{"vulnerability": "cve-2021-4101", "sightings": [{"uuid": "3abb3229-46f3-4e58-b5e1-5a03b684bb41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41010", "type": "seen", "source": "https://t.me/cibsecurity/56024", "content": "\u203c CVE-2021-41010 \u203c\n\nCVE was unused by HPE.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-06T00:19:30.000000Z"}, {"uuid": "3dedbeb2-737c-4c08-b57d-d051d65c7655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4101", "type": "exploited", "source": "https://t.me/true_secator/2439", "content": "\u041f\u043e\u0434 \u0448\u0443\u043c\u043e\u043a log4shell \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0440\u0435\u0448\u0438\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Chrome.\n \n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Chrome 96.0.4664.110 \u0441\u0442\u0430\u043b\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0434\u043b\u044f Windows, Mac \u0438 Linux \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0437\u043d\u0430\u043b\u0438 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f CVE-2021-4102 \u0443\u0436\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u0438 \u043d\u0430\u0447\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0440\u043e\u0447\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435:\n \n- \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f CVE-2021-4098 (\u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 Mojo, \u0430\u0432\u0442\u043e\u0440: \u0421\u0435\u0440\u0433\u0435\u0439 \u0413\u043b\u0430\u0437\u0443\u043d\u043e\u0432 \u0438\u0437 Google Project Zero)\n- \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 CVE-2021-4099 (\u043e\u0448\u0438\u0431\u043a\u0430 \u0432 Swiftshader, \u0430\u0432\u0442\u043e\u0440: \u0410\u043a\u0438 \u0425\u0435\u043b\u0438\u043d \u0438\u0437 Solita)\n- \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 CVE-2021-4100 (\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0430 \u043e\u0431\u044a\u0435\u043a\u0442\u0430 \u0432 ANGLE, \u0430\u0432\u0442\u043e\u0440: \u0410\u043a\u0438 \u0425\u0435\u043b\u0438\u043d \u0438\u0437 Solita)\n- \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 CVE-2021-4101 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u043a\u0443\u0447\u0438 \u0432 Swiftshader, \u0430\u0432\u0442\u043e\u0440: \u0410\u0431\u0440\u0430\u0440\u0443\u0434\u0434\u0438\u043d \u0425\u0430\u043d \u0438 \u041e\u043c\u0430\u0439\u0440).\n \nCVE-2021-4102 \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript Chrome V8 \u0438 WebAssembly, \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0438\u043b\u0438 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. Google \u043e\u0442\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043e\u0442 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u044f \u0434\u0435\u0442\u0430\u043b\u0435\u0439 \u043f\u043e \u043f\u043e\u0432\u043e\u0434\u0443 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0439 \u0434\u044b\u0440\u043e\u0439.\n \n\u0412 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u044d\u0442\u043e \u0443\u0436\u0435 17-\u0430\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f Google 0-day \u0432 Chrome, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c Google Chrome \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u043a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u043d\u043e \u0441\u0442\u0430\u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c.", "creation_timestamp": "2021-12-14T13:04:00.000000Z"}, {"uuid": "6d1d33cf-5d41-4767-bc31-85f9112a8509", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41016", "type": "seen", "source": "https://t.me/cibsecurity/36691", "content": "\u203c CVE-2021-41016 \u203c\n\nA improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special characters\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-02T14:28:17.000000Z"}, {"uuid": "58c876af-47ab-42bb-a3a7-1bdb98045f35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41018", "type": "seen", "source": "https://t.me/cibsecurity/36695", "content": "\u203c CVE-2021-41018 \u203c\n\nA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-02T14:28:21.000000Z"}, {"uuid": "95e834aa-1848-4924-9ee1-5c2410169ca6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41015", "type": "seen", "source": "https://t.me/cibsecurity/33580", "content": "\u203c CVE-2021-41015 \u203c\n\nA improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-08T16:22:41.000000Z"}, {"uuid": "140a9d66-e1b3-4f1a-bb9b-94181c078f5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41014", "type": "seen", "source": "https://t.me/cibsecurity/33578", "content": "\u203c CVE-2021-41014 \u203c\n\nA uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-08T16:22:40.000000Z"}, {"uuid": "a67dd3ab-8fdc-445d-bac5-e56b0674fb33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41019", "type": "seen", "source": "https://t.me/cibsecurity/31630", "content": "\u203c CVE-2021-41019 \u203c\n\nAn improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to disclosure of sensitive information, such as AD credentials.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-02T21:23:20.000000Z"}, {"uuid": "539eb278-4ad6-4bad-bb0c-684b99a74ccc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41013", "type": "seen", "source": "https://t.me/cibsecurity/33615", "content": "\u203c CVE-2021-41013 \u203c\n\nAn improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-08T20:22:48.000000Z"}, {"uuid": "6a91944b-1673-4e7d-96d3-5f9b2828050f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41017", "type": "seen", "source": "https://t.me/cibsecurity/33639", "content": "\u203c CVE-2021-41017 \u203c\n\nMultiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-08T22:23:01.000000Z"}, {"uuid": "84c1191a-29a6-4995-aaa7-b15ab66624b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41011", "type": "seen", "source": "https://t.me/cibsecurity/29228", "content": "\u203c CVE-2021-41011 \u203c\n\nLINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually impossible, but in combination with a server-side bug, attackers could get this information.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-22T18:28:53.000000Z"}]}