{"vulnerability": "cve-2015-1635", "sightings": [{"uuid": "6128e408-0eb7-4bed-830d-4d64bbaa7833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "4a904662-0b6d-4145-a68d-dae5fcf66c5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971239", "content": "", "creation_timestamp": "2024-12-24T20:26:21.322537Z"}, {"uuid": "60d662ff-79ec-4fe6-887d-a5fddb57dbf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "dbdfeef6-28c9-4ab6-b762-ff95531f3470", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:07.000000Z"}, {"uuid": "4aa7b23c-e6d0-4a71-916d-2ebdfe979a54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:37.000000Z"}, {"uuid": "29710324-4c07-4e09-b373-685f08271db6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "723204a4-775e-4ddf-ac94-81f33ac3f530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/ms15_034_ulonglongadd.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "480b0dd8-dc04-41fa-b2e0-13468c7aedf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2015-1635", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/971dd6c6-9b16-4f8b-916c-991233f9bdaa", "content": "", "creation_timestamp": "2026-02-02T12:28:25.204060Z"}, {"uuid": "c10378f5-d561-403c-9b59-fefe8344d9c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "Telegram/Gq5_JfB-dW2Qi3ZUx_s3iPdk8koHXwSStdMwRf2OX5s1KxF0", "content": "", "creation_timestamp": "2025-02-14T10:00:35.000000Z"}, {"uuid": "df0705b9-a1ef-43b4-bc57-7372efa03eaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "https://t.me/arpsyndicate/4099", "content": "#ExploitObserverAlert\n\nPD/http/cves/2015/CVE-2015-1635\n\nDESCRIPTION: Exploit Observer has 64 entries in 15 file formats related to PD/http/cves/2015/CVE-2015-1635. HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka \"HTTP.sys Remote Code Execution Vulnerability.\"", "creation_timestamp": "2024-02-29T23:36:07.000000Z"}, {"uuid": "89181afa-04d8-40f2-8074-2bc2ad8d43ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "https://t.me/arpsyndicate/1310", "content": "#ExploitObserverAlert\n\nCVE-2015-1635\n\nDESCRIPTION: Exploit Observer has 53 entries related to CVE-2015-1635. HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka \"HTTP.sys Remote Code Execution Vulnerability.\"\n\nFIRST-EPSS: 0.975590000\nNVD-IS: 10.0\nNVD-ES: 10.0", "creation_timestamp": "2023-12-04T21:32:32.000000Z"}, {"uuid": "606865c2-cc71-4797-a262-b09938b153a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "https://t.me/arpsyndicate/1734", "content": "#ExploitObserverAlert\n\nCVE-2015-1635\n\nDESCRIPTION: Exploit Observer has 53 entries related to CVE-2015-1635. HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka \"HTTP.sys Remote Code Execution Vulnerability.\"\n\nFIRST-EPSS: 0.975590000\nNVD-IS: 10.0\nNVD-ES: 10.0", "creation_timestamp": "2023-12-11T12:37:13.000000Z"}, {"uuid": "31c90d2b-11c1-4ab5-9590-bebac0c9d3d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ", "content": "", "creation_timestamp": "2026-08-01T11:00:07.165170Z"}, {"uuid": "912413e7-572b-44d8-9ac1-3576965a99b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ", "content": "", "creation_timestamp": "2026-08-02T00:00:58.750525Z"}, {"uuid": "966ddfdd-a085-4ca0-b85a-c3d123ba5b9d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/93b145b1-32d8-41f6-b5d3-e76ea4f049a4", "content": "", "creation_timestamp": "2026-06-19T12:47:39.818989Z"}, {"uuid": "916add67-beb9-41ed-9f05-23958269e323", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2a8a48eb-c564-4975-aee1-c0f5810a02e0", "content": "", "creation_timestamp": "2026-06-23T14:04:55.659035Z"}, {"uuid": "cd112ec1-c6f6-4d54-904f-5a2ff29a8371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-27T12:00:13.191341Z"}, {"uuid": "c86292bc-a7cb-4ec0-955e-dd9672b556c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-28T00:00:57.133873Z"}, {"uuid": "4fdef9fa-9859-4e33-96a1-05c3dae6cc76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "published-proof-of-concept", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-29T00:00:12.304612Z"}, {"uuid": "67a9fe22-fa4e-4267-9754-42184dbadd57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ", "content": "", "creation_timestamp": "2026-07-29T12:01:23.230748Z"}, {"uuid": "64e864a8-ce22-4542-bfa0-8c9277c4ec16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ", "content": "", "creation_timestamp": "2026-07-30T00:01:53.306760Z"}, {"uuid": "87197062-153a-46c0-be53-54e8b04e1785", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/ms15_034_ulonglongadd.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Bill Finlayson\", \"sinn3r \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module will check if scanned hosts are vulnerable to CVE-2015-1635 (MS15-034), a\\n          vulnerability in the HTTP protocol stack (HTTP.sys) that could result in arbitrary code\\n          execution. This module will try to cause a denial-of-service.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/dos/http/ms15_034_ulonglongadd\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/auxiliary/dos/http/ms15_034_ulonglongadd.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"dos/http/ms15_034_ulonglongadd\", \"references\": [\"CVE-2015-1635\", \"MSB-MS15-034\", \"URL-https://pastebin.com/ypURDPc4\", \"URL-https://github.com/rapid7/metasploit-framework/pull/5150\", \"URL-https://community.qualys.com/blogs/securitylabs/2015/04/20/ms15-034-analyze-and-remote-detection\", \"URL-http://www.securitysift.com/an-analysis-of-ms15-034/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:00.480901Z"}, {"uuid": "c268669e-230c-44e2-879d-b18fd5f1e92c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-1635", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Rich Whitcroft \", \"sinn3r \", \"Sunny Neo \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module dumps memory contents using a crafted Range header and affects only\\n          Windows 8.1, Server 2012, and Server 2012R2. Note that if the target\\n          is running in VMware Workstation, this module has a high likelihood\\n          of resulting in BSOD; however, VMware ESX and non-virtualized hosts\\n          seem stable. Using a larger target file should result in more memory\\n          being dumped, and SSL seems to produce more data as well.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/http/ms15_034_http_sys_memory_dump\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:52:36 +0000\", \"name\": \"MS15-034 HTTP Protocol Stack Request Handling HTTP.SYS Memory Information Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/ms15_034_http_sys_memory_dump\", \"references\": [\"CVE-2015-1635\", \"MSB-MS15-034\", \"URL-https://pastebin.com/ypURDPc4\", \"URL-https://github.com/rapid7/metasploit-framework/pull/5150\", \"URL-https://community.qualys.com/blogs/securitylabs/2015/04/20/ms15-034-analyze-and-remote-detection\", \"URL-http://www.securitysift.com/an-analysis-of-ms15-034/\", \"URL-http://securitysift.com/an-analysis-of-ms15-034/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:37.740852Z"}]}