{"vulnerability": "cve-2015-5287", "sightings": [{"uuid": "40171935-460e-4374-bdcc-2b3f72ab4903", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "exploited", "source": "https://www.exploit-db.com/exploits/47421", "content": "", "creation_timestamp": "2019-09-25T00:00:00.000000Z"}, {"uuid": "265fb471-f7c7-40e7-9e3d-ab69385221bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "exploited", "source": "https://www.exploit-db.com/exploits/38835", "content": "", "creation_timestamp": "2015-12-01T00:00:00.000000Z"}, {"uuid": "b144680e-50c0-411d-b593-d6060c262f8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "exploited", "source": "https://www.exploit-db.com/exploits/38832", "content": "", "creation_timestamp": "2015-12-01T00:00:00.000000Z"}, {"uuid": "8f773c95-4c14-4436-8e85-205cbbb6d293", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "89e358f6-6fd3-4390-8e49-a91bb62bdf52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:40.000000Z"}, {"uuid": "f2f7baf5-6eb0-4908-86d6-76cc6e6662cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb", "content": "", "creation_timestamp": "2019-09-24T14:59:10.000000Z"}, {"uuid": "607a0a85-a487-4aa9-b88c-91ffc8629349", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/846", "content": "CVE-2019-10677 DASAN Zhone ZNID GPON 2426A EU Multiple XSS\u6f0f\u6d1e\nCVE-2019-1619&CVE-2019-1622 Cisco Data Center Network Manager \u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nCVE-2019-15081 Opencart 3.x XSS\u6f0f\u6d1e\nCVE-2019-15814 Sentrifugo 3.2 XSS\u6f0f\u6d1e\nCVE-2011-2921 ktsuss 1.4 suid \u6b0a\u9650\u63d0\u5347\u6f0f\u6d1e\nCVE-2019-16197 Dolibarr ERP-CRM 10.0.1 XSS\u6f0f\u6d1e\nCVE-2019-16119 WordPress Plugin Photo Gallery 1.5.34 SQL\u6ce8\u5165\u6f0f\u6d1e\nCVE-2019-16068 Enigma NMS 65.0.0 CSRF\u6f0f\u6d1e\nCVE-2019-16065 Enigma NMS 65.0.0 SQL\u6ce8\u5165\u6f0f\u6d1e\nCVE-2015-5287 ABRT sosreport \u672c\u5730\u6b0a\u9650\u63d0\u5347\u6f0f\u6d1e\nCVE-2019-16701 pfSense 2.3.4&2.4.4-p3 \u9060\u7a0b\u4ee3\u78bc\u6ce8\u5165\u6f0f\u6d1e\nCVE-2019-16679 Gila CMS \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\nCVE-2019-17080 mintinstall 7.9.9 \u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nCVE-2019-12562 DotNetNuke XSS\u6f0f\u6d1e\nCVE-2015-5287 ABRT sosreport \u6b0a\u9650\u63d0\u5347\u6f0f\u6d1e\nCVE-2019-5485 NPMJS gitlabhook 0.0.17 \u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nCVE-2019-17132 vBulletin 5.5.4 \u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nCVE-2019-17271 vBulletin 5.5.4 SQL\u6ce8\u5165\u6f0f\u6d1e\nCVE-2019-17225 Subrion 4.2.1 XSS\u6f0f\u6d1e\nCVE-2019-15741 GitLab Omnibus 12.2.1 Logrotate \u6b0a\u9650\u63d0\u5347\u6f0f\u6d1e\nGaruda Media SQL\u6ce8\u5165\u6f0f\u6d1e\nBelajarBro SQL\u6ce8\u5165\u6f0f\u6d1e\nCVE-2019-13529 SMA Solar Technology AG Sunny WebBox 1.6 CSRF\u6f0f\u6d1e\nCVE-2019-6971 TP-Link TL-WR1043ND 2 \u8eab\u4efd\u9a57\u8b49\u7e5e\u904e\u6f0f\u6d1e", "creation_timestamp": "2021-09-21T04:41:50.000000Z"}, {"uuid": "d8b4e0e5-a0af-4e9a-ba5c-94b32cb8182b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-29T23:00:20.963261Z"}, {"uuid": "337f61f2-a5d8-475b-ac0b-62e90384c2cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-30T00:00:27.889332Z"}, {"uuid": "2912f317-5ce0-47f4-9193-ebcd6a06064d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mueh6cftmy2q", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-08-31T08:06:46.451272Z"}, {"uuid": "a09cc649-e383-42e4-840d-dd968ce5bbf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mtyuwusc6o2e", "content": "\ud83d\uded1 CVE-2015-5287\nRed Hat Automatic Bug Reporting Tool\nEPSS 3% / KEV: No\nTL;DR: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1\u2026\nhttps://cvesentinel.com/report/CVE-2015-5287?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-26T17:41:12.747635Z"}, {"uuid": "79e6e799-12b1-48eb-be3a-4a79d5a547a1", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/09e763ed-a0e9-45de-8584-87610e8016b9", "content": "", "creation_timestamp": "2026-08-26T18:00:02.499537Z"}, {"uuid": "1ed6b7bb-382c-42d6-8800-15a0146e2deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mtz2g7jamn2w", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2015-5287: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permiss\u2026\nCVSS 7.8 \u00b7 EPSS 3.4% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2015-5287\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-26T19:19:16.686268Z"}, {"uuid": "7fa1a8b3-0d8c-4d17-86d2-0fcc77b92dfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mtzefi2rys2j", "content": "\ud83d\udea8 CISA Adds 6 KEV to Catalog\n\n\ud83d\udd34 CVE-2015-3246 Red Hat Libuser\n\ud83d\udfe0 CVE-2015-5287 Red Hat Automatic Bug Reporting Tool\n\ud83d\udd34 CVE-2019-1068 