https://vulnerability.circl.lu/sightings/feed 2026-09-11T22:31:41.374762+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/908cc7cf-3e86-4556-9976-4778f36b6891/export 2026-09-11T22:31:41.396441+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "908cc7cf-3e86-4556-9976-4778f36b6891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2443", "content": "Threat_Research\n1. Emails Disclosure on WordPress\nhttps://www.gosecure.net/blog/2021/03/02/emails-disclosure-on-wordpress\n\n2. Pre-Auth RCE in VMware ESXI (PoC for CVE-2020-3992, CVE-2021-21974)\nhttps://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\n\n3. A Preauth RCE to Root Chain on D-Link DAP-2020 (PoC)\nhttps://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html", "creation_timestamp": "2026-09-11T18:00:05.130433Z"} 2026-09-11T18:00:05.130433+00:00 https://vulnerability.circl.lu/sighting/2082685b-acdc-43f2-baf7-2ff93cbc0f8e/export 2026-09-11T22:31:41.399003+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2082685b-acdc-43f2-baf7-2ff93cbc0f8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2407", "content": "Red_Team_Tactics\n1. Rootkit Arsenal Guacamole\n// An attempt to restore and adapt to modern Win10 version the Rootkit Arsenal original code sampls. All projects have been ported to x64 and tested on latest Win10 (2004-19041.746)\nhttps://github.com/uf0o/rootkit-arsenal-guacamole\n\n2. CVE-2021-21972 (1-day):\nThe vSphere Client (HTML5) contains a RCE vulnerability in a vCenter Server plugin (PoCs)\nhttps://swarm.ptsecurity.com/unauth-rce-vmware/#more-2477\n]-> https://github.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC\n]-> https://github.com/NS-Sp4ce/CVE-2021-21972\n]-> https://github.com/yaunsky/CVE-2021-21972\n]-> PoC for Unix VCSA:\nhttps://github.com/yaunsky/CVE-2021-21972\n\n3. A solid XSS payload that bypasses Imperva WAF\nclick", "creation_timestamp": "2026-09-11T18:00:05.026273Z"} 2026-09-11T18:00:05.026273+00:00 https://vulnerability.circl.lu/sighting/5af6c2e7-8959-4372-8a64-28fbc145aa3b/export 2026-09-11T22:31:41.399201+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5af6c2e7-8959-4372-8a64-28fbc145aa3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "seen", "source": "https://t.me/cissp/2394", "content": "https://kb.vmware.com/s/article/82374\n\nVMware addressed a critical remote code execution flaw, tracked as CVE-2021-21972, in vCenter Server virtual infrastructure management platform.", "creation_timestamp": "2026-09-11T18:00:04.924742Z"} 2026-09-11T18:00:04.924742+00:00 https://vulnerability.circl.lu/sighting/2abde4ec-9c4c-4091-b99b-3059afbc6eb1/export 2026-09-11T22:31:41.399346+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2abde4ec-9c4c-4091-b99b-3059afbc6eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "seen", "source": "https://t.me/cissp/2545", "content": "https://kb.vmware.com/s/article/76372\n\nVMSA-2021-0002 (CVE-2021-21974)\nhttps://www.vmware.com/security/\nadvisories/VMSA-2021-0002.html\n\nVMSA-2020-0023 (CVE-2020-3992)\nhttps://www.vmware.com/security/advisories/VMSA-2020-0023.html\n\nVMSA-2019-0022 (CVE-2019-5544)\nhttps://www.vmware.com/security/advisories/VMSA-2019-0022.html\n\n\nhttps://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "creation_timestamp": "2026-09-11T16:00:06.551353Z"} 2026-09-11T16:00:06.551353+00:00 https://vulnerability.circl.lu/sighting/5e378513-2523-4403-89ce-9554a41cda03/export 2026-09-11T22:31:41.399490+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5e378513-2523-4403-89ce-9554a41cda03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21975", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2897", "content": "CVE-2021-21975:\nSSRF in VMWare vRealize Operations Manager API < 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials (1-day