https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 20:38:31 +0000 https://vulnerability.circl.lu/sighting/06a1145d-628e-4631-81ba-5f495bfcab8a/export {"uuid": "06a1145d-628e-4631-81ba-5f495bfcab8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47575", "type": "seen", "source": "MISP/616cfae2-9da9-48bb-8be3-053d5b26bf13", "content": "", "creation_timestamp": "2026-09-10T12:15:02.540906Z"} {"uuid": "06a1145d-628e-4631-81ba-5f495bfcab8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47575", "type": "seen", "source": "MISP/616cfae2-9da9-48bb-8be3-053d5b26bf13", "content": "", "creation_timestamp": "2026-09-10T12:15:02.540906Z"} https://vulnerability.circl.lu/sighting/06a1145d-628e-4631-81ba-5f495bfcab8a/export Thu, 10 Sep 2026 12:15:02 +0000 https://vulnerability.circl.lu/sighting/d9c561b8-d6be-4d4e-acf2-ce78a617b3f0/export {"uuid": "d9c561b8-d6be-4d4e-acf2-ce78a617b3f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47407", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/mypro_mgr_cmd.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Michael Heinzl\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Unauthenticated Command Injection in MyPRO Manager <= v1.2 from mySCADA.\\n The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of the myscada9 administrative user that is automatically added by the product.\", \"disclosure_date\": \"2024-11-21\", \"fullname\": \"exploit/windows/scada/mypro_mgr_cmd\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:58 +0000\", \"name\": \"mySCADA myPRO Manager Unauthenticated Command Injection (CVE-2024-47407)\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/scada/mypro_mgr_cmd.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/scada/mypro_mgr_cmd\", \"references\": [\"URL-https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07\", \"CVE-2024-47407\"], \"rport\": 34022, \"session_types\": false, \"targets\": [\"Windows_Fetch\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:29.455560Z"} {"uuid": "d9c561b8-d6be-4d4e-acf2-ce78a617b3f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47407", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/mypro_mgr_cmd.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Michael Heinzl\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Unauthenticated Command Injection in MyPRO Manager <= v1.2 from mySCADA.\\n The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of the myscada9 administrative user that is automatically added by the product.\", \"disclosure_date\": \"2024-11-21\", \"fullname\": \"exploit/windows/scada/mypro_mgr_cmd\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:58 +0000\", \"name\": \"mySCADA myPRO Manager Unauthenticated Command Injection (CVE-2024-47407)\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/scada/mypro_mgr_cmd.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/scada/mypro_mgr_cmd\", \"references\": [\"URL-https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07\", \"CVE-2024-47407\"], \"rport\": 34022, \"session_types\": false, \"targets\": [\"Windows_Fetch\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:29.455560Z"} https://vulnerability.circl.lu/sighting/d9c561b8-d6be-4d4e-acf2-ce78a617b3f0/export Tue, 08 Sep 2026 06:52:29 +0000 https://vulnerability.circl.lu/sighting/85f54f44-1c81-48cf-bb5c-7ec646ed9486/export {"uuid": "85f54f44-1c81-48cf-bb5c-7ec646ed9486", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47177", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Simone Margaritelli\", \"Rick de Jager\", \"David Batley\", \"Spencer McIntyre\", \"RageLtMan \", \"Ryan Emmons\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities in OpenPrinting CUPS, which is running by\\n default on most Linux distributions. The vulnerabilities allow an attacker on\\n the LAN to advertise a malicious printer that triggers remote code execution\\n when a victim sends a print job to the malicious printer. Successful exploitation\\n requires user interaction, but no CUPS services need to be reachable via accessible\\n ports. Code execution occurs in the context of the lp user. Affected versions\\n are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and\\n cups-filters <= 2.0.1.