https://vulnerability.circl.lu/sightings/feed 2026-09-17T13:29:28.829428+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/08ac6b33-7a24-46e8-b3c7-1f2b08c0dcf9/export 2026-09-17T13:29:28.845440+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "08ac6b33-7a24-46e8-b3c7-1f2b08c0dcf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33891", "type": "exploited", "source": "https://t.me/cissp/6650", "content": "CISA has added 3 more flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation:\n\nCVE-2022-35914 - Teclib GLPI RCE\nCVE-2022-33891 - Apache Spark Command Injection\nCVE-2022-28810 - Zoho ADSelfService Plus RCE\n\nRead: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.htm\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.17", "creation_timestamp": "2026-09-11T00:00:55.170067Z"} 2026-09-11T00:00:55.170067+00:00 https://vulnerability.circl.lu/sighting/dc4c9a84-5b53-46cf-a72e-7f6ccc05aa89/export 2026-09-17T13:29:28.848580+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "dc4c9a84-5b53-46cf-a72e-7f6ccc05aa89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33679", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6317", "content": "exploit\nCVE-2022-33679:\nWindows Kerberos EoP Vulnerability\nhttps://github.com/Bdenneu/CVE-2022-33679\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.08.13", "creation_timestamp": "2026-09-11T00:00:50.856129Z"} 2026-09-11T00:00:50.856129+00:00 https://vulnerability.circl.lu/sighting/60f193ac-702a-4d08-9cfc-1d6f09758ffe/export 2026-09-17T13:29:28.848728+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "60f193ac-702a-4d08-9cfc-1d6f09758ffe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3368", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6223", "content": "exploit\n1. CVE-2022-3368:\nArbitrary file move bug in Avira Security\nhttps://github.com/Wh04m1001/CVE-2022-3368\n\n2. CVE-2022-27502:\nRealVNC server <6.9.0 DLL Hijacking Exploit\nhttps://github.com/alirezac0/CVE-2022-27502\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.07.27", "creation_timestamp": "2026-09-11T00:00:50.352850Z"} 2026-09-11T00:00:50.352850+00:00 https://vulnerability.circl.lu/sighting/9e63d15e-77be-45f8-9f8c-2ab893f6d74d/export 2026-09-17T13:29:28.848838+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9e63d15e-77be-45f8-9f8c-2ab893f6d74d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33679", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6317", "content": "exploit\nCVE-2022-33679:\nWindows Kerberos EoP Vulnerability\nhttps://github.com/Bdenneu/CVE-2022-33679\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.08.13", "creation_timestamp": "2026-09-10T06:00:06.047183Z"} 2026-09-10T06:00:06.047183+00:00 https://vulnerability.circl.lu/sighting/285e7494-fa23-40dc-89fe-801afc0878de/export 2026-09-17T13:29:28.848948+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "285e7494-fa23-40dc-89fe-801afc0878de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3368", "type": "published-proof-of-concept", "source": "https://t.me/cissp/6223", "content": "exploit\n1. CVE-2022-3368:\nArbitrary file move bug in Avira Security\nhttps://github.com/Wh04m1001/CVE-2022-3368\n\n2. CVE-2022-27502:\nRealVNC server <6.9.0 DLL Hijacking Exploit\nhttps://github.com/alirezac0/CVE-2022-27502\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.07.27", "creation_timestamp": "2026-09-10T06:00:05.562137Z"} 2026-09-10T06:00:05.562137+00:00 https://vulnerability.circl.lu/sighting/1f36b507-e8e6-49ca-aa7b-58a707dee3c7/export 2026-09-17T13:29:28.849047+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1f36b507-e8e6-49ca-aa7b-58a707dee3c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33891", "type": "exploited", "source": "https://t.me/cissp/6650", "content": "CISA has added 3 more flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation:\n\nCVE-2022-35914 - Teclib GLPI RCE\nCVE-2022-33891 - Apache Spark Command Injection\nCVE-2022-28810 - Zoho ADSelfService Plus RCE\n\nRead: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.htm\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.17", "creation_timestamp": "2026-09-10T02:00:04.423749Z"} 2026-09-10T02:00:04.423749+00:00 https://vulnerability.circl.lu/sighting/44305f6a-9d0c-4804-bb52-41823f8a4b5a/export 2026-09-17T13:29:28.849144+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "44305f6a-9d0c-4804-bb52-41823f8a4b5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3365", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/remote_mouse_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64, x86\", \"author\": [\"h00die\", \"0RPHON\", \"H4rk3nz0\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module utilizes the Remote Mouse Server by Emote Interactive protocol\\n to deploy a payload and run it from the server on versions < 4.200 (500 server response).