{"vulnerability": "CVE-2021-1758", "sightings": [{"uuid": "4706c4c7-6038-42bf-b08a-829aa7973417", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1758", "type": "seen", "source": "https://t.me/arpsyndicate/700", "content": "#ExploitObserverAlert\n\nCVE-2021-1758\n\nDESCRIPTION: Exploit Observer has 6 entries related to CVE-2021-1758. An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.\n\nFIRST-EPSS: 0.002840000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-11-29T08:28:19.000000Z"}, {"uuid": "f21f107b-a67d-4e83-9553-7cf94accff72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1758", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3225", "content": "#exploit\nmacOS/iOS FontParser Exploits\n\n1. CVE-2021-1758:\nmacOS 10.15/iOS CoreText Out-Of-Bounds Read\nhttps://starlabs.sg/advisories/21-1758\n\n2. CVE-2021-1790:\nmacOS 10.15/iOS CoreText libhvf Out-Of-Bounds Read\nhttps://starlabs.sg/advisories/21-1790", "creation_timestamp": "2024-09-25T16:50:25.000000Z"}, {"uuid": "729965c0-3903-4808-81e4-a21b173c9d35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1758", "type": "seen", "source": "https://t.me/cissp/3052", "content": "Threat Research:\n1. Hypervisor Research Notes\nhttps://github.com/farazsth98/hypervisor_research_notes\n2. DRDoS warning: deep analysis of TCP reflection\nhttps://paper.seebug.org/1571\n\nBlue Team Techniques:\n1. A python tool to parse Windows Background Intelligent Transfer Service (BITS) database files\ud83d\ude2c\nhttps://github.com/fireeye/BitsParser\n2. SSH Sniffing (SSH Spying) Methods and Defense\ud83d\ude03\nhttps://www.infosecmatter.com/ssh-sniffing-ssh-spying-methods-and-defense\n\nTapJacking Attacks, a thorough guide:\nPart 1:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-2cd6486d0fc9\nPart 2:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-part-2-3b0390602a81\nPart 3:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-last-part-3-f19614314b7\n\nexploit\nmacOS/iOS FontParser Exploits\nCVE-2021-1758:\nmacOS 10.15 /iOS CoreText Out-Of-Bounds Read (PoC)\nhttps://starlabs.sg/advisories/21-1758\n\nCVE-2021-1790:\nmacOS 10.15/iOS CoreText libhvf Out-Of-Bounds Read (PoC)\nhttps://starlabs.sg/advisories/21-1790\n\nAdvanced IRC bot/botnet PoC\nhttps://github.com/trackmastersteve/HackServ\n\nRed Team Tactics:\n1. XXE\n// Exploiting XXE to perform SSRF attacks, Blind XXE vulnerabilities, XInclude attacks, XXE attacks via file upload\nhttps://newrouge.medium.com/xxe-from-zero-to-hero-b38118750556\n2. Hacking GraphQL\nPart 1:  https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-1-understanding-graphql-basics-72bb3dd22efa\nPart 2:  https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-2-methodology-and-examples-5992093bcc24", "creation_timestamp": "2026-09-01T17:00:52.733443Z"}, {"uuid": "7faf850f-81c3-4776-8a75-da17c531f111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1758", "type": "seen", "source": "https://t.me/cissp/3052", "content": "Threat Research:\n1. Hypervisor Research Notes\nhttps://github.com/farazsth98/hypervisor_research_notes\n2. DRDoS warning: deep analysis of TCP reflection\nhttps://paper.seebug.org/1571\n\nBlue Team Techniques:\n1. A python tool to parse Windows Background Intelligent Transfer Service (BITS) database files\ud83d\ude2c\nhttps://github.com/fireeye/BitsParser\n2. SSH Sniffing (SSH Spying) Methods and Defense\ud83d\ude03\nhttps://www.infosecmatter.com/ssh-sniffing-ssh-spying-methods-and-defense\n\nTapJacking Attacks, a thorough guide:\nPart 1:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-2cd6486d0fc9\nPart 2:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-part-2-3b0390602a81\nPart 3:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-last-part-3-f19614314b7\n\nexploit\nmacOS/iOS FontParser Exploits\nCVE-2021-1758:\nmacOS 10.15 /iOS CoreText Out-Of-Bounds Read (PoC)\nhttps://starlabs.sg/advisories/21-1758\n\nCVE-2021-1790:\nmacOS 10.15/iOS CoreText libhvf Out-Of-Bounds Read (PoC)\nhttps://starlabs.sg/advisories/21-1790\n\nAdvanced IRC bot/botnet PoC\nhttps://github.com/trackmastersteve/HackServ\n\nRed Team Tactics:\n1. XXE\n// Exploiting XXE to perform SSRF attacks, Blind XXE vulnerabilities, XInclude attacks, XXE attacks via file upload\nhttps://newrouge.medium.com/xxe-from-zero-to-hero-b38118750556\n2. Hacking GraphQL\nPart 1:  https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-1-understanding-graphql-basics-72bb3dd22efa\nPart 2:  https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-2-methodology-and-examples-5992093bcc24", "creation_timestamp": "2026-09-02T01:04:42.698494Z"}, {"uuid": "8d388bc8-b2d3-48e1-b7ef-9941026c4d0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1758", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3052", "content": "Threat Research:\n1. Hypervisor Research Notes\nhttps://github.com/farazsth98/hypervisor_research_notes\n2. DRDoS warning: deep analysis of TCP reflection\nhttps://paper.seebug.org/1571\n\nBlue Team Techniques:\n1. A python tool to parse Windows Background Intelligent Transfer Service (BITS) database files\ud83d\ude2c\nhttps://github.com/fireeye/BitsParser\n2. SSH Sniffing (SSH Spying) Methods and Defense\ud83d\ude03\nhttps://www.infosecmatter.com/ssh-sniffing-ssh-spying-methods-and-defense\n\nTapJacking Attacks, a thorough guide:\nPart 1:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-2cd6486d0fc9\nPart 2:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-part-2-3b0390602a81\nPart 3:  https://valsamaras.medium.com/tapjacking-attacks-a-thorough-guide-last-part-3-f19614314b7\n\nexploit\nmacOS/iOS FontParser Exploits\nCVE-2021-1758:\nmacOS 10.15 /iOS CoreText Out-Of-Bounds Read (PoC)\nhttps://starlabs.sg/advisories/21-1758\n\nCVE-2021-1790:\nmacOS 10.15/iOS CoreText libhvf Out-Of-Bounds Read (PoC)\nhttps://starlabs.sg/advisories/21-1790\n\nAdvanced IRC bot/botnet PoC\nhttps://github.com/trackmastersteve/HackServ\n\nRed Team Tactics:\n1. XXE\n// Exploiting XXE to perform SSRF attacks, Blind XXE vulnerabilities, XInclude attacks, XXE attacks via file upload\nhttps://newrouge.medium.com/xxe-from-zero-to-hero-b38118750556\n2. Hacking GraphQL\nPart 1:  https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-1-understanding-graphql-basics-72bb3dd22efa\nPart 2:  https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-2-methodology-and-examples-5992093bcc24", "creation_timestamp": "2026-09-11T08:00:07.564229Z"}]}