\", \"disclosure_date\": \"2024-09-26\", \"fullname\": \"exploit/multi/misc/cups_ipp_remote_code_execution\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"CUPS IPP Attributes LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/misc/cups_ipp_remote_code_execution\", \"references\": [\"CVE-2024-47076\", \"CVE-2024-47175\", \"CVE-2024-47177\", \"CVE-2024-47176\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\", \"URL-https://github.com/RickdeJager/cupshax\", \"GHSA-rj88-6mr5-rcw8\", \"GHSA-w63j-6g73-wmg5\", \"GHSA-7xfx-47qg-grp6\", \"GHSA-p9rh-jxmq-gq47\", \"URL-https://github.com/h2g2bob/ipp-server/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.939943Z"} {"uuid": "85f54f44-1c81-48cf-bb5c-7ec646ed9486", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47177", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Simone Margaritelli\", \"Rick de Jager\", \"David Batley\", \"Spencer McIntyre\", \"RageLtMan \", \"Ryan Emmons\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities in OpenPrinting CUPS, which is running by\\n default on most Linux distributions. The vulnerabilities allow an attacker on\\n the LAN to advertise a malicious printer that triggers remote code execution\\n when a victim sends a print job to the malicious printer. Successful exploitation\\n requires user interaction, but no CUPS services need to be reachable via accessible\\n ports. Code execution occurs in the context of the lp user. Affected versions\\n are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and\\n cups-filters <= 2.0.1.\", \"disclosure_date\": \"2024-09-26\", \"fullname\": \"exploit/multi/misc/cups_ipp_remote_code_execution\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"CUPS IPP Attributes LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/misc/cups_ipp_remote_code_execution\", \"references\": [\"CVE-2024-47076\", \"CVE-2024-47175\", \"CVE-2024-47177\", \"CVE-2024-47176\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\", \"URL-https://github.com/RickdeJager/cupshax\", \"GHSA-rj88-6mr5-rcw8\", \"GHSA-w63j-6g73-wmg5\", \"GHSA-7xfx-47qg-grp6\", \"GHSA-p9rh-jxmq-gq47\", \"URL-https://github.com/h2g2bob/ipp-server/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.939943Z"} https://vulnerability.circl.lu/sighting/85f54f44-1c81-48cf-bb5c-7ec646ed9486/export Tue, 08 Sep 2026 06:50:25 +0000 https://vulnerability.circl.lu/sighting/09d5a668-9819-439d-94cb-564f60ac79d8/export {"uuid": "09d5a668-9819-439d-94cb-564f60ac79d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47176", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Simone Margaritelli\", \"Rick de Jager\", \"David Batley\", \"Spencer McIntyre\", \"RageLtMan \", \"Ryan Emmons\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities in OpenPrinting CUPS, which is running by\\n default on most Linux distributions. The vulnerabilities allow an attacker on\\n the LAN to advertise a malicious printer that triggers remote code execution\\n when a victim sends a print job to the malicious printer. Successful exploitation\\n requires user interaction, but no CUPS services need to be reachable via accessible\\n ports. Code execution occurs in the context of the lp user. Affected versions\\n are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and\\n cups-filters <= 2.0.1.\", \"disclosure_date\": \"2024-09-26\", \"fullname\": \"exploit/multi/misc/cups_ipp_remote_code_execution\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"CUPS IPP Attributes LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/misc/cups_ipp_remote_code_execution\", \"references\": [\"CVE-2024-47076\", \"CVE-2024-47175\", \"CVE-2024-47177\", \"CVE-2024-47176\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\", \"URL-https://github.com/RickdeJager/cupshax\", \"GHSA-rj88-6mr5-rcw8\", \"GHSA-w63j-6g73-wmg5\", \"GHSA-7xfx-47qg-grp6\", \"GHSA-p9rh-jxmq-gq47\", \"URL-https://github.com/h2g2bob/ipp-server/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.853986Z"} {"uuid": "09d5a668-9819-439d-94cb-564f60ac79d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47176", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Simone Margaritelli\", \"Rick de Jager\", \"David Batley\", \"Spencer McIntyre\", \"RageLtMan \", \"Ryan Emmons\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities in OpenPrinting CUPS, which is running by\\n default on most Linux distributions. The vulnerabilities allow an attacker on\\n the LAN to advertise a malicious printer that triggers remote code execution\\n when a victim sends a print job to the malicious printer. Successful exploitation\\n requires user interaction, but no CUPS services need to be reachable via accessible\\n ports. Code execution occurs in the context of the lp user. Affected versions\\n are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and\\n cups-filters <= 2.0.1.