https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 11 Sep 2026 22:31:51 +0000 https://vulnerability.circl.lu/sighting/908cc7cf-3e86-4556-9976-4778f36b6891/export {"uuid": "908cc7cf-3e86-4556-9976-4778f36b6891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2443", "content": "Threat_Research\n1. Emails Disclosure on WordPress\nhttps://www.gosecure.net/blog/2021/03/02/emails-disclosure-on-wordpress\n\n2. Pre-Auth RCE in VMware ESXI (PoC for CVE-2020-3992, CVE-2021-21974)\nhttps://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\n\n3. A Preauth RCE to Root Chain on D-Link DAP-2020 (PoC)\nhttps://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html", "creation_timestamp": "2026-09-11T18:00:05.130433Z"} {"uuid": "908cc7cf-3e86-4556-9976-4778f36b6891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2443", "content": "Threat_Research\n1. Emails Disclosure on WordPress\nhttps://www.gosecure.net/blog/2021/03/02/emails-disclosure-on-wordpress\n\n2. Pre-Auth RCE in VMware ESXI (PoC for CVE-2020-3992, CVE-2021-21974)\nhttps://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\n\n3. A Preauth RCE to Root Chain on D-Link DAP-2020 (PoC)\nhttps://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html", "creation_timestamp": "2026-09-11T18:00:05.130433Z"} https://vulnerability.circl.lu/sighting/908cc7cf-3e86-4556-9976-4778f36b6891/export Fri, 11 Sep 2026 18:00:05 +0000 https://vulnerability.circl.lu/sighting/2082685b-acdc-43f2-baf7-2ff93cbc0f8e/export {"uuid": "2082685b-acdc-43f2-baf7-2ff93cbc0f8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2407", "content": "Red_Team_Tactics\n1. Rootkit Arsenal Guacamole\n// An attempt to restore and adapt to modern Win10 version the Rootkit Arsenal original code sampls. All projects have been ported to x64 and tested on latest Win10 (2004-19041.746)\nhttps://github.com/uf0o/rootkit-arsenal-guacamole\n\n2. CVE-2021-21972 (1-day):\nThe vSphere Client (HTML5) contains a RCE vulnerability in a vCenter Server plugin (PoCs)\nhttps://swarm.ptsecurity.com/unauth-rce-vmware/#more-2477\n]-> https://github.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC\n]-> https://github.com/NS-Sp4ce/CVE-2021-21972\n]-> https://github.com/yaunsky/CVE-2021-21972\n]-> PoC for Unix VCSA:\nhttps://github.com/yaunsky/CVE-2021-21972\n\n3. A solid XSS payload that bypasses Imperva WAF\nclick", "creation_timestamp": "2026-09-11T18:00:05.026273Z"} {"uuid": "2082685b-acdc-43f2-baf7-2ff93cbc0f8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2407", "content": "Red_Team_Tactics\n1. Rootkit Arsenal Guacamole\n// An attempt to restore and adapt to modern Win10 version the Rootkit Arsenal original code sampls. All projects have been ported to x64 and tested on latest Win10 (2004-19041.746)\nhttps://github.com/uf0o/rootkit-arsenal-guacamole\n\n2. CVE-2021-21972 (1-day):\nThe vSphere Client (HTML5) contains a RCE vulnerability in a vCenter Server plugin (PoCs)\nhttps://swarm.ptsecurity.com/unauth-rce-vmware/#more-2477\n]-> https://github.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC\n]-> https://github.com/NS-Sp4ce/CVE-2021-21972\n]-> https://github.com/yaunsky/CVE-2021-21972\n]-> PoC for Unix VCSA:\nhttps://github.com/yaunsky/CVE-2021-21972\n\n3. A solid XSS payload that bypasses Imperva WAF\nclick", "creation_timestamp": "2026-09-11T18:00:05.026273Z"} https://vulnerability.circl.lu/sighting/2082685b-acdc-43f2-baf7-2ff93cbc0f8e/export Fri, 11 Sep 2026 18:00:05 +0000 https://vulnerability.circl.lu/sighting/5af6c2e7-8959-4372-8a64-28fbc145aa3b/export {"uuid": "5af6c2e7-8959-4372-8a64-28fbc145aa3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "seen", "source": "https://t.me/cissp/2394", "content": "https://kb.vmware.com/s/article/82374\n\nVMware addressed a critical remote code execution flaw, tracked as CVE-2021-21972, in vCenter Server virtual infrastructure management platform.", "creation_timestamp": "2026-09-11T18:00:04.924742Z"} {"uuid": "5af6c2e7-8959-4372-8a64-28fbc145aa3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "seen", "source": "https://t.me/cissp/2394", "content": "https://kb.vmware.com/s/article/82374\n\nVMware addressed a critical remote code execution flaw, tracked as CVE-2021-21972, in vCenter Server virtual infrastructure management platform.", "creation_timestamp": "2026-09-11T18:00:04.924742Z"} https://vulnerability.circl.lu/sighting/5af6c2e7-8959-4372-8a64-28fbc145aa3b/export Fri, 11 Sep 2026 18:00:04 +0000 https://vulnerability.circl.lu/sighting/2abde4ec-9c4c-4091-b99b-3059afbc6eb1/export {"uuid": "2abde4ec-9c4c-4091-b99b-3059afbc6eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "seen", "source": "https://t.me/cissp/2545", "content": "https://kb.vmware.com/s/article/76372\n\nVMSA-2021-0002 (CVE-2021-21974)\nhttps://www.vmware.com/security/\nadvisories/VMSA-2021-0002.html\n\nVMSA-2020-0023 (CVE-2020-3992)\nhttps://www.vmware.com/security/advisories/VMSA-2020-0023.html\n\nVMSA-2019-0022 (CVE-2019-5544)\nhttps://www.vmware.com/security/advisories/VMSA-2019-0022.html\n\n\nhttps://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "creation_timestamp": "2026-09-11T16:00:06.551353Z"} {"uuid": "2abde4ec-9c4c-4091-b99b-3059afbc6eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "seen", "source": "https://t.me/cissp/2545", "content": "https://kb.vmware.com/s/article/76372\n\nVMSA-2021-0002 (CVE-2021-21974)\nhttps://www.vmware.com/security/\nadvisories/VMSA-2021-0002.html\n\nVMSA-2020-0023 (CVE-2020-3992)\nhttps://www.vmware.com/security/advisories/VMSA-2020-0023.html\n\nVMSA-2019-0022 (CVE-2019-5544)\nhttps://www.vmware.com/security/advisories/VMSA-2019-0022.html\n\n\nhttps://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "creation_timestamp": "2026-09-11T16:00:06.551353Z"} https://vulnerability.circl.lu/sighting/2abde4ec-9c4c-4091-b99b-3059afbc6eb1/export Fri, 11 Sep 2026 16:00:06 +0000 https://vulnerability.circl.lu/sighting/5e378513-2523-4403-89ce-9554a41cda03/export {"uuid": "5e378513-2523-4403-89ce-9554a41cda03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21975", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2897", "content": "CVE-2021-21975:\nSSRF in VMWare vRealize Operations Manager API < 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials (1-day PoC)\nhttps://github.com/Al1ex/CVE-2021-21975", "creation_timestamp": "2026-09-11T11:00:04.362376Z"} {"uuid": "5e378513-2523-4403-89ce-9554a41cda03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21975", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2897", "content": "CVE-2021-21975:\nSSRF in VMWare vRealize Operations Manager API < 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials (1-day PoC)\nhttps://github.com/Al1ex/CVE-2021-21975", "creation_timestamp": "2026-09-11T11:00:04.362376Z"} https://vulnerability.circl.lu/sighting/5e378513-2523-4403-89ce-9554a41cda03/export Fri, 11 Sep 2026 11:00:04 +0000 https://vulnerability.circl.lu/sighting/045f0da4-9c88-4caa-bc6b-4b6449c6ccc2/export {"uuid": "045f0da4-9c88-4caa-bc6b-4b6449c6ccc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3279", "content": "Offensive