{"vulnerability": "cve-2019-12840", "sightings": [{"uuid": "03f345dd-c077-494b-8ad2-1df2471c6fa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "exploited", "source": "https://www.exploit-db.com/exploits/46984", "content": "", "creation_timestamp": "2019-06-11T00:00:00.000000Z"}, {"uuid": "2406fb9f-611c-4889-9af7-8cfbce1eab46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "MISP/9e8f4e39-3831-432a-b196-8fed951d7f0c", "content": "", "creation_timestamp": "2024-11-14T06:07:39.000000Z"}, {"uuid": "0510e216-650a-424f-bd74-2285b9d77b69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "e18be482-4575-480a-b536-a53ae0069e13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:12.000000Z"}, {"uuid": "6f08536f-fc4c-42a1-9eba-6f2c30d49dbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webmin_packageup_rce.rb", "content": "", "creation_timestamp": "2019-06-19T13:57:30.000000Z"}, {"uuid": "bbdb1502-4972-44a2-9167-b1e335c899e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/6500", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aEsto es una prueba de concepto propia i basica de la vulneravilidad CVE-2019-12840 la qual te da un RCE en root\nURL\uff1ahttps://github.com/Pol-Ruiz/PoC-CVE-2019-12840\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2024-01-25T23:08:46.000000Z"}, {"uuid": "03a32148-6b58-42b3-a06f-e12bada9af3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "https://t.me/cibsecurity/21140", "content": "\u203c CVE-2020-35606 \u203c\n\nArbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-21T22:52:17.000000Z"}, {"uuid": "e5ef0355-07ca-4d4a-9d71-db01912c4ee7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/2350", "content": "#Threat_Research\n1. CVE-2020-35606 - Arbitrary Command Execution Vulnerability in Webmin\n// This vulnerability is bypassing the measure taken for CVE-2019-12840 and converting it into a new vector\nhttps://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html\n2. SUNBURST, TEARDROP and the NetSec New Normal\nhttps://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal\n3. CyRC analysis: Authentication bypass vulnerability in Java Bouncy Castle (PoC for CVE-2020-28052)\nhttps://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle", "creation_timestamp": "2020-12-31T18:30:13.000000Z"}, {"uuid": "b7c55b7c-a5cc-4e92-aac5-aa2adeb23ef8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "https://t.me/cissp/2061", "content": "Sunburst Backdoor\nPart 1: A Deeper Look Into The SolarWinds' Supply Chain Malware\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-deeper-look-into.html?m=1\nPart 2: DGA & The List of Victims\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-part-ii-dga-list-of.html?m=1\nPart 3: DGA & Security Software\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-part-iii-dga-security.html\n\n1. CVE-2020-35606 - Arbitrary Command Execution Vulnerability in Webmin\n// This vulnerability is bypassing the measure taken for CVE-2019-12840 and converting it into a new vector\nhttps://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html\n\n2. SUNBURST, TEARDROP and the NetSec New Normal\nhttps://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal\n\n3. CyRC analysis: Authentication bypass vulnerability in Java Bouncy Castle (PoC for CVE-2020-28052)\nhttps://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle\n\n1. Signature bypass in RAUC embedded Linux firmware updater (PoC for CVE-2020-25860)\n\n2. A post-exploitation technique - Locating the kernel PGD on Android/aarch64\nhttps://duasynt.com/blog/android-pgd-page-tables\n\n3. Reading/writing memory of other processes using fasttrap (PoC for CVE-2020-27949)\nhttps://github.com/seemoo-lab/dtrace-memaccess_cve-2020-27949\n\nRCE when open a project in android studio that google refused to fix (still 0day) (PoC)\nhttps://seclists.org/fulldisclosure/2020/Dec/43", "creation_timestamp": "2026-09-01T17:01:07.775032Z"}, {"uuid": "be5a33b2-6a03-4601-a06a-db1c0fc4311b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "https://t.me/cissp/2061", "content": "Sunburst Backdoor\nPart 1: A Deeper Look Into The SolarWinds' Supply Chain Malware\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-deeper-look-into.html?m=1\nPart 2: DGA & The List of Victims\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-part-ii-dga-list-of.html?m=1\nPart 3: DGA & Security Software\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-part-iii-dga-security.html\n\n1. CVE-2020-35606 - Arbitrary Command Execution Vulnerability in Webmin\n// This vulnerability is bypassing the measure taken for CVE-2019-12840 and converting it into a new vector\nhttps://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html\n\n2. SUNBURST, TEARDROP and the NetSec New Normal\nhttps://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal\n\n3. CyRC analysis: Authentication bypass vulnerability in Java Bouncy Castle (PoC for CVE-2020-28052)\nhttps://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle\n\n1. Signature bypass in RAUC embedded Linux firmware updater (PoC for CVE-2020-25860)\n\n2. A post-exploitation technique - Locating