{"vulnerability": "cve-2021-4361", "sightings": [{"uuid": "67bb3f94-ae47-434c-af1e-c6852bd59906", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-43618", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/", "content": "", "creation_timestamp": "2026-04-02T17:00:00.000000Z"}, {"uuid": "b66d4608-a9c4-4719-8a49-f67772df095a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/861", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aRepo demonstrating CVE-2021-43616 / https://github.com/npm/cli/issues/2701\nURL\uff1ahttps://github.com/icatalina/CVE-2021-43616", "creation_timestamp": "2021-11-15T01:10:50.000000Z"}, {"uuid": "f5c3f508-9ba6-4b69-87e5-36b46d020539", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43619", "type": "seen", "source": "https://t.me/cibsecurity/38240", "content": "\u203c CVE-2021-43619 \u203c\n\nTrusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-01T07:23:40.000000Z"}, {"uuid": "2252c2c3-3254-4416-b0cb-349d27cec70c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43615", "type": "seen", "source": "https://t.me/cibsecurity/36736", "content": "\u203c CVE-2021-43615 \u203c\n\nSMM callout vulnerability allowing a possible attacker to hijack execution flow of a code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-03T07:29:31.000000Z"}, {"uuid": "b39d9b9f-ab4d-43df-8ea2-92fd453270e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43611", "type": "seen", "source": "https://t.me/cibsecurity/32355", "content": "\u203c CVE-2021-43611 \u203c\n\nBelledonne Belle-sip before 5.0.20 can crash applications such as Linphone via \" \\ \" in the display name of a From header.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-13T00:39:47.000000Z"}, {"uuid": "a424275d-6f39-4214-bb7a-7356f94f8695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "seen", "source": "https://t.me/cibsecurity/32376", "content": "\u203c CVE-2021-43616 \u203c\n\nThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-13T20:40:17.000000Z"}, {"uuid": "dc5d200f-bf02-4924-8a65-a840ded5f073", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43618", "type": "seen", "source": "https://t.me/cibsecurity/32395", "content": "\u203c CVE-2021-43618 \u203c\n\nGNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-15T07:11:51.000000Z"}, {"uuid": "fee4acad-a1e7-4819-a0ac-0a5f4a2b0341", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1185", "content": "#exploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616\n\n@BlueRedTeam", "creation_timestamp": "2021-11-16T09:37:44.000000Z"}, {"uuid": "410b03f2-b85a-4a25-9a61-8cb1cd4c9198", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43617", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1197", "content": "#exploit\n1. CVE-2021-43617:\nBypass CRF\nhttps://github.com/kombat1/CVE-2021-43617\n\n2. Linux: UAF read: SO_PEERCRED\nand SO_PEERGROUPS race with listen() (and connect())\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2230\n\n3. CVE-2021-37580:\nApache ShenYu 2.3.0/2.4.0 authentication bypass\nhttps://github.com/0x0021h/expbox/blob/main/cve-2021-37580-poc.py\n\n@BlueRedTeam", "creation_timestamp": "2021-11-20T06:56:13.000000Z"}, {"uuid": "fc0d23bd-8ac9-44b5-b3ec-3fa0fb5f3a85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4765", "content": "#exploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616", "creation_timestamp": "2021-11-16T11:01:01.000000Z"}, {"uuid": "a12983c2-e46f-4f8a-840d-be7dd20e4d00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43617", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4790", "content": "#exploit\n1. CVE-2021-43617:\nBypass CRF\nhttps://github.com/kombat1/CVE-2021-43617\n\n2. Linux: UAF read: SO_PEERCRED\nand SO_PEERGROUPS race with listen() (and connect())\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2230\n\n3. CVE-2021-37580:\nApache ShenYu 2.3.0/2.4.0 authentication bypass\nhttps://github.com/0x0021h/expbox/blob/main/cve-2021-37580-poc.py", "creation_timestamp": "2021-11-20T13:55:25.000000Z"}, {"uuid": "ae2fa961-08e9-42a5-aa13-23a10290b414", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43617", "type": "seen", "source": "https://t.me/kasraone_com/580", "content": "\ud83d\udd34 exploit\n\n\n CVE-2021-43617\n\n\nBypass CRF\n\n\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2661 \u2800\u2800 \u3007\u2800\u00a0 \u2800 \u2399\u2800\u200c \u200c \u2332\u2063 \n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u02e1\u2071\u1d4f\u1d49\u00a0 \u1d9c\u1d52\u1d50\u1d50\u1d49\u207f\u1d57\u00a0 \u02e2\u1d43\u1d5b\u1d49\u00a0 \u02e2\u02b0\u1d43\u02b3\u1d49\n\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 K1\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 kasraone", "creation_timestamp": "2023-11-06T17:02:27.000000Z"}, {"uuid": "f98c44f8-7135-4db5-9658-210286467e2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43617", "type": "seen", "source": "https://t.me/cissp/4835", "content": "exploit\nSeamlessly Discovering Netgear Universal Plug-and-Pwn (UPnP) 0-days (Netgear UPNP Stack Based Buffer Overflow)\nhttps://blog.grimm-co.com/2021/11/seamlessly-discovering-netgear.html\n\nexploit\n1. CVE-2021-43617:\nBypass CRF\nhttps://github.com/kombat1/CVE-2021-43617\n\n2. Linux: UAF read: SO_PEERCRED\nand SO_PEERGROUPS race