{"metadata": {"vulnerability": "CVE-2015-5119", "count": 137, "kinds": {"milestone": 8, "sighting": 59, "kev": 11, "other": 59}}, "data": [{"timestamp": "2015-06-26T00:00:00Z", "date_only": false, "value": "2015-06-26T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2015-5119", "field": "cveMetadata.dateReserved"}, {"timestamp": "2015-07-05T00:00:00Z", "date_only": false, "value": "2015-07-05T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2015-5119", "field": "containers.cna.datePublic"}, {"timestamp": "2015-07-07T00:00:00Z", "date_only": false, "value": "2015-07-07T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_release_date.data.0.date"}, {"timestamp": "2015-07-07T00:00:00Z", "date_only": false, "value": "2015-07-07T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "vulnerabilities.34.discovery_date"}, {"timestamp": "2015-07-07T00:00:00Z", "date_only": false, "value": "2015-07-07T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "vulnerabilities.34.discovery_date"}, {"timestamp": "2015-07-07T00:00:00Z", "date_only": false, "value": "2015-07-07T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "vulnerabilities.34.release_date"}, {"timestamp": "2015-07-07T00:00:00Z", "date_only": false, "value": "2015-07-07T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "vulnerabilities.34.release_date"}, {"timestamp": "2015-07-08T00:00:00Z", "date_only": false, "value": "2015-07-08T00:00:00.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://www.exploit-db.com/exploits/37523", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "04da1b12-77d8-442f-9548-d3ac84cc6de1", "url": "https://www.exploit-db.com/exploits/37523"}, {"timestamp": "2015-07-08T00:00:00Z", "date_only": false, "value": "2015-07-08T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_release_date.data.1.date"}, {"timestamp": "2015-07-08T00:00:00Z", "date_only": false, "value": "2015-07-08T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2015-07-08T00:00:00Z", "date_only": false, "value": "2015-07-08T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2015-07-08T00:00:00Z", "date_only": false, "value": "2015-07-08T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2015-07-08T00:00:00Z", "date_only": false, "value": "2015-07-08T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2015-07-08T00:00:00Z", "date_only": false, "value": "2015-07-08T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2015-AVI-284", "record": "CERTFR-2015-AVI-284", "field": "revisions.0.revision_date"}, {"timestamp": "2015-07-08T06:53:08Z", "date_only": false, "value": "2015-07-08T06:53:08.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/559cc8a7-1a7c-4002-bff0-4e1d950d210b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "3448c075-6eb0-4de0-a435-6b3e4ec598bf"}, {"timestamp": "2015-07-08T14:00:00Z", "date_only": false, "value": "2015-07-08T14:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2015-5119", "field": "cveMetadata.datePublished"}, {"timestamp": "2015-07-08T14:59:00Z", "date_only": false, "value": "2015-07-08T14:59:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3792-FF84-674W", "record": "GHSA-3792-FF84-674W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2015-07-08T14:59:00Z", "date_only": false, "value": "2015-07-08T14:59:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2015-5119", "record": "UBUNTU-CVE-2015-5119", "field": "published"}, {"timestamp": "2015-07-08T14:59:00Z", "date_only": false, "value": "2015-07-08T14:59Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2015-5119", "record": "GSD-2015-5119", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2015-07-08T14:59:05.677Z", "date_only": false, "value": "2015-07-08T14:59:05.677000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_release_date.data.7.date"}, {"timestamp": "2015-07-08T14:59:05.677Z", "date_only": false, "value": "2015-07-08T14:59:05.677", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2015-5119", "record": "FKIE_CVE-2015-5119", "field": "published"}, {"timestamp": "2015-07-08T19:43:00Z", "date_only": false, "value": "2015-07-08T19:43:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2015:1211-1", "record": "SUSE-SU-2015:1211-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2015-07-08T19:43:00Z", "date_only": false, "value": "2015-07-08T19:43:00Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2015:1211-1", "record": "SUSE-SU-2015:1211-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2015-07-08T19:43:00Z", "date_only": false, "value": "2015-07-08T19:43:00Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2015:1211-1", "record": "SUSE-SU-2015:1211-1", "field": "document.tracking.generator.date"}, {"timestamp": "2015-07-08T19:43:00Z", "date_only": false, "value": "2015-07-08T19:43:00Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2015:1211-1", "record": "SUSE-SU-2015:1211-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2015-07-08T20:46:49Z", "date_only": false, "value": "2015-07-08T20:46:49+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2015-07-08T20:46:49Z", "date_only": false, "value": "2015-07-08T20:46:49+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2015-07-08T20:46:49Z", "date_only": false, "value": "2015-07-08T20:46:49+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2015-07-08T20:46:49Z", "date_only": false, "value": "2015-07-08T20:46:49+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2015-07-08T20:46:49Z", "date_only": false, "value": "2015-07-08T20:46:49+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "document.tracking.initial_release_date"}, {"timestamp": "2015-07-08T20:46:49Z", "date_only": false, "value": "2015-07-08T20:46:49+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "document.tracking.initial_release_date"}, {"timestamp": "2015-07-08T23:45:17Z", "date_only": false, "value": "2015-07-08T23:45:17", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_release_date.data.6.date"}, {"timestamp": "2015-07-09T00:00:00Z", "date_only": false, "value": "2015-07-09T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_release_date.data.8.date"}, {"timestamp": "2015-07-09T08:29:31Z", "date_only": false, "value": "2015-07-09T08:29:31.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/559e30bc-535c-4713-ae52-406f950d210b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "49d4f045-71c4-4663-934d-911e72516b84"}, {"timestamp": "2015-07-10T00:00:00Z", "date_only": false, "value": "2015-07-10T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_release_date.data.4.date"}, {"timestamp": "2015-07-10T00:00:00Z", "date_only": true, "value": "2015-07-10", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2015-04438", "record": "CNVD-2015-04438", "field": "submitTime"}, {"timestamp": "2015-07-10T15:43:35Z", "date_only": false, "value": "2015-07-10T15:43:35", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_release_date.data.5.date"}, {"timestamp": "2015-07-11T00:00:00Z", "date_only": false, "value": "2015-07-11T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_update_date.data.0.date"}, {"timestamp": "2015-07-13T18:19:07Z", "date_only": false, "value": "2015-07-13T18:19:07.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/55a3ed9f-8ee0-45f9-a83a-2aad0a00020f", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "e0c9212a-58f4-43fb-afb9-999e3e155492"}, {"timestamp": "2015-07-14T00:00:00Z", "date_only": true, "value": "2015-07-14", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2015-04438", "record": "CNVD-2015-04438", "field": "openTime"}, {"timestamp": "2015-07-24T03:16:46Z", "date_only": false, "value": "2015-07-24T03:16:46.