\", \"disclosure_date\": \"2024-09-26\", \"fullname\": \"exploit/multi/misc/cups_ipp_remote_code_execution\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"CUPS IPP Attributes LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/misc/cups_ipp_remote_code_execution\", \"references\": [\"CVE-2024-47076\", \"CVE-2024-47175\", \"CVE-2024-47177\", \"CVE-2024-47176\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\", \"URL-https://github.com/RickdeJager/cupshax\", \"GHSA-rj88-6mr5-rcw8\", \"GHSA-w63j-6g73-wmg5\", \"GHSA-7xfx-47qg-grp6\", \"GHSA-p9rh-jxmq-gq47\", \"URL-https://github.com/h2g2bob/ipp-server/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.853986Z"} https://vulnerability.circl.lu/sighting/09d5a668-9819-439d-94cb-564f60ac79d8/export Tue, 08 Sep 2026 06:50:25 +0000 https://vulnerability.circl.lu/sighting/e3b6d816-ac00-4881-bfd8-db00c53c0bfe/export {"uuid": "e3b6d816-ac00-4881-bfd8-db00c53c0bfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47175", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Simone Margaritelli\", \"Rick de Jager\", \"David Batley\", \"Spencer McIntyre\", \"RageLtMan \", \"Ryan Emmons\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities in OpenPrinting CUPS, which is running by\\n default on most Linux distributions. The vulnerabilities allow an attacker on\\n the LAN to advertise a malicious printer that triggers remote code execution\\n when a victim sends a print job to the malicious printer. Successful exploitation\\n requires user interaction, but no CUPS services need to be reachable via accessible\\n ports. Code execution occurs in the context of the lp user. Affected versions\\n are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and\\n cups-filters <= 2.0.1.\", \"disclosure_date\": \"2024-09-26\", \"fullname\": \"exploit/multi/misc/cups_ipp_remote_code_execution\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"CUPS IPP Attributes LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/misc/cups_ipp_remote_code_execution\", \"references\": [\"CVE-2024-47076\", \"CVE-2024-47175\", \"CVE-2024-47177\", \"CVE-2024-47176\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\", \"URL-https://github.com/RickdeJager/cupshax\", \"GHSA-rj88-6mr5-rcw8\", \"GHSA-w63j-6g73-wmg5\", \"GHSA-7xfx-47qg-grp6\", \"GHSA-p9rh-jxmq-gq47\", \"URL-https://github.com/h2g2bob/ipp-server/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.769149Z"} {"uuid": "e3b6d816-ac00-4881-bfd8-db00c53c0bfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47175", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Simone Margaritelli\", \"Rick de Jager\", \"David Batley\", \"Spencer McIntyre\", \"RageLtMan \", \"Ryan Emmons\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities in OpenPrinting CUPS, which is running by\\n default on most Linux distributions. The vulnerabilities allow an attacker on\\n the LAN to advertise a malicious printer that triggers remote code execution\\n when a victim sends a print job to the malicious printer. Successful exploitation\\n requires user interaction, but no CUPS services need to be reachable via accessible\\n ports. Code execution occurs in the context of the lp user. Affected versions\\n are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and\\n cups-filters <= 2.0.1.\", \"disclosure_date\": \"2024-09-26\", \"fullname\": \"exploit/multi/misc/cups_ipp_remote_code_execution\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"CUPS IPP Attributes LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/misc/cups_ipp_remote_code_execution\", \"references\": [\"CVE-2024-47076\", \"CVE-2024-47175\", \"CVE-2024-47177\", \"CVE-2024-47176\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\", \"URL-https://github.com/RickdeJager/cupshax\", \"GHSA-rj88-6mr5-rcw8\", \"GHSA-w63j-6g73-wmg5\", \"GHSA-7xfx-47qg-grp6\", \"GHSA-p9rh-jxmq-gq47\", \"URL-https://github.com/h2g2bob/ipp-server/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.769149Z"} https://vulnerability.circl.lu/sighting/e3b6d816-ac00-4881-bfd8-db00c53c0bfe/export Tue, 08 Sep 2026 06:50:25 +0000 https://vulnerability.circl.lu/sighting/0a1b9a1a-9c8e-4ae4-ade7-f908c8627c27/export {"uuid": "0a1b9a1a-9c8e-4ae4-ade7-f908c8627c27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47076", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Simone Margaritelli\", \"Rick de Jager\", \"David Batley\", \"Spencer McIntyre\", \"RageLtMan \", \"Ryan Emmons\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities in OpenPrinting CUPS, which is running by\\n default on most Linux distributions. The vulnerabilities allow an attacker on\\n the LAN to advertise a malicious printer that triggers remote code execution\\n when a victim sends a print job to the malicious printer. Successful exploitation\\n requires user interaction, but no CUPS services need to be reachable via accessible\\n ports. Code execution occurs in the context of the lp user. Affected versions\\n are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and\\n cups-filters <= 2.0.1.