security\nApplying the Invisibility Cloak:\nObfuscate C# Tools to Evade Signature-Based Detection\nhttps://securityintelligence.com/posts/invisibility-cloak-obfuscate-c-tools-evade-signature-based-detection\n\nexploit\nVMware\u00a0ESXi OpenSLP heap-overflow vulnerability\nhttps://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2021-21974.py\n]-> RCE PoC walkthrough:\nhttps://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9\n\nRed Team Tactics\n1. Nightly builds of common C# offensive tools\nhttps://github.com/Flangvik/SharpCollection\n2. Red Team tool for exfiltrating the target organization's Google People Directory that you have access to\nhttps://github.com/antman1p/GDir-Thief\n\nWLAN Security\nUbiquiti Networks EdgeOS Improper Certificate Validation RCE Vulnerability/Firmware Update Bug (PoC for CVE-2021-22909)\nhttps://www.zerodayinitiative.com/blog/2021/5/24/cve-2021-22909-digging-into-a-ubiquiti-firmware-update-bug\n\nAccessing Windows Systems Remotely From Linux\ud83d\ude01\nhttps://www.infosecmatter.com/accessing-windows-systems-remotely-from-linux\n// Collection of 30+ methods for accessing remote Windows systems from Linux to execute commands, use remote shell or connect to graphical remote desktop (RDP)", "creation_timestamp": "2026-09-11T05:00:04.851695Z"} {"uuid": "045f0da4-9c88-4caa-bc6b-4b6449c6ccc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21974", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3279", "content": "Offensive security\nApplying the Invisibility Cloak:\nObfuscate C# Tools to Evade Signature-Based Detection\nhttps://securityintelligence.com/posts/invisibility-cloak-obfuscate-c-tools-evade-signature-based-detection\n\nexploit\nVMware\u00a0ESXi OpenSLP heap-overflow vulnerability\nhttps://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2021-21974.py\n]-> RCE PoC walkthrough:\nhttps://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9\n\nRed Team Tactics\n1. Nightly builds of common C# offensive tools\nhttps://github.com/Flangvik/SharpCollection\n2. Red Team tool for exfiltrating the target organization's Google People Directory that you have access to\nhttps://github.com/antman1p/GDir-Thief\n\nWLAN Security\nUbiquiti Networks EdgeOS Improper Certificate Validation RCE Vulnerability/Firmware Update Bug (PoC for CVE-2021-22909)\nhttps://www.zerodayinitiative.com/blog/2021/5/24/cve-2021-22909-digging-into-a-ubiquiti-firmware-update-bug\n\nAccessing Windows Systems Remotely From Linux\ud83d\ude01\nhttps://www.infosecmatter.com/accessing-windows-systems-remotely-from-linux\n// Collection of 30+ methods for accessing remote Windows systems from Linux to execute commands, use remote shell or connect to graphical remote desktop (RDP)", "creation_timestamp": "2026-09-11T05:00:04.851695Z"} https://vulnerability.circl.lu/sighting/045f0da4-9c88-4caa-bc6b-4b6449c6ccc2/export Fri, 11 Sep 2026 05:00:04 +0000 https://vulnerability.circl.lu/sighting/ed7c9cd2-1e6b-4d78-a370-10d1f46597ac/export {"uuid": "ed7c9cd2-1e6b-4d78-a370-10d1f46597ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4885", "content": "Blue_Team_Techniques\n1. How to Detect Azure AD Backdoors:\nIdentity Federation\nhttps://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html\n2. Checks for signature requirements over LDAP\nhttps://github.com/GoSecure/ldap-scanner\n\nRed_Team_Tactics\n1. Finding XSS on .apple.com and building a proof of concept to leak your PII information\nhttps://zseano.medium.com/finding-xss-on-apple-com-and-building-a-proof-of-concept-to-leak-your-pii-information-d7bc93cff2df\n2. Using