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/55a5fe46-4c98-4257-9ac6-0ab50a00020f", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "6faabe00-b6c6-4a86-8942-b37cd0491e57"}, {"timestamp": "2015-08-04T00:00:00Z", "date_only": false, "value": "2015-08-04T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_update_date.data.6.date"}, {"timestamp": "2015-08-11T07:17:58Z", "date_only": false, "value": "2015-08-11T07:17:58.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/55c98ff2-f2fc-4284-8a34-f483950d210b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "53ef0ccd-c309-46c5-a96d-b22f68bd8c37"}, {"timestamp": "2015-08-12T11:08:45Z", "date_only": false, "value": "2015-08-12T11:08:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/55cb26d8-00b8-4345-9423-f5e8950d210b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "e1ec0ab7-3245-423c-90fa-20ce1558af5e"}, {"timestamp": "2015-08-18T15:22:40Z", "date_only": false, "value": "2015-08-18T15:22:40.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/55d34d95-04e8-4b87-b6c3-4c8f950d210b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "03bcd701-5f7e-48f8-b695-80fc39f31987"}, {"timestamp": "2015-08-21T07:28:12Z", "date_only": false, "value": "2015-08-21T07:28:12.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/55d6d2c7-8fe0-4de5-aa4f-4532950d210b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "b49937b0-ba40-4558-b757-cae32d2ac776"}, {"timestamp": "2015-08-25T06:58:09Z", "date_only": false, "value": "2015-08-25T06:58:09.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/55db9387-6a70-4fdd-8fee-6e76950d210b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "893c7194-b7cc-4957-9271-a30bad77a6cb"}, {"timestamp": "2015-09-03T00:00:00Z", "date_only": false, "value": "2015-09-03T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_update_date.data.4.date"}, {"timestamp": "2015-10-15T22:07:39Z", "date_only": false, "value": "2015-10-15T22:07:39.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/56201e1d-f4dc-4ddd-8049-4f2e950d210b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "af1fa51a-7d98-450f-b1a0-3f20baf8db08"}, {"timestamp": "2016-01-07T16:05:05Z", "date_only": false, "value": "2016-01-07T16:05:05.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/568e8c71-0700-4cf9-a197-4673950d210f", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "9961b532-409d-455a-b71c-a623f326994a"}, {"timestamp": "2016-12-23T18:57:01Z", "date_only": false, "value": "2016-12-23T18:57:01.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / adobe", "record": "CVE-2015-5119", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2017-01-20T00:00:00Z", "date_only": false, "value": "2017-01-20T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_update_date.data.1.date"}, {"timestamp": "2017-01-20T02:59:00Z", "date_only": false, "value": "2017-01-20T02:59Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2015-5119", "record": "GSD-2015-5119", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2017-01-20T02:59:03.013Z", "date_only": false, "value": "2017-01-20T02:59:03.013000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_update_date.data.5.date"}, {"timestamp": "2017-10-04T21:01:00Z", "date_only": false, "value": "2017-10-04T21:01:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "sources_update_date.data.3.date"}, {"timestamp": "2018-02-09T18:11:35Z", "date_only": false, "value": "2018-02-09T18:11:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/canyoupwnme/3222", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "50166daf-5a8e-41c1-b08a-7bbe80c9c449", "content": "Adobe Flash Exploitation, Then and Now: From CVE-2015-5119 to CVE-2018-4878\nhttps://www.mdsec.co.uk/2018/02/adobe-flash-exploitation-then-and-now-from-cve-2015-5119-to-cve-2018-4878/", "url": "https://t.me/canyoupwnme/3222"}, {"timestamp": "2018-03-14T21:04:26Z", "date_only": false, "value": "2018-03-14T21:04:26.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/5aa98d8a-3cac-42f0-b224-45d09f590eb0", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "f6eecee2-e7be-4768-b6a7-719891e9cbde"}, {"timestamp": "2018-05-29T15:50:33Z", "date_only": false, "value": "2018-05-29T15:50:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "2ac25b32-eb61-4b5c-83ea-ae81da40475c", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_hacking_team_uaf.rb"}, {"timestamp": "2020-10-09T15:56:18Z", "date_only": false, "value": "2020-10-09T15:56:18.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/7307af77-52b3-45f5-9d2c-eb0ba23f7f85", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "b93b2ab3-e3ab-4295-a09f-81e1c37e3de3"}, {"timestamp": "2020-10-09T16:03:15Z", "date_only": false, "value": "2020-10-09T16:03:15.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/373b418c-0ff6-4bc9-ac2b-c3bbfeb7f155", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "4b53d3c8-fd44-4b56-b4d2-b7b7491be12f"}, {"timestamp": "2020-10-09T16:17:11Z", "date_only": false, "value": "2020-10-09T16:17:11.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/37eaa589-7c2e-4382-839f-c4e33c5645e7", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "926807db-2820-4fa4-94f1-339624720892"}, {"timestamp": "2020-10-09T16:28:35Z", "date_only": false, "value": "2020-10-09T16:28:35.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/4237df88-801e-41e4-87f5-3fe3881b5e79", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "134a79b8-264c-4e2e-bfbd-0560f241cfe9"}, {"timestamp": "2020-10-09T16:35:58Z", "date_only": false, "value": "2020-10-09T16:35:58.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/21b8cf94-f9f1-467a-9b17-5328dd7dcdf3", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "ae4d1913-87a1-4f9c-83db-59036393c697"}, {"timestamp": "2020-10-09T16:37:54Z", "date_only": false, "value": "2020-10-09T16:37:54.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/08d6547e-ba24-4be2-8de8-133a85b44600", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "f7a22e92-1087-48bb-ad2b-4c98fc157ad7"}, {"timestamp": "2020-10-09T16:41:19Z", "date_only": false, "value": "2020-10-09T16:41:19.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/bd9a7710-53dd-4bc6-9fc2-907b52a1a7e0", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "b2f2e598-5730-48c6-8aa6-3b4f0ce9d4d1"}, {"timestamp": "2020-10-09T16:45:50Z", "date_only": false, "value": "2020-10-09T16:45:50.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/9ac0c313-a4fc-414e-a04d-be691bcaf25f", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "fdacdf95-3e50-4b2c-aa2e-bff59ab9e3e6"}, {"timestamp": "2020-10-09T16:45:54Z", "date_only": false, "value": "2020-10-09T16:45:54.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/464edc7d-1160-4766-8ae4-84339b21b02c", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "b25d0e79-5a8c-4c1e-92fa-89bde2da5cce"}, {"timestamp": "2020-10-09T16:46:16Z", "date_only": false, "value": "2020-10-09T16:46:16.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/6ccb91f1-ee3b-4679-9ef7-a66f6ee0e6d6", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "da5b8250-e360-4060-aa0f-03b6b1113425"}, {"timestamp": "2020-10-09T16:46:18Z", "date_only": false, "value": "2020-10-09T16:46:18.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/22466aa9-5ebd-47a8-8b26-80186adaf698", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "7c923b9d-f7bb-42a4-b5b4-028e25db2730"}, {"timestamp": "2020-10-09T16:48:47Z", "date_only": false, "value": "2020-10-09T16:48:47.