\", \"disclosure_date\": \"2024-09-26\", \"fullname\": \"exploit/multi/misc/cups_ipp_remote_code_execution\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"CUPS IPP Attributes LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/misc/cups_ipp_remote_code_execution\", \"references\": [\"CVE-2024-47076\", \"CVE-2024-47175\", \"CVE-2024-47177\", \"CVE-2024-47176\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\", \"URL-https://github.com/RickdeJager/cupshax\", \"GHSA-rj88-6mr5-rcw8\", \"GHSA-w63j-6g73-wmg5\", \"GHSA-7xfx-47qg-grp6\", \"GHSA-p9rh-jxmq-gq47\", \"URL-https://github.com/h2g2bob/ipp-server/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.683852Z"} {"uuid": "0a1b9a1a-9c8e-4ae4-ade7-f908c8627c27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47076", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Simone Margaritelli\", \"Rick de Jager\", \"David Batley\", \"Spencer McIntyre\", \"RageLtMan \", \"Ryan Emmons\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits vulnerabilities in OpenPrinting CUPS, which is running by\\n default on most Linux distributions. The vulnerabilities allow an attacker on\\n the LAN to advertise a malicious printer that triggers remote code execution\\n when a victim sends a print job to the malicious printer. Successful exploitation\\n requires user interaction, but no CUPS services need to be reachable via accessible\\n ports. Code execution occurs in the context of the lp user. Affected versions\\n are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and\\n cups-filters <= 2.0.1.\", \"disclosure_date\": \"2024-09-26\", \"fullname\": \"exploit/multi/misc/cups_ipp_remote_code_execution\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"CUPS IPP Attributes LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/misc/cups_ipp_remote_code_execution\", \"references\": [\"CVE-2024-47076\", \"CVE-2024-47175\", \"CVE-2024-47177\", \"CVE-2024-47176\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\", \"URL-https://github.com/RickdeJager/cupshax\", \"GHSA-rj88-6mr5-rcw8\", \"GHSA-w63j-6g73-wmg5\", \"GHSA-7xfx-47qg-grp6\", \"GHSA-p9rh-jxmq-gq47\", \"URL-https://github.com/h2g2bob/ipp-server/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:25.683852Z"} https://vulnerability.circl.lu/sighting/0a1b9a1a-9c8e-4ae4-ade7-f908c8627c27/export Tue, 08 Sep 2026 06:50:25 +0000 https://vulnerability.circl.lu/sighting/033958bf-a386-4f7a-bc37-7ed02c78abb9/export {"uuid": "033958bf-a386-4f7a-bc37-7ed02c78abb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47575", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/fortimanager_rce_cve_2024_47575.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a missing authentication vulnerability affecting FortiManager and FortiManager\\n Cloud devices to achieve unauthenticated RCE with root privileges.\\n\\n The vulnerable FortiManager versions are:\\n * 7.6.0\\n * 7.4.0 through 7.4.4\\n * 7.2.0 through 7.2.7\\n * 7.0.0 through 7.0.12\\n * 6.4.0 through 6.4.14\\n * 6.2.0 through 6.2.12\\n\\n The vulnerable FortiManager Cloud versions are:\\n * 7.4.1 through 7.4.4\\n * 7.2.1 through 7.2.7\\n * 7.0.1 through 7.0.12\\n * 6.4 (all versions).\", \"disclosure_date\": \"2024-10-23\", \"fullname\": \"exploit/linux/misc/fortimanager_rce_cve_2024_47575\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Fortinet FortiManager Unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/misc/fortimanager_rce_cve_2024_47575.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/misc/fortimanager_rce_cve_2024_47575\", \"references\": [\"CVE-2024-47575\", \"URL-https://attackerkb.com/topics/OFBGprmpIE/cve-2024-47575/rapid7-analysis\", \"URL-https://bishopfox.com/blog/a-look-at-fortijump-cve-2024-47575\", \"URL-https://fortiguard.fortinet.com/psirt/FG-IR-24-423\"], \"rport\": 541, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:15.939172Z"} {"uuid": "033958bf-a386-4f7a-bc37-7ed02c78abb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47575", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/fortimanager_rce_cve_2024_47575.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a missing authentication vulnerability affecting FortiManager and FortiManager\\n Cloud devices to achieve unauthenticated RCE with root privileges.\\n\\n The vulnerable FortiManager versions are:\\n * 7.6.0\\n * 7.4.0 through 7.4.4\\n * 7.2.0 through 7.2.7\\n * 7.0.0 through 7.0.12\\n * 6.4.0 through 6.4.14\\n * 6.2.0 through 6.2.12\\n\\n The vulnerable FortiManager Cloud versions are:\\n * 7.4.1 through 7.4.4\\n * 7.2.1 through 7.2.7\\n * 7.0.1 through 7.0.12\\n * 6.4 (all versions).\", \"disclosure_date\": \"2024-10-23\", \"fullname\": \"exploit/linux/misc/fortimanager_rce_cve_2024_47575\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Fortinet FortiManager Unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/misc/fortimanager_rce_cve_2024_47575.