{"vulnerability": "cve-2021-3864", "sightings": [{"uuid": "2aa4540e-4527-4c51-9dce-072220bca26c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "ecbbfae8-b93a-452a-890d-904f34cba506", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/adf17496-6707-44ba-8601-10ab486eb92f", "content": "", "creation_timestamp": "2021-09-17T13:41:39.000000Z"}, {"uuid": "3d1ed366-303d-457a-9670-328c31ff0f89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "ca2e788b-1665-4898-9b8f-0fee78e8a0aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "618993be-9037-426b-be57-3bb389f9b640", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "d1f1cae7-d134-461e-be65-c6d08d145002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "29ccad2e-3937-4f75-abd1-33d95e45213b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "1d733d1b-ad78-498a-8bef-2457f8112acb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "b6825653-6f44-471f-8a33-ca38ffd6dc30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:19.000000Z"}, {"uuid": "8fb7de5f-9b04-44d8-8d58-e1625214c79e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/39000112-e2b5-4051-9f87-35bec53b4ff5", "content": "", "creation_timestamp": "2021-09-22T15:53:32.000000Z"}, {"uuid": "ad82c408-bd5f-4bf7-a94c-f6b93c37bc71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:32:43.000000Z"}, {"uuid": "31550b47-689b-41d2-bda7-80e6786def43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:32:43.000000Z"}, {"uuid": "ddd99e50-d3d5-4694-852a-f685d992d02f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "95a9b74a-84ff-4109-bd0f-2442b36665fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "seen", "source": "https://msrc.microsoft.com/blog/2021/09/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/", "content": "", "creation_timestamp": "2021-09-16T05:00:00.000000Z"}, {"uuid": "b92a3505-84e5-4617-af8f-b40eafb8c1cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "seen", "source": "https://msrc.microsoft.com/blog/2021/09/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/", "content": "", "creation_timestamp": "2021-09-16T05:00:00.000000Z"}, {"uuid": "0c359570-181f-4635-80bf-307870f25c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "https://msrc.microsoft.com/blog/2021/09/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/", "content": "", "creation_timestamp": "2021-09-16T05:00:00.000000Z"}, {"uuid": "9e352b0a-a2dc-4b83-ab61-86b5533d79df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://msrc.microsoft.com/blog/2021/09/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/", "content": "", "creation_timestamp": "2021-09-16T05:00:00.000000Z"}, {"uuid": "d55f33c0-6664-4546-88c9-cfd8b09d6adf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971028", "content": "", "creation_timestamp": "2024-12-24T20:23:15.467215Z"}, {"uuid": "ae9c0fe5-ee4d-4a4c-b1d9-ac4c421a5bbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970970", "content": "", "creation_timestamp": "2024-12-24T20:22:28.725610Z"}, {"uuid": "30f6ec9e-1ce0-4bb9-8436-23fa8ff48dbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971024", "content": "", "creation_timestamp": "2024-12-24T20:23:11.858682Z"}, {"uuid": "6cbed927-9ecb-4724-b0c0-50a4f0accbef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971047", "content": "", "creation_timestamp": "2024-12-24T20:23:31.207090Z"}, {"uuid": "9a3b6d1c-670d-4c0b-baf2-ea308a9bfd5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971484", "content": "", "creation_timestamp": "2024-12-24T20:29:59.327474Z"}, {"uuid": "16ccd34a-48fb-45f5-b03e-427080ea75ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-01-26)", "content": "", "creation_timestamp": "2025-01-26T00:00:00.000000Z"}, {"uuid": "35ad4c06-759f-4069-8f53-73b0cd907c32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "9a97256c-538e-4353-b5fc-f390a7ed2a5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "6d0b4442-dc7c-4745-86a7-6e0e7c117b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2024-10-31)", "content": "", "creation_timestamp": "2024-10-31T00:00:00.000000Z"}, {"uuid": "e00c00de-7273-4bc3-a162-3251f872250c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-26)", "content": "", "creation_timestamp": "2025-01-26T00:00:00.000000Z"}, {"uuid": "f1c6daba-7183-47bd-9e81-bc2fc53118e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-08)", "content": "", "creation_timestamp": "2025-02-08T00:00:00.000000Z"}, {"uuid": "f5ff6a3c-5ce2-498d-80cd-a041805ecf3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "b0839572-16f7-4077-8eac-2e74c43ccd65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "8522c5b3-fb18-42c8-bd7c-6509b90faa8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-26)", "content": "", "creation_timestamp": "2025-02-26T00:00:00.000000Z"}, {"uuid": "954bb630-5130-4d64-a8f5-caa739b7e4b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:57.000000Z"}, {"uuid": "6cbce7b9-7a53-47e2-afac-32f2128df546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:57.000000Z"}, {"uuid": "8a1c70c5-32cc-48f9-adad-3ad122176c8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:57.000000Z"}, {"uuid": "3c1c4e10-caca-4f6f-8c89-44adeca5b5eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:57.000000Z"}, {"uuid": "b5f68185-70db-4de6-8604-3be639184fab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:31.000000Z"}, {"uuid": "b730b646-0234-4815-99bc-f9036b036e11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-02)", "content": "", "creation_timestamp": "2025-03-02T00:00:00.000000Z"}, {"uuid": "b34b1926-78c8-47d7-a87d-7bcdbd32ac9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-11)", "content": "", "creation_timestamp": "2025-06-11T00:00:00.000000Z"}, {"uuid": "197783ee-4d11-43db-ac29-d5b19b946d78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-04-28)", "content": "", "creation_timestamp": "2025-04-28T00:00:00.000000Z"}, {"uuid": "f8eabd7b-22e7-49c7-82d4-40652e0d8401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-12)", "content": "", "creation_timestamp": "2025-06-12T00:00:00.000000Z"}, {"uuid": "c8297be5-baf2-4e56-8a9f-660a89d6013d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-07)", "content": "", "creation_timestamp": "2025-05-07T00:00:00.000000Z"}, {"uuid": "ecbab2ec-a97f-4cb0-b4a7-8a852a9ba1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-25)", "content": "", "creation_timestamp": "2025-10-25T00:00:00.000000Z"}, {"uuid": "a6e11bb5-0bb4-4898-8ee9-5651b5122e96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-15)", "content": "", "creation_timestamp": "2025-10-15T00:00:00.000000Z"}, {"uuid": "af6690f4-d729-444b-899f-3002fe652b62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-03)", "content": "", "creation_timestamp": "2025-08-03T00:00:00.000000Z"}, {"uuid": "09e7d282-39f5-4baf-aa7a-50516fbc525a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-20)", "content": "", "creation_timestamp": "2025-11-20T00:00:00.000000Z"}, {"uuid": "a11036e6-26f0-4aff-8a2d-271e06c03707", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-08)", "content": "", "creation_timestamp": "2025-11-08T00:00:00.000000Z"}, {"uuid": "12f55cb8-1969-4d69-9fd4-bbe31ff1e681", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-14)", "content": "", "creation_timestamp": "2025-08-14T00:00:00.000000Z"}, {"uuid": "56b84ec5-d323-4bc6-8373-35f455baa0cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-16)", "content": "", "creation_timestamp": "2025-08-16T00:00:00.000000Z"}, {"uuid": "568866ac-1136-49da-a537-4b0333969fc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-27)", "content": "", "creation_timestamp": "2025-11-27T00:00:00.000000Z"}, {"uuid": "519bd4f6-84bc-49eb-bc47-2274734ca2de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-10-12)", "content": "", "creation_timestamp": "2025-10-12T00:00:00.000000Z"}, {"uuid": "7af81651-6ee5-4f3c-b551-1864cb12b99c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/cve_2021_38647_omigod.rb", "content": "", "creation_timestamp": "2021-10-28T01:18:51.000000Z"}, {"uuid": "21d48620-56d4-493b-969f-52fa80d9a295", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:12:44.000000Z"}, {"uuid": "cf2d77de-1f0a-444b-aa66-107b6da9b9bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3864", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:20.000000Z"}, {"uuid": "67709a5d-6740-4008-b249-6efff6a5f3ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:59.000000Z"}, {"uuid": "36e58c52-8070-4327-998f-1d666be3edb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-09-26)", "content": "", "creation_timestamp": "2025-09-26T00:00:00.000000Z"}, {"uuid": "7b39dd5d-5bcd-4da3-b814-2e963f22eee0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_38648_omigod.rb", "content": "", "creation_timestamp": "2021-11-09T16:49:06.000000Z"}, {"uuid": "c344c20c-111c-4a93-afae-96b08e4c72e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-28)", "content": "", "creation_timestamp": "2026-02-28T00:00:00.000000Z"}, {"uuid": "adacbb11-5afa-4622-875c-27cccd41c612", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-09)", "content": "", "creation_timestamp": "2025-12-09T00:00:00.000000Z"}, {"uuid": "aa14a6df-4edc-419a-88a3-40becea5aacc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-14)", "content": "", "creation_timestamp": "2025-12-14T00:00:00.000000Z"}, {"uuid": "c441f86e-45ea-486e-be26-9a157e49fee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-15)", "content": "", "creation_timestamp": "2025-12-15T00:00:00.000000Z"}, {"uuid": "f3e5bc02-5caf-446b-93b4-61772383dde6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-26)", "content": "", "creation_timestamp": "2026-02-26T00:00:00.000000Z"}, {"uuid": "af9c7c35-63de-4a97-83a2-72bd3e1564f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-08)", "content": "", "creation_timestamp": "2026-02-08T00:00:00.000000Z"}, {"uuid": "f24e8aaf-cb25-4c35-b3e6-c300fbd899b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-22)", "content": "", "creation_timestamp": "2026-03-22T00:00:00.000000Z"}, {"uuid": "d8540723-ecb2-426c-aaa8-56b1812967c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-12)", "content": "", "creation_timestamp": "2026-01-12T00:00:00.000000Z"}, {"uuid": "d8640d1a-0182-4e72-a3f8-9d14f7b087b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-14)", "content": "", "creation_timestamp": "2026-01-14T00:00:00.000000Z"}, {"uuid": "e7e97375-c1c6-454b-a6b7-413c86274672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-19)", "content": "", "creation_timestamp": "2026-01-19T00:00:00.000000Z"}, {"uuid": "c7771565-ff8b-4758-8ec0-77aed847e931", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-3864", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "94a7228e-569a-4882-888a-84916396fe98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-27)", "content": "", "creation_timestamp": "2026-01-27T00:00:00.000000Z"}, {"uuid": "85fa98c6-39a0-4156-8f15-780459409377", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-38646", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/336c2a6b-7714-497e-ab1f-9b677e40341e", "content": "", "creation_timestamp": "2026-02-02T12:27:55.234427Z"}, {"uuid": "3a5ec581-d669-4346-b288-7aa024c6d3f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-38648", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/734f60ad-c048-4dbf-a4b4-4207cde78df1", "content": "", "creation_timestamp": "2026-02-02T12:28:58.163322Z"}, {"uuid": "e1c27880-2634-4649-bfc8-b84b2f81acd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6924827c-800f-405c-9c5b-4b98a828336d", "content": "", "creation_timestamp": "2026-02-02T12:28:48.489939Z"}, {"uuid": "58f7bf39-fe2e-45c4-91c2-e0b7e3271be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-38645", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a293ac31-0095-412c-a4e3-7a2b35062af4", "content": "", "creation_timestamp": "2026-02-02T12:28:50.657378Z"}, {"uuid": "5c6b26ff-1971-4e74-9d98-dd5be9438146", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-38649", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/df9216f8-90a9-4ded-abc9-a20eb31a9c68", "content": "", "creation_timestamp": "2026-02-02T12:28:51.091346Z"}, {"uuid": "abd27187-4384-45e6-a5f6-c1696695fa70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/543", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA PoC exploit for CVE-2021-38647 RCE in OMI\nURL\uff1ahttps://github.com/Immersive-Labs-Sec/cve-2021-38647", "creation_timestamp": "2021-09-16T14:53:43.000000Z"}, {"uuid": "0f46038a-2321-4cad-94bd-2337d02ace79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7088", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 Reproduction of CVE-2021-38647 (unauthed root RCE in the OMI agent) using the details in the technical blog post.\n\nuid=0(root) gid=0(root) groups=0(root)
\n\nhttps://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution", "creation_timestamp": "2021-09-15T05:46:05.000000Z"}, {"uuid": "cae9bfbe-2e95-4918-bc26-f0e0d7dbe25e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/579", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1ahttps://github.com/corelight/CVE-2021-38647 without the bloat\nURL\uff1ahttps://github.com/abousteif/cve-2021-38647", "creation_timestamp": "2021-09-22T15:25:32.000000Z"}, {"uuid": "b0a1d70f-765b-4cbe-846d-1ac47252eae8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/576", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aOMIGOD! OM I GOOD? A free scanner to detect VMs vulnerable to one of the \\\"OMIGOD\\\" vulnerabilities discovered by Wiz's threat research team, specifically CVE-2021-38647.\nURL\uff1ahttps://github.com/marcosimioni/omigood", "creation_timestamp": "2021-09-22T11:35:56.000000Z"}, {"uuid": "0f4f9514-3135-422f-9f1a-4bcefb8d374c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/608", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA Vagrant VM test lab to learn about CVE-2021-38647 in the Open Management Infrastructure agent (aka \\\"omigod\\\").\nURL\uff1ahttps://github.com/craig-m-unsw/omigod-lab", "creation_timestamp": "2021-09-27T11:37:23.000000Z"}, {"uuid": "88b59760-7d9d-4aac-be2b-55b934e362ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7741", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Code Execution in Microsoft Office (CVE-2021-38646)\n\nhttps://spaceraccoon.dev/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office", "creation_timestamp": "2021-10-24T07:35:33.000000Z"}, {"uuid": "438fd3ff-ccd5-4448-84ad-e0705f5b38c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7428", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 Experts warn that CVE-2021-38647 OMIGOD flaws affect IBM QRadar Azure and can be exploited by remote attackers to execute arbitrary code.