{"vulnerability": "CVE-2021-21481", "sightings": [{"uuid": "e181b197-9992-427b-8570-9e775dc8257a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21481", "type": "seen", "source": "https://t.me/cibsecurity/24606", "content": "\u203c CVE-2021-21481 \u203c\n\nThe MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-09T18:51:51.000000Z"}, {"uuid": "fab330f8-2931-45e7-9359-233b5af03b6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21481", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/3597", "content": "#Threat_Research\n1. Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection\nhttps://github.com/LordNoteworthy/al-khaser\n2. About the Unsuccessful Quest for a Deserialization Gadget (CVE-2021-21481)\nhttps://codewhitesec.blogspot.com/2021/06/about-unsuccessful-quest-for.html", "creation_timestamp": "2022-06-03T18:50:37.000000Z"}, {"uuid": "f62c49cb-c41e-41d3-8eaa-5c33dbee56d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21481", "type": "seen", "source": "https://t.me/cissp/3395", "content": "Search for security bugs in the pre-\ud83d\udc4d\ud83c\udffdinstalled apps on Samsung devices\nhttps://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1\n\nBlue Team Techniques\n1. Proxy Windows Tooling via SOCKS\nhttps://posts.specterops.io/proxy-windows-tooling-via-socks-c1af66daeef3\n2. HaE - BurpSuite Highlighter and Extractor\ud83d\ude01\nhttps://github.com/gh0stkey/HaE\n\nRed Team Tactics \n1. Hiding your syscalls\nhttps://passthehashbrowns.github.io/hiding-your-syscalls\n2. Full DLL Unhooking with C++\nhttps://www.ired.team/offensive-security/defense-evasion/how-to-unhook-a-dll-using-c++\n3. EDR Evasion: Unhooking Dll's with C#\nhttps://makosecblog.com/malware-dev/dll-unhooking-csharp\n\nThreat Research\n1. Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection\ud83d\udc4d\ud83c\udffd\u270c\ud83c\udffc\nhttps://github.com/LordNoteworthy/al-khaser\n2. About the Unsuccessful Quest for a Deserialization Gadget (CVE-2021-21481)\nhttps://codewhitesec.blogspot.com/2021/06/about-unsuccessful-quest-for.html?m=1", "creation_timestamp": "2026-09-01T17:00:48.607546Z"}, {"uuid": "817b7dfa-ef08-4bf9-818e-5c06a39d8730", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21481", "type": "seen", "source": "https://t.me/cissp/3395", "content": "Search for security bugs in the pre-\ud83d\udc4d\ud83c\udffdinstalled apps on Samsung devices\nhttps://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1\n\nBlue Team Techniques\n1. Proxy Windows Tooling via SOCKS\nhttps://posts.specterops.io/proxy-windows-tooling-via-socks-c1af66daeef3\n2. HaE - BurpSuite Highlighter and Extractor\ud83d\ude01\nhttps://github.com/gh0stkey/HaE\n\nRed Team Tactics \n1. Hiding your syscalls\nhttps://passthehashbrowns.github.io/hiding-your-syscalls\n2. Full DLL Unhooking with C++\nhttps://www.ired.team/offensive-security/defense-evasion/how-to-unhook-a-dll-using-c++\n3. EDR Evasion: Unhooking Dll's with C#\nhttps://makosecblog.com/malware-dev/dll-unhooking-csharp\n\nThreat Research\n1. Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection\ud83d\udc4d\ud83c\udffd\u270c\ud83c\udffc\nhttps://github.com/LordNoteworthy/al-khaser\n2. About the Unsuccessful Quest for a Deserialization Gadget (CVE-2021-21481)\nhttps://codewhitesec.blogspot.com/2021/06/about-unsuccessful-quest-for.html?m=1", "creation_timestamp": "2026-09-02T01:04:35.888857Z"}, {"uuid": "821e61da-c70b-4def-9784-7ba15ab519d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21481", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3395", "content": "Search for security bugs in the pre-\ud83d\udc4d\ud83c\udffdinstalled apps on Samsung devices\nhttps://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1\n\nBlue Team Techniques\n1. Proxy Windows Tooling via SOCKS\nhttps://posts.specterops.io/proxy-windows-tooling-via-socks-c1af66daeef3\n2. HaE - BurpSuite Highlighter and Extractor\ud83d\ude01\nhttps://github.com/gh0stkey/HaE\n\nRed Team Tactics \n1. Hiding your syscalls\nhttps://passthehashbrowns.github.io/hiding-your-syscalls\n2. Full DLL Unhooking with C++\nhttps://www.ired.team/offensive-security/defense-evasion/how-to-unhook-a-dll-using-c++\n3. EDR Evasion: Unhooking Dll's with C#\nhttps://makosecblog.com/malware-dev/dll-unhooking-csharp\n\nThreat Research\n1. Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection\ud83d\udc4d\ud83c\udffd\u270c\ud83c\udffc\nhttps://github.com/LordNoteworthy/al-khaser\n2. About the Unsuccessful Quest for a Deserialization Gadget (CVE-2021-21481)\nhttps://codewhitesec.blogspot.com/2021/06/about-unsuccessful-quest-for.html?m=1", "creation_timestamp": "2026-09-11T04:00:05.243057Z"}]}