{"vulnerability": "cve-2011-2005", "sightings": [{"uuid": "e095bf87-0fcd-4ac9-9247-26f16d48d389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "70f6a1c7-960d-4361-8fb3-ff1fcd522816", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971456", "content": "", "creation_timestamp": "2024-12-24T20:29:36.498474Z"}, {"uuid": "0eabc636-a386-4355-89a9-48e49c84772d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:40.000000Z"}, {"uuid": "8a7ebb79-5b69-4353-ba02-169e45cb4e60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:01.000000Z"}, {"uuid": "23321822-fad2-4eec-b8f7-df490ccaaaa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:08:55.000000Z"}, {"uuid": "cf4a1626-ba89-41c5-8a8c-a7bd17e992a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "9aaa9f54-4945-4402-92d7-286932af28f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2011-2005", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/29aa0f02-8988-43cd-98ce-f9f93ea3473b", "content": "", "creation_timestamp": "2026-02-02T12:27:58.392788Z"}, {"uuid": "c2ff2451-1167-4bc5-87b4-4e4c2c5c5849", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2011-2005", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/21844", "content": "", "creation_timestamp": "2012-10-10T00:00:00.000000Z"}, {"uuid": "f0a4a507-f5a6-47af-bd67-2a35616305c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2011-2005", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/18176", "content": "", "creation_timestamp": "2011-11-30T00:00:00.000000Z"}, {"uuid": "af622b87-4ca0-404e-9210-7a3e2590e662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "https://t.me/arpsyndicate/225", "content": "#ExploitObserverAlert\n\nCVE-2011-2005\n\nDESCRIPTION: Exploit Observer has 15 entries related to CVE-2011-2005. afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka \"Ancillary Function Driver Elevation of Privilege Vulnerability.\"\n\nFIRST-EPSS: 0.000570000\nNVD-IS: 10.0\nNVD-ES: 3.9", "creation_timestamp": "2023-11-17T06:53:34.000000Z"}, {"uuid": "471ac806-e448-4438-b508-8b9c93c8c591", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5d0f3d8c-f6e8-41e5-9390-f71e769a5888", "content": "", "creation_timestamp": "2026-06-19T12:47:23.226860Z"}, {"uuid": "f02940d4-be77-427e-908b-06e419d6ca83", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fd3237d6-2130-42e3-97df-b40afb09e0da", "content": "", "creation_timestamp": "2026-06-23T14:05:13.910033Z"}, {"uuid": "4d5c5b83-7e00-4e5c-8f4a-d3143c4a4730", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-2005", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86\", \"author\": [\"Matteo Memelli\", \"Spencer McIntyre\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a flaw in the AfdJoinLeaf function of the\\n            afd.sys driver to overwrite data in kernel space.  An address\\n            within the HalDispatchTable is overwritten and when triggered\\n            with a call to NtQueryIntervalProfile will execute shellcode.\\n\\n            This module will elevate itself to SYSTEM, then inject the payload\\n            into another SYSTEM process before restoring its own token to\\n            avoid causing system instability.\", \"disclosure_date\": \"2011-11-30\", \"fullname\": \"exploit/windows/local/ms11_080_afdjoinleaf\", \"is_install_path\": true, \"mod_time\": \"2023-05-25 12:45:30 +0000\", \"name\": \"MS11-080 AfdJoinLeaf Privilege Escalation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"windows/local/ms11_080_afdjoinleaf\", \"references\": [\"CVE-2011-2005\", \"OSVDB-76232\", \"EDB-18176\", \"MSB-MS11-080\", \"URL-http://www.offensive-security.com/vulndev/ms11-080-voyage-into-ring-zero/\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Automatic\", \"Windows XP SP2 / SP3\", \"Windows Server 2003 SP2\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:10.680462Z"}]}