https://vulnerability.circl.lu/sightings/feed 2026-09-17T14:16:05.995622+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ee6991b6-b939-4fae-be1f-fd62b6cce6e5/export 2026-09-17T14:16:06.000145+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ee6991b6-b939-4fae-be1f-fd62b6cce6e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7766", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manage_engine_opmanager_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java\", \"author\": [\"xistence \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a default credential vulnerability in ManageEngine OpManager, where a\\n default hidden account \\\"IntegrationUser\\\" with administrator privileges exists. The account\\n has a default password of \\\"plugin\\\" which cannot be reset through the user interface. By\\n log-in and abusing the default administrator's SQL query functionality, it's possible to\\n write a WAR payload to disk and trigger an automatic deployment of this payload. This\\n module has been tested successfully on OpManager v11.0 and v11.4-v11.6 for Windows.\", \"disclosure_date\": \"2015-09-14\", \"fullname\": \"exploit/windows/http/manage_engine_opmanager_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"ManageEngine OpManager Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/http/manage_engine_opmanager_rce.rb\", \"platform\": \"Java\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"windows/http/manage_engine_opmanager_rce\", \"references\": [\"EDB-38174\", \"CVE-2015-7765\", \"CVE-2015-7766\", \"URL-https://seclists.org/fulldisclosure/2015/Sep/66\", \"URL-https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"ManageEngine OpManager <= v11.6\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:53.673200Z"} 2026-09-08T06:51:53.673200+00:00 https://vulnerability.circl.lu/sighting/f8e391d1-b6a6-455a-8d04-0733517d7c14/export 2026-09-17T14:16:06.003407+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f8e391d1-b6a6-455a-8d04-0733517d7c14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7765", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manage_engine_opmanager_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java\", \"author\": [\"xistence \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a default credential vulnerability in ManageEngine OpManager, where a\\n default hidden account \\\"IntegrationUser\\\" with administrator privileges exists. The account\\n has a default password of \\\"plugin\\\" which cannot be reset through the user interface. By\\n log-in and abusing the default administrator's SQL query functionality, it's possible to\\n write a WAR payload to disk and trigger an automatic deployment of this payload. This\\n module has been tested successfully on OpManager v11.0 and v11.4-v11.6 for Windows.\", \"disclosure_date\": \"2015-09-14\", \"fullname\": \"exploit/windows/http/manage_engine_opmanager_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"ManageEngine OpManager Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/http/manage_engine_opmanager_rce.rb\", \"platform\": \"Java\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"windows/http/manage_engine_opmanager_rce\", \"references\": [\"EDB-38174\", \"CVE-2015-7765\", \"CVE-2015-7766\", \"URL-https://seclists.org/fulldisclosure/2015/Sep/66\", \"URL-https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"ManageEngine OpManager <= v11.6\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:53.596647Z"} 2026-09-08T06:51:53.596647+00:00 https://vulnerability.circl.lu/sighting/420b8a1e-6e79-46c0-9f7f-1cb113cfb587/export 2026-09-17T14:16:06.003727+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "420b8a1e-6e79-46c0-9f7f-1cb113cfb587", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7768", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/kmftp_utility_cwd.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"Shankar Damodaran\", \"Muhamad Fadzil Ramli \"], \"autofilter_ports\": [21, 2121], \"autofilter_services\": [\"ftp\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.\\n Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which\\n leads to an SEH overflow. Konica FTP allows anonymous access by default; valid\\n credentials are typically unnecessary to exploit this vulnerability.\", \"disclosure_date\": \"2015-08-23\", \"fullname\": \"exploit/windows/ftp/kmftp_utility_cwd\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:58 +0000\", \"name\": \"Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": []}, \"path\": \"/modules/exploits/windows/ftp/kmftp_utility_cwd.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/ftp/kmftp_utility_cwd\", \"references\": [\"CVE-2015-7768\", \"EDB-37908\"], \"rport\": 21, \"session_types\": false, \"targets\": [\"Windows 7 SP1 x86\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:37.985785Z"} 2026-09-08T06:51:37.985785+00:00 https://vulnerability.circl.lu/sighting/5e4e6d52-3fd8-4ff7-a932-c64d0185bc19/export 2026-09-17T14:16:06.003863+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5e4e6d52-3fd8-4ff7-a932-c64d0185bc19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7709", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/arkeia_agent_exec.rb", "content": "{\"aliases\": [], \"arch\": \"x86, cmd\", \"author\": [\"xistence \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a code execution flaw in Western Digital Arkeia version 11.0.12 and below.