{"metadata": {"vulnerability": "CVE-2021-28663", "count": 64, "kinds": {"milestone": 6, "sighting": 28, "kev": 11, "other": 19}}, "data": [{"timestamp": "2021-03-18T00:00:00Z", "date_only": false, "value": "2021-03-18T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-28663", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-05-04T00:00:00Z", "date_only": false, "value": "2021-05-04T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-337", "record": "CERTFR-2021-AVI-337", "field": "last_revision_date"}, {"timestamp": "2021-05-04T00:00:00Z", "date_only": false, "value": "2021-05-04T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-337", "record": "CERTFR-2021-AVI-337", "field": "initial_release_date"}, {"timestamp": "2021-05-04T00:00:00Z", "date_only": false, "value": "2021-05-04T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-337", "record": "CERTFR-2021-AVI-337", "field": "revisions.0.revision_date"}, {"timestamp": "2021-05-10T00:00:00Z", "date_only": false, "value": "2021-05-10T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-28663", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-05-10T15:15:00Z", "date_only": false, "value": "2021-05-10T15:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2RC2-892P-6HC2", "record": "GHSA-2RC2-892P-6HC2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-05-10T15:15:07.557Z", "date_only": false, "value": "2021-05-10T15:15:07.557", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-28663", "record": "FKIE_CVE-2021-28663", "field": "published"}, {"timestamp": "2021-05-10T15:15:07.557Z", "date_only": false, "value": "2021-05-10T15:15:07.557", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2021-28663", "record": "GSD-2021-28663", "field": "namespaces.nvd.nist.gov.cve.published"}, {"timestamp": "2021-05-21T00:00:00Z", "date_only": true, "value": "2021-05-21", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2021-36598", "record": "CNVD-2021-36598", "field": "submitTime"}, {"timestamp": "2021-05-24T00:00:00Z", "date_only": true, "value": "2021-05-24", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2021-36598", "record": "CNVD-2021-36598", "field": "openTime"}, {"timestamp": "2021-06-08T17:52:38Z", "date_only": false, "value": "2021-06-08T17:52:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/androidMalware/1217", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "132d6640-2979-463f-954e-4ffed43cd6f3", "content": "Four Android vulnerabilities patched earlier this month may be under limited, targeted exploitation (CVE-2021-1905, CVE-2021-1906, CVE-2021-28663, CVE-2021-28664)\nhttps://therecord.media/arm-and-qualcomm-zero-days-quietly-patched-in-this-months-android-security-updates/", "url": "https://t.me/androidMalware/1217"}, {"timestamp": "2021-09-01T11:10:02Z", "date_only": false, "value": "2021-09-01T11:10:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/4197", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "51518225-db8d-47f7-ab3c-e48214c5ffe6", "content": "#Offensive_security\n1. Deception in Depth - LSASS Injection\nhttps://blog.spookysec.net/DnD-LSASS-Injection\n2. CVE-2021-28663:\nAndroid kernel backdoor vulnerability\nhttps://paper.seebug.org/1690\n// This vulnerability in the ARM Mali GPU driver can help an attacker:\n- steal other APP running memory data;\n- modify other APP code;\n- steal kernel running memory data;\n- stably obtain ROOT permission...", "url": "https://t.me/CyberSecurityTechnologies/4197"}, {"timestamp": "2021-09-02T08:17:16Z", "date_only": false, "value": "2021-09-02T08:17:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/490", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "5d18d0c5-24ff-461b-9b54-73aad451689d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nURL\uff1ahttps://github.com/lntrx/CVE-2021-28663", "url": "https://t.me/GithubRedTeam/490"}, {"timestamp": "2021-09-02T09:51:47Z", "date_only": false, "value": "2021-09-02T09:51:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/491", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "bd789f7b-e2ab-44de-ac39-1654b477e0fe", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nURL\uff1ahttps://github.com/AlAIAL90/CVE-2021-28164", "url": "https://t.me/GithubRedTeam/491"}, {"timestamp": "2021-09-03T10:26:19Z", "date_only": false, "value": "2021-09-03T10:26:19.