\n\nhttps://hackademicus.nl/cve-2021-38647-omigod-flaw-impacts-ibm-qradar-azure/", "creation_timestamp": "2021-10-03T19:55:25.000000Z"}, {"uuid": "6b79e7c1-aaaf-4322-8c2b-3f047183c92f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-19)", "content": "", "creation_timestamp": "2026-04-19T00:00:00.000000Z"}, {"uuid": "97f186b4-ddfa-41e4-8c5d-99075236ae0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/570", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-38647 - POC to exploit unauthenticated RCE #OMIGOD\nURL\uff1ahttps://github.com/AlteredSecurity/CVE-2021-38647", "creation_timestamp": "2021-09-21T15:57:38.000000Z"}, {"uuid": "9871dfd3-64d5-41e8-ad4d-75191cabd119", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/537", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-38647 POC for RCE\nURL\uff1ahttps://github.com/midoxnet/CVE-2021-38647", "creation_timestamp": "2021-09-15T21:47:42.000000Z"}, {"uuid": "8f7c3f66-6367-4dd9-9a32-0ccc4b772300", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/561", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aOMIGod / CVE-2021-38647 POC and Demo environment\nURL\uff1ahttps://github.com/SimenBai/CVE-2021-38647-POC-and-Demo-environment", "creation_timestamp": "2021-09-19T19:08:56.000000Z"}, {"uuid": "9a30d6ed-87c3-4791-956d-7084091fe3a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/609", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA Vagrant VM test lab to learn about CVE-2021-38647 in the Open Management Infrastructure agent (aka \\\"omigod\\\").\nURL\uff1ahttps://github.com/itsjeffersonli/CVE-2021-24741", "creation_timestamp": "2021-09-27T16:57:28.000000Z"}, {"uuid": "05ad6b93-6695-4579-ab06-475dbcca8c2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/569", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-38647 AKA \\\"OMIGOD\\\" vulnerability in Windows OMI \nURL\uff1ahttps://github.com/corelight/CVE-2021-38647", "creation_timestamp": "2021-09-21T14:32:18.000000Z"}, {"uuid": "76558536-81a1-46e4-b54d-19b26f7c635d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/587", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-38647 is an unauthenticated RCE vulnerability effecting the OMI agent as root.\nURL\uff1ahttps://github.com/Vulnmachines/OMIGOD_cve-2021-38647", "creation_timestamp": "2021-09-24T10:59:39.000000Z"}, {"uuid": "55c033e6-e8a7-48e2-a240-ffc89a59f8d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/542", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nURL\uff1ahttps://github.com/horizon3ai/CVE-2021-38647", "creation_timestamp": "2021-09-16T10:42:12.000000Z"}, {"uuid": "cae2cdbb-2a32-4c6c-a6f7-c09edf1e3dac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "https://t.me/arpsyndicate/1301", "content": "#ExploitObserverAlert\n\nCVE-2021-38646\n\nDESCRIPTION: Exploit Observer has 5 entries related to CVE-2021-38646. Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.012750000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-04T20:46:02.000000Z"}, {"uuid": "2cd53c75-bba0-4a84-b35c-1815a6317016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3864", "type": "seen", "source": "https://t.me/arpsyndicate/761", "content": "#ExploitObserverAlert\n\nCVE-2021-3864\n\nDESCRIPTION: Exploit Observer has 11 entries related to CVE-2021-3864. A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.\n\nFIRST-EPSS: 0.000420000\nNVD-IS: 5.9\nNVD-ES: 1.0", "creation_timestamp": "2023-11-29T15:44:43.000000Z"}, {"uuid": "79714a05-70dc-4f6c-ad94-b7c5710302b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "Telegram/XzdQswcVkc5anRIIilZev5rhw86-ytMb-ixyyjWWaaWCfg", "content": "", "creation_timestamp": "2022-07-11T09:36:50.000000Z"}, {"uuid": "0d00bca5-f75a-4992-a505-82785f323203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/204", "content": "#CVE-2021-38647 - POC to exploit unauthenticated RCE #OMIGOD \n\nhttps://github.com/AlteredSecurity/CVE-2021-38647", "creation_timestamp": "2021-09-22T14:27:08.000000Z"}, {"uuid": "6169d74f-db48-4345-97d2-d89086e4b267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/186", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-18T23:06:09.000000Z"}, {"uuid": "a95bcca8-6988-443a-9a02-65f3fc9dd710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "Telegram/Mktlp6ZEg5sETEEiDRh5v1gkdpJ8gkWjSlWm8uPe_p1yvg", "content": "", "creation_timestamp": "2021-09-23T21:01:24.000000Z"}, {"uuid": "ff88f019-18a4-456c-bfeb-a572385b87c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/crackcodes/826", "content": "Today's Updates\n\n\ud83d\udc49\ud83c\udffbAzure Omigod Unauth Rce | CVE-2021-38647 | Omigod Exploit\n\ud83d\udc49\ud83c\udffbDeepFaceLive \u2013 Real-time face swap for PC streaming or video calls\n\ud83d\udc49\ud83c\udffbWAF from the scratch\n\ud83d\udc49\ud83c\udffbPractical Approach on Securing Web Sessions\n\ud83d\udc49\ud83c\udffbChisel-Strike - A .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.\n\ud83d\udc49\ud83c\udffbOWASP Mobile Security Testing Guide (MSTG)\n\ud83d\udc49\ud83c\udffbGrawler\n\ud83d\udc49\ud83c\udffbCVE-2022-29554 - Mishandling of Input to API in PrintixService.exe\n\ud83d\udc49\ud83c\udffbKIZAGAN - A python backdoor(Remote Access Trojan) and it can take camera pictures,screenshots,getting microphone sounds\u2026 etc.\n\ud83d\udc49\ud83c\udffbHunter Biden\u2019s iPhone & is Releasing 450GB MORE Private Data Including Passwords Leak\n\ud83d\udc49\ud83c\udffbShanghai Gov National Police\n\ud83d\udc49\ud83c\udffbDoenerium - Fully undetected #stealer (0/67)\n\ud83d\udc49\ud83c\udffbFree Hosting for 60 Day\n\ud83d\udc49\ud83c\udffbANKA MARINE ELECTRONICs Turkey VSAT Maritime Satellite Leak\n\ud83d\udc49\ud83c\udffbTripleCross - Linux eBPF rootkit\n\nAll Updates on \ud83d\udc49\ud83c\udffb https://bit.ly/3yRyah3", "creation_timestamp": "2022-07-11T10:39:45.000000Z"}, {"uuid": "a24fcb24-77c7-4f4f-b10e-45ed12d25ce1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3864", "type": "seen", "source": "https://t.me/cibsecurity/48899", "content": "\u203c CVE-2021-3864 \u203c\n\nA flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-26T20:30:36.000000Z"}, {"uuid": "601da35b-7d88-47f2-b8de-4d409d83e04d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "seen", "source": "https://t.me/cibsecurity/28884", "content": "\u203c CVE-2021-38649 \u203c\n\nOpen Management Infrastructure Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-38645, CVE-2021-38648.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-15T16:22:29.000000Z"}, {"uuid": "c4b1964f-88a0-4f23-b067-9b7275b413b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "seen", "source": "https://t.me/cibsecurity/28884", "content": "\u203c CVE-2021-38649 \u203c\n\nOpen Management Infrastructure Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-38645, CVE-2021-38648.