\\n This module will only deploy\\n a payload if the server is set without a password (default).\\n Tested against 4.110, current at the time of module writing\", \"disclosure_date\": \"2019-04-15\", \"fullname\": \"exploit/windows/misc/remote_mouse_rce\", \"is_install_path\": true, \"mod_time\": \"2022-10-17 15:30:17 +0000\", \"name\": \"Remote Mouse RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"screen-effects\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/misc/remote_mouse_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/misc/remote_mouse_rce\", \"references\": [\"EDB-46697\", \"CVE-2022-3365\", \"URL-https://www.remotemouse.net/\", \"URL-https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/remote%20mouse/remote-mouse-rce.py\"], \"rport\": 1978, \"session_types\": false, \"targets\": [\"default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:21.428837Z"} 2026-09-08T06:52:21.428837+00:00 https://vulnerability.circl.lu/sighting/3f525070-9af0-4e92-8234-9afc79e68c4f/export 2026-09-17T13:29:28.849254+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3f525070-9af0-4e92-8234-9afc79e68c4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33891", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_spark_rce_cve_2022_33891.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Kostya Kortchinsky\", \"h00die-gr3y \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated command injection vulnerability in Apache Spark.\\n Successful exploitation results in remote code execution under the context of the Spark application user.\\n\\n The command injection occurs because Spark checks the group membership of the user passed\\n in the ?doAs parameter by using a raw Linux command.\\n\\n It is triggered by a non-default setting called spark.acls.enable.\\n This configuration setting spark.acls.enable should be set true in the Spark configuration to make the application vulnerable for this attack.\\n\\n Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1 are affected by this vulnerability.\", \"disclosure_date\": \"2022-07-18\", \"fullname\": \"exploit/linux/http/apache_spark_rce_cve_2022_33891\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Apache Spark Unauthenticated Command Injection RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/apache_spark_rce_cve_2022_33891.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/apache_spark_rce_cve_2022_33891\", \"references\": [\"URL-https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc\", \"URL-https://attackerkb.com/topics/5FyKBES4BL/cve-2022-33891\", \"CVE-2022-33891\"], \"rport\": 8080, \"session_types\": false, \"targets\": [\"Unix (In-Memory)\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:22.291239Z"} 2026-09-08T06:48:22.291239+00:00 https://vulnerability.circl.lu/sighting/8dbb33eb-c5ac-4eaa-88e7-379ea638c869/export 2026-09-17T13:29:28.849368+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8dbb33eb-c5ac-4eaa-88e7-379ea638c869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3358", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb", "content": "{\"actions\": [], \"aliases\": [\"auxiliary/scanner/http/ssl\", \"auxiliary/scanner/http/ssl_version\"], \"arch\": \"\", \"author\": [\"todb \", \"et \", \"Chris John Riley\", \"Veit Hailperin \", \"h00die\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"Check if a server supports a given version of SSL/TLS and cipher suites.\\n\\n The certificate is stored in loot, and any known vulnerabilities against that\\n SSL version and cipher suite combination are checked. These checks include\\n POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites,\\n certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST.\", \"disclosure_date\": \"2014-10-14\", \"fullname\": \"auxiliary/scanner/ssl/ssl_version\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"SSL/TLS Version Detection\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/ssl/ssl_version.