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/androidMalware/1290", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "17490ce7-e429-4caf-8f0e-aabe63e114cb", "content": "Internal of the Android kernel backdoor vulnerability CVE-2021-28663\nhttp://translate.google.com/translate?hl=en&sl=auto&tl=en&u=https%3A%2F%2Fvul.360.net%2Farchives%2F263", "url": "https://t.me/androidMalware/1290"}, {"timestamp": "2021-09-03T19:40:06Z", "date_only": false, "value": "2021-09-03T19:40:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerOne/3161", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "ecb84fa4-babf-4935-b3bb-26bdba2717eb", "content": "https://github.com/lntrx/CVE-2021-28663", "url": "https://t.me/HackerOne/3161"}, {"timestamp": "2021-09-18T23:06:09Z", "date_only": false, "value": "2021-09-18T23:06:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacker_trick/186", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "8d090c7c-8d92-4c83-ad59-23860070d50f", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "url": "https://t.me/hacker_trick/186"}, {"timestamp": "2021-09-25T02:14:31Z", "date_only": false, "value": "2021-09-25T02:14:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyber0iq/18", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "7ac8a77a-cce3-4ab8-891a-5d66f3d70efe", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "url": "https://t.me/cyber0iq/18"}, {"timestamp": "2021-09-25T02:15:23Z", "date_only": false, "value": "2021-09-25T02:15:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyber0iq/19", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "a713d478-53fe-483e-8716-5f9ffe3dc50b", "content": "Latest Vulnerabilities and Exploits\n\nCVE-2021-3449 OpenSSL denial-of-service exploit\nhttps://github.com/terorie/cve-2021-3449\n\nProxyToken\nhttps://github.com/bhdresh/CVE-2021-33766-ProxyToken\n\nCVES Xstream-1.4.17\nhttps://github.com/zwjjustdoit/Xstream-1.4.17\n\nCVE-2021-36934/HiveNightmare/SeriousSAM\nhttps://github.com/cube0x0/CVE-2021-36934\n\nHow to exploit a vulnerable windows driver Exploit for AsrDrv104 sys\nhttps://github.com/stong/CVE-2020-15368\n\nCVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel\nhttps://github.com/0vercl0k/CVE-2021-32537\n\nCVE-2021-28476 a guest-to-host \"Hyper-V Remote Code Execution Vulnerability\" in vmswitch sys\nhttps://github.com/0vercl0k/CVE-2021-28476\n\nCVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit\nhttps://github.com/klezVirus/CVE-2021-40444\n\nExploit Accsess network clients by sending packets in wirless TP-LINK and preparing for a mitm attack\nhttps://github.com/lhashashinl/CVE-2021-37152\n\nProof on Concept Exploit for CVE-2021-38647 (OMIGOD)\nhttps://github.com/horizon3ai/CVE-2021-38647\n\nProof of Concept Exploit for vCenter CVE-2021-21972\nhttps://github.com/horizon3ai/CVE-2021-21972\n\nProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893\nhttps://github.com/ZephrFish/CVE-2021-22893\n\nCVE-2021-33766 (ProxyToken)\nhttps://github.com/demossl/CVE-2021-33766-ProxyToken\n\nCVE-2021-2456\nhttps://github.com/peterjson31337/CVE-2021-2456\n\nCVE-2021-38647 POC for RCE\nhttps://github.com/midoxnet/CVE-2021-38647\n\nCVE-2021-26084 (PoC) | Confluence Server Webwork OGNL injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\nhttps://github.com/r0ckysec/CVE-2021-26084_Confluence\nhttps://github.com/march0s1as/CVE-2021-26084\n\n\nCVE-2021-21551 Dell Driver EoP\nhttps://github.com/ihack4falafel/Dell-Driver-EoP-CVE-2021-21551\n\nA basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)\nhttps://github.com/lntrx/CVE-2021-28663\n\nCVE-2021-40353 openSIS 8.0 SQL Injection\nhttps://github.com/5qu1n7/CVE-2021-40353\n\nCVE-2021-28476 Ubuntu 20.04\nhttps://github.com/sh4m2hwz/CVE-2021-28476-tools-env\n\nmy exp for chrome V8 CVE-2021-30551\nhttps://github.com/xmzyshypnc/CVE-2021-30551\n\nPOC of CVE-2021-2394\nhttps://github.com/lz2y/CVE-2021-2394\n\nWordPress Backup Guard Authenticated Remote Code Execution Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb\n\nExploit code for CVE-2021-33909,Just a dump of removed\nhttps://github.com/bbinfosec43/CVE-2021-33909", "url": "https://t.me/cyber0iq/19"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-28663", "field": "timestamps.asserted_at", "uuid": "1bce9e25-6aaa-4d41-855f-f417c325ffed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-28663", "field": "timestamps.asserted_at", "uuid": "2ede7ee5-4b32-4923-b72d-c4b893776d47", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-28663", "field": "containers.adp.0.metrics.2.other.content.dateAdded"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2021-28663", "record": "GSD-2021-28663", "field": "namespaces.cisa.gov.dateAdded"}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-28663", "field": "evidence.0.details.added_date", "uuid": "2ede7ee5-4b32-4923-b72d-c4b893776d47", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": true, "value": "2021-11-03", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-28663", "field": "evidence.0.details.date_added", "uuid": "1bce9e25-6aaa-4d41-855f-f417c325ffed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-28663", "field": "timestamps.first_seen_at", "uuid": "1bce9e25-6aaa-4d41-855f-f417c325ffed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-28663", "field": "timestamps.first_seen_at", "uuid": "2ede7ee5-4b32-4923-b72d-c4b893776d47", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-28663", "field": "status.status_updated_at", "uuid": "1bce9e25-6aaa-4d41-855f-f417c325ffed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-28663", "field": "status.status_updated_at", "uuid": "2ede7ee5-4b32-4923-b72d-c4b893776d47", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-03T00:00:00Z", "date_only": false, "value": "2021-11-03T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-28663", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2021-11-08T08:58:17Z", "date_only": false, "value": "2021-11-08T08:58:17.