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-15T16:22:29.000000Z"}, {"uuid": "6356e58d-21ed-4684-9ed7-02256be9d326", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "https://t.me/cibsecurity/28884", "content": "\u203c CVE-2021-38649 \u203c\n\nOpen Management Infrastructure Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-38645, CVE-2021-38648.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-15T16:22:29.000000Z"}, {"uuid": "b0b3563b-7a9f-4dec-ac67-36cf3bc6262c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://t.me/cibsecurity/28876", "content": "\u203c CVE-2021-38647 \u203c\n\nOpen Management Infrastructure Remote Code Execution Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-15T16:22:15.000000Z"}, {"uuid": "5440dab8-ed53-42b7-877f-80a9d2eea5b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38642", "type": "seen", "source": "https://t.me/cibsecurity/28249", "content": "\u203c CVE-2021-38642 \u203c\n\nMicrosoft Edge for iOS Spoofing Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-03T02:36:24.000000Z"}, {"uuid": "112619c0-ac88-4d35-8569-8be97f5ef2ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38641", "type": "seen", "source": "https://t.me/cibsecurity/28248", "content": "\u203c CVE-2021-38641 \u203c\n\nMicrosoft Edge for Android Spoofing Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-03T02:36:23.000000Z"}, {"uuid": "d88b950e-f797-430f-9391-dc69bf3536b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/4315", "content": "#exploit\n#Cloud_Security\nOMIGOD - RCE Vulnerability in Multiple Azure Linux Deployments\nhttps://www.horizon3.ai/news/blog/omigod\n]-> PoC Exploit for CVE-2021-38647 (OMIGOD):\nhttps://github.com/horizon3ai/CVE-2021-38647", "creation_timestamp": "2021-09-17T11:05:04.000000Z"}, {"uuid": "12401a8a-a78e-4135-9cff-e39356eb2b3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4416", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Sep 1-30)\nCVE-2021-40444 - Microsoft MSHTML RCE\nhttps://t.me/cybersecuritytechnologies/4276\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-22005 - vCenter Server contains - arbitrary file upload\nhttps://t.me/cybersecuritytechnologies/4401\nCVE-2021-30860 - Zero-Click iPhone Exploit\nhttps://t.me/cybersecuritytechnologies/4318\nCVE-2021-38647 - OMIGOD RCE Vuln in Multiple Azure Linux Deployments\nhttps://t.me/cybersecuritytechnologies/4315\nCVE-2021-30632 - Out of bounds write in V8\nhttps://t.me/cybersecuritytechnologies/4342\nCVE-2021-33035 - Code Execution in Apache OpenOffice\nhttps://t.me/cybersecuritytechnologies/4329\nCVE-2021-38112 - AWS WorkSpaces Desktop Client RCE\nhttps://t.me/cybersecuritytechnologies/4358\nCVE-2021-30740 / CVE-2021-30768 - A malicious application may be able to execute arbitrary code with kernel privileges\nhttps://mobile.twitter.com/infinityABCDE/status/1437596340222038017", "creation_timestamp": "2021-10-01T11:01:01.000000Z"}, {"uuid": "c5f78299-ec63-4390-a831-a73e63314f31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4632", "content": "#exploit\nCVE-2021-38646:\n1. Code Execution in Microsoft Office\nhttps://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162\n\n2. Windows User Profile Service 0day LPE\nhttps://github.com/klinix5/ProfSvcLPE/blob/main/write-up.docx\n]-> PoC: https://github.com/klinix5/ProfSvcLPE/tree/main/DoubleJunctionEoP", "creation_timestamp": "2021-10-30T14:25:18.000000Z"}, {"uuid": "c7153eec-fd89-4e76-b0cd-72ba5d62bad1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/18", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:14:31.000000Z"}, {"uuid": "ce63d25f-238d-4fbb-b459-7c2f81ead35c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "published-proof-of-concept", "source": "https://t.me/cyber0iq/19", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "creation_timestamp": "2021-09-25T02:15:23.000000Z"}, {"uuid": "51895b47-9c03-4635-932c-83f2ce8b1000", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1727", "content": "All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021\u201338646) https://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162", "creation_timestamp": "2026-08-03T05:00:04.543454Z"}, {"uuid": "e8725937-ef89-43f4-a242-a7f7c35a6716", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1727", "content": "All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021\u201338646) https://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162", "creation_timestamp": "2026-08-04T00:00:49.996996Z"}, {"uuid": "bbb82db7-e2be-47ed-b4ad-61969e56323b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e781d754-ed4f-4f68-aaf0-7cbfaa5f94a7", "content": "", "creation_timestamp": "2026-06-19T12:47:50.011947Z"}, {"uuid": "2bcc5c84-9c3f-4090-815b-81f1a66adc30", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3e036c56-0be9-4c36-8aff-e2a608496ed3", "content": "", "creation_timestamp": "2026-06-19T12:47:50.342374Z"}, {"uuid": "527fb2dd-5a1f-429c-a165-e307bbe6b42c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/62a96021-79fd-4fd1-87f1-5f796f5eb18b", "content": "", "creation_timestamp": "2026-06-19T12:47:21.001582Z"}, {"uuid": "85e646ff-4257-4e75-b817-dae5542c057e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ee8b0f78-3a5f-47cd-9bea-168c42252d56", "content": "", "creation_timestamp": "2026-06-19T12:47:48.436972Z"}, {"uuid": "585de98b-18ac-455c-be22-f702456392eb", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/537960a8-d7e0-4169-ae5d-58a47bff9358", "content": "", "creation_timestamp": "2026-06-19T12:48:01.372820Z"}, {"uuid": "4bc4f807-cc41-4fe2-a0c3-be9ab8057217", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/86961e5a-6aa2-4b62-94d0-7da6ba7e3884", "content": "", "creation_timestamp": "2026-06-23T14:04:38.597403Z"}, {"uuid": "6695a933-ea13-4c0b-a974-d429472dea21", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cc524db7-1492-464e-9bb2-c9acb1ca49cb", "content": "", "creation_timestamp": "2026-06-23T14:04:38.891084Z"}, {"uuid": "6989e0ee-7add-4aa6-a879-8da61b0d801e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0152ac15-4c73-4be9-8807-db580ff016fc", "content": "", "creation_timestamp": "2026-06-23T14:04:33.009842Z"}, {"uuid": "60fece81-0c3a-4777-b08f-b2cb60b77ced", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0e27cdfa-3108-43b8-aa82-18dd7b8da778", "content": "", "creation_timestamp": "2026-06-23T14:04:40.408872Z"}, {"uuid": "e9411e69-11ff-4c2a-aed7-f9b199bdfbd6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cbd3ed60-0306-44ee-85f2-a97eeb03e0ec", "content": "", "creation_timestamp": "2026-06-23T14:05:16.233063Z"}, {"uuid": "7a66ca88-f688-48de-9ad5-2c3f5bca7121", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://t.me/hacking_Attack/23975", "content": "ow-tos\u00a0and PoCs for the Windows MSHTML zero-day. BleepingComputer gave it a try and found that the guides are \u201csimple to follow and [allow] anyone to create their own working version\u201d of the exploit, \u201cincluding a Python server to distribute the malicious documents and CAB files.\u201d\n\nIt took the publication all of 15 minutes to recreate the exploit.\n\nA week ago, on Tuesday, Sept. 7, Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) had urged mitigations\u00a0of the remote-code execution (RCE) flaw, which is found in all modern Windows operating systems.