Malicious Tag Roundup (Jun 21-Jul 16, 2021) | Cybersecurity Blog | Grey Noise
Summary: GreyNoise's tag roundup for June 21 to July 16, 2021 added tags for observed attempts to exploit CVE-2020-36289 in Jira for user enumeration, CVE-2021-1497 and CVE-2021-1498 remote code execution flaws in Cisco HyperFlex HX Data Platform, and NoSQL command injection in Cockpit CMS via CVE-2020-35846, CVE-2020-35847 and CVE-2020-35848. The roundup also added a CISA actor tag marked benign and removed the ZeroShell RCE CVE-2009-0545 tag because it no longer exists, scans, or can be accurately identified.
Key Takeaway: Three separate exploit families were being probed in under a month, and the Cisco HyperFlex tags split between malicious exploitation attempts and unknown-intent vulnerability checks, so a hit on either tag is a signal worth triaging rather than ignoring.