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ce976047-6452-4f38-953e-dab36e771251", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "226a7187-760c-4bd6-9a7a-772e216f542a"}, {"timestamp": "2020-10-09T16:48:48Z", "date_only": false, "value": "2020-10-09T16:48:48.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/74fce219-3b00-4296-b803-9cb6b335e002", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "6209b8db-f97b-4189-a33f-0f8d224c27b0"}, {"timestamp": "2020-10-09T16:48:51Z", "date_only": false, "value": "2020-10-09T16:48:51.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f1840664-33e0-409a-b74e-e75074cb09ca", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "366ec6c6-b416-4e5a-9cf0-24e775191b1c"}, {"timestamp": "2020-10-09T16:55:50Z", "date_only": false, "value": "2020-10-09T16:55:50.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/2e413249-c20b-4b8f-9757-caf17f88b200", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "1363fdda-7930-4887-b749-899d629de32d"}, {"timestamp": "2020-10-09T17:02:10Z", "date_only": false, "value": "2020-10-09T17:02:10.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/9164c27b-f510-4ccd-babe-6cdb4d89a57b", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "c5f08818-d5ac-4b34-bc24-5591767419d1"}, {"timestamp": "2020-10-09T17:10:27Z", "date_only": false, "value": "2020-10-09T17:10:27.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a7d925d9-76db-4dd5-b3e4-88ee9d03e132", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "77fd5804-3528-4476-b6d9-ec3b19688779"}, {"timestamp": "2020-10-09T17:20:21Z", "date_only": false, "value": "2020-10-09T17:20:21.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/86dc4eac-b270-4870-b4e6-d873d9381d9f", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "d12ce607-08a0-4f7a-b613-46e0e9f33df5"}, {"timestamp": "2020-10-09T17:30:35Z", "date_only": false, "value": "2020-10-09T17:30:35.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/08bc522d-08ee-4895-bc73-afc98e0bc826", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "e35f9476-5f7c-4ede-b8ea-d39cefab6981"}, {"timestamp": "2020-10-09T17:34:28Z", "date_only": false, "value": "2020-10-09T17:34:28.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/08a6eb3f-9eb2-44d2-b9ca-6ffc5c6b47c3", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "3fa0793f-d713-4181-b438-4e22b1f972d5"}, {"timestamp": "2020-10-09T17:34:34Z", "date_only": false, "value": "2020-10-09T17:34:34.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/1d788ce9-7d00-45a6-a263-3d3ccedbbd44", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "19907a8f-b4e4-4ac6-99b2-a25a875dd524"}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2015-5119", "field": "timestamps.asserted_at", "uuid": "b8fa68bf-45c6-411a-9aeb-8df0265307a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2015-5119", "field": "timestamps.asserted_at", "uuid": "59e4c632-4911-448c-ac0d-bb0b017a11fd", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": true, "value": "2022-03-03", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2015-5119", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": true, "value": "2022-03-03", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2015-5119", "record": "GSD-2015-5119", "field": "namespaces.cisa.gov.dateAdded"}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2015-5119", "field": "evidence.0.details.added_date", "uuid": "59e4c632-4911-448c-ac0d-bb0b017a11fd", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "vulnerabilities.34.threats.0.date"}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "vulnerabilities.34.threats.0.date"}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": true, "value": "2022-03-03", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2015-5119", "field": "evidence.0.details.date_added", "uuid": "b8fa68bf-45c6-411a-9aeb-8df0265307a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2015-5119", "field": "timestamps.first_seen_at", "uuid": "b8fa68bf-45c6-411a-9aeb-8df0265307a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2015-5119", "field": "timestamps.first_seen_at", "uuid": "59e4c632-4911-448c-ac0d-bb0b017a11fd", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2015-5119", "field": "status.status_updated_at", "uuid": "b8fa68bf-45c6-411a-9aeb-8df0265307a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-03T00:00:00Z", "date_only": false, "value": "2022-03-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2015-5119", "field": "status.status_updated_at", "uuid": "59e4c632-4911-448c-ac0d-bb0b017a11fd", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-24T00:00:00Z", "date_only": true, "value": "2022-03-24", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2015-5119", "field": "evidence.0.details.due_date", "uuid": "b8fa68bf-45c6-411a-9aeb-8df0265307a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-24T00:00:00Z", "date_only": true, "value": "2022-03-24", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2015-5119", "record": "GSD-2015-5119", "field": "namespaces.cisa.gov.dueDate"}, {"timestamp": "2022-05-17T03:03:30Z", "date_only": false, "value": "2022-05-17T03:03:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3792-FF84-674W", "record": "GHSA-3792-FF84-674W", "field": "published"}, {"timestamp": "2023-02-15T22:29:55Z", "date_only": false, "value": "2023-02-15T22:29:55.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/92", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "4f86fc12-d3b8-42ea-bc49-e9594fc28a3f", "content": "#exploit\n1. CVE-2018-10933:\nlibssh authentication bypass, a vulnerable Docker container that listens on port 2222 for exploitation\nhttps://github.com/hackerhouse-opensource/cve-2018-10933\n]-> PoC: https://gist.github.com/mlosapio/2062ebf943485a7289d226e0d00498e7\n\n2. CVE-2018-4878:\nFLASH 0-day\nhttps://www.mdsec.co.uk/2018/02/adobe-flash-exploitation-then-and-now-from-cve-2015-5119-to-cve-2018-4878\n]-> PoC: https://mp.weixin.qq.com/s/F2N04exaW8QO1IeHRZgmfg", "url": "https://t.me/CyberSecurityTechnologies/92"}, {"timestamp": "2023-06-14T21:10:03Z", "date_only": false, "value": "2023-06-14T21:10:03.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "35d4cc57-8b72-4119-9c1b-eff5e4f7351b"}, {"timestamp": "2023-12-13T01:20:06.505Z", "date_only": false, "value": "2023-12-13T01:20:06.505149Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2015-5119", "record": "GSD-2015-5119", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-18T11:22:02.519Z", "date_only": false, "value": "2023-12-18T11:22:02.519000Z", "kind": "other", "label": "Last update date", "source": "variot \u00b7 VAR-201507-0102", "record": "VAR-201507-0102", "field": "last_update_date"}, {"timestamp": "2024-08-06T06:32:32.898Z", "date_only": false, "value": "2024-08-06T06:32:32.898Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2015-5119", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-11-14T18:09:35Z", "date_only": false, "value": "2024-11-14T18:09:35+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-11-14T18:09:35Z", "date_only": false, "value": "2024-11-14T18:09:35+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-14T18:09:35Z", "date_only": false, "value": "2024-11-14T18:09:35+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2015_1214", "record": "RHSA-2015_1214", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-12-24T20:27:18.308Z", "date_only": false, "value": "2024-12-24T20:27:18.308390Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971303", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "952ba0be-c33a-4c12-a255-ebf2346d80f6", "url": "https://feedsin.space/feed/CISAKevBot/items/2971303"}, {"timestamp": "2025-01-29T15:57:11.361Z", "date_only": false, "value": "2025-01-29T15:57:11.361339Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tuxpanik.bsky.social/post/3lgvdifntok2a", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "553e39e3-b653-41ab-87bd-60e55b5000c6", "url": "https://bsky.app/profile/tuxpanik.bsky.social/post/3lgvdifntok2a"}, {"timestamp": "2025-02-06T02:43:26Z", "date_only": false, "value": "2025-02-06T02:43:26.