CVE-2021-40531 for RCE with Sketch\nhttps://jonpalmisc.com/2021/11/22/cve-2021-40531\n\nOffensive_security\nMsfvenom Cheatsheet: Windows Exploitation\nhttps://www.hackingarticles.in/msfvenom-cheatsheet-windows-exploitation\n\n_security\nTesting FIX-backed applications\nhttps://labs.f-secure.com/blog/a-bit-of-a-fixer-upper-playing-with-the-fix-tcp-protocol\n]-> A Burp extension to enable modification of FIX messages when relayed from MitM_Relay:\nhttps://github.com/FSecureLABS/FixerUpper\n\nexploit\nWLAN_Security\n1. CVE-2021-21972:\nPoC Exploit for vCenter\nhttps://github.com/NS-Sp4ce/CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\n2. Exploits the Wii U's bluetooth stack to gain IOSU\nkernel access via bluetooth\nhttps://github.com/GaryOderNichts/bluubomb", "creation_timestamp": "2026-09-11T00:00:37.365458Z"} {"uuid": "ed7c9cd2-1e6b-4d78-a370-10d1f46597ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4885", "content": "Blue_Team_Techniques\n1. How to Detect Azure AD Backdoors:\nIdentity Federation\nhttps://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html\n2. Checks for signature requirements over LDAP\nhttps://github.com/GoSecure/ldap-scanner\n\nRed_Team_Tactics\n1. Finding XSS on .apple.com and building a proof of concept to leak your PII information\nhttps://zseano.medium.com/finding-xss-on-apple-com-and-building-a-proof-of-concept-to-leak-your-pii-information-d7bc93cff2df\n2. Using CVE-2021-40531 for RCE with Sketch\nhttps://jonpalmisc.com/2021/11/22/cve-2021-40531\n\nOffensive_security\nMsfvenom Cheatsheet: Windows Exploitation\nhttps://www.hackingarticles.in/msfvenom-cheatsheet-windows-exploitation\n\n_security\nTesting FIX-backed applications\nhttps://labs.f-secure.com/blog/a-bit-of-a-fixer-upper-playing-with-the-fix-tcp-protocol\n]-> A Burp extension to enable modification of FIX messages when relayed from MitM_Relay:\nhttps://github.com/FSecureLABS/FixerUpper\n\nexploit\nWLAN_Security\n1. CVE-2021-21972:\nPoC Exploit for vCenter\nhttps://github.com/NS-Sp4ce/CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\n2. Exploits the Wii U's bluetooth stack to gain IOSU\nkernel access via bluetooth\nhttps://github.com/GaryOderNichts/bluubomb", "creation_timestamp": "2026-09-11T00:00:37.365458Z"} https://vulnerability.circl.lu/sighting/ed7c9cd2-1e6b-4d78-a370-10d1f46597ac/export Fri, 11 Sep 2026 00:00:37 +0000 https://vulnerability.circl.lu/sighting/4b0b9ae8-72a9-405a-9b1a-e72181d54a2e/export {"uuid": "4b0b9ae8-72a9-405a-9b1a-e72181d54a2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4885", "content": "Blue_Team_Techniques\n1. How to Detect Azure AD Backdoors:\nIdentity Federation\nhttps://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html\n2. Checks for signature requirements over LDAP\nhttps://github.com/GoSecure/ldap-scanner\n\nRed_Team_Tactics\n1. Finding XSS on .apple.com and building a proof of concept to leak your PII information\nhttps://zseano.medium.com/finding-xss-on-apple-com-and-building-a-proof-of-concept-to-leak-your-pii-information-d7bc93cff2df\n2. Using CVE-2021-40531 for RCE with Sketch\nhttps://jonpalmisc.com/2021/11/22/cve-2021-40531\n\nOffensive_security\nMsfvenom Cheatsheet: Windows Exploitation\nhttps://www.hackingarticles.in/msfvenom-cheatsheet-windows-exploitation\n\n_security\nTesting FIX-backed applications\nhttps://labs.f-secure.com/blog/a-bit-of-a-fixer-upper-playing-with-the-fix-tcp-protocol\n]-> A Burp extension to enable modification of FIX messages when relayed from