\\n The vulnerability exists in the 'arkeiad' daemon listening on TCP port 617. Because there are\\n insufficient checks on the authentication of all clients, this can be bypassed.\\n Using the ARKFS_EXEC_CMD operation it's possible to execute arbitrary commands with root or\\n SYSTEM privileges.\\n The daemon is installed on both the Arkeia server as well on all the backup clients. The module\\n has been successfully tested on Windows, Linux, OSX, FreeBSD and OpenBSD.\", \"disclosure_date\": \"2015-07-10\", \"fullname\": \"exploit/multi/misc/arkeia_agent_exec\", \"is_install_path\": true, \"mod_time\": \"2026-06-05 11:39:07 +0000\", \"name\": \"Western Digital Arkeia Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/misc/arkeia_agent_exec.rb\", \"platform\": \"Unix,Windows\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"multi/misc/arkeia_agent_exec\", \"references\": [\"CVE-2015-7709\", \"EDB-37600\", \"URL-https://seclists.org/fulldisclosure/2015/Jul/54\"], \"rport\": 617, \"session_types\": false, \"targets\": [\"Windows\", \"Linux\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.192092Z"} 2026-09-08T06:50:25.192092+00:00 https://vulnerability.circl.lu/sighting/ceba9628-65f1-463a-b63c-64dd8067470f/export 2026-09-17T14:16:06.003984+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ceba9628-65f1-463a-b63c-64dd8067470f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7755", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/juniper_backdoor.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"hdm \", \"h00die \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module scans for the Juniper SSH backdoor (also valid on Telnet).\\n Any username is required, and the password is <<< %s(un='%s') = %u.\", \"disclosure_date\": \"2015-12-20\", \"fullname\": \"auxiliary/scanner/ssh/juniper_backdoor\", \"is_install_path\": true, \"mod_time\": \"2025-09-22 19:52:39 +0000\", \"name\": \"Juniper SSH Backdoor Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/auxiliary/scanner/ssh/juniper_backdoor.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ssh/juniper_backdoor\", \"references\": [\"CVE-2015-7755\", \"URL-https://www.rapid7.com/blog/post/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor/\", \"URL-https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713\", \"ATT&CK-T1021.004\"], \"rport\": 22, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:07.810041Z"} 2026-09-08T06:48:07.810041+00:00 https://vulnerability.circl.lu/sighting/f6f17849-a2ae-438f-9902-00c9a688625d/export 2026-09-17T14:16:06.004102+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f6f17849-a2ae-438f-9902-00c9a688625d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7792", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mp7ibedtdn24", "content": "\ud83d\udccc CVE-2015-7792 - Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors. https://www.cyberhub.blog/cves/CVE-2015-7792", "creation_timestamp": "2026-06-26T17:37:06.508738Z"} 2026-06-26T17:37:06.508738+00:00 https://vulnerability.circl.lu/sighting/57114130-5aa6-4c97-b436-db9d9c2fb79a/export 2026-09-17T14:16:06.004213+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "57114130-5aa6-4c97-b436-db9d9c2fb79a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7755", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d4c11b1c-5410-497d-9631-2d99cba9b8a0", "content": "", "creation_timestamp": "2026-06-23T14:03:50.256668Z"} 2026-06-23T14:03:50.256668+00:00 https://vulnerability.circl.lu/sighting/99d14286-bce3-4750-8c3c-4395cc8047d4/export 2026-09-17T14:16:06.004319+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "99d14286-bce3-4750-8c3c-4395cc8047d4", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7755", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fb1459f7-880b-4e74-a73b-4b400cd2ff25", "content": "", "creation_timestamp": "2026-06-19T12:45:24.994466Z"} 2026-06-19T12:45:24.994466+00:00 https://vulnerability.circl.lu/sighting/e28788cf-1247-4aae-8d94-4191bb06d70a/export 2026-09-17T14:16:06.004418+00:00 Cédric Bonhomme https://cvepremium.circl.lu/user/cedric {"uuid": "e28788cf-1247-4aae-8d94-4191bb06d70a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2015-7755", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/da49d3a6-54e5-40e3-add3-e0f4774085eb", "content": "", "creation_timestamp": "2026-02-02T12:25:51.730264Z"} 2026-02-02T12:25:51.730264+00:00 https://vulnerability.circl.lu/sighting/83ef0844-2cdd-4e5d-87ec-b71a21ad9007/export 2026-09-17T14:16:06.006666+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "83ef0844-2cdd-4e5d-87ec-b71a21ad9007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7755", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m2cxpplc5h23", "content": "", "creation_timestamp": "2025-10-03T21:02:29.492392Z"} 2025-10-03T21:02:29.492392+00:00