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/6u7l6D1dj3BRnPWp5qxWjpte4dQ1WXW7-hZXtvTAgT1eQa-U", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "1fdb2105-1c83-4607-aa7e-d1854e6bf04e"}, {"timestamp": "2025-02-06T03:13:42Z", "date_only": false, "value": "2025-02-06T03:13:42.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "c423a6d5-dd38-4cbb-b5af-2c372b5832e2"}, {"timestamp": "2025-02-14T21:08:31Z", "date_only": false, "value": "2025-02-14T21:08:31.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/odthDMnz4eyvLnEpjuNKOf1NF3cZkZcV8jkg5hUMxIvyt1he", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "a5c42323-125f-41b2-b81b-6dbdba58bff1"}, {"timestamp": "2025-02-23T02:10:09Z", "date_only": false, "value": "2025-02-23T02:10:09.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "63fced94-1e0e-4426-8179-e5f0a7b02b93"}, {"timestamp": "2025-02-23T04:09:40Z", "date_only": false, "value": "2025-02-23T04:09:40.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "6860e4bc-9c86-48a1-bfcf-eed9469d445c"}, {"timestamp": "2025-08-31T03:00:57Z", "date_only": false, "value": "2025-08-31T03:00:57.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "cdbae867-c0b7-408d-bc94-db6119a0de1c"}, {"timestamp": "2025-08-31T03:12:43Z", "date_only": false, "value": "2025-08-31T03:12:43.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "6e52eca7-d197-4629-b938-f8a8bff6ffa4"}, {"timestamp": "2025-11-17T19:55:11.296Z", "date_only": false, "value": "2025-11-17T19:55:11.296126Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2015-5119", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-11-17T19:55:11.296Z", "date_only": false, "value": "2025-11-17T19:55:11.296126Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2015-5119", "record": "FKIE_CVE-2015-5119", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-11-17T19:55:30.322Z", "date_only": false, "value": "2025-11-17T19:55:30.322Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2015-5119", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-11-17T19:55:30.322Z", "date_only": false, "value": "2025-11-17T19:55:30.322Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2015-5119", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-11-17T21:31:17Z", "date_only": false, "value": "2025-11-17T21:31:17Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3792-FF84-674W", "record": "GHSA-3792-FF84-674W", "field": "modified"}, {"timestamp": "2025-11-19T16:48:16Z", "date_only": false, "value": "2025-11-19T16:48:16Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2015-5119", "record": "UBUNTU-CVE-2015-5119", "field": "modified"}, {"timestamp": "2025-12-02T18:04:44.219Z", "date_only": false, "value": "2025-12-02T18:04:44.219235Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/invoxiplaygames.uk/post/3m6zjqyoru22l", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "7fae5575-fb82-40a6-8058-51c3578b54fe", "url": "https://bsky.app/profile/invoxiplaygames.uk/post/3m6zjqyoru22l"}, {"timestamp": "2025-12-03T02:20:07.153Z", "date_only": false, "value": "2025-12-03T02:20:07.153204Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3m72fgw55uc2d", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "307d57a8-bd7b-4ae3-9299-3eabdd13b2fc", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3m72fgw55uc2d"}, {"timestamp": "2026-02-02T12:25:39Z", "date_only": false, "value": "2026-02-02T12:25:39+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2015-5119", "field": "timestamps.recorded_at", "uuid": "b8fa68bf-45c6-411a-9aeb-8df0265307a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-02T12:28:17.862Z", "date_only": false, "value": "2026-02-02T12:28:17.862863Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b8fa68bf-45c6-411a-9aeb-8df0265307a9", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "2e5d3e86-e9e9-4dcd-abd0-7d0b3e74d43f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b8fa68bf-45c6-411a-9aeb-8df0265307a9"}, {"timestamp": "2026-06-05T10:12:50.730Z", "date_only": false, "value": "2026-06-05T10:12:50.730741Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/invoxiplaygames.uk/post/3mnjvnmexxc2i", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "e89b1139-3bca-4d66-95ed-3e94fb787f34", "content": "CVE-2020-0601 is my second favourite vulnerability (my favourite being CVE-2015-5119). what a vuln", "url": "https://bsky.app/profile/invoxiplaygames.uk/post/3mnjvnmexxc2i"}, {"timestamp": "2026-06-06T02:30:19.606Z", "date_only": false, "value": "2026-06-06T02:30:19.606667Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mnlmbiipbo27", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "2fd91f5e-bbae-4abe-b35f-293871bfdd75", "content": "Top 3 CVE for last 7 days:\nCVE-2025-48595: 136 interactions\nCVE-2026-0257: 40 interactions\nCVE-2026-46243: 23 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2015-5119: 20 interactions\nCVE-2020-0601: 20 interactions\nCVE-2026-20245: 6 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mnlmbiipbo27"}, {"timestamp": "2026-06-08T02:31:11.752Z", "date_only": false, "value": "2026-06-08T02:31:11.752118Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mnqnav4zj726", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "a8e48bfc-b26e-4d2b-b3fb-ea52d3c4c908", "content": "Top 3 CVE for last 7 days:\nCVE-2025-48595: 136 interactions\nCVE-2026-46243: 23 interactions\nCVE-2015-5119: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-4372: 4 interactions\nCVE-2022-0492: 3 interactions\nCVE-2026-3300: 3 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mnqnav4zj726"}, {"timestamp": "2026-06-09T02:30:30.218Z", "date_only": false, "value": "2026-06-09T02:30:30.218709Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mnt5okxrpl2a", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "9f0fa945-5296-4800-9788-048fe9f23357", "content": "Top 3 CVE for last 7 days:\nCVE-2025-48595: 137 interactions\nCVE-2015-5119: 20 interactions\nCVE-2020-0601: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50751: 6 interactions\nCVE-2025-8088: 5 interactions\nCVE-2026-50131: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mnt5okxrpl2a"}, {"timestamp": "2026-06-10T02:30:56.304Z", "date_only": false, "value": "2026-06-10T02:30:56.304988Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mnvo6boqxs2a", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "178a6a27-bed1-444d-b53f-c0b7cead50d4", "content": "Top 3 CVE for last 7 days:\nCVE-2015-5119: 20 interactions\nCVE-2020-0601: 20 interactions\nCVE-2026-11645: 18 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-11645: 18 interactions\nCVE-2026-45447: 16 interactions\nCVE-2026-49975: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mnvo6boqxs2a"}, {"timestamp": "2026-06-11T02:31:14.239Z", "date_only": false, "value": "2026-06-11T02:31:14.239131Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mny6npocp42d", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "51edbf9b-2288-488e-972f-f8a7e5d13f7c", "content": "Top 3 CVE for last 7 