PoC)\nhttps://github.com/Al1ex/CVE-2021-21975", "creation_timestamp": "2026-09-11T11:00:04.362376Z"} 2026-09-11T11:00:04.362376+00:00 https://vulnerability.circl.lu/sighting/045f0da4-9c88-4caa-bc6b-4b6449c6ccc2/export 2026-09-11T22:31:41.399633+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "045f0da4-9c88-4caa-bc6b-4b6449c6ccc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3279", "content": "Offensive security\nApplying the Invisibility Cloak:\nObfuscate C# Tools to Evade Signature-Based Detection\nhttps://securityintelligence.com/posts/invisibility-cloak-obfuscate-c-tools-evade-signature-based-detection\n\nexploit\nVMware\u00a0ESXi OpenSLP heap-overflow vulnerability\nhttps://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2021-21974.py\n]-> RCE PoC walkthrough:\nhttps://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9\n\nRed Team Tactics\n1. Nightly builds of common C# offensive tools\nhttps://github.com/Flangvik/SharpCollection\n2. Red Team tool for exfiltrating the target organization's Google People Directory that you have access to\nhttps://github.com/antman1p/GDir-Thief\n\nWLAN Security\nUbiquiti Networks EdgeOS Improper Certificate Validation RCE Vulnerability/Firmware Update Bug (PoC for CVE-2021-22909)\nhttps://www.zerodayinitiative.com/blog/2021/5/24/cve-2021-22909-digging-into-a-ubiquiti-firmware-update-bug\n\nAccessing Windows Systems Remotely From Linux\ud83d\ude01\nhttps://www.infosecmatter.com/accessing-windows-systems-remotely-from-linux\n// Collection of 30+ methods for accessing remote Windows systems from Linux to execute commands, use remote shell or connect to graphical remote desktop (RDP)", "creation_timestamp": "2026-09-11T05:00:04.851695Z"} 2026-09-11T05:00:04.851695+00:00 https://vulnerability.circl.lu/sighting/ed7c9cd2-1e6b-4d78-a370-10d1f46597ac/export 2026-09-11T22:31:41.399785+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ed7c9cd2-1e6b-4d78-a370-10d1f46597ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4885", "content": "Blue_Team_Techniques\n1. How to Detect Azure AD Backdoors:\nIdentity Federation\nhttps://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html\n2. Checks for signature requirements over LDAP\nhttps://github.com/GoSecure/ldap-scanner\n\nRed_Team_Tactics\n1. Finding XSS on .apple.com and building a proof of concept to leak your PII information\nhttps://zseano.medium.com/finding-xss-on-apple-com-and-building-a-proof-of-concept-to-leak-your-pii-information-d7bc93cff2df\n2. Using CVE-2021-40531 for RCE with Sketch\nhttps://jonpalmisc.com/2021/11/22/cve-2021-40531\n\nOffensive_security\nMsfvenom Cheatsheet: Windows Exploitation\nhttps://www.hackingarticles.in/msfvenom-cheatsheet-windows-exploitation\n\n_security\nTesting FIX-backed applications\nhttps://labs.f-secure.com/blog/a-bit-of-a-fixer-upper-playing-with-the-fix-tcp-protocol\n]-> A Burp extension to enable modification of FIX messages when relayed from MitM_Relay:\nhttps://github.com/FSecureLABS/FixerUpper\n\nexploit\nWLAN_Security\n1. CVE-2021-21972:\nPoC Exploit for vCenter\nhttps://github.com/NS-Sp4ce/CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\n2. Exploits the Wii U's bluetooth stack to gain IOSU\nkernel access via bluetooth\nhttps://github.com/GaryOderNichts/bluubomb", "creation_timestamp": "2026-09-11T00:00:37.365458Z"} 2026-09-11T00:00:37.365458+00:00 https://vulnerability.circl.lu/sighting/4b0b9ae8-72a9-405a-9b1a-e72181d54a2e/export 2026-09-11T22:31:41.399925+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4b0b9ae8-72a9-405a-9b1a-e72181d54a2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4885", "content": "Blue_Team_Techniques\n1. How to Detect Azure AD Backdoors:\nIdentity Federation\nhttps://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html\n2. Checks for signature requirements over LDAP\nhttps://github.com/GoSecure/ldap-scanner\n\nRed_Team_Tactics\n1. Finding