https://vulnerability.circl.lu/sightings/feed 2026-09-17T08:34:17.889602+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a58b3cbd-3a80-47c2-82fe-6b7ce1f6e824/export 2026-09-17T08:34:17.900697+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a58b3cbd-3a80-47c2-82fe-6b7ce1f6e824", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "Telegram/SWXpTb_FDgqk-a1sBSyz4gpK1bNcdSIfJKm4SIv87MwvEOM", "content": "", "creation_timestamp": "2026-09-15T00:00:24.439480Z"} 2026-09-15T00:00:24.439480+00:00 https://vulnerability.circl.lu/sighting/b349154b-36e3-41d6-9efc-81fc0a80eb17/export 2026-09-17T08:34:17.902409+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b349154b-36e3-41d6-9efc-81fc0a80eb17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/SWXpTb_FDgqk-a1sBSyz4gpK1bNcdSIfJKm4SIv87MwvEOM", "content": "", "creation_timestamp": "2026-09-14T03:00:09.963639Z"} 2026-09-14T03:00:09.963639+00:00 https://vulnerability.circl.lu/sighting/875d0c2d-60d5-429e-8a56-77df09ed674f/export 2026-09-17T08:34:17.902539+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "875d0c2d-60d5-429e-8a56-77df09ed674f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11774", "type": "published-proof-of-concept", "source": "https://t.me/cissp/1314", "content": "Threat Research\nBreaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774)\n\nAttackers have a dirty little secret that is being used to conduct big intrusions. We\u2019ll explain how they're \"unpatching\" an exploit and then provide new Outlook hardening guidance that is not available elsewhere. Specifically, this blog post covers field-tested automated registry processing for registry keys to protect against attacker attempts to reverse Microsoft\u2019s CVE-2017-11774 patch functionality.\nhttps://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html", "creation_timestamp": "2026-09-13T00:01:00.863916Z"} 2026-09-13T00:01:00.863916+00:00 https://vulnerability.circl.lu/sighting/554f0753-7bff-433a-8902-79cd2e414daa/export 2026-09-17T08:34:17.902661+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "554f0753-7bff-433a-8902-79cd2e414daa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11774", "type": "published-proof-of-concept", "source": "https://t.me/cissp/1314", "content": "Threat Research\nBreaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774)\n\nAttackers have a dirty little secret that is being used to conduct big intrusions. We\u2019ll explain how they're \"unpatching\" an exploit and then provide new Outlook hardening guidance that is not available elsewhere. Specifically, this blog post covers field-tested automated registry processing for registry keys to protect against attacker attempts to reverse Microsoft\u2019s CVE-2017-11774 patch functionality.\nhttps://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html", "creation_timestamp": "2026-09-12T01:00:04.428979Z"} 2026-09-12T01:00:04.428979+00:00 https://vulnerability.circl.lu/sighting/1ea4b418-9a94-4944-906f-6eaede9ccd8c/export 2026-09-17T08:34:17.902762+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "1ea4b418-9a94-4944-906f-6eaede9ccd8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "published-proof-of-concept", "source": "Telegram/mZUTN-dgFzZWTpxOL4QNH3xIbYerCrrMD24kuXMsejlEOCQ", "content": "", "creation_timestamp": "2026-09-11T00:00:55.809385Z"} 2026-09-11T00:00:55.809385+00:00 https://vulnerability.circl.lu/sighting/9a27abb1-c8b5-49d9-899c-53fd6ed0a1da/export 2026-09-17T08:34:17.902857+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9a27abb1-c8b5-49d9-899c-53fd6ed0a1da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/mZUTN-dgFzZWTpxOL4QNH3xIbYerCrrMD24kuXMsejlEOCQ", "content": "", "creation_timestamp": "2026-09-10T01:00:03.454984Z"} 2026-09-10T01:00:03.454984+00:00 https://vulnerability.circl.lu/sighting/8ba30fe7-0258-4e9b-b216-267cc7ce6385/export 2026-09-17T08:34:17.902950+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8ba30fe7-0258-4e9b-b216-267cc7ce6385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/eSGsp3WtYnX4D6nk7zI0XrQXLVBIBFPNJ554BlveoPv5VcY", "content": "", "creation_timestamp": "2026-09-09T00:00:26.280948Z"} 2026-09-09T00:00:26.280948+00:00 https://vulnerability.circl.lu/sighting/efc6ffcb-08eb-4950-8e75-cf318c83e589/export 2026-09-17T08:34:17.903043+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "efc6ffcb-08eb-4950-8e75-cf318c83e589", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11882", "type": "seen", "source": "Telegram/eSGsp3WtYnX4D6nk7zI0XrQXLVBIBFPNJ554BlveoPv5VcY", "content": "", "creation_timestamp": "2026-09-08T20:00:04.576958Z"} 2026-09-08T20:00:04.576958+00:00 https://vulnerability.circl.lu/sighting/213d712c-6630-4e50-80dd-96497e821058/export 2026-09-17T08:34:17.903134+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "213d712c-6630-4e50-80dd-96497e821058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11394", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/trendmicro_officescan_widget_exec.