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/misc/fortimanager_rce_cve_2024_47575\", \"references\": [\"CVE-2024-47575\", \"URL-https://attackerkb.com/topics/OFBGprmpIE/cve-2024-47575/rapid7-analysis\", \"URL-https://bishopfox.com/blog/a-look-at-fortijump-cve-2024-47575\", \"URL-https://fortiguard.fortinet.com/psirt/FG-IR-24-423\"], \"rport\": 541, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:15.939172Z"} https://vulnerability.circl.lu/sighting/033958bf-a386-4f7a-bc37-7ed02c78abb9/export Tue, 08 Sep 2026 06:49:15 +0000 https://vulnerability.circl.lu/sighting/3c1fd749-87df-4062-b7c4-70a5ef9bf20e/export {"uuid": "3c1fd749-87df-4062-b7c4-70a5ef9bf20e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47176", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/cups_browsed_info_disclosure.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"evilsocket\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"Retrieve CUPS version and kernel version information from cups-browsed services.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/misc/cups_browsed_info_disclosure\", \"is_install_path\": true, \"mod_time\": \"2026-04-01 20:34:46 +0000\", \"name\": \"cups-browsed Information Disclosure\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/misc/cups_browsed_info_disclosure.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/misc/cups_browsed_info_disclosure\", \"references\": [\"CVE-2024-47176\", \"GHSA-rj88-6mr5-rcw8\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\"], \"rport\": 631, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:00.428450Z"} {"uuid": "3c1fd749-87df-4062-b7c4-70a5ef9bf20e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47176", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/cups_browsed_info_disclosure.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"evilsocket\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"Retrieve CUPS version and kernel version information from cups-browsed services.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/misc/cups_browsed_info_disclosure\", \"is_install_path\": true, \"mod_time\": \"2026-04-01 20:34:46 +0000\", \"name\": \"cups-browsed Information Disclosure\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/misc/cups_browsed_info_disclosure.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/misc/cups_browsed_info_disclosure\", \"references\": [\"CVE-2024-47176\", \"GHSA-rj88-6mr5-rcw8\", \"URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\"], \"rport\": 631, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:00.428450Z"} https://vulnerability.circl.lu/sighting/3c1fd749-87df-4062-b7c4-70a5ef9bf20e/export Tue, 08 Sep 2026 06:48:00 +0000 https://vulnerability.circl.lu/sighting/b881afb2-8446-488a-ba9c-94b051154274/export {"uuid": "b881afb2-8446-488a-ba9c-94b051154274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47131", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muw7ibypjz2r", "content": "\ud83d\udccc CVE-2024-47131 - If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BA... https://www.cyberhub.blog/cves/CVE-2024-47131", "creation_timestamp": "2026-09-07T09:37:07.038486Z"} {"uuid": "b881afb2-8446-488a-ba9c-94b051154274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47131", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muw7ibypjz2r", "content": "\ud83d\udccc CVE-2024-47131 - If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BA... https://www.cyberhub.blog/cves/CVE-2024-47131", "creation_timestamp": "2026-09-07T09:37:07.038486Z"} https://vulnerability.circl.lu/sighting/b881afb2-8446-488a-ba9c-94b051154274/export Mon, 07 Sep 2026 09:37:07 +0000 https://vulnerability.circl.lu/sighting/a030befa-ec41-453d-8d57-755526b12349/export {"uuid": "a030befa-ec41-453d-8d57-755526b12349", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47964", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muubhh4uvn2k", "content": "\ud83d\udccc CVE-2024-47964 - Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An a... https://www.cyberhub.blog/cves/CVE-2024-47964", "creation_timestamp": "2026-09-06T15:07:07.341910Z"} {"uuid": "a030befa-ec41-453d-8d57-755526b12349", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-47964", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muubhh4uvn2k", "content": "\ud83d\udccc CVE-2024-47964 - Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An a... https://www.cyberhub.blog/cves/CVE-2024-47964", "creation_timestamp": "2026-09-06T15:07:07.341910Z"} https://vulnerability.circl.lu/sighting/a030befa-ec41-453d-8d57-755526b12349/export Sun, 06 Sep 2026 15:07:07 +0000