\n\nLast week, the company didn\u2019t say much about the bug in MSHTML, aka Trident, which is the HTML engine built into Windows since Internet Explorer debuted more than 20 years ago and which allows Windows to read and display HTML files.\n\nMicrosoft did say, however, that it was aware of targeted attacks trying to exploit it via specially crafted Microsoft Office documents.\n\nIn spite of there being no security updates available for the vulnerability at that time, MIcrosoft went ahead and disclosed it, along with mitigations meant to help prevent exploitation.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges Mitigations That Don\u2019t MitigateTracked as CVE-2021-40444, the flaw is serious enough that CISA sent its own advisory, alerting users and administrators and recommending that they use the mitigations and workarounds Microsoft recommended \u2013 mitigations that try to prevent exploitation by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nEmphasis on \u201ctry to:\u201d Unfortunately, those mitigations proved to be less than foolproof, as researchers, including Beaumont, managed to modify the exploit\u00a0so that it didn\u2019t use ActiveX, effectively skirting Microsoft\u2019s mitigations.\n\nThe Zero Day Initiative said that\u00a0for now, the most-effective defense is \u201cto apply the patch and avoid Office docs you aren\u2019t expecting to receive.\u201d\n\nBe sure to carefully review and install all the needed patches\u00a0for your setup: There\u2019s a long list of updates for specific platforms, and it\u2019s important not to slather on too thin a layer of protection.\n\nCredit for finding this bug goes to Rick Cole of MSTIC; Bryce Abdo, Dhanesh Kizhakkinan and Genwei Jiang, all from Mandiant; and Haifei Li of EXPMON. Baddest Bug AwardThe award for baddest bug \u2013 or at least, the one with the highest severity rating, with a CVSS score of 9.8 \u2013 goes to CVE-2021-38647: a critical remote-code execution (RCE) vulnerability in Open Management Infrastructure. OMI is an open-source project\u00a0to further the development of a production-quality implementation of the DMTF CIM/WBEM\u00a0standards.\n\n\u201cThis vulnerability requires no user interaction or privileges, so an attacker can run their code on an affected system just by sending a specially crafted message to an affected system,\u201d the Zero Day Initiatve explained. That makes it high priority: ZDI recommended that OMI users test and deploy this one quickly.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Yet More PrintNightmare PatchesMicrosoft also patched three elevation of privilege vulnerabilities in Windows Print Spooler (CVE-2021-38667, CVE-2021-38671\u00a0and CVE-2021-40447), all rated important.\n\nThese are the three latest fixes in a steady stream\u00a0of patches\u00a0for flaws in Windows Print Spooler that followed the disclosure of PrintNightmare\u00a0in June. This probably won\u2019t be the last patch in that parade: Tenable\u2019s Narang told Threatpost that \u201cresearchers continue to discover ways to exploit Print Spooler\u201d and that the firm expects \u201ccontinued research in this area.\u201d\n\nOnly one \u2013 CVE-2021-38671 \u2013 of today\u2019s patch trio is rated as \u201cexploitation more likely.\u201d Regardless, organizations should prioritize patching these flaws as \u201cthey are extremely valuable to attackers in post-exploitation scenarios,\u201d Narang observed. More \u2018Exploitation More Likely\u2019Immersive\u2019s Breen told Thre[...]", "creation_timestamp": "2026-09-01T20:02:22.936614Z"}, {"uuid": "7a58702d-a6ef-4735-8dd2-61cb7b574550", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9ac95d30-8475-4275-bfb1-25efbe583c21", "content": "", "creation_timestamp": "2026-06-30T09:23:22.113356Z"}, {"uuid": "4c61ff82-09a3-4c3b-b55c-056d43666a9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst7fijdfw2z", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-38646: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability\nCVSS 7.8 \u00b7 EPSS 8.0% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-38646\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T18:07:10.576731Z"}, {"uuid": "dbb0e1c1-693b-4448-a729-91802f55ce22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst7flsmhc25", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-38648: Open Management Infrastructure Elevation of Privilege Vulnerability\nCVSS 7.8 \u00b7 EPSS 11.4% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-38648\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T18:07:14.022787Z"}, {"uuid": "e523b7aa-288b-4468-a765-d60feec047f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst7fguyqg2m", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-38645: Open Management Infrastructure Elevation of Privilege Vulnerability\nCVSS 7.8 \u00b7 EPSS 2.7% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-38645\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T18:07:09.324031Z"}, {"uuid": "b7b77e42-de64-49c1-beb1-957697baac10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst7fk6dmh2t", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2021-38647: Open Management Infrastructure (OMI) Remote Code Execution Vulnerability\nCVSS 9.8 \u00b7 EPSS 99.9% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-38647\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T18:07:12.472354Z"}, {"uuid": "a6479564-6143-4da7-90d0-7030d1519004", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/adf17496-6707-44ba-8601-10ab486eb92f", "content": "", "creation_timestamp": "2026-07-09T06:15:02.953412Z"}, {"uuid": "529f488a-24da-43be-845f-a7da5d24938a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mstcqxmncq2x", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-38649: Open Management Infrastructure Elevation of Privilege Vulnerability\nCVSS 7 \u00b7 EPSS 2.9% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-38649\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T19:07:17.018559Z"}, {"uuid": "19ae19e3-4f68-4f38-91a4-b31a0784f894", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/adf17496-6707-44ba-8601-10ab486eb92f", "content": "", "creation_timestamp": "2026-07-10T00:15:04.254789Z"}, {"uuid": "9c29fd92-7870-4beb-8ba7-a1e6a8ebc336", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/adf17496-6707-44ba-8601-10ab486eb92f", "content": "", "creation_timestamp": "2026-07-22T00:15:02.792492Z"}, {"uuid": "3e3ff994-cdd4-4a31-b6b6-44b24c48928f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/adf17496-6707-44ba-8601-10ab486eb92f", "content": "", "creation_timestamp": "2026-07-23T00:15:02.503255Z"}, {"uuid": "6038a380-f89f-4a01-ac32-121a8f072b54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-22)", "content": "", "creation_timestamp": "2026-07-23T10:15:11.056300Z"}, {"uuid": "ab62ba83-40bc-4eb3-833e-01c2b0073f82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "MISP/adf17496-6707-44ba-8601-10ab486eb92f", "content": "", "creation_timestamp": "2026-07-24T00:15:02.517997Z"}, {"uuid": "ff0e78f5-9349-4c45-8f7a-fec66f785435", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-27)", "content": "", "creation_timestamp": "2026-07-28T10:00:06.450491Z"}, {"uuid": "59bee03b-99fc-403f-a28b-41636b6c06e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "https://t.me/reverseame/1727", "content": "All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021\u201338646) https://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162", "creation_timestamp": "2026-07-29T12:02:52.135802Z"}, {"uuid": "ff22cb18-197e-4d05-b025-4ab4ab573ae6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "https://t.me/reverseame/1727", "content": "All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021\u201338646) https://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162", "creation_timestamp": "2026-07-30T00:02:42.607915Z"}, {"uuid": "ac2bca4e-134b-4b91-9411-99774366924d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38646", "type": "seen", "source": "https://t.me/cissp/4702", "content": "Europol