021-01-20T18:37:43Z", "date_only": false, "value": "2021-01-20T18:37:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/22389", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "dfafcf59-8d37-4555-9597-bd63eb902856", "content": "\u203c CVE-2021-2109 \u203c\n\nVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/22389"}, {"timestamp": "2021-01-22T00:00:00Z", "date_only": true, "value": "2021-01-22", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2021-05110", "record": "CNVD-2021-05110", "field": "openTime"}, {"timestamp": "2021-01-22T16:06:09Z", "date_only": false, "value": "2021-01-22T16:06:09.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / oracle", "record": "CVE-2021-2109", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-01-24T14:36:01Z", "date_only": false, "value": "2021-01-24T14:36:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/2562", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "60fbfc2c-9a6a-4ba4-b9d2-0f3e3d9e2e2b", "content": "#Analytics\n10 most exploited vulnerabilities of the week (january 18-24)\nCVE-2020-14882/883:\nhttps://t.me/cybersecuritytechnologies/2004\nCVE-2021-2109:\nhttps://t.me/cybersecuritytechnologies/2540\nCVE-2020-6207:\nhttps://t.me/cybersecuritytechnologies/2506\nCVE-2021-3114/3115:\nArbitrary command execution in Go\nhttps://blog.golang.org/path-security\nCVE-2019-8791:\nhttps://t.me/cybersecuritytechnologies/2535\nCVE-2021-3129:\nhttps://t.me/cybersecuritytechnologies/2557\nCVE-2020-1033:\nhttps://t.me/cybersecuritytechnologies/2528\nCVE-2019-8792:\nhttps://t.me/cybersecuritytechnologies/2535", "url": "https://t.me/CyberSecurityTechnologies/2562"}, {"timestamp": "2021-01-27T22:33:00Z", "date_only": false, "value": "2021-01-27T22:33Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-2109", "record": "GSD-2021-2109", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2021-02-07T20:56:01Z", "date_only": false, "value": "2021-02-07T20:56:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reconshell/420", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "79fd728a-f9ef-4ff7-b9c1-352a67386b2c", "content": "CVE-2021-2109 Weblogic Server Remote Code Execution vulnerability analysis\n\n#WeblogicRCE #CVE-2021-2109 #vulnerability #InfoSec #CyberSecurity #RCE\n\nhttps://reconshell.com/cve-2021-2109-weblogic-server-remote-code-execution-vulnerability-analysis/", "url": "https://t.me/reconshell/420"}, {"timestamp": "2021-08-09T11:06:06Z", "date_only": false, "value": "2021-08-09T11:06:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/281", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "dae1749f-57ab-4d7c-bf05-1718a0006a20", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-2109 basic scanner\nURL\uff1ahttps://github.com/dinosn/CVE-2021-2109", "url": "https://t.me/GithubRedTeam/281"}, {"timestamp": "2022-05-24T17:39:55Z", "date_only": false, "value": "2022-05-24T17:39:55Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WX9H-Q254-5W45", "record": "GHSA-WX9H-Q254-5W45", "field": "published"}, {"timestamp": "2022-05-24T17:39:55Z", "date_only": false, "value": "2022-05-24T17:39:55Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WX9H-Q254-5W45", "record": "GHSA-WX9H-Q254-5W45", "field": "modified"}, {"timestamp": "2023-11-10T15:34:11Z", "date_only": false, "value": "2023-11-10T15:34:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/1479", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "f4e15ab4-081a-4505-aec8-568c8a229b3b", "content": "https://github.com/sp4zcmd/WeblogicExploit-GUI\nWeblogic\u6f0f\u6d1e\u5229\u7528\u56fe\u5f62\u5316\u5de5\u5177\n\nCVE-2020-2551\nCVE-2020-2555\nCVE-2020-2883\nCVE-2016-3510\nCVE-2016-0638\nCVE-2017-10271\nJdk7u21\nCVE-2017-3248\uff08JRMP\uff09\nCVE-2018-2628\uff08JRMP\uff09\nCVE-2018-2893\uff08JRMP\uff09\nCVE-2018-3245\uff08JRMP\uff09\nCVE-2018-3181\uff08JNDI\uff09\nCVE-2020-14882\u672a\u6388\u6743\u8bbf\u95ee+CVE-2021-2109\uff08JNDI\uff09\n\n#github #tools #exploit", "url": "https://t.me/CNArsenal/1479"}, {"timestamp": "2023-11-11T07:49:11Z", "date_only": false, "value": "2023-11-11T07:49:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/v3n0mhack/301", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "aa058eb5-fa1a-4574-89b7-d454f511d310", "content": "https://github.com/sp4zcmd/WeblogicExploit-GUI\nWeblogic\u6f0f\u6d1e\u5229\u7528\u56fe\u5f62\u5316\u5de5\u5177\n\nCVE-2020-2551\nCVE-2020-2555\nCVE-2020-2883\nCVE-2016-3510\nCVE-2016-0638\nCVE-2017-10271\nJdk7u21\nCVE-2017-3248\uff08JRMP\uff09\nCVE-2018-2628\uff08JRMP\uff09\nCVE-2018-2893\uff08JRMP\uff09\nCVE-2018-3245\uff08JRMP\uff09\nCVE-2018-3181\uff08JNDI\uff09\nCVE-2020-14882\u672a\u6388\u6743\u8bbf\u95ee+CVE-2021-2109\uff08JNDI\uff09", "url": "https://t.me/v3n0mhack/301"}, {"timestamp": "2023-12-13T01:23:14.852Z", "date_only": false, "value": "2023-12-13T01:23:14.852551Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-2109", "record": "GSD-2021-2109", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-03T16:32:02.874Z", "date_only": false, "value": "2024-08-03T16:32:02.874Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-2109", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-26T18:11:42.639Z", "date_only": false, "value": "2024-09-26T18:11:42.639742Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-2109", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2024-09-26T18:11:42.639Z", "date_only": false, "value": "2024-09-26T18:11:42.639742Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-2109", "record": "FKIE_CVE-2021-2109", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-09-26T18:16:10.908Z", "date_only": false, "value": "2024-09-26T18:16:10.908Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-2109", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-09-26T18:16:10.908Z", "date_only": false, "value": "2024-09-26T18:16:10.908Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-2109", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2024-10-09T19:55:22Z", "date_only": false, "value": "2024-10-09T19:55:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/2540", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "0e8f84c7-93e4-4818-a813-cb822497a473", "content": "#exploit\nCVE-2021-2109:\nWeblogic Server RCE involving HTTP protocol and JNDI injection gadget\nhttps://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw", "url": "https://t.me/CyberSecurityTechnologies/2540"}, {"timestamp": "2024-11-14T06:07:38Z", "date_only": false, "value": "2024-11-14T06:07:38.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/5e6a7080-af48-4d95-ba3e-03ad60728fc8", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "f8f6689a-8d72-4109-b142-6ba5e83bd7f8"}, {"timestamp": "2025-01-04T20:01:45Z", "date_only": false, "value": "2025-01-04T20:01:45.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/2605", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "daca1861-1129-468c-850e-4ff6e81ab245", "content": "#Analytics\nTop 10 Most Used Vulnerabilities of the Month (january 1-31)\nCVE-2021-3156:\nhttps://t.me/cybersecuritytechnologies/2577\nCVE-2020-16875:\nhttps://t.me/cybersecuritytechnologies/1751\nCVE-2020-29583:\nhttps://t.me/cybersecuritytechnologies/2386\nCVE-2021-2109:\nhttps://t.me/cybersecuritytechnologies/2540\nCVE-2020-17519:\nhttps://t.me/cybersecuritytechnologies/2473\nCVE-2020-25684/25685/25686:\nhttps://t.me/cybersecuritytechnologies/2534\nCVE-2021-3011:\nhttps://t.me/cybersecuritytechnologies/2447", "url": "https://t.me/CyberSecurityTechnologies/2605"}, {"timestamp": "2026-06-17T03:48:50.320Z", "date_only": false, "value": "2026-06-17T03:48:50.320", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-2109", "record": "FKIE_CVE-2021-2109", "field": "lastModified"}, {"timestamp": "2026-07-29T12:01:01.975Z", "date_only": false, "value": "2026-07-29T12:01:01.975157Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/1992", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "b4b1cc93-94d6-49bf-898d-ef18c54fd868", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2021-2109\nGithub: https://github.com/Vulnmachines/oracle-weblogic-CVE-2021-2109\nDescribe: \nVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).", "url": "https://t.me/CVEhub/1992"}, {"timestamp": "2026-07-29T12:02:54.894Z", "date_only": false, "value": "2026-07-29T12:02:54.894980Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1461", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "8a1dae21-e697-4a1c-af5a-6f32e9e6c1cb", "content": "CVE-2021-2109: Oracle Weblogic/Peoplesoft Malware attack and Analysis https://digitalitskills.com/cve-2021-2109-oracle-weblogic-peoplesoft-malware-attack-and-analysis/", "url": "https://t.me/reverseame/1461"}, {"timestamp": "2026-08-01T05:00:05.806Z", "date_only": false, "value": "2026-08-01T05:00:05.806965Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/1992", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "1d521e8f-c929-46cc-9b44-9549de4e2f58", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2021-2109\nGithub: https://github.com/Vulnmachines/oracle-weblogic-CVE-2021-2109\nDescribe: \nVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).", "url": "https://t.me/CVEhub/1992"}, {"timestamp": "2026-08-02T14:34:21.603Z", "date_only": false, "value": "2026-08-02T14:34:21.603289Z", "kind": "sighting", "label": "Seen", "source": "Telegram/HEqho0Owx0a9R4QYf6O-zBOL1L6vXz0vX86o8vEe9Eh0Pg", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "ef00522f-6fee-4caa-8667-c36b1ab88ff9"}, {"timestamp": "2026-08-03T02:07:04.025Z", "date_only": false, "value": "2026-08-03T02:07:04.025388Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/HEqho0Owx0a9R4QYf6O-zBOL1L6vXz0vX86o8vEe9Eh0Pg", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "2af5b799-327e-4a8e-9d38-4f9b3907accb"}, {"timestamp": "2026-08-03T08:00:04.966Z", "date_only": false, "value": "2026-08-03T08:00:04.966700Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/1461", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "d03084a7-ac9f-437b-bef6-c2d108c1a2ca", "content": "CVE-2021-2109: Oracle Weblogic/Peoplesoft Malware attack and Analysis https://digitalitskills.com/cve-2021-2109-oracle-weblogic-peoplesoft-malware-attack-and-analysis/", "url": "https://t.me/reverseame/1461"}, {"timestamp": "2026-08-15T00:00:00Z", "date_only": false, "value": "2026-08-15T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-2109", "field": "timestamps.asserted_at", "uuid": "10433a5e-c941-4f72-ae1d-40c385ef3dae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-15T00:00:00Z", "date_only": false, "value": "2026-08-15T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-2109", "field": "evidence.0.details.added_date", "uuid": "10433a5e-c941-4f72-ae1d-40c385ef3dae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-15T00:00:00Z", "date_only": false, "value": "2026-08-15T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-2109", "field": "timestamps.first_seen_at", "uuid": "10433a5e-c941-4f72-ae1d-40c385ef3dae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-15T00:00:00Z", "date_only": false, "value": "2026-08-15T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-2109", "field": "status.status_updated_at", "uuid": "10433a5e-c941-4f72-ae1d-40c385ef3dae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-15T23:19:31Z", "date_only": false, "value": "2026-08-15T23:19:31+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2021-2109", "field": "timestamps.asserted_at", "uuid": "8e00f2cb-c30e-4370-a944-a8e6d1d15b70", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-15T23:19:31Z", "date_only": false, "value": "2026-08-15T23:19:31+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2021-2109", "field": "timestamps.first_seen_at", "uuid": "8e00f2cb-c30e-4370-a944-a8e6d1d15b70", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-16T11:00:01Z", "date_only": false, "value": "2026-08-16T11:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-2109", "field": "timestamps.recorded_at", "uuid": "10433a5e-c941-4f72-ae1d-40c385ef3dae", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-16T11:00:35.206Z", "date_only": false, "value": "2026-08-16T11:00:35.206979Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/10433a5e-c941-4f72-ae1d-40c385ef3dae", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "6c82f8ff-0361-4c47-a74c-124b04e74fdd", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/10433a5e-c941-4f72-ae1d-40c385ef3dae"}, {"timestamp": "2026-08-17T01:00:56.917Z", "date_only": false, "value": "2026-08-17T01:00:56.917974Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8e00f2cb-c30e-4370-a944-a8e6d1d15b70", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "8ae4e85d-c8ba-4d1e-a277-58e63e72f253", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8e00f2cb-c30e-4370-a944-a8e6d1d15b70"}, {"timestamp": "2026-08-19T10:15:18.524Z", "date_only": false, "value": "2026-08-19T10:15:18.524894Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-18)", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "76ad674b-cd80-42df-a610-7f0bc98f887c"}, {"timestamp": "2026-08-21T10:15:09.330Z", "date_only": false, "value": "2026-08-21T10:15:09.330622Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-20)", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "f24121c8-b773-4b7b-b554-dcd64ae3cbc5"}, {"timestamp": "2026-09-01T17:01:05.147Z", "date_only": false, "value": "2026-09-01T17:01:05.147381Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/2180", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "5b01d52a-b21e-4125-8e03-dfc5271dab4e", "content": "Auditing AWS PassRole: A Problematic Privilege Escalation Permission\nhttps://ermetic.com/whats-new/blog/auditing-passrole-a-problematic-privilege-escalation-permission\n\nExploiting CVE-2020-15994 Chrome WebAssembly Engine UAF Vulnerability (PoC)\nhttps://blog.br0vvnn.io/pages/blogpost.aspx?id=5\n\n1. Going Rogue - a Mastermind behind Android Malware Returns with a New RAT\nhttps://research.checkpoint.com/2021/going-rogue-a-mastermind-behind-android-malware-returns-with-a-new-rat\n2. Arbitrium-RAT: remote access trojan, Fully Undetectable\nhttps://securityonline.info/arbitrium-rat-remote-access-trojan-fully-undetectable\n3. Linux.Midrashim: Assembly x64 ELF virus\nhttps://www.guitmz.com/linux-midrashim-elf-virus\n4. FreakOut - Leveraging Newest Vulnerabilities for creating a Botnet\nhttps://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet\n\n\"Detecting Use-After-Free vulnerabilities using REVEN\", 2020.\nhttps://blog.tetrane.com/2020/vulnerability-detection-use-after-free.html\n]-> UAF vulnerabilities detection algorithm:\nhttps://github.com/tetrane/reven2-resources/blob/master/automation/analysis/vulnerability_detection/detect_use_after_free_2.6.ipynb\n\nWebRTC and State Machines.\n// Investigation of state machines signaling seven video conferencing applications (Signal, JioChat, Mocha, Google Duo, Facebook Messenger, Telegram, Viber): five vulnerabilities that could allow the calling device to force the called device to transmit audio or video data\nhttps://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.html?m=1\n\nCVE-2021-2109:\nWeblogic Server Remote Code Execution involving HTTP protocol and JNDI injection gadget (PoC)\nhttps://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw\n\n1. Shellcode Injection using Nim and Syscalls\nhttps://ajpc500.github.io/nim/Shellcode-Injection-using-Nim-and-Syscalls\n2. Bad Pods: Kubernetes Pod Privilege Escalation\nhttps://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation\n3 Hijacking connections without injections: a ShadowMoving approach to the art of pivoting\nhttps://adepts.of0x.cc/shadowmove-hijack-socket\n4 . Abusing CVE-2019-8791, CVE-2019-8792 in Shazam (iOS/Android)\nhttps://ash-king.co.uk/blog/Shazlocate-abusing-CVE-2019-8791-CVE-2019-8792\n\n1. An Incorrect Calculation Bug in the Linux Kernel (4.9-4.13) eBPF Verifier (PoC)\nhttps://www.thezdi.com/blog/2021/1/18/zdi-20-1440-an-incorrect-calculation-bug-in-the-linux-kernel-ebpf-verifier\n2. Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452\nhttps://www.fireeye.com/blog/threat-research/2021/01/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452.html", "url": "https://t.me/cissp/2180"}, {"timestamp": "2026-09-05T00:00:00Z", "date_only": false, "value": "2026-09-05T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2021-2109", "field": "timestamps.last_seen_at", "uuid": "8e00f2cb-c30e-4370-a944-a8e6d1d15b70", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-05T00:00:00Z", "date_only": true, "value": "2026-09-05", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2021-2109", "field": "evidence.0.details.observation_date", "uuid": "8e00f2cb-c30e-4370-a944-a8e6d1d15b70", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-05T00:00:00Z", "date_only": false, "value": "2026-09-05T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2021-2109", "field": "status.status_updated_at", "uuid": "8e00f2cb-c30e-4370-a944-a8e6d1d15b70", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-07T01:00:02Z", "date_only": false, "value": "2026-09-07T01:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2021-2109", "field": "timestamps.recorded_at", "uuid": "8e00f2cb-c30e-4370-a944-a8e6d1d15b70", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-11T20:00:06.535Z", "date_only": false, "value": "2026-09-11T20:00:06.535991Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/2180", "record": "CVE-2021-2109", "field": "creation_timestamp", "uuid": "924c6078-8fdb-477a-b0b6-815ddb5357cd", "content": "Auditing AWS PassRole: A Problematic Privilege Escalation Permission\nhttps://ermetic.com/whats-new/blog/auditing-passrole-a-problematic-privilege-escalation-permission\n\nExploiting CVE-2020-15994 Chrome WebAssembly Engine UAF Vulnerability (PoC)\nhttps://blog.br0vvnn.io/pages/blogpost.aspx?id=5\n\n1. Going Rogue - a Mastermind behind Android Malware Returns with a New RAT\nhttps://research.checkpoint.com/2021/going-rogue-a-mastermind-behind-android-malware-returns-with-a-new-rat\n2. Arbitrium-RAT: remote access trojan, Fully Undetectable\nhttps://securityonline.info/arbitrium-rat-remote-access-trojan-fully-undetectable\n3. Linux.Midrashim: Assembly x64 ELF virus\nhttps://www.guitmz.com/linux-midrashim-elf-virus\n4. FreakOut - Leveraging Newest Vulnerabilities for creating a Botnet\nhttps://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet\n\n\"Detecting Use-After-Free vulnerabilities using REVEN\", 2020.\nhttps://blog.tetrane.com/2020/vulnerability-detection-use-after-free.html\n]-> UAF vulnerabilities detection algorithm:\nhttps://github.com/tetrane/reven2-resources/blob/master/automation/analysis/vulnerability_detection/detect_use_after_free_2.6.ipynb\n\nWebRTC and State Machines.\n// Investigation of state machines signaling seven video conferencing applications (Signal, JioChat, Mocha, Google Duo, Facebook Messenger, Telegram, Viber): five vulnerabilities that could allow the calling device to force the called device to transmit audio or video data\nhttps://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.html?m=1\n\nCVE-2021-2109:\nWeblogic Server Remote Code Execution involving HTTP protocol and JNDI injection gadget (PoC)\nhttps://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw\n\n1. Shellcode Injection using Nim and Syscalls\nhttps://ajpc500.github.io/nim/Shellcode-Injection-using-Nim-and-Syscalls\n2. Bad Pods: Kubernetes Pod Privilege Escalation\nhttps://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation\n3 Hijacking connections without injections: a ShadowMoving approach to the art of pivoting\nhttps://adepts.of0x.cc/shadowmove-hijack-socket\n4 . Abusing CVE-2019-8791, CVE-2019-8792 in Shazam (iOS/Android)\nhttps://ash-king.co.uk/blog/Shazlocate-abusing-CVE-2019-8791-CVE-2019-8792\n\n1. An Incorrect Calculation Bug in the Linux Kernel (4.9-4.13) eBPF Verifier (PoC)\nhttps://www.thezdi.com/blog/2021/1/18/zdi-20-1440-an-incorrect-calculation-bug-in-the-linux-kernel-ebpf-verifier\n2. Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452\nhttps://www.fireeye.com/blog/threat-research/2021/01/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452.html", "url": "https://t.me/cissp/2180"}]}