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"mr_me \", \"Mehmet Ince \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a\\n terminal command under the context of the web server user.\\n\\n The specific flaw exists within the management interface, which listens on TCP port 443 by default. The Trend Micro Officescan product\\n has a widget feature which is implemented with PHP. Talker.php takes ack and hash parameters but doesn't validate these values, which\\n leads to an authentication bypass for the widget. Proxy.php files under the mod TMCSS folder take multiple parameters but the process\\n does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities,\\n unauthenticated users can execute a terminal command under the context of the web server user.\", \"disclosure_date\": \"2017-10-07\", \"fullname\": \"exploit/windows/http/trendmicro_officescan_widget_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"Trend Micro OfficeScan Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/http/trendmicro_officescan_widget_exec.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/trendmicro_officescan_widget_exec\", \"references\": [\"CVE-2017-11394\", \"URL-https://pentest.blog/one-ring-to-rule-them-all-same-rce-on-multiple-trend-micro-products/\", \"URL-http://www.zerodayinitiative.com/advisories/ZDI-17-521/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Automatic Targeting\", \"OfficeScan 11\", \"OfficeScan XG\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:01.523855Z"} 2026-09-08T06:52:01.523855+00:00 https://vulnerability.circl.lu/sighting/aa904781-c00f-4c3d-9c36-48ef4a12e0c4/export 2026-09-17T08:34:17.903250+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "aa904781-c00f-4c3d-9c36-48ef4a12e0c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-11317", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/telerik_rau_deserialization.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Spencer McIntyre\", \"Paul Taylor\", \"Markus Wulftange\", \"Caleb Gross\", \"Alvaro Mu\\u00f1oz\", \"Oleksandr Mirosh\", \"straightblast\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits the .NET deserialization vulnerability within the RadAsyncUpload (RAU) component of Telerik\\n UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET\\n assembly DLL which is then loaded through the deserialization flaw. Uploading the file requires knowledge of the\\n cryptographic keys used by RAU. The default values used by this module are related to CVE-2017-11317, which once\\n patched randomizes these keys. It is also necessary to know the version of Telerik UI ASP.NET that is running.\\n This version number is in the format YYYY.#(.###)? where YYYY is the year of the release (e.g. '2020.3.915').\", \"disclosure_date\": \"2019-12-09\", \"fullname\": \"exploit/windows/http/telerik_rau_deserialization\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unreliable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/telerik_rau_deserialization.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/telerik_rau_deserialization\", \"references\": [\"CVE-2017-11317\", \"URL-https://github.com/bao7uo/RAU_crypto\", \"URL-https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/unrestricted-file-upload\", \"URL-https://github.com/straightblast/UnRadAsyncUpload/wiki\", \"CVE-2019-18935\", \"URL-https://github.com/noperator/CVE-2019-18935\", \"URL-https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization\", \"URL-https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html\", \"URL-https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Windows\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:00.839310Z"} 2026-09-08T06:52:00.839310+00:00