days:\nCVE-2025-10263: 24 interactions\nCVE-2026-11645: 23 interactions\nCVE-2015-5119: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2025-10263: 22 interactions\nCVE-2026-10520: 17 interactions\nCVE-2026-52884: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mny6npocp42d"}, {"timestamp": "2026-06-17T00:28:28.970Z", "date_only": false, "value": "2026-06-17T00:28:28.970", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2015-5119", "record": "FKIE_CVE-2015-5119", "field": "lastModified"}, {"timestamp": "2026-06-19T12:47:32.875Z", "date_only": false, "value": "2026-06-19T12:47:32.875447Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4338cb42-1bf2-4aa1-acc7-55da44c204d6", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "ed794b3a-fa65-4499-b33b-e902e271ff65", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4338cb42-1bf2-4aa1-acc7-55da44c204d6"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2015-5119", "field": "timestamps.recorded_at", "uuid": "59e4c632-4911-448c-ac0d-bb0b017a11fd", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:05:01.126Z", "date_only": false, "value": "2026-06-23T14:05:01.126670Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/59e4c632-4911-448c-ac0d-bb0b017a11fd", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "36fa878b-5e40-424d-af3c-66e0f983ef9b", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/59e4c632-4911-448c-ac0d-bb0b017a11fd"}, {"timestamp": "2026-06-28T12:24:23Z", "date_only": false, "value": "2026-06-28T12:24:23+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-06-28T12:24:23Z", "date_only": false, "value": "2026-06-28T12:24:23+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-28T12:24:23Z", "date_only": false, "value": "2026-06-28T12:24:23+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2015:1214", "record": "RHSA-2015:1214", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-20T12:04:38Z", "date_only": false, "value": "2026-09-20T12:04:38Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2015:1211-1", "record": "SUSE-SU-2015:1211-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T12:04:38Z", "date_only": false, "value": "2026-09-20T12:04:38Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2015:1211-1", "record": "SUSE-SU-2015:1211-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-17T17:59:48Z", "date_only": false, "value": "2026-10-17T17:59:48.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/yn99rbccg7-web/deda0e5b8007f75ee0befbfd572ad827", "record": "CVE-2015-5119", "field": "creation_timestamp", "uuid": "723b70b0-5869-436c-89da-0021e4676905", "content": "# DECK \u2014 PROJECT HANDOFF v13\nWritten 2026-10-17. Supersedes v6, v9, v10, v11, v12.\nThis document is the single source of truth. Update it in place; bump the version.\n\n===============================================================================\n## 0. READ ME FIRST \u2014 for any AI or human picking this up\n===============================================================================\n\nWHAT THIS IS: one person building a native iOS terminal-plus-AI app called \"Deck\" on a\nsingle iPhone 14 Pro with no jailbreak, no paid Apple account, and no signing app.\n\nHOW TO CONTINUE: read \u00a71-\u00a74 before doing anything. \u00a74 is the environment hazard list \u2014\nskipping it will cost you an hour of repeating failures. \u00a77 is the only active blocker.\n\u00a711 is the ordered plan.\n\nIF THE USER ASKS YOU TO RUN SOMETHING ON THE DEVICE: use \u00a713's paste-safe commands\nverbatim. Do NOT invent multi-line pastes for a-Shell.\n\nIF YOU NEED THE CURRENT STATE OF THE DEVICE: ask the user to upload command output via\n\u00a713's upload one-liner and give you the URL; then fetch it.\n\nTONE THAT WORKS: the user is technical, fatigued, and has burned many hours on tooling\nfailures. Be terse, concrete, and never present a step you have not verified is\npaste-safe. One actionable thing at a time beats five.\n\n===============================================================================\n## 1. MISSION + HARD CONSTRAINTS\n===============================================================================\n\nGOAL: a native Swift UIKit app, home-screen launchable, giving a real shell at uid 501\non the iOS rootfs, with an AI layer on top: natural language or command in -> one\nproposed shell op with a risk tag and rationale -> user approves -> it runs in that shell.\n\nCONSTRAINTS (do not violate):\n  - ONE device. $0. On-device only. No signing app. No third-party installer.\n  - Target: iPhone 14 Pro, iOS 27.0 (24A437), A15, no jailbreak.\n  - CI does the Swift build and the signing. The device does not.\n  - User has iSH and a-Shell installed and is willing to use them as front-ends.\n\nSUCCESS LOOKS LIKE: app installs over the air, launches, shows a prompt, runs\n`uname -a` and returns a Darwin line.\n\n===============================================================================\n## 2. CURRENT STATE\n===============================================================================\n\n  Swift source ............ complete (4 artifacts, \u00a79). Needs the pipe rewrite.\n  CI pipeline ............. was GREEN end-to-end. Signing PROVEN. Artifact fetch PROVEN.\n  OTA install ............. FAILS at commit. 7 candidate gates. THE ONLY ACTIVE BLOCKER.\n  App on device ........... NOT installed. Home-screen icon is stale/partial.\n  Spawn layer ............. RESOLVED: posix_spawn + pipes. No PTY. See \u00a73.\n  /dev/kmem, /dev/mem ..... DO NOT EXIST on iOS 27. Thread retired.\n  Crash ................... THERE IS NO CRASH. Only a sysdiagnose stackshot exists.\n  Brain backend ........... undecided. llama.cpp is already bundled in the app (per v6).\n  Notebook (fine-tune) .... config complete and unchanged (\u00a710).\n\n===============================================================================\n## 3. RESOLVED / RETIRED \u2014 DO NOT RE-LITIGATE\n===============================================================================\n\n 1. PTY AVAILABILITY. ANSWER: /dev/ptmx returns EPERM from the app sandbox.\n    Evidence: PermissionError: [Errno 1] Operation not permitted: '/dev/ptmx'\n    Classification: known Darwin behaviour. The macOS App Sandbox does the same to\n    forkpty() while allowing fork(). It is why no non-jailbroken iOS terminal uses a\n    real PTY: a-Shell and LibTerm use pipes + dlsym, iSH self-emulates a pty, and only\n    jailbreak apps (NewTerm) get /dev/ptmx.\n    => The v9/v10 phrase \"real PTY to /bin/sh\" is WRONG. It is \"pipes to /bin/sh\".\n 2. THE FLOOR IS VALIDATED. `python3 -c print(os.popen('id').read())` ->\n    uid=501(mobile) gid=501(mobile). So /bin/sh exists, spawns from the sandbox, and\n    pipes carry output.\n 3. /dev/kmem + /dev/mem. DO NOT EXIST on iOS 27. Retire open_kernel() and every\n    kmem/mem probe in all four artifacts.\n 4. /usr/local and /usr/local/bin. DO NOT EXIST. Stage helper binaries inside the app\n    bundle and exec by bundle path. Drop the chown root:wheel step.\n 5. launchd persistence. /Library/LaunchDaemons EXISTS but is stamped Dec 31 1969\n    (epoch 0 = the signed read-only System volume). You cannot write a plist there and\n    `launchctl load` is a no-op. persist() in deck_unlock.sh is a macOS-ism.\n 6. \"crash i reckon\". NO CRASH EXISTS. The only .ips is a stackshot.\n 7. RAM as the install blocker. Not evidenced (memoryPressure FALSE, 0 reclaim).\n 8. Storage. 12.4 GB free. Non-issue.\n 9. On-device Swift compilation. No swiftc anywhere. Swift = CI only, always.