{"vulnerability": "cve-2021-1499", "sightings": [{"uuid": "7829263d-f5fe-4480-bc47-3f3ff1a48a54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-1499.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "4d50a532-46da-4824-b588-2265d95795e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "fdce11a4-8fe4-4940-8214-98e588321916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:33.000000Z"}, {"uuid": "196f30c9-aab3-41c5-9dd1-3545da4c8cdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cisco_hyperflex_file_upload_rce.rb", "content": "", "creation_timestamp": "2021-06-17T17:48:07.000000Z"}, {"uuid": "d45727db-4116-4c13-b7de-4bb5259fcf52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "seen", "source": "https://t.me/ptswarm/34", "content": "Cisco fixed two Unauth RCEs and an Arbitrary File Upload in HyperFlex HX Data Platform found by our researchers Nikita Abramov and Mikhail Klyuchnikov.\n\nCVE-2021-1497\nCVE-2021-1498\nCVE-2021-1499\n\nAdvisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR", "creation_timestamp": "2021-05-06T13:51:34.000000Z"}, {"uuid": "5fe14841-83a4-4676-a26f-c8f77e3dae92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/680", "content": "CVE-2021-1499 Cisco HyperFlex HX Data Platform \u6587\u4ef6\u4e0a\u50b3&\u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-1499_Cisco_HyperFlex_HX_Data_Platform_%E6%96%87%E4%BB%B6%E4%B8%8A%E5%82%B3%26%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-06-20T01:57:48.000000Z"}, {"uuid": "4b601e2a-a331-4f67-91f5-53a475fb0538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4424", "content": "#Threat_Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings", "creation_timestamp": "2021-10-02T16:33:01.000000Z"}, {"uuid": "ef08e0f2-c593-41be-a20d-1e22ff3dac4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "seen", "source": "https://t.me/cissp/4519", "content": "Malware analysis\n1. GriftHorse Android Trojan\nhttps://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally\n2. GhostEmperor: From ProxyLogon to kernel mode\nhttps://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407\n\nThreat Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings\n\nRed Team Tactics\n1. Determine if the WebClient Service (WebDAV) is running on a remote system\nhttps://github.com/xforcered/GetWebDAVStatus\n2. Invoke-DLLClone - Koppeling x Metatwin x LazySign\nhttps://redteamer.tips/appdata-is-a-mistake-introducing-invoke-dllclone\n]-> https://github.com/jfmaes/Invoke-DLLClone\n\nexploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604\n\n\n\u200e", "creation_timestamp": "2026-09-01T17:00:39.208142Z"}, {"uuid": "4bb8259f-60fb-43fb-a938-1fbea29b4568", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "seen", "source": "https://t.me/cissp/4519", "content": "Malware analysis\n1. GriftHorse Android Trojan\nhttps://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally\n2. GhostEmperor: From ProxyLogon to kernel mode\nhttps://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407\n\nThreat Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings\n\nRed Team Tactics\n1. Determine if the WebClient Service (WebDAV) is running on a remote system\nhttps://github.com/xforcered/GetWebDAVStatus\n2. Invoke-DLLClone - Koppeling x Metatwin x LazySign\nhttps://redteamer.tips/appdata-is-a-mistake-introducing-invoke-dllclone\n]-> https://github.com/jfmaes/Invoke-DLLClone\n\nexploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604\n\n\n\u200e", "creation_timestamp": "2026-09-02T01:04:24.401862Z"}, {"uuid": "23ba85fb-4013-468c-b313-073a48578a7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cisco_hyperflex_file_upload_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java, x86, x64\", \"author\": [\"Nikita Abramov\", \"Mikhail Klyuchnikov\", \"wvu \", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated file upload vulnerability in\\n          Cisco HyperFlex HX Data Platform's /upload endpoint to upload and\\n          execute a payload as the Tomcat user.\", \"disclosure_date\": \"2021-05-05\", \"fullname\": \"exploit/linux/http/cisco_hyperflex_file_upload_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499)\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/cisco_hyperflex_file_upload_rce.rb\", \"platform\": \"Java,Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/cisco_hyperflex_file_upload_rce\", \"references\": [\"CVE-2021-1499\", \"URL-https://attackerkb.com/assessments/82738621-1114-4aba-990a-9ea007b05834\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Java Dropper\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:26.903584Z"}, {"uuid": "1148bf19-2a7a-44f9-905e-2982a594313c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4519", "content": "Malware analysis\n1. GriftHorse Android Trojan\nhttps://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally\n2. GhostEmperor: From ProxyLogon to kernel mode\nhttps://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407\n\nThreat Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings\n\nRed Team Tactics\n1. Determine if the WebClient Service (WebDAV) is running on a remote system\nhttps://github.com/xforcered/GetWebDAVStatus\n2. Invoke-DLLClone - Koppeling x Metatwin x LazySign\nhttps://redteamer.tips/appdata-is-a-mistake-introducing-invoke-dllclone\n]-> https://github.com/jfmaes/Invoke-DLLClone\n\nexploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604\n\n\n\u200e", "creation_timestamp": "2026-09-10T18:00:05.012798Z"}, {"uuid": "d166d11b-dc74-4340-ab06-4d66e0d00abd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1499", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4519", "content": "Malware analysis\n1. GriftHorse Android Trojan\nhttps://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally\n2. GhostEmperor: From ProxyLogon to kernel mode\nhttps://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407\n\nThreat Research\nCisco Hyperflex:\nRCE Through Login Form and Other Findings (CVE-2021-1497, CVE-2021-1498, CVE-2021-1499)\nhttps://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings\n\nRed Team Tactics\n1. Determine if the WebClient Service (WebDAV) is running on a remote system\nhttps://github.com/xforcered/GetWebDAVStatus\n2. Invoke-DLLClone - Koppeling x Metatwin x LazySign\nhttps://redteamer.tips/appdata-is-a-mistake-introducing-invoke-dllclone\n]-> https://github.com/jfmaes/Invoke-DLLClone\n\nexploit\nCVE-2021-24604 :\nThe Availability Calendar WordPress plugin <1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed\nhttps://github.com/AlAIAL90/CVE-2021-24604\n\n\n\u200e", "creation_timestamp": "2026-09-11T00:00:31.012145Z"}]}