{"vulnerability": "cve-2021-30128", "sightings": [{"uuid": "6fdee42e-068c-415a-a608-19178fbc8605", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30128", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-30128.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "7cc7f6ca-acce-4076-b87e-76f8e66487c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30128", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3260", "content": "#exploit\nCVE-2021-30128:\nApache OFBiz has unsafe deserialization prior to 17.12.07 version (PoC)\nhttps://github.com/LioTree/CVE-2021-30128-EXP", "creation_timestamp": "2021-05-01T12:41:31.000000Z"}, {"uuid": "f97eabea-b56a-4cc3-9880-cbe40f70940c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30128", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/07ba7d04-e340-4a57-90b9-b292c1ce1506", "content": "", "creation_timestamp": "2026-06-23T14:02:56.048750Z"}, {"uuid": "d10b3d39-280b-4915-82ab-a6b24b50ae04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30128", "type": "seen", "source": "https://t.me/cissp/3085", "content": "Red Team Tactics:\n1. Red Team engagement platform with the goal of unifying offensive tools behind a simple UI\ud83d\ude0a\nhttps://github.com/KCarretto/paragon\n2. Bypass UAC by hijacking a DLL located in the Native Image Cache\nhttps://github.com/AzAgarampur/byeintegrity-uac#uacme\n\nMalware analysis:\n1. Ragnarok Ransomware\nhttps://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware\n2. RotaJakiro: A secret backdoor with 0 VT detection\nhttps://blog.netlab.360.com/stealth_rotajakiro_backdoor_en\n\nexploit\nCVE-2021-30128:\nApache OFBiz has unsafe deserialization prior to 17.12.07 version (PoC)\nhttps://github.com/LioTree/CVE-2021-30128-EXP\n\nThreat Research:\n1. KDC Spoofing Vulnerability in F5 Big-IP (CVE-2021-23008)\ud83d\ude42\nhttps://www.silverfort.com/blog/silverfort-researchers-discover-kdc-spoofing-vulnerability-in-f5-big-ip-cve-2021-23008\n2. UNC2447 SOMBRAT/FIVEHANDS Ransomware:\ud83d\ude2d\nA Sophisticated Financial Threat\nhttps://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html\n\nCVE-2021-29921 - python stdlib \"ipaddress\" - Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF/RFI vulnerabilities. - \"ipaddress leading zeros in IPv4 address\" (PoC)\nhttps://sick.codes/sick-2021-014", "creation_timestamp": "2026-09-01T17:00:52.319589Z"}, {"uuid": "a92ac2f2-4403-488e-be9e-990a6da5eac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30128", "type": "seen", "source": "https://t.me/cissp/3085", "content": "Red Team Tactics:\n1. Red Team engagement platform with the goal of unifying offensive tools behind a simple UI\ud83d\ude0a\nhttps://github.com/KCarretto/paragon\n2. Bypass UAC by hijacking a DLL located in the Native Image Cache\nhttps://github.com/AzAgarampur/byeintegrity-uac#uacme\n\nMalware analysis:\n1. Ragnarok Ransomware\nhttps://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware\n2. RotaJakiro: A secret backdoor with 0 VT detection\nhttps://blog.netlab.360.com/stealth_rotajakiro_backdoor_en\n\nexploit\nCVE-2021-30128:\nApache OFBiz has unsafe deserialization prior to 17.12.07 version (PoC)\nhttps://github.com/LioTree/CVE-2021-30128-EXP\n\nThreat Research:\n1. KDC Spoofing Vulnerability in F5 Big-IP (CVE-2021-23008)\ud83d\ude42\nhttps://www.silverfort.com/blog/silverfort-researchers-discover-kdc-spoofing-vulnerability-in-f5-big-ip-cve-2021-23008\n2. UNC2447 SOMBRAT/FIVEHANDS Ransomware:\ud83d\ude2d\nA Sophisticated Financial Threat\nhttps://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html\n\nCVE-2021-29921 - python stdlib \"ipaddress\" - Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF/RFI vulnerabilities. - \"ipaddress leading zeros in IPv4 address\" (PoC)\nhttps://sick.codes/sick-2021-014", "creation_timestamp": "2026-09-02T01:04:41.299863Z"}, {"uuid": "c52e2362-daf1-45dc-8488-f4c420cc3687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30128", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3085", "content": "Red Team Tactics:\n1. Red Team engagement platform with the goal of unifying offensive tools behind a simple UI\ud83d\ude0a\nhttps://github.com/KCarretto/paragon\n2. Bypass UAC by hijacking a DLL located in the Native Image Cache\nhttps://github.com/AzAgarampur/byeintegrity-uac#uacme\n\nMalware analysis:\n1. Ragnarok Ransomware\nhttps://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware\n2. RotaJakiro: A secret backdoor with 0 VT detection\nhttps://blog.netlab.360.com/stealth_rotajakiro_backdoor_en\n\nexploit\nCVE-2021-30128:\nApache OFBiz has unsafe deserialization prior to 17.12.07 version (PoC)\nhttps://github.com/LioTree/CVE-2021-30128-EXP\n\nThreat Research:\n1. KDC Spoofing Vulnerability in F5 Big-IP (CVE-2021-23008)\ud83d\ude42\nhttps://www.silverfort.com/blog/silverfort-researchers-discover-kdc-spoofing-vulnerability-in-f5-big-ip-cve-2021-23008\n2. UNC2447 SOMBRAT/FIVEHANDS Ransomware:\ud83d\ude2d\nA Sophisticated Financial Threat\nhttps://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html\n\nCVE-2021-29921 - python stdlib \"ipaddress\" - Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF/RFI vulnerabilities. - \"ipaddress leading zeros in IPv4 address\" (PoC)\nhttps://sick.codes/sick-2021-014", "creation_timestamp": "2026-09-11T08:00:08.193486Z"}, {"uuid": "8e526259-27c8-4a17-b70a-e842038e27f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30128", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3085", "content": "Red Team Tactics:\n1. Red Team engagement platform with the goal of unifying offensive tools behind a simple UI\ud83d\ude0a\nhttps://github.com/KCarretto/paragon\n2. Bypass UAC by hijacking a DLL located in the Native Image Cache\nhttps://github.com/AzAgarampur/byeintegrity-uac#uacme\n\nMalware analysis:\n1. Ragnarok Ransomware\nhttps://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware\n2. RotaJakiro: A secret backdoor with 0 VT detection\nhttps://blog.netlab.360.com/stealth_rotajakiro_backdoor_en\n\nexploit\nCVE-2021-30128:\nApache OFBiz has unsafe deserialization prior to 17.12.07 version (PoC)\nhttps://github.com/LioTree/CVE-2021-30128-EXP\n\nThreat Research:\n1. KDC Spoofing Vulnerability in F5 Big-IP (CVE-2021-23008)\ud83d\ude42\nhttps://www.silverfort.com/blog/silverfort-researchers-discover-kdc-spoofing-vulnerability-in-f5-big-ip-cve-2021-23008\n2. UNC2447 SOMBRAT/FIVEHANDS Ransomware:\ud83d\ude2d\nA Sophisticated Financial Threat\nhttps://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html\n\nCVE-2021-29921 - python stdlib \"ipaddress\" - Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF/RFI vulnerabilities. - \"ipaddress leading zeros in IPv4 address\" (PoC)\nhttps://sick.codes/sick-2021-014", "creation_timestamp": "2026-09-12T00:00:47.741863Z"}]}