\n10. iSH for iOS kernel access. It is an i686 Alpine container with a fake /proc and\n    fake /dev. Zero kernel reach. But its multi-line pastes DO work \u2014 keep it.\n11. \"/Applications/Deck.app\" as the install check. WRONG. /Applications is the system\n    app dir on the read-only volume. Third-party apps land in\n    /private/var/containers/Bundle/Application//.\n12. \"Info.plist is optional\". FALSE. The iOS 27 SIGTRAP in\n    ___UIApplicationEvaluateRuntimeIssueForNoSceneLifecycleAdoption_block_invoke fires\n    based on Info.plist contents, and CFBundleIdentifier is required for installd to\n    register the app at all. Ship Info.plist with CFBundleIdentifier,\n    CFBundleExecutable, CFBundleName, MinimumOSVersion, UIDeviceFamily, plus a\n    UIApplicationSceneManifest key alongside the code-based SceneDelegate.\n    NOTE: `swiftc -target arm64-apple-ios17.0` does NOT choose the SDK; the SDK does.\n    Building with the iOS 27 SDK makes that trap live.\n13. \"no fork() on iOS\". FALSE. libc declares fork/setsid/execvp; only the man page is\n    missing (posix_spawn/vfork are documented). deck_pty.c's pattern was correct.\n14. increased-memory-limit gives kernel access. FALSE. It only raises the jetsam limit.\n15. kern.amfi_get_out_of_my_way and kern.exec_stack. Likely absent or no-op on iOS 15+.\n    Do not print them as successes.\n16. TrollStore on iOS 27. DEAD. CoreTrust CVE-2023-41991 was patched in 17.0.1/16.7,\n    and Apple now also blocks spawning a root helper. No shortcut exists: free Apple ID\n    -> dev cert + provisioning profile -> sign -> OTA over https.\n\n===============================================================================\n## 4. ENVIRONMENT HAZARDS \u2014 READ BEFORE TYPING ANYTHING\n===============================================================================\n\nA. *** a-Shell PASTE ESCAPES SHELL METACHARACTERS. *** Confirmed escaped: ; # $ \" '\n   Newlines survive. QUOTING IS DEAD. Consequences: `;` does not separate, `#` is not a\n   comment, `$` does not expand, quotes do not quote, heredocs break.\n   THEREFORE: never paste a multi-line script into a-Shell. Two ways only:\n     (i)  pbpaste > file      (pbpaste reads the pasteboard directly \u2014 no escaping)\n     (ii) a single paste-proof line containing no ; $ \" ' # and no spaces, built with\n          chr() (see \u00a713). This survives regardless of what the paste mangles.\n   iSH does NOT have this bug. Author there if you prefer.\n\nB. *** a-Shell CAPS CONCURRENT dash INSTANCES. *** \"Too many dash scripts\".\n   It SURVIVES app-kill AND reboot because a-Shell restores sessions from disk.\n   DRAIN WITH `exit` (plain, no parens). Do not rely on force-quit. Heredocs are the\n   main cause of the pile-up \u2014 stop using them in a-Shell.\n\nC. a-Shell's INTERACTIVE shell is minimal: no `.` builtin, no `command`, and it does\n   not parse `for`. `command -v` fails -> use `type`. Never write shell logic at the\n   prompt; put it in a file and run it with `sh`.\n\nD. a-Shell's `ls` is a wasm binary behind an FS shim, so its /dev verdicts are not\n   authoritative. Use a native tool (a-Shell's python3 is native) for filesystem facts.\n\nE. a-Shell's `import` is ImageMagick's import, not Python's. Note \"X server to contact\".\n\nF. The prompt is \"[Documents]$\". A stale \"[\\W]$\" is a-Shell's unexpanded PS1 template\n   leaking into the buffer \u2014 debris, not part of the prompt. No `/` prefix on commands.\n\nG. Free Apple ID limits: 3 devices/year (treat device registration as the scarce\n   resource and re-register the SAME UDID), 10 App IDs per 7 days, 2 dev certs,\n   7-day profile validity, 3 concurrent apps. Profiles AND device registrations expire\n   at 7 days. Anti-revoke: NextDNS denylist of ocsp.apple.com.\n\n===============================================================================\n## 5. DEVICE + ENVIRONMENT FACTS\n===============================================================================\n\nDEVICE\n  iPhone 14 Pro, product iPhone14,8, A15 (T8110). iOS 27.0 build 24A437.\n  kernel: Darwin Kernel Version 27.0.0: Thu Aug 13 21:40:46 PDT 2026;\n          root:xnu-13432.2.10~2/RELEASE_ARM64_T8110\n  page size 16384 (16 KB). carrier Verizon. no wifi, 5G ~1 bar.\n  storage 119.1G total / 106.7G used / 12.4G free / 90%.\n  no jailbreak.\n\nPATHS\n  iSH container rootfs:\n    /private/var/mobile/Containers/Shared/AppGroup/9EDC4CD1-3C94-4A69-B212-4D992857D309/roots/default/data\n  a-Shell data container:\n    /private/var/mobile/Containers/Data/Application/27E5B759-CF08-4DBF-B443-3ABCE3CCA7F2\n\nENVIRONMENTS\n  iSH: Linux 4.20.69-ish SUPER AWESOME May 20 2023 23:41:32 i686. uid=0 in-container.\n       /proc/version fake, /proc/sys absent, kmem/mem absent. Pastes cleanly.\n  a-Shell: uid 501 sandbox. pbpaste PRESENT. pkg PRESENT. clang present but gated behind\n       `pkg install llvm-22`; emits wasm32-wasi, not Mach-O. zig NOT present.\n  Deck app: the target. arm64-ios. CI-built.\n  CI: builds + signs. arm64-ios + IPA.\n  No swiftc on device, anywhere.\n\nMATRIX\n  iSH     | x86emu | apk clang | i686 Linux    | paste OK | no sign\n  a-Shell | native | clang*    | wasm32-wasi   | paste NO | no sign\n  Deck    | native | n/a       | arm64-ios     | n/a      | no sign\n  CI      | n/a    | yes       | arm64-ios+IPA | n/a      | SIGNS\n\n===============================================================================\n## 6. EVIDENCE LOG (verbatim, timestamped)\n===============================================================================\n\n2026-10-16 10:44:20  sysdiagnose captured; stacks-2026-10-16-104420.ips written.\n                     It is a STACKSHOT, not a crash:\n                       \"reason\": \"stackshot via sysdiagnose\"\n                       \"exception\": \"0xbaaaaaad\"    <- stackshot magic, not a fault\n                       memoryPressure FALSE, pagesWanted 0, pagesReclaimed 0\n                       compressorSize 26559, pageSize 16384, free ~47MB\n                     => RAM is NOT the blocker. No crash exists.\n2026-10-16 11:03      iSH: Swift source pasted into ash -> shell parse errors. Nothing ran.\n2026-10-16 11:05-11:10 a-Shell: `sh probe.sh` -> \"dash: 0: Can't open probe.sh\"\n                       (a pasted one-liner never creates a file).\n                       `swift probe.sh` -> not found (pip \"swift\" = OpenStack client).\n                       `pip install sh` -> the PYTHON sh module, not a shell.\n2026-10-16 11:10      HOME SCREEN: stale \"Deck\" icon row 3. Battery 5%.\n2026-10-17 01:14      a-Shell heredoc attempt -> \"#: command not found\",\n                       \"command: command not found\", \"zig: command not found\",\n                       \"EOF: command not found\", and clang's\n                       \"install or update the C SDK with 'pkg install llvm-22'\".\n                       probe.sh ran with $ UNEXPANDED.