the kernel PGD on Android/aarch64\nhttps://duasynt.com/blog/android-pgd-page-tables\n\n3. Reading/writing memory of other processes using fasttrap (PoC for CVE-2020-27949)\nhttps://github.com/seemoo-lab/dtrace-memaccess_cve-2020-27949\n\nRCE when open a project in android studio that google refused to fix (still 0day) (PoC)\nhttps://seclists.org/fulldisclosure/2020/Dec/43", "creation_timestamp": "2026-09-02T01:04:56.925613Z"}, {"uuid": "9d11fe73-3771-4876-bc8e-085576e9ef51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "creation_timestamp": "2026-09-05T07:00:03.281364Z"}, {"uuid": "fd9be21a-454d-453f-badb-3ab4998ffc5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "creation_timestamp": "2026-09-06T00:00:53.971887Z"}, {"uuid": "f8a9f63d-07ad-4a76-88b8-58c6a69ad516", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webmin_packageup_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"AkkuS <\\u00d6zkan Mustafa Akku\\u015f>\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an arbitrary command execution vulnerability in Webmin\\n          1.910 and lower versions. Any user authorized to the \\\"Package Updates\\\"\\n          module can execute arbitrary commands with root privileges.\", \"disclosure_date\": \"2019-05-16\", \"fullname\": \"exploit/linux/http/webmin_packageup_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Webmin Package Updates Remote Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/webmin_packageup_rce.rb\", \"platform\": \"Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/webmin_packageup_rce\", \"references\": [\"CVE-2019-12840\", \"URL-https://www.pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html\"], \"rport\": 10000, \"session_types\": false, \"targets\": [\"Webmin <= 1.910\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:03.175804Z"}, {"uuid": "c691a0e6-524e-46a5-87ca-53bce5d00272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2061", "content": "Sunburst Backdoor\nPart 1: A Deeper Look Into The SolarWinds' Supply Chain Malware\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-deeper-look-into.html?m=1\nPart 2: DGA & The List of Victims\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-part-ii-dga-list-of.html?m=1\nPart 3: DGA & Security Software\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-part-iii-dga-security.html\n\n1. CVE-2020-35606 - Arbitrary Command Execution Vulnerability in Webmin\n// This vulnerability is bypassing the measure taken for CVE-2019-12840 and converting it into a new vector\nhttps://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html\n\n2. SUNBURST, TEARDROP and the NetSec New Normal\nhttps://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal\n\n3. CyRC analysis: Authentication bypass vulnerability in Java Bouncy Castle (PoC for CVE-2020-28052)\nhttps://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle\n\n1. Signature bypass in RAUC embedded Linux firmware updater (PoC for CVE-2020-25860)\n\n2. A post-exploitation technique - Locating the kernel PGD on Android/aarch64\nhttps://duasynt.com/blog/android-pgd-page-tables\n\n3. Reading/writing memory of other processes using fasttrap (PoC for CVE-2020-27949)\nhttps://github.com/seemoo-lab/dtrace-memaccess_cve-2020-27949\n\nRCE when open a project in android studio that google refused to fix (still 0day) (PoC)\nhttps://seclists.org/fulldisclosure/2020/Dec/43", "creation_timestamp": "2026-09-11T21:00:04.628054Z"}, {"uuid": "b28ad841-e775-4711-a637-db9f359546e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12840", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2061", "content": "Sunburst Backdoor\nPart 1: A Deeper Look Into The SolarWinds' Supply Chain Malware\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-deeper-look-into.html?m=1\nPart 2: DGA & The List of Victims\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-part-ii-dga-list-of.html?m=1\nPart 3: DGA & Security Software\nhttps://blog.prevasio.com/2020/12/sunburst-backdoor-part-iii-dga-security.html\n\n1. CVE-2020-35606 - Arbitrary Command Execution Vulnerability in Webmin\n// This vulnerability is bypassing the measure taken for CVE-2019-12840 and converting it into a new vector\nhttps://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html\n\n2. SUNBURST, TEARDROP and the NetSec New Normal\nhttps://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal\n\n3. CyRC analysis: Authentication bypass vulnerability in Java Bouncy Castle (PoC for CVE-2020-28052)\nhttps://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle\n\n1. Signature bypass in RAUC embedded Linux firmware updater (PoC for CVE-2020-25860)\n\n2. A post-exploitation technique - Locating the kernel PGD on Android/aarch64\nhttps://duasynt.com/blog/android-pgd-page-tables\n\n3. Reading/writing memory of other processes using fasttrap (PoC for CVE-2020-27949)\nhttps://github.com/seemoo-lab/dtrace-memaccess_cve-2020-27949\n\nRCE when open a project in android studio that google refused to fix (still 0day) (PoC)\nhttps://seclists.org/fulldisclosure/2020/Dec/43", "creation_timestamp": "2026-09-12T00:00:13.457096Z"}]}