MitM_Relay:\nhttps://github.com/FSecureLABS/FixerUpper\n\nexploit\nWLAN_Security\n1. CVE-2021-21972:\nPoC Exploit for vCenter\nhttps://github.com/NS-Sp4ce/CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\n2. Exploits the Wii U's bluetooth stack to gain IOSU\nkernel access via bluetooth\nhttps://github.com/GaryOderNichts/bluubomb", "creation_timestamp": "2026-09-10T14:00:06.619473Z"} {"uuid": "4b0b9ae8-72a9-405a-9b1a-e72181d54a2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4885", "content": "Blue_Team_Techniques\n1. How to Detect Azure AD Backdoors:\nIdentity Federation\nhttps://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html\n2. Checks for signature requirements over LDAP\nhttps://github.com/GoSecure/ldap-scanner\n\nRed_Team_Tactics\n1. Finding XSS on .apple.com and building a proof of concept to leak your PII information\nhttps://zseano.medium.com/finding-xss-on-apple-com-and-building-a-proof-of-concept-to-leak-your-pii-information-d7bc93cff2df\n2. Using CVE-2021-40531 for RCE with Sketch\nhttps://jonpalmisc.com/2021/11/22/cve-2021-40531\n\nOffensive_security\nMsfvenom Cheatsheet: Windows Exploitation\nhttps://www.hackingarticles.in/msfvenom-cheatsheet-windows-exploitation\n\n_security\nTesting FIX-backed applications\nhttps://labs.f-secure.com/blog/a-bit-of-a-fixer-upper-playing-with-the-fix-tcp-protocol\n]-> A Burp extension to enable modification of FIX messages when relayed from MitM_Relay:\nhttps://github.com/FSecureLABS/FixerUpper\n\nexploit\nWLAN_Security\n1. CVE-2021-21972:\nPoC Exploit for vCenter\nhttps://github.com/NS-Sp4ce/CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\n2. Exploits the Wii U's bluetooth stack to gain IOSU\nkernel access via bluetooth\nhttps://github.com/GaryOderNichts/bluubomb", "creation_timestamp": "2026-09-10T14:00:06.619473Z"} https://vulnerability.circl.lu/sighting/4b0b9ae8-72a9-405a-9b1a-e72181d54a2e/export Thu, 10 Sep 2026 14:00:06 +0000 https://vulnerability.circl.lu/sighting/3f67f39e-9240-472b-8fbe-5a187174db00/export {"uuid": "3f67f39e-9240-472b-8fbe-5a187174db00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21975", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:13.627846Z"} {"uuid": "3f67f39e-9240-472b-8fbe-5a187174db00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21975", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:13.627846Z"} https://vulnerability.circl.lu/sighting/3f67f39e-9240-472b-8fbe-5a187174db00/export Wed, 09 Sep 2026 10:00:13 +0000 https://vulnerability.circl.lu/sighting/dcc06115-2298-497a-ac53-24ec253630d2/export {"uuid": "dcc06115-2298-497a-ac53-24ec253630d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vmware_vcenter_uploadova_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java\", \"author\": [\"Mikhail Klyuchnikov\", \"wvu \", \"mr_me\", \"Viss\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated OVA file upload and path\\n traversal in VMware vCenter Server to write a JSP payload to a\\n web-accessible directory.\\n\\n Fixed versions are 6.5 Update 3n, 6.7 Update 3l, and 7.0 Update 1c.\\n Note that later vulnerable versions of the Linux appliance aren't\\n exploitable via the webshell technique. Furthermore, writing an SSH\\n public key to /home/vsphere-ui/.ssh/authorized_keys works, but the\\n user's non-existent password expires 90 days after install, rendering\\n the technique nearly useless against production environments.\\n\\n You'll have the best luck targeting older versions of the Linux\\n appliance. The Windows target should work ubiquitously.