{"vulnerability": "cve-2021-1791", "sightings": [{"uuid": "324fec0c-62b2-4d2a-a199-b315a1001416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1791", "type": "seen", "source": "https://gist.github.com/h0medev2024/3c86fc0e9234786e66c18835b9c71fd9", "content": "", "creation_timestamp": "2025-05-24T06:42:30.000000Z"}, {"uuid": "d188b55c-71ab-43d5-a075-bd13ac6ec32f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1791", "type": "seen", "source": "https://gist.github.com/vrtcode/80e31c8519ce0bb494287edd76f79aaf", "content": "", "creation_timestamp": "2026-02-17T04:19:42.000000Z"}, {"uuid": "716824df-c245-4eda-abac-6f76d97d7297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1791", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2628", "content": "#exploit\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320", "creation_timestamp": "2024-10-09T19:21:22.000000Z"}, {"uuid": "9c166468-4ea1-4f00-b453-939cd718d3b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1791", "type": "seen", "source": "https://t.me/cissp/2280", "content": "SCADA Security\nThe Rockwell Automation Allen-Bradley Flex I/O input/output device is vulnerable to a denial-of-service vulnerability (PoC for CVE-2020-6088)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1008\n\nMalware analysis\n1. Excel spreadsheets push SystemBC malware\nhttps://isc.sans.edu/diary/rss/27060\n2. New Example of XSL Script Processing aka \"Mitre T1220\"\nhttps://isc.sans.edu/forums/diary/New+Example+of+XSL+Script+Processing+aka+Mitre+T1220/27056\n3. Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests\nhttps://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests\n4. Kobalos - A complex Linux threat to high performance computing infrastructure\nhttps://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure\n]-> Report in .pdf:\nhttps://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf\n\nThe INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20\n\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read PoC\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320\n\nThreat Research\n1. Spoofing and Attacking With Skype (PoC):\n- Spoofing Links/File Names/File Size/Shared Contacts\n- Crash Skype For Any User\n- Spear Phishing With Skype\u2019s Domain\n- Breaking Out Of The Chat Bubble\nhttps://blog.thecybersecuritytutor.com/spoofing-and-attacking-with-skype\n2. The State of 0-day In the Wild Exploitation\nhttps://github.com/maddiestone/ConPresentations/blob/master/Enigma2021.StateOf0day.pdf", "creation_timestamp": "2026-09-01T17:01:02.551478Z"}, {"uuid": "20f0bd05-7999-48df-ba76-346b669f2b62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1791", "type": "seen", "source": "https://t.me/cissp/2280", "content": "SCADA Security\nThe Rockwell Automation Allen-Bradley Flex I/O input/output device is vulnerable to a denial-of-service vulnerability (PoC for CVE-2020-6088)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1008\n\nMalware analysis\n1. Excel spreadsheets push SystemBC malware\nhttps://isc.sans.edu/diary/rss/27060\n2. New Example of XSL Script Processing aka \"Mitre T1220\"\nhttps://isc.sans.edu/forums/diary/New+Example+of+XSL+Script+Processing+aka+Mitre+T1220/27056\n3. Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests\nhttps://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests\n4. Kobalos - A complex Linux threat to high performance computing infrastructure\nhttps://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure\n]-> Report in .pdf:\nhttps://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf\n\nThe INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20\n\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read PoC\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320\n\nThreat Research\n1. Spoofing and Attacking With Skype (PoC):\n- Spoofing Links/File Names/File Size/Shared Contacts\n- Crash Skype For Any User\n- Spear Phishing With Skype\u2019s Domain\n- Breaking Out Of The Chat