{"uuid": "5ad2fe2e-7ebe-4222-ae5d-478ac868a06e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-20837", "type": "seen", "source": "https://t.me/cissp/4682", "content": "Cloud Security\nAttacking Azure/Azure AD\nhttps://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii\n\nRed Team Tactics\nBypassing ModSecurity WAF\nhttp://blog.h3xstream.com/2021/10/bypassing-modsecurity-waf.html?m=1\n]-> A Scientific Notation Bug in MySQL left AWS WAF Clients Vulnerable to SQL Injection:\nhttps://www.gosecure.net/blog/2021/10/19/a-scientific-notation-bug-in-mysql-left-aws-waf-clients-vulnerable-to-sql-injection\n\nOffensive security\nExploiting an ARM-only race condition:\nHow to exploit a double free vulnerability in 2021\nhttps://github.com/stong/how-to-exploit-a-double-free\n]-> Exploit Code:\nhttps://github.com/stong/how-to-exploit-a-double-free/blob/master/solve.py\n\nThreat Research\n1. Exploiting Grandstream HT801 ATA\n(CVE-2021-37748, CVE-2021-37915)\nhttps://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915\n]-> PoC:\nhttps://github.com/SECFORCE/CVE-2021-37748\n\n2. Finding An Unauthenticated RCE Vulnerability in MovableType (CVE-2021-20837)\nhttps://nemesis.sh/posts/movable-type-0day\n]-> PoC:\nhttps://github.com/ghost-nemesis/cve-2021-20837-poc\n\nMalware analysis\n1. UltimaSMS Android Malware\nhttps://blog.avast.com/premium-sms-scam-apps-on-play-store-avast\n2. Firefox Proxy Malware\nhttps://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons\n3. Craigslist E-Mail Hijack\nhttps://www.inky.com/blog/urgency-mail-relay-serve-phishers-well-on-craigslist\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-02T01:04:22.122668Z"}