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ssl/ssl_version\", \"references\": [\"URL-https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html\", \"CVE-2014-3566\", \"URL-http://web.archive.org/web/20240319071045/https://www.openssl.org/~bodo/ssl-poodle.pdf\", \"URL-https://datatracker.ietf.org/doc/rfc8996/\", \"URL-https://datatracker.ietf.org/doc/html/rfc6176\", \"URL-https://datatracker.ietf.org/doc/html/rfc7568\", \"URL-https://www.win.tue.nl/hashclash/rogue-ca/\", \"CWE-328\", \"URL-https://drownattack.com/\", \"CVE-2016-0800\", \"CVE-2011-3389\", \"URL-http://web.archive.org/web/20240607160328/https://www.isg.rhul.ac.uk/tls/\", \"CVE-2013-2566\", \"CVE-2015-4000\", \"CVE-2022-3358\", \"CWE-319\", \"CWE-298\", \"CWE-327\", \"CWE-326\"], \"rport\": 443, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:10.285868Z"} 2026-09-08T06:48:10.285868+00:00 https://vulnerability.circl.lu/sighting/a398d81d-19be-4dd6-9209-3c757f102926/export 2026-09-17T13:29:28.849481+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a398d81d-19be-4dd6-9209-3c757f102926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33942", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/78424", "content": "Exploit Collector\nIntel Data Center Manager 4.1.1.45749 Authentication Bypass / Spoofing\n\nhttps://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png Intel Data Center Manager versions 4.1.1.45749 and below suffer from an authentication bypass vulnerability via spoofing.\n\nSHA-256 | c994d19000e263ed1c33f5352902d080b70eb355d42bec09d1cf2d70a522e3e4Download RCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct: Intel Data Center Manager\nVendor URL: https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html\nType: Authentication Bypass by Spoofing [CWE-290]\nDate found: 2022-06-01\nDate published: 2022-11-23\nCVSSv3 Score: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\nCVE: CVE-2022-33942\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nIntel Data Center Manager 4.1.1.45749 and below\n4. INTRODUCTION\n===============\nEnergy costs are the fastest rising expense for today\u2019s data centers. Intel\u00ae Data\nCenter Manager (Intel\u00ae DCM) provides real-time power and thermal consumption data,\ngiving you the clarity you need to lower power usage, increase rack density, and\nprolong operation during outages.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe application allows configuring authentication via Active Directory groups. While\nthis by itself isn't an issue, it becomes one as soon as an Active Directory group\nwith a well-known SID (such as \"S-1-5-32-544\" or \"S-1-5-32-546\") is configured to\nallow authentication to DCM. This is because Intel's DCM only relies on the group's\nSID to allow authentication but doesn't verify the authenticating domain, which the\nuser can give during the authentication process against the DCM Console and its REST\ninterface.\n\nSince the DCM will send all Kerberos and LDAP (authentication) requests against the\ngiven domain, it is trivially easy to spoof the authentication responses by using an\narbitrary Kerberos and LDAP server and replying with the SID of one of the configured\nActive Directory groups.\n\nThis allows an attacker to bypass the authentication schema by using any domain\nwith any user/password combination without actually being part of any Active Directory\ngroups.\n6. PROOF OF CONCEPT\n===================\nSee the referenced blog post for a full exploit.\n7. SOLUTION\n===========\nUpdate to Intel DCM 5.0 or later\n8. REPORT TIMELINE\n==================\n2022-06-01: Discovery of the vulnerability\n2022-06-28: Sent notification to Intel via their PSIRT\n2022-06-28: Vendor response: Sent to appropriate reviewers.\n2022-06-29: Vendor acknowledges the vulnerability and asks for coordinated disclosure on Nov. 8, 2022\n2022-06-30: Rejected the disclosure date, due to my own policy, which makes it: August 13, 2022\n2022-07-08: After a vendor call, I've submitted the issue through Intel's bug bounty program\n2022-xx-xx: Vendor releases version 5.0 without any notification which fixes this vulnerability\n2022-11-08: Vendor (responsible CNA) assigns CVE-2022-33942\n2022-11-08: Vendor publishes security advisory INTEL-SA-00713\n2022-11-23: Public disclosure\n9. REFERENCES\n=============\nhttps://www.rcesecurity.com/2022/11/from-zero-to-hero-part-1-bypassing-intel-dcms-authentication-by-spoofing-kerberos-and-ldap-responses-cve-2022-33942\nhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\nhttps://github.com/MrTuxracer/advisories Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:59.170576Z"} 2026-09-06T00:00:59.170576+00:00