\", \"disclosure_date\": \"2021-02-23\", \"fullname\": \"exploit/multi/http/vmware_vcenter_uploadova_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"VMware vCenter Server Unauthenticated OVA File Upload RCE\", \"needs_cleanup\": true, \"notes\": {\"RelatedModules\": [\"auxiliary/scanner/vmware/esx_fingerprint\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/vmware_vcenter_uploadova_rce.rb\", \"platform\": \"Linux,Windows\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"multi/http/vmware_vcenter_uploadova_rce\", \"references\": [\"CVE-2021-21972\", \"URL-https://www.vmware.com/security/advisories/VMSA-2021-0002.html\", \"URL-https://swarm.ptsecurity.com/unauth-rce-vmware/\", \"URL-https://twitter.com/jas502n/status/1364810720261496843\", \"URL-https://twitter.com/_0xf4n9x_/status/1364905040876503045\", \"URL-https://twitter.com/HackingLZ/status/1364636303606886403\", \"URL-https://kb.vmware.com/s/article/2143838\", \"URL-https://nmap.org/nsedoc/scripts/vmware-version.html\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"VMware vCenter Server <= 6.7 Update 1b (Linux)\", \"VMware vCenter Server <= 6.7 Update 3j (Windows)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:18.852762Z"} {"uuid": "dcc06115-2298-497a-ac53-24ec253630d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21972", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vmware_vcenter_uploadova_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java\", \"author\": [\"Mikhail Klyuchnikov\", \"wvu \", \"mr_me\", \"Viss\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated OVA file upload and path\\n traversal in VMware vCenter Server to write a JSP payload to a\\n web-accessible directory.\\n\\n Fixed versions are 6.5 Update 3n, 6.7 Update 3l, and 7.0 Update 1c.\\n Note that later vulnerable versions of the Linux appliance aren't\\n exploitable via the webshell technique. Furthermore, writing an SSH\\n public key to /home/vsphere-ui/.ssh/authorized_keys works, but the\\n user's non-existent password expires 90 days after install, rendering\\n the technique nearly useless against production environments.\\n\\n You'll have the best luck targeting older versions of the Linux\\n appliance. The Windows target should work ubiquitously.\", \"disclosure_date\": \"2021-02-23\", \"fullname\": \"exploit/multi/http/vmware_vcenter_uploadova_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"VMware vCenter Server Unauthenticated OVA File Upload RCE\", \"needs_cleanup\": true, \"notes\": {\"RelatedModules\": [\"auxiliary/scanner/vmware/esx_fingerprint\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/vmware_vcenter_uploadova_rce.rb\", \"platform\": \"Linux,Windows\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"multi/http/vmware_vcenter_uploadova_rce\", \"references\": [\"CVE-2021-21972\", \"URL-https://www.vmware.com/security/advisories/VMSA-2021-0002.html\", \"URL-https://swarm.ptsecurity.com/unauth-rce-vmware/\", \"URL-https://twitter.com/jas502n/status/1364810720261496843\", \"URL-https://twitter.com/_0xf4n9x_/status/1364905040876503045\", \"URL-https://twitter.com/HackingLZ/status/1364636303606886403\", \"URL-https://kb.vmware.com/s/article/2143838\", \"URL-https://nmap.org/nsedoc/scripts/vmware-version.html\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"VMware vCenter Server <= 6.7 Update 1b (Linux)\", \"VMware vCenter Server <= 6.7 Update 3j (Windows)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:18.852762Z"} https://vulnerability.circl.lu/sighting/dcc06115-2298-497a-ac53-24ec253630d2/export Tue, 08 Sep 2026 06:50:18 +0000