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "d881dc18-241d-47b8-aad3-781df29a38ae"}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-28663", "field": "evidence.0.details.due_date", "uuid": "1bce9e25-6aaa-4d41-855f-f417c325ffed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2021-28663", "record": "GSD-2021-28663", "field": "namespaces.cisa.gov.dueDate"}, {"timestamp": "2021-11-20T09:53:52Z", "date_only": false, "value": "2021-11-20T09:53:52.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "f8afab4f-b730-49fb-b97b-71fd1a3193ea"}, {"timestamp": "2022-04-27T11:03:23Z", "date_only": false, "value": "2022-04-27T11:03:23.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/androidMalware/1514", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "88bccf46-1529-4954-b847-72e867c26769", "content": "A Year in Review of 0-days Used In-the-Wild in 2021 by Google\nIn 2021 there were 7 #Android in-the-wild 0-days detected and disclosed:\n - Qualcomm Adreno GPU driver (CVE-2020-11261, CVE-2021-1905, CVE-2021-1906)\n - ARM Mali GPU driver (CVE-2021-28663, CVE-2021-28664)\n - Upstream Linux kernel (CVE-2021-1048, CVE-2021-0920)\n\nFor the 5 total #iOS and macOS in-the-wild 0-days, they targeted 3 different attack surfaces:\n - IOMobileFrameBuffer (CVE-2021-30807, CVE-2021-30883)\n - XNU Kernel (CVE-2021-1782 & CVE-2021-30869)\n - CoreGraphics (CVE-2021-30860)\n - CommCenter (FORCEDENTRY sandbox escape - CVE requested, not yet assigned)\nhttps://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html", "url": "https://t.me/androidMalware/1514"}, {"timestamp": "2022-05-24T19:01:54Z", "date_only": false, "value": "2022-05-24T19:01:54Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2RC2-892P-6HC2", "record": "GHSA-2RC2-892P-6HC2", "field": "published"}, {"timestamp": "2023-02-23T00:00:00Z", "date_only": false, "value": "2023-02-23T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2021-28663", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2023-12-04T07:13:43Z", "date_only": false, "value": "2023-12-04T07:13:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1143", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "e3d29fa9-596f-4698-993f-487911cc7ae4", "content": "#ExploitObserverAlert\n\nCVE-2021-28663\n\nDESCRIPTION: Exploit Observer has 7 entries related to CVE-2021-28663. The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.\n\nFIRST-EPSS: 0.006260000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/1143"}, {"timestamp": "2023-12-13T01:23:29.092Z", "date_only": false, "value": "2023-12-13T01:23:29.092478Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-28663", "record": "GSD-2021-28663", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-13T13:51:52.563Z", "date_only": false, "value": "2023-12-13T13:51:52.563", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-28663", "record": "GSD-2021-28663", "field": "namespaces.nvd.nist.gov.cve.lastModified"}, {"timestamp": "2024-07-24T20:58:41.342Z", "date_only": false, "value": "2024-07-24T20:58:41.342252Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-28663", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2024-07-24T20:58:41.342Z", "date_only": false, "value": "2024-07-24T20:58:41.342252Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-28663", "record": "FKIE_CVE-2021-28663", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-08-03T21:47:33.122Z", "date_only": false, "value": "2024-08-03T21:47:33.122Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-28663", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2024-11-14T06:09:01Z", "date_only": false, "value": "2024-11-14T06:09:01.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/171e3ddd-22c8-4687-8e3e-f7f469dff1f5", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "81529d26-4f47-485f-b223-a239f3503342"}, {"timestamp": "2024-12-24T20:24:35.190Z", "date_only": false, "value": "2024-12-24T20:24:35.190436Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971123", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "108c43f5-94ff-4955-af8f-260ff836b110", "url": "https://feedsin.space/feed/CISAKevBot/items/2971123"}, {"timestamp": "2025-02-23T02:09:54Z", "date_only": false, "value": "2025-02-23T02:09:54.