has arrested 12 hackers believed to be behind the LockerGoga, MegaCortex and Dharma ransomware attacks, which targeted large companies and critical infrastructure with over 1,800 victims in 71 countries\nRead: \nhttps://thehackernews.com/2021/10/police-arrest-suspected-ransomware.html\n\nCloud Security\nSnowcat: World\u2019s First Dedicated Security Scanner for Istio\ud83d\ude03\nhttps://www.praetorian.com/blog/introducing-snowcat\n]-> https://github.com/praetorian-inc/snowcat\n\nRed Team Tactics\nUnderstanding SysCalls Manipulation\nhttps://redteaming.co.uk/2021/10/28/understanding-syscalls\n\nexploit\nCVE-2021-38646:\n1. Code Execution in Microsoft Office\nhttps://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162\n\n2. Windows User Profile Service 0day LPE\nhttps://github.com/klinix5/ProfSvcLPE/blob/main/write-up.docx\n]-> PoC: https://github.com/klinix5/ProfSvcLPE/tree/main/DoubleJunctionEoP\n\nThreat Research\n1. Atlassian Bug Bounty: XSS stored in api-media-atlassian-com via MS Office Doc file (iOS)\nhttps://omespino.com/write-up-xss-stored-in-api-media-atlassian-com-via-doc-file-ios\n2. 50 Shades of SolarWinds Orion Deserialization (CVE-2021-35218)\nhttps://testbnull.medium.com/50-shades-of-solarwinds-orion-patch-manager-deserialization-final-part-cve-2021-35218-3d38166cb81f", "creation_timestamp": "2026-09-01T17:00:37.068340Z"}, {"uuid": "c4a96bcf-1773-48ab-b61d-ab46e372066a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://t.me/hacking_Attack/24258", "content": "Black Hat Ethical Hacking\nAzure Zero-Day Flaws Highlight Lurking Supply-Chain Risk\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Azure Zero-Day Flaws Highlight Lurking Supply-Chain RiskPost Views: 107 \nReading Time: 1 Minute\nDubbed OMIGOD, a series of vulnerabilities in the Open Management Infrastructure used in Azure on Linux demonstrate hidden security threats\nFour Microsoft zero-day vulnerabilities in the Azure cloud platform\u2019s Open Management Infrastructure (OMI) \u2014 a software that many don\u2019t know is embedded in a host of services \u2014 show that OMI represents a significant security blind spot, researchers said.\n\nCollectively dubbed \u201cOMIGOD\u201d because of the name and the reaction of the researchers who discovered them, the flaws \u2014 which were zero-day when found \u2014 affect thousands of Azure customers and millions of endpoints, according to a blog post\u00a0published this week by cloud infrastructure security firm Wiz.\n\nThough Microsoft patched them this week in its monthly Patch Tuesday\u00a0raft of updates, their presence in OMI highlights the risk for the supply chain when companies unknowingly run code \u2014 particularly open-source code \u2014 on their systems that allows for exploitation, researchers said.\n\nIndeed, recent high-profile supply-chain attacks such as SolarWinds\u00a0and Kaseya\u00a0demonstrate how much damage can be done when undetected flaws in third-party software that organizations use in larger systems are exploited.\n\n\u201cOne of the biggest challenges in preventing them is that our digital supply chain is not transparent,\u201d senior security researcher Nir Ohfeld wrote in the Wiz post. \u201cIf you don\u2019t know what\u2019s hidden in the services and products you use every day, how can you manage the risk?\n\nIndeed, the OMIGOD \u00a0vulnerabilities discovered by Ohfeld and his colleagues present a security danger to potentially millions of unsuspecting customers of cloud computing services, he said.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cIn a small sample of Azure tenants we analyzed, over 65 percent [of Azure customers] were unknowingly at risk,\u201d Ohfeld wrote.\n\nThe vulnerabilities that Wiz researchers discovered include one that allows for remote code execution (RCE), CVE-2021-38647. The other three are privilege-escalation vulnerabilities (CVE-2021-38648, CVE-2021-38645\u00a0and CVE-2021-38649)\u00a0of lower risk but which are critical for a full attack chain.\n\n\u201cUnless a patch is applied, attackers can easily exploit these four vulnerabilities to escalate to root privileges and remotely execute malicious code (for instance, encrypting files for ransom),\u201d Ohfeld said. Hidden Cloud Security Danger in OMIOne reason for the significant alarm over the flaws is that they are found in OMI, an agent automatically deployed when customers set up a Linux virtual machine (VM) in their cloud and enable certain Azure services, researchers explained.\n\n\u201cThis happens without customers\u2019 explicit consent or knowledge,\u201d Ohfeld wrote. \u201cUsers simply click \u2018agree\u2019 to log collection during setup, and they have unknowingly opted in.\u201d\n\nOMI is a perilous attack surface because Azure provides \u201cvirtually no public documentation\u201d about it, he said. That means most customers have never heard of it and are unaware that it even exists as an exploitable entity in their deployment.\n\nMoreover, the OMI agent runs as root with the highest privileges, so any user can communicate with it using a UNIX socket or via an HTTP API when configured to allow external access, Ohfeld explained.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges \u201cAs a result, the vulnerabilities we found would allow external users or low-privileged users to remotely execute [...]", "creation_timestamp": "2026-09-01T20:02:22.070108Z"}, {"uuid": "1d55ca20-84ff-489b-b6f2-afc4c7d3b460", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38648", "type": "seen", "source": "https://t.me/hacking_Attack/24258", "content": "Black Hat Ethical Hacking\nAzure Zero-Day Flaws Highlight Lurking Supply-Chain Risk\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Azure Zero-Day Flaws Highlight Lurking Supply-Chain RiskPost Views: 107 \nReading Time: 1 Minute\nDubbed OMIGOD, a series of vulnerabilities in the Open Management Infrastructure used in Azure on Linux demonstrate hidden security threats\nFour Microsoft zero-day vulnerabilities in the Azure cloud platform\u2019s Open Management Infrastructure (OMI) \u2014 a software that many don\u2019t know is embedded in a host of services \u2014 show that OMI represents a significant security blind spot, researchers said.