MS SQL Server\n\ud83d\udd34 CVE-2021-23758 Ajax.NET Professional\n\ud83d\udd34 CVE-2022-0995 Linux Kernel\n\ud83d\udd34 CVE-2026-8452 Citrix NetScaler ADC & NetScaler GW\n\nsecdb.nttzen.cloud/security-adv...", "creation_timestamp": "2026-08-26T22:17:50.232671Z"}, {"uuid": "aec58ad5-0032-4856-8ced-c116e6adf014", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mtziqv7s3t2a", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2015-5287", "creation_timestamp": "2026-08-26T23:35:47.439905Z"}, {"uuid": "d5ea3d2e-9c69-4614-a78e-3dc1ab07d1d8", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2d5da46a-6560-45b3-86dd-26e9d087fa99", "content": "", "creation_timestamp": "2026-08-27T18:00:33.163186Z"}, {"uuid": "9441e44b-4635-400d-8344-85ef261230fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2015-5287", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mu4cahdf3c2b", "content": "Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability https://0daynews.com/cves/cve-2015-5287", "creation_timestamp": "2026-08-28T02:17:12.645435Z"}, {"uuid": "0da7d1b0-43b5-44ed-a0d4-e548a642e2b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mu27wxuklw2n", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2015-5287: \u26a0\ufe0f CVE-2015-5287: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 3.4%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2015-5287-the-abrt-hook-ccpp-help-program-in-automatic", "creation_timestamp": "2026-08-27T06:30:46.838646Z"}, {"uuid": "9cb30a40-efe1-49b4-bfaf-c622cc0b0375", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mu2frb6lui27", "content": "\ud83d\udea8 Executive Risk Brief: CVE-2015-5287 targets Red Hat ABRT via symlink privilege escalation. Leaders must review asset visibility, compliance tracking, and patch management protocols. Read the full CSUITE brief from The Cyber Mind Co. https://thecybermind.co/9pkv", "creation_timestamp": "2026-08-27T08:14:58.382264Z"}, {"uuid": "a5b41cbb-94ec-4f9e-b13e-e0ec75b30225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "published-proof-of-concept", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-31T00:00:40.392225Z"}, {"uuid": "cb327aa5-08ea-433b-942b-017bfc927f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3muw2kwoiqt25", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-09-07T08:09:07.221677Z"}, {"uuid": "50ea9064-d316-4dce-abf2-d6273009fc4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64, armle, aarch64, riscv64le, riscv32le, ppc, mipsle, mipsbe\", \"author\": [\"rebel\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module attempts to gain root privileges on RHEL systems with\\n          a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured\\n          as the crash handler.\\n\\n          `sosreport` uses an insecure temporary directory, allowing local users\\n          to write to arbitrary files (CVE-2015-5287). This module uses a symlink\\n          attack on `/var/tmp/abrt/cc-*$pid/` to overwrite the `modprobe` path\\n          in `/proc/sys/kernel/modprobe`, resulting in root privileges.\\n\\n          Waiting for `sosreport` could take a few minutes.\\n\\n          This module has been tested successfully on:\\n\\n          abrt 2.1.11-12.el7 on RHEL 7.0 x86_64; and\\n          abrt 2.1.11-19.el7 on RHEL 7.1 x86_64.\", \"disclosure_date\": \"2015-11-23\", \"fullname\": \"exploit/linux/local/abrt_sosreport_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"ABRT sosreport Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/abrt_sosreport_priv_esc\", \"references\": [\"BID-78137\", \"CVE-2015-5287\", \"EDB-38832\", \"URL-https://www.openwall.com/lists/oss-security/2015/12/01/1\", \"URL-https://access.redhat.com/errata/RHSA-2015:2505\", \"URL-https://access.redhat.com/security/cve/CVE-2015-5287\", \"URL-https://bugzilla.redhat.com/show_bug.cgi?id=1266837\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:05.582009Z"}, {"uuid": "18efc116-1e69-420b-9f4b-638299b90bc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mvhnrkgzst26", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-09-14T08:08:06.012017Z"}, {"uuid": "c482e760-62b5-4bb1-bda3-27ef2a0eb552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5287", "type": "seen", "source": "https://t.me/VulnerabilityNews/44179", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2015-3246 Red Hat Libuser Race Condition Vulnerability\nCVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability\nCVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability\nCVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability\nCVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability\nCVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-18T12:00:06.537368Z"}]}