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "2d3698d9-5afa-42a0-8ba2-777d366e968b"}, {"timestamp": "2025-10-21T23:25:46.291Z", "date_only": false, "value": "2025-10-21T23:25:46.291Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-28663", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:25:46.291Z", "date_only": false, "value": "2025-10-21T23:25:46.291Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-28663", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T00:32:13Z", "date_only": false, "value": "2025-10-22T00:32:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2RC2-892P-6HC2", "record": "GHSA-2RC2-892P-6HC2", "field": "modified"}, {"timestamp": "2026-02-02T12:28:39.069Z", "date_only": false, "value": "2026-02-02T12:28:39.069498Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/dc390748-0edb-4e94-9082-36aca30caab0", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "2ad05a52-3577-450e-9f2f-a0bd5f8b14d7", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/dc390748-0edb-4e94-9082-36aca30caab0"}, {"timestamp": "2026-02-02T12:28:39.069Z", "date_only": false, "value": "2026-02-02T12:28:39.069498Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/dc390748-0edb-4e94-9082-36aca30caab0", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "f94e0378-bc0a-4f22-9c78-90e00dd02f51", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/dc390748-0edb-4e94-9082-36aca30caab0"}, {"timestamp": "2026-02-02T13:24:01Z", "date_only": false, "value": "2026-02-02T13:24:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-28663", "field": "timestamps.recorded_at", "uuid": "1bce9e25-6aaa-4d41-855f-f417c325ffed", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T03:46:43.793Z", "date_only": false, "value": "2026-06-17T03:46:43.793", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-28663", "record": "FKIE_CVE-2021-28663", "field": "lastModified"}, {"timestamp": "2026-06-19T12:47:57.106Z", "date_only": false, "value": "2026-06-19T12:47:57.106289Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8eb4b66c-1560-49e4-873d-cc581b609330", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "b77ed85d-650d-4963-9200-25edacea7bb4", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8eb4b66c-1560-49e4-873d-cc581b609330"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-28663", "field": "timestamps.recorded_at", "uuid": "2ede7ee5-4b32-4923-b72d-c4b893776d47", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:13:22.563Z", "date_only": false, "value": "2026-06-23T11:13:22.563296Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/2ede7ee5-4b32-4923-b72d-c4b893776d47", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "a3052733-9a03-47d2-80f7-9ba2877e8d75", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/2ede7ee5-4b32-4923-b72d-c4b893776d47"}, {"timestamp": "2026-06-23T14:04:46.397Z", "date_only": false, "value": "2026-06-23T14:04:46.397027Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25636d25-33e9-4b6e-ac65-ccf7ce8558a4", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "7567f6ba-400e-4abb-bb94-e1328f9d5182", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25636d25-33e9-4b6e-ac65-ccf7ce8558a4"}, {"timestamp": "2026-08-09T05:02:33.162Z", "date_only": false, "value": "2026-08-09T05:02:33.162905Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/onelab1337/1225", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "f035e90c-41b9-4a50-b16f-819148b8ab09", "url": "https://t.me/onelab1337/1225"}, {"timestamp": "2026-08-10T00:00:10.624Z", "date_only": false, "value": "2026-08-10T00:00:10.624684Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/onelab1337/1225", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "3e92cd55-713f-4894-a2f9-5c5ddb1b3c46", "url": "https://t.me/onelab1337/1225"}, {"timestamp": "2026-09-01T17:00:41.894Z", "date_only": false, "value": "2026-09-01T17:00:41.894327Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/4236", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "4e406a90-6276-48bc-86a4-b06e25ff179b", "url": "https://t.me/cissp/4236"}, {"timestamp": "2026-09-01T18:00:05.063Z", "date_only": false, "value": "2026-09-01T18:00:05.063475Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hackersmeet0/2446", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "6c241336-18b0-4e4a-81e7-a4e2f5609f11", "url": "https://t.me/hackersmeet0/2446"}, {"timestamp": "2026-09-01T20:02:20.936Z", "date_only": false, "value": "2026-09-01T20:02:20.936344Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/24602", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "1a091803-220f-42c6-9762-c541754adadb", "url": "https://t.me/hacking_Attack/24602"}, {"timestamp": "2026-09-07T14:00:05.155Z", "date_only": false, "value": "2026-09-07T14:00:05.155391Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/24602", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "028dd4ed-34b1-4987-8559-43f1d0b8fe7d", "url": "https://t.me/hacking_Attack/24602"}, {"timestamp": "2026-09-10T22:00:04.687Z", "date_only": false, "value": "2026-09-10T22:00:04.687064Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/4236", "record": "CVE-2021-28663", "field": "creation_timestamp", "uuid": "0e9d4721-bb07-47f1-8727-6780b4ed8fb5", "url": "https://t.me/cissp/4236"}]}