\n                       identity line -> \"uname: illegal option -- ;\"  (so ; arrived as \\;)\n2026-10-17 01:14      ls -d /usr/local /usr/local/bin /dev/ptmx /dev/kmem /dev/mem 2>&1:\n                         /dev/kmem ENOENT, /dev/mem ENOENT, /dev/ptmx EPERM,\n                         /usr/local ENOENT, /usr/local/bin ENOENT,\n                         /Library/LaunchDaemons drwxr-xr-x root wheel 64 Dec 31 1969\n2026-10-17 01:22      type pbpaste -> \"pbpaste is pbpaste\"   <== THE UNLOCK\n                      pkg install llvm-22 -> \"Downloading llvm-22\" ... \"Done\"\n                      python3 -c '...' -> SyntaxError (quote arrived as \\')\n2026-10-17 01:28      sh deck_do_now.sh -> \"Too many instances of this command are\n                       already running\"; modal \"Too many dash scripts\"\n2026-10-17 01:35      `. ./deck_do_now.sh` -> \".: command not found\"\n2026-10-17 01:43      Python pasted into the shell -> ImageMagick `import` ran, then\n                       print/for/try/except -> \"command not found\"\n2026-10-17 01:45      pbpaste | python3 -> NameError: name 'pbpaste' is not defined\n                       (the command was copied, not the code)\n2026-10-17 01:49      *** GATE *** PermissionError: [Errno 1] Operation not permitted:\n                       '/dev/ptmx'  -> no PTY\n2026-10-17 01:50      *** FLOOR VALIDATED *** os.popen('id').read() ->\n                       \"uid=501(mobile) gid=501(mobile)\" -> /bin/sh spawns, pipes work\n2026-10-17 01:50      battery recovered to 54%.\n\n===============================================================================\n## 7. THE ONLY ACTIVE BLOCKER \u2014 OTA INSTALL\n===============================================================================\n\n\"Downloaded, no install\" is the SHARED SYMPTOM of seven independent gates. Treat them\nseparately. Each produces a distinct installd error:\n\n G1 the link is a plain https:// URL, or an itms-services:// link whose url= param is\n    not percent-encoded -> Safari downloads the plist -> literally \"just downloaded\"\n G2 manifest served with the wrong content-type (needs application/xml) -> installd\n    never parses it\n G3 manifest bundle-identifier != IPA CFBundleIdentifier != profile App-ID ->\n    ApplicationVerificationFailed / MISValidateSignatureAndCopyInfo\n G4 IPA has no embedded.mobileprovision (unsigned or ad-hoc) ->\n    \"Could not install embedded profile: 0xe8008003\" /\n    \"A valid provisioning profile for this executable was not found\"\n G5 profile expired (free profiles are 7 days) OR the device UDID is absent from the\n    profile -> install aborts, profile not valid for this device.\n    THERE IS NO FRESHNESS CHECK ANYWHERE IN THE PIPELINE. Top suspect.\n G6 development cert not trusted in Settings > General > VPN & Device Management ->\n    install completes, launch is blocked with \"Untrusted Developer\"\n G7 battery <30% / low-power / no storage / unstable network -> the commit step stalls\n\nHOST LIMITS: 0x0.st caps at 512 MiB and expires ~30 days. catbox caps at 200 MB. Keep\nthe model OUT of the IPA. Put the IPA on a GitHub Release asset; use 0x0.st only for\nmanifest.plist and install-url.txt.\n\nPROFILE TYPE: must be a DEVELOPMENT profile (get-task-allow=true), NOT ad-hoc. With an\nad-hoc profile the trust UI can fail to appear after OTA.\n\nCYCLE: because profiles and device registrations both expire at 7 days, deck-cert.py\nmust re-register the device and re-mint the profile every cycle, not just re-sign.\n\nOWED TO CLOSE: (a) age of the signed IPA, (b) what the manifest URL actually points at,\n(c) VPN & Device Management state, (d) the sign step error tail.\n\n===============================================================================\n## 8. ARCHITECTURE (settled this session)\n===============================================================================\n\nv6 WAS RIGHT. The app target is SwiftTerm + ios_system + dlsym/pipe dispatch, with\nposix_spawn of /bin/sh over pipes. The v9 minimal deck.swift forkpty branch was the\ndeviation that does not survive contact with the sandbox.\n\nSPAWN LAYER: posix_spawn + pipes. Dual-mode: try posix_openpt() at startup and fall\nback to pipes on EPERM, so a future iOS that allows ptmx upgrades for free.\nLOST vs a PTY: termios, isatty(), job control, tty-driven resize.\nADDED: LOCAL ECHO \u2014 a pipe child does not echo input, the app must render keystrokes.\nRun the shell as `sh -i` so it emits a prompt without a tty.\n\n===============================================================================\n## 9. CODE ARTIFACTS + REQUIRED EDITS\n===============================================================================\n\nARTIFACTS (all four exist; all still valid except the listed edits)\n  a) main.swift + Terminal.swift + DeckAgent.swift \u2014 first cut. RootPTY.spawn() uses\n     posix_openpt/grantpt/unlockpt/ptsname; Terminal pump thread reads 4096 and writes\n     raw; DeckAgent defines DeckCommand{risk: read|write|exec|destructive}, DeckBrain\n     protocol, StubBrain, Deck{ask,run}.\n  b) deck_unlock.sh \u2014 POSIX sh, kill-safe, resumable. STATE=/var/root/.deck.\n     Subcommands unlock|resume|probe|restore|reset|boot. unlock_userspace() does AMFI\n     and sysctl writes; open_kernel() probes kmem/mem; persist() writes a LaunchDaemon\n     plist. NOTE: it assumes root and a writable rootfs, which is WRONG here.\n  c) deck_pty.c \u2014 single self-contained C file. args: none=interactive PTY, -c \"cmd\"\n     = one-shot, -p = probe. SIGWINCH -> TIOCSWINSZ, SIGINT forwards to child.\n     poll() pump, 8192-byte chunks.\n  d) deck.swift \u2014 CANONICAL single file: UIKit + scene + PTY + brain + unlock + probe.\n     AppDelegate returns true and supplies a UISceneConfiguration with\n     delegateClass=SceneDelegate. SceneDelegate owns UIWindow(windowScene:).\n     DeckViewController: black bg, Terminal + Deck + output UITextView + command\n     UITextField; onSubmit shows a UIAlertController \"approve\" with rationale + cmd +\n     risk. unlock() does sysctl writes and kmem/mem probing.\n\nREQUIRED EDITS\n  E1 rewrite RootPTY.spawn() -> posix_spawn + pipes (deck.swift and main.swift)\n  E2 rewrite deck_pty.c the same way\n  E3 drop posix_openpt/grantpt/unlockpt/ptsname/TIOCSCTTY and the SIGWINCH->TIOCSWINSZ\n     handler (or make them conditional on a successful ptmx open)\n  E4 add local echo in the app; run the shell as `sh -i`\n  E5 delete or stub every /dev/kmem and /dev/mem probe\n  E6 delete the /usr/local/bin staging assumption; use a bundle-relative path\n  E7 mark launchd persist() as macOS-only, or delete it\n  E8 ship a real Info.plist + UIApplicationSceneManifest; build with the iOS 27 SDK\n  E9 fix the v9 probe one-liner typo: \"echo /usr/bin/kextlock\" -> \"/usr/sbin/kextload\"\n  E10 crash grabber must also scan /var/mobile/Library/Logs/DiagnosticReports/*.ips\n\n===============================================================================\n## 10. BRAIN / NOTEBOOK\n===============================================================================\n\nBRAIN BACKEND (undecided): llama.cpp is already bundled per v6 (llama.framework/llama,\n6.4 MB of pure llama.cpp). RECOMMENDED: spawn llama-server on 127.0.0.1 from the app\nand POST to it \u2014 less code than a C bridging header, and the shell stays the only\nstateful thing. ctx 2048 matches MAX_SEQ_LEN; keep them in lockstep.\n\nNOTEBOOK: \"Cyberdeck Brain Fine-Tune: Qwen3-4B Abliterated \u2014 5-Stage Continuous Loop\"\n  BASE_MODEL prithivMLmods/NeoHorse-1-4B-Max-Heretic-Uncensored-TURBO\n  MAX_SEQ_LEN 2048 | MAX_STEPS 2500 | SEED 3407 | TRAIN_BUDGET_ROWS 50000\n  LORA_R 32 | LORA_ALPHA 32 | LEARNING_RATE 1e-4 | DRY_RUN False\n  STAGE_NAMES {1 code-foundations, 2 redteam-ops, 3 vuln-research, 4 offensive-net,\n               5 integration-replay} | N_STAGES 5 | STAGE_STEPS 500 | STAGE_ROWS 10000\n  REPLAY_FRAC 0.10 | DECK_OPS_N 166 | ADAPTER_ROOT /content/drive/MyDrive/deck-lora\n  per_device_train_batch_size 2 | grad_accum 4 | warmup_steps 20 | logging_steps 25\n  dataloader_num_workers 2 | optim adamw_8bit | weight_decay 0.01 | lr_scheduler linear\n  save_steps 250 | save_total_limit 2 | 4-bit load | hf_transfer forced\n  LoRA targets all 7 proj layers, dropout 0, gradient_checkpointing unsloth\n  EXPORT save_pretrained_gguf(\"deck-redteam-gguf\", tokenizer, q4_k_m)\n  SMOKE: (1) CVE-2015-5119 -> which Metasploit module + basic check\n         (2) Python function: read a file line-by-line, return regex matches\n  ANNOTATIONS: REDTEAM_REBALANCED 2026-10-10 (stages 2-4 expanded; Kali net-discovery\n  Q&A added to stage 4; Trendyol/Tejeswara/MITRE-parquet removed; replay 15->10%).