\n\nCollectively dubbed \u201cOMIGOD\u201d because of the name and the reaction of the researchers who discovered them, the flaws \u2014 which were zero-day when found \u2014 affect thousands of Azure customers and millions of endpoints, according to a blog post\u00a0published this week by cloud infrastructure security firm Wiz.\n\nThough Microsoft patched them this week in its monthly Patch Tuesday\u00a0raft of updates, their presence in OMI highlights the risk for the supply chain when companies unknowingly run code \u2014 particularly open-source code \u2014 on their systems that allows for exploitation, researchers said.\n\nIndeed, recent high-profile supply-chain attacks such as SolarWinds\u00a0and Kaseya\u00a0demonstrate how much damage can be done when undetected flaws in third-party software that organizations use in larger systems are exploited.\n\n\u201cOne of the biggest challenges in preventing them is that our digital supply chain is not transparent,\u201d senior security researcher Nir Ohfeld wrote in the Wiz post. \u201cIf you don\u2019t know what\u2019s hidden in the services and products you use every day, how can you manage the risk?\n\nIndeed, the OMIGOD \u00a0vulnerabilities discovered by Ohfeld and his colleagues present a security danger to potentially millions of unsuspecting customers of cloud computing services, he said.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cIn a small sample of Azure tenants we analyzed, over 65 percent [of Azure customers] were unknowingly at risk,\u201d Ohfeld wrote.\n\nThe vulnerabilities that Wiz researchers discovered include one that allows for remote code execution (RCE), CVE-2021-38647. The other three are privilege-escalation vulnerabilities (CVE-2021-38648, CVE-2021-38645\u00a0and CVE-2021-38649)\u00a0of lower risk but which are critical for a full attack chain.\n\n\u201cUnless a patch is applied, attackers can easily exploit these four vulnerabilities to escalate to root privileges and remotely execute malicious code (for instance, encrypting files for ransom),\u201d Ohfeld said. Hidden Cloud Security Danger in OMIOne reason for the significant alarm over the flaws is that they are found in OMI, an agent automatically deployed when customers set up a Linux virtual machine (VM) in their cloud and enable certain Azure services, researchers explained.\n\n\u201cThis happens without customers\u2019 explicit consent or knowledge,\u201d Ohfeld wrote. \u201cUsers simply click \u2018agree\u2019 to log collection during setup, and they have unknowingly opted in.\u201d\n\nOMI is a perilous attack surface because Azure provides \u201cvirtually no public documentation\u201d about it, he said. That means most customers have never heard of it and are unaware that it even exists as an exploitable entity in their deployment.\n\nMoreover, the OMI agent runs as root with the highest privileges, so any user can communicate with it using a UNIX socket or via an HTTP API when configured to allow external access, Ohfeld explained.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges \u201cAs a result, the vulnerabilities we found would allow external users or low-privileged users to remotely execute [...]", "creation_timestamp": "2026-09-01T20:02:22.115159Z"}, {"uuid": "b46830a4-a4a4-48d4-9972-02036d90dbbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38647", "type": "seen", "source": "https://t.me/hacking_Attack/24262", "content": "code on target machines or escalate privileges,\u201d he wrote. \u2018Textbook RCE Vulnerability\u201dCVE-2021-38647, with a 9.8 severity rating, is the most serious of the flaws, allowing for RCE. However, for it to be exploited, the Azure product using OMI would have to be one, such as Configuration Management, that exposes an HTTPS port, or port 5986, for interacting with OMI.\n\n\u201cThat\u2019s what makes RCE possible,\u201d Ohfeld explained. \u201cNote that most Azure services that use OMI deploy it without exposing the HTTPS port.\u201d\n\nCalling the bug \u201ca textbook RCE vulnerability that you would expect to see in the 90s\u201d not in 2021, the flaw can expose millions of endpoints because \u201can attacker could use a single packet to become root on a remote machine by simply removing the authentication header,\u201d Ohfeld wrote.\n\n\u201cThanks to the combination of a simple conditional statement coding mistake and an uninitialized auth struct, any request without an Authorization header has its privileges default to uid=0, gid=0, which is root,\u201d he explained.\n\nIn situations where the OMI ports are accessible to the internet to allow for remote management, threat actors can use the vulnerability co-obtain initial access to a target Azure environment and then move laterally within it, Ohfeld added.\n\n\u201cAn exposed HTTPS port is the holy grail for malicious actors,\u201d he observed. \u201cWith one simple exploit they can get access to new targets, execute commands at the highest privileges and possibly spread to new target machines.\u201d\n\nThe other three flaws\u2014with severity ratings that range from 7.1 to 7.8\u2014can be used as part of attack chains once attackers gain initial low-privileged access to their targets, Ohfeld added.\nSee Also: Offensive Security Tool: SniperPhish Threat Discovery and MitigationsWiz researchers reported the four vulnerabilities to Microsoft through the responsible disclosure process; the company patched them as of Tuesday, researchers said.\n\nUpgrading OMI and thus patch installation happens through the parent Azure service that installed it, they added. \u201cHowever, we urge customers to verify that their environment is indeed patched and they are running the latest version of OMI (Version 1.6.8.1),\u201d Ohfeld wrote.\n\nDifferent Azure services have different port numbers, Microsoft noted in its advisory for CVE-2021-38647. However, for customers who want to check that their Azure Linux Node does not have an exposed port, they should look for the command \u2018netstat -an | grep <port-number\u2018 on most Linux distributions, which will indicate if any processes are listening on an open port, the company said.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago\n* https://www.blackhatethicalhackin[...]", "creation_timestamp": "2026-09-01T20:02:22.170902Z"}, {"uuid": "0b4aabb4-ac00-44b8-a5f0-3f89e077ed46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38645", "type": "seen", "source": "https://t.me/hacking_Attack/24258", "content": "Black Hat Ethical Hacking\nAzure Zero-Day Flaws Highlight Lurking Supply-Chain Risk\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Azure Zero-Day Flaws Highlight Lurking Supply-Chain RiskPost Views: 107 \nReading Time: 1 Minute\nDubbed OMIGOD, a series of vulnerabilities in the Open Management Infrastructure used in Azure on Linux demonstrate hidden security threats\nFour Microsoft zero-day vulnerabilities in the Azure cloud platform\u2019s Open Management Infrastructure (OMI) \u2014 a software that many don\u2019t know is embedded in a host of services \u2014 show that OMI represents a significant security blind spot, researchers said.\n\nCollectively dubbed \u201cOMIGOD\u201d because of the name and the reaction of the researchers who discovered them, the flaws \u2014 which were zero-day when found \u2014 affect thousands of Azure customers and millions of endpoints, according to a blog post\u00a0published this week by cloud infrastructure security firm Wiz.