XSS on .apple.com and building a proof of concept to leak your PII information\nhttps://zseano.medium.com/finding-xss-on-apple-com-and-building-a-proof-of-concept-to-leak-your-pii-information-d7bc93cff2df\n2. Using CVE-2021-40531 for RCE with Sketch\nhttps://jonpalmisc.com/2021/11/22/cve-2021-40531\n\nOffensive_security\nMsfvenom Cheatsheet: Windows Exploitation\nhttps://www.hackingarticles.in/msfvenom-cheatsheet-windows-exploitation\n\n_security\nTesting FIX-backed applications\nhttps://labs.f-secure.com/blog/a-bit-of-a-fixer-upper-playing-with-the-fix-tcp-protocol\n]-> A Burp extension to enable modification of FIX messages when relayed from MitM_Relay:\nhttps://github.com/FSecureLABS/FixerUpper\n\nexploit\nWLAN_Security\n1. CVE-2021-21972:\nPoC Exploit for vCenter\nhttps://github.com/NS-Sp4ce/CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\n2. Exploits the Wii U's bluetooth stack to gain IOSU\nkernel access via bluetooth\nhttps://github.com/GaryOderNichts/bluubomb", "creation_timestamp": "2026-09-10T14:00:06.619473Z"} 2026-09-10T14:00:06.619473+00:00 https://vulnerability.circl.lu/sighting/3f67f39e-9240-472b-8fbe-5a187174db00/export 2026-09-11T22:31:41.400043+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3f67f39e-9240-472b-8fbe-5a187174db00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21975", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:13.627846Z"} 2026-09-09T10:00:13.627846+00:00 https://vulnerability.circl.lu/sighting/dcc06115-2298-497a-ac53-24ec253630d2/export 2026-09-11T22:31:41.400152+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dcc06115-2298-497a-ac53-24ec253630d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vmware_vcenter_uploadova_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java\", \"author\": [\"Mikhail Klyuchnikov\", \"wvu \", \"mr_me\", \"Viss\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated OVA file upload and path\\n traversal in VMware vCenter Server to write a JSP payload to a\\n web-accessible directory.\\n\\n Fixed versions are 6.5 Update 3n, 6.7 Update 3l, and 7.0 Update 1c.\\n Note that later vulnerable versions of the Linux appliance aren't\\n exploitable via the webshell technique. Furthermore, writing an SSH\\n public key to /home/vsphere-ui/.ssh/authorized_keys works, but the\\n user's non-existent password expires 90 days after install, rendering\\n the technique nearly useless against production environments.\\n\\n You'll have the best luck targeting older versions of the Linux\\n appliance. The Windows target should work ubiquitously.\", \"disclosure_date\": \"2021-02-23\", \"fullname\": \"exploit/multi/http/vmware_vcenter_uploadova_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"VMware vCenter Server Unauthenticated OVA File Upload RCE\", \"needs_cleanup\": true, \"notes\": {\"RelatedModules\": [\"auxiliary/scanner/vmware/esx_fingerprint\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/vmware_vcenter_uploadova_rce.rb\", \"platform\": \"Linux,Windows\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"multi/http/vmware_vcenter_uploadova_rce\", \"references\": [\"CVE-2021-21972\", \"URL-https://www.vmware.com/security/advisories/VMSA-2021-0002.html\", \"URL-https://swarm.ptsecurity.com/unauth-rce-vmware/\", \"URL-https://twitter.com/jas502n/status/1364810720261496843\", \"URL-https://twitter.com/_0xf4n9x_/status/1364905040876503045\", \"URL-https://twitter.com/HackingLZ/status/1364636303606886403\", \"URL-https://kb.vmware.com/s/article/2143838\", \"URL-https://nmap.org/nsedoc/scripts/vmware-version.html\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"VMware vCenter Server <= 6.7 Update 1b (Linux)\", \"VMware vCenter Server <= 6.7 Update 3j (Windows)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:18.852762Z"} 2026-09-08T06:50:18.852762+00:00