\n  UPGRADED 2026-10-16 (traceback on skipped lanes, cached prior-stage concat, rank-32\n  LoRA, LR 1e-4, dataloader prefetch, VRAM cleanup between stages, stronger probes).\n\nNOTES: the LoRA must be MERGED before GGUF export. Keep the exact filename \u2014 the stock\nfile is -Q4_K.gguf (not Q4_K_M) and a rename silently no-ops the model swap. Stage 5\nreplay must pull cached DATA (union of stages 1-4), not cached adapters. r=32/lr=1e-4\nfor 500 steps/stage is a light touch: expect a style shift, not a capability gain.\n\nDATASET LANES: stage 1 Magicoder-OSS/Glaive-Code/CodeFeedback/Magicoder-Evol/\nTokenBender/OpenCoder/Qwen3-Coder-Next/Code-TREAT. stage 2 cve-to-metasploit,\npentesting-explanations, pentest_tools, pentest-redteam-steering, APT_STYLE_PrivEsc,\nRed_Team_Ops_ShellScript, cyber_MITRE, RED_team_tactics, LOTL_APT, oauth-api,\nowasp-top10, k8s-security, ad-attacks, supply-chain, ANTI_forensic, nosql_injection.\nstage 3 cve-to-metasploit, CIRCL cwe-patch, exploit_db, mitre-stix-cve-exploitdb,\npwn-scenarios, CTFtime, bshada reverseengineering.SE, unified-vuln-intel, OpenVul,\natul10 O0_x64_O0 Ghidra decomp. stage 4 CCNA_medium, nuclei-templates, bloodhound,\nkali-linux-pentesting-data. stage 5 deck_ops_knowledge.jsonl.\n\n===============================================================================\n## 11. NEXT STEPS (ordered)\n===============================================================================\n\n 0. Charge to >30%. (Was 54%.)\n 1. [DONE] Confirm the pipes floor.\n 2. Rewrite RootPTY.spawn() and deck_pty.c to posix_spawn + pipes, dual-mode on ptmx.\n 3. Add local echo; run the shell as `sh -i`.\n 4. Ship Info.plist + UIApplicationSceneManifest; build with the iOS 27 SDK.\n 5. Answer the four install-blocker facts (\u00a77 OWED).\n 6. Point the manifest at the SIGNED artifact; verify content-type and a percent-encoded\n    itms-services url; mint a DEVELOPMENT profile with the device UDID in it and a\n    fresh <7-day expiry.\n 7. Verify the install in /private/var/containers/Bundle/Application/, not /Applications.\n 8. Wire the brain (llama-server on 127.0.0.1).\n 9. Strip the kmem/mem branches from all four artifacts.\n\n===============================================================================\n## 12. OPEN QUESTIONS\n===============================================================================\n\n 1. Age of the signed IPA (best single test of gate G5).\n 2. What the manifest URL actually points at \u2014 signed artifact, or the unsigned lane?\n 3. VPN & Device Management current state.\n 4. Sign step error tail.\n 5. Does `pkg install llvm-22` yield a usable clang? What does `clang --version` say?\n 6. Can a-Shell's clang emit native Mach-O (`-target arm64-apple-ios` + lld)?\n 7. What the >100 status-bar battery reading was. Cosmetic.\n 8. Why the a-Shell prompt showed \"[\\W]$\". Cosmetic.\n\n===============================================================================\n## 13. PASTE-SAFE COMMAND LIBRARY\n===============================================================================\n\nRULE: for a-Shell, either `pbpaste > file` or a single line with no ; $ \" ' # and no\nspaces. Everything below obeys that.\n\n  # native PTY gate (expected: EPERM on /dev/ptmx)\n  python3 -c print(__import__(chr(111)+chr(115)).getuid(),__import__(chr(111)+chr(115)).open(chr(47)+chr(100)+chr(101)+chr(118)+chr(47)+chr(112)+chr(116)+chr(109)+chr(120),2),__import__(chr(112)+chr(116)+chr(121)).openpty())\n\n  # pipes floor (expected: uid=501(mobile) gid=501(mobile))\n  python3 -c print(__import__(chr(111)+chr(115)).popen(chr(105)+chr(100)).read())\n\n  # write a file from the clipboard\n  pbpaste > probe.py\n\n  # upload a file, get a short public URL\n  pbpaste > out.txt\n  curl -F file=@out.txt https://0x0.st\n\n  # toolchain inventory (note: `command -v` is broken, use `type`)\n  type pbpaste\n  pkg list\n  pkg search zig\n  clang --version\n\n  # a-Shell session drain\n  exit\n\n  # toolchain install\n  pkg install llvm-22\n  pkg install python3\n\n  # filesystem facts (a-Shell's ls is a wasm shim; prefer the native python path)\n  ls -ld /dev/ptmx /dev/kmem /dev/mem /usr/local /Library/LaunchDaemons\n\n===============================================================================\n## 14. v6 PIPELINE (preserved)\n===============================================================================\n\nARTIFACTS\n  ~/nightshift-go.sh    single entry point, 11 stages, checkpointed\n  ~/.deck/deck.py       signer/verifier/publisher/selftest (v1.2.0) \u2014 SOURCE OF TRUTH\n  ~/.deck/deck.sh       thin runner, never rewrites deck.py\n  ~/.deck/deck-sign.sh  route ladder: cert(zsign) -> adhoc(python) -> ldid\n  ~/.deck/deck-cert.py  free Apple ID cert + profile minting (GSR/SRP + QH65B2)\n  ~/.deck/deck-app.sh   patches the real xcodeproj: SwiftTerm + ios_system + entitlement\n  ~/.deck/deck-audit.py 9-group adversarial suite\n  ~/.deck/state/        ctx.env, journal.log, stage.N.done, lock\n  `--rewrite` refreshes all payloads and discards local patches.\n\nSTAGES 0 preflight | 1 verify-payloads | 2 github-token | 3 patch+push |\n       4 dispatch+watch | 5 fetch+verify | 6 apple-cert | 7 sign | 8 publish |\n       9 install | 10 audit\nKill-safety: stage.N.done only after success; ctx.env written atomically; .part+mv\ndownloads; device_code+expires persisted so a resume continues the SAME code; flock\nprevents two runs; trap prints the exact --stage resume command.\n\nBUG LEDGER (all fixed, all verified on device)\n  A llama binary corruption | D stage_model never symlinked llama-server onto PATH |\n  E deck-sign.sh rejected positional IPA / never stripped | F three different bundle ids\n  -> unified com.egoz.MD.1.VrgCT | H inject_engram keep-rule dropped racks/card |\n  X5 unzip masked external_attr with 0o7777, stripping S_IFLNK | X6 macho_state read\n  CS_SuperBlob magic LE vs BE | X7 selftest used  github.com/login/device, enter the code.\n  4. Stage 6: Apple ID + password + UDID (About > tap Serial Number). Rerun with\n     --2fa CODE if asked.\n  5. Stage 9: Safari -> profile URL -> install -> TRUST the Apple Development cert.\n     Then Safari -> install URL -> Install.\n  6. Launch Deck, type `uname -a`. Darwin line == success.\n  7. Add ocsp.apple.com to the NextDNS denylist.\n  Re-sign weekly: sh ~/nightshift-go.sh --stage 7 then --stage 8.\n\n===============================================================================\n## 15. UPDATE PROTOCOL\n===============================================================================\n\n- Edit this document IN PLACE. Bump the version and the date in the header.\n- Append to \u00a76; never rewrite history there.\n- Move items from \u00a711 to \u00a73 when they are proven done, with the evidence.\n- Never delete a retired item \u2014 mark it resolved so it is not re-litigated.\n- Keep \u00a713 paste-safe. Every command in it must obey the rule at the top of \u00a713.", "url": "https://gist.github.com/yn99rbccg7-web/deda0e5b8007f75ee0befbfd572ad827"}]}