with listen() (and connect())\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2230\n\n3. CVE-2021-37580:\nApache ShenYu 2.3.0/2.4.0 authentication bypass\nhttps://github.com/0x0021h/expbox/blob/main/cve-2021-37580-poc.py\n\nMalware_analysis\nPython Malware Imitates Signed PyPI Traffic\nin Novel Exfiltration Technique\n(11 Malicious PyPI Python Libraries)\nhttps://jfrog.com/blog/python-malware-imitates-signed-pypi-traffic-in-novel-exfiltration-technique\n\n\nRed_Team_Tactics\n1. Google SSRF - URL whitelist bypass\nhttps://feed.bugs.xdavidhu.me/bugs/0008\n2. HTTP Request Smuggling due to ignoring chunk extensions\nhttps://hackerone.com/reports/1238099\n3. How I was able to revoke your Instagram 2FA\nhttps://dhiyaneshgeek.github.io/web/security/2021/10/23/how-i-was-able-to-revoke-your-instagram-2fa", "creation_timestamp": "2026-09-01T17:00:35.259333Z"}, {"uuid": "1f981014-bf71-4f3d-a134-8565fcb2e86a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "seen", "source": "https://t.me/cissp/4832", "content": "Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology\nhttps://thalium.github.io/blog/posts/fuzzing-microsoft-rdp-client-using-virtual-channels\n\nThreat Research\n1. Android WebView and Its Vulnerabilities\nhttps://blog.securelayer7.net/learn-about-android-webview-and-its-vulnerabilities\n2. Groups Target Alibaba ECS Instances for Cryptojacking\nhttps://www.trendmicro.com/en_us/research/21/k/groups-target-alibaba-ecs-instances-for-cryptojacking.html\n\nexploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616\n\nMalware analysis\n1. Uncovering MosesStaff techniques:\nIdeology over Money\nhttps://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies\n2. Malware uses namesilo Parking pages and Google's custom pages to spread\nhttps://blog.netlab.360.com/zhatuniubility-malware-uses-namesilo-parking-pages-and-googles-custom-pages-to-spread\n3. Exchange Exploit Leads to Domain Wide Ransomware\ud83d\ude01\nhttps://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware", "creation_timestamp": "2026-09-01T17:00:35.355684Z"}, {"uuid": "0f2f47fd-e820-49fe-8471-ba315ad4b94a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43617", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4835", "content": "exploit\nSeamlessly Discovering Netgear Universal Plug-and-Pwn (UPnP) 0-days (Netgear UPNP Stack Based Buffer Overflow)\nhttps://blog.grimm-co.com/2021/11/seamlessly-discovering-netgear.html\n\nexploit\n1. CVE-2021-43617:\nBypass CRF\nhttps://github.com/kombat1/CVE-2021-43617\n\n2. Linux: UAF read: SO_PEERCRED\nand SO_PEERGROUPS race with listen() (and connect())\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2230\n\n3. CVE-2021-37580:\nApache ShenYu 2.3.0/2.4.0 authentication bypass\nhttps://github.com/0x0021h/expbox/blob/main/cve-2021-37580-poc.py\n\nMalware_analysis\nPython Malware Imitates Signed PyPI Traffic\nin Novel Exfiltration Technique\n(11 Malicious PyPI Python Libraries)\nhttps://jfrog.com/blog/python-malware-imitates-signed-pypi-traffic-in-novel-exfiltration-technique\n\n\nRed_Team_Tactics\n1. Google SSRF - URL whitelist bypass\nhttps://feed.bugs.xdavidhu.me/bugs/0008\n2. HTTP Request Smuggling due to ignoring chunk extensions\nhttps://hackerone.com/reports/1238099\n3. How I was able to revoke your Instagram 2FA\nhttps://dhiyaneshgeek.github.io/web/security/2021/10/23/how-i-was-able-to-revoke-your-instagram-2fa", "creation_timestamp": "2026-09-10T14:00:05.299838Z"}, {"uuid": "1141faa7-5b61-4e16-8f45-ece7acbc8806", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4832", "content": "Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology\nhttps://thalium.github.io/blog/posts/fuzzing-microsoft-rdp-client-using-virtual-channels\n\nThreat Research\n1. Android WebView and Its Vulnerabilities\nhttps://blog.securelayer7.net/learn-about-android-webview-and-its-vulnerabilities\n2. Groups Target Alibaba ECS Instances for Cryptojacking\nhttps://www.trendmicro.com/en_us/research/21/k/groups-target-alibaba-ecs-instances-for-cryptojacking.html\n\nexploit\nCVE-2021-43616:\nNPM < 8.1.3 CI Command package-lock.json RCE\nhttps://github.com/npm/cli/issues/2701\n]-> https://github.com/icatalina/CVE-2021-43616\n\nMalware analysis\n1. Uncovering MosesStaff techniques:\nIdeology over Money\nhttps://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies\n2. Malware uses namesilo Parking pages and Google's custom pages to spread\nhttps://blog.netlab.360.com/zhatuniubility-malware-uses-namesilo-parking-pages-and-googles-custom-pages-to-spread\n3. Exchange Exploit Leads to Domain Wide Ransomware\ud83d\ude01\nhttps://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware", "creation_timestamp": "2026-09-10T15:00:07.595361Z"}, {"uuid": "213eac39-35ba-4470-8eee-173849378ac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "seen", "source": "Telegram/ihh6lu2JwVHbxCCtzMwz7J2so3OYSU8lmtMIGGUfSqoltoc", "content": "", "creation_timestamp": "2026-09-18T04:00:13.549409Z"}, {"uuid": "fba27bff-3018-42c7-84ca-17984a800014", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43616", "type": "published-proof-of-concept", "source": "Telegram/ihh6lu2JwVHbxCCtzMwz7J2so3OYSU8lmtMIGGUfSqoltoc", "content": "", "creation_timestamp": "2026-09-19T00:00:13.194618Z"}]}