\n\nThough Microsoft patched them this week in its monthly Patch Tuesday\u00a0raft of updates, their presence in OMI highlights the risk for the supply chain when companies unknowingly run code \u2014 particularly open-source code \u2014 on their systems that allows for exploitation, researchers said.\n\nIndeed, recent high-profile supply-chain attacks such as SolarWinds\u00a0and Kaseya\u00a0demonstrate how much damage can be done when undetected flaws in third-party software that organizations use in larger systems are exploited.\n\n\u201cOne of the biggest challenges in preventing them is that our digital supply chain is not transparent,\u201d senior security researcher Nir Ohfeld wrote in the Wiz post. \u201cIf you don\u2019t know what\u2019s hidden in the services and products you use every day, how can you manage the risk?\n\nIndeed, the OMIGOD \u00a0vulnerabilities discovered by Ohfeld and his colleagues present a security danger to potentially millions of unsuspecting customers of cloud computing services, he said.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cIn a small sample of Azure tenants we analyzed, over 65 percent [of Azure customers] were unknowingly at risk,\u201d Ohfeld wrote.\n\nThe vulnerabilities that Wiz researchers discovered include one that allows for remote code execution (RCE), CVE-2021-38647. The other three are privilege-escalation vulnerabilities (CVE-2021-38648, CVE-2021-38645\u00a0and CVE-2021-38649)\u00a0of lower risk but which are critical for a full attack chain.\n\n\u201cUnless a patch is applied, attackers can easily exploit these four vulnerabilities to escalate to root privileges and remotely execute malicious code (for instance, encrypting files for ransom),\u201d Ohfeld said. Hidden Cloud Security Danger in OMIOne reason for the significant alarm over the flaws is that they are found in OMI, an agent automatically deployed when customers set up a Linux virtual machine (VM) in their cloud and enable certain Azure services, researchers explained.\n\n\u201cThis happens without customers\u2019 explicit consent or knowledge,\u201d Ohfeld wrote. \u201cUsers simply click \u2018agree\u2019 to log collection during setup, and they have unknowingly opted in.\u201d\n\nOMI is a perilous attack surface because Azure provides \u201cvirtually no public documentation\u201d about it, he said. That means most customers have never heard of it and are unaware that it even exists as an exploitable entity in their deployment.\n\nMoreover, the OMI agent runs as root with the highest privileges, so any user can communicate with it using a UNIX socket or via an HTTP API when configured to allow external access, Ohfeld explained.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges \u201cAs a result, the vulnerabilities we found would allow external users or low-privileged users to remotely execute [...]", "creation_timestamp": "2026-09-01T20:02:22.321185Z"}, {"uuid": "0079d4e7-a359-403a-8703-74f2ad78168c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38649", "type": "seen", "source": "https://t.me/hacking_Attack/24258", "content": "Black Hat Ethical Hacking\nAzure Zero-Day Flaws Highlight Lurking Supply-Chain Risk\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Azure Zero-Day Flaws Highlight Lurking Supply-Chain RiskPost Views: 107 \nReading Time: 1 Minute\nDubbed OMIGOD, a series of vulnerabilities in the Open Management Infrastructure used in Azure on Linux demonstrate hidden security threats\nFour Microsoft zero-day vulnerabilities in the Azure cloud platform\u2019s Open Management Infrastructure (OMI) \u2014 a software that many don\u2019t know is embedded in a host of services \u2014 show that OMI represents a significant security blind spot, researchers said.\n\nCollectively dubbed \u201cOMIGOD\u201d because of the name and the reaction of the researchers who discovered them, the flaws \u2014 which were zero-day when found \u2014 affect thousands of Azure customers and millions of endpoints, according to a blog post\u00a0published this week by cloud infrastructure security firm Wiz.\n\nThough Microsoft patched them this week in its monthly Patch Tuesday\u00a0raft of updates, their presence in OMI highlights the risk for the supply chain when companies unknowingly run code \u2014 particularly open-source code \u2014 on their systems that allows for exploitation, researchers said.\n\nIndeed, recent high-profile supply-chain attacks such as SolarWinds\u00a0and Kaseya\u00a0demonstrate how much damage can be done when undetected flaws in third-party software that organizations use in larger systems are exploited.\n\n\u201cOne of the biggest challenges in preventing them is that our digital supply chain is not transparent,\u201d senior security researcher Nir Ohfeld wrote in the Wiz post. \u201cIf you don\u2019t know what\u2019s hidden in the services and products you use every day, how can you manage the risk?\n\nIndeed, the OMIGOD \u00a0vulnerabilities discovered by Ohfeld and his colleagues present a security danger to potentially millions of unsuspecting customers of cloud computing services, he said.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cIn a small sample of Azure tenants we analyzed, over 65 percent [of Azure customers] were unknowingly at risk,\u201d Ohfeld wrote.\n\nThe vulnerabilities that Wiz researchers discovered include one that allows for remote code execution (RCE), CVE-2021-38647. The other three are privilege-escalation vulnerabilities (CVE-2021-38648, CVE-2021-38645\u00a0and CVE-2021-38649)\u00a0of lower risk but which are critical for a full attack chain.\n\n\u201cUnless a patch is applied, attackers can easily exploit these four vulnerabilities to escalate to root privileges and remotely execute malicious code (for instance, encrypting files for ransom),\u201d Ohfeld said. Hidden Cloud Security Danger in OMIOne reason for the significant alarm over the flaws is that they are found in OMI, an agent automatically deployed when customers set up a Linux virtual machine (VM) in their cloud and enable certain Azure services, researchers explained.\n\n\u201cThis happens without customers\u2019 explicit consent or knowledge,\u201d Ohfeld wrote. \u201cUsers simply click \u2018agree\u2019 to log collection during setup, and they have unknowingly opted in.\u201d\n\nOMI is a perilous attack surface because Azure provides \u201cvirtually no public documentation\u201d about it, he said. That means most customers have never heard of it and are unaware that it even exists as an exploitable entity in their deployment.\n\nMoreover, the OMI agent runs as root with the highest privileges, so any user can communicate with it using a UNIX socket or via an HTTP API when configured to allow external access, Ohfeld explained.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges \u201cAs a result, the vulnerabilities we found would allow external users or low-privileged users to remotely execute [...]", "creation_timestamp": "2026-09-01T20:02:22.365832Z"}]}