Bubble\nhttps://blog.thecybersecuritytutor.com/spoofing-and-attacking-with-skype\n2. The State of 0-day In the Wild Exploitation\nhttps://github.com/maddiestone/ConPresentations/blob/master/Enigma2021.StateOf0day.pdf", "creation_timestamp": "2026-09-02T01:04:53.180400Z"}, {"uuid": "be0f8bff-56c6-4406-ae49-5112ad4f924d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1791", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2280", "content": "SCADA Security\nThe Rockwell Automation Allen-Bradley Flex I/O input/output device is vulnerable to a denial-of-service vulnerability (PoC for CVE-2020-6088)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1008\n\nMalware analysis\n1. Excel spreadsheets push SystemBC malware\nhttps://isc.sans.edu/diary/rss/27060\n2. New Example of XSL Script Processing aka \"Mitre T1220\"\nhttps://isc.sans.edu/forums/diary/New+Example+of+XSL+Script+Processing+aka+Mitre+T1220/27056\n3. Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests\nhttps://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests\n4. Kobalos - A complex Linux threat to high performance computing infrastructure\nhttps://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure\n]-> Report in .pdf:\nhttps://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf\n\nThe INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20\n\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read PoC\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320\n\nThreat Research\n1. Spoofing and Attacking With Skype (PoC):\n- Spoofing Links/File Names/File Size/Shared Contacts\n- Crash Skype For Any User\n- Spear Phishing With Skype\u2019s Domain\n- Breaking Out Of The Chat Bubble\nhttps://blog.thecybersecuritytutor.com/spoofing-and-attacking-with-skype\n2. The State of 0-day In the Wild Exploitation\nhttps://github.com/maddiestone/ConPresentations/blob/master/Enigma2021.StateOf0day.pdf", "creation_timestamp": "2026-09-11T19:00:05.256239Z"}, {"uuid": "c9652e1b-2ad9-476c-8e1a-3c0d4f9e8be6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1791", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2280", "content": "SCADA Security\nThe Rockwell Automation Allen-Bradley Flex I/O input/output device is vulnerable to a denial-of-service vulnerability (PoC for CVE-2020-6088)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1008\n\nMalware analysis\n1. Excel spreadsheets push SystemBC malware\nhttps://isc.sans.edu/diary/rss/27060\n2. New Example of XSL Script Processing aka \"Mitre T1220\"\nhttps://isc.sans.edu/forums/diary/New+Example+of+XSL+Script+Processing+aka+Mitre+T1220/27056\n3. Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests\nhttps://decoded.avast.io/janvojtesek/backdoored-browser-extensions-hid-malicious-traffic-in-analytics-requests\n4. Kobalos - A complex Linux threat to high performance computing infrastructure\nhttps://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure\n]-> Report in .pdf:\nhttps://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf\n\nThe INFILTRATE effect: 6 bugs in 6 months (PoCs):\n- LPE via xscreensaver (CVE-2019-3010);\n- Low impact information disclosure via Solaris xlock (CVE-2020-2656);\n- LPE via CDE (CVE-2020-2696, CVE-2020-2944);\n- Stack-based buffer overflow in CDE libDtSvc (CVE-2020-2851);\n- Heap-based buffer overflow in Solaris whodo and w commands (CVE-2020-2771)\nhttps://github.com/0xdea/raptor_infiltrate20\n\nCVE-2021-1791:\nApple macOS - Fairplay OOB Read PoC\nhttps://gist.github.com/pwn0rz/e34ab9f6e46956621a9d4f98cf222320\n\nThreat Research\n1. Spoofing and Attacking With Skype (PoC):\n- Spoofing Links/File Names/File Size/Shared Contacts\n- Crash Skype For Any User\n- Spear Phishing With Skype\u2019s Domain\n- Breaking Out Of The Chat Bubble\nhttps://blog.thecybersecuritytutor.com/spoofing-and-attacking-with-skype\n2. The State of 0-day In the Wild Exploitation\nhttps://github.com/maddiestone/ConPresentations/blob/master/Enigma2021.StateOf0day.pdf", "creation_timestamp": "2026-09-12T00:00:32.418638Z"}]}