{"vulnerability": "cve-2012-1889", "sightings": [{"uuid": "0b832427-2597-4119-b500-10d6a77f1cbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/52820098-69f4-4415-b737-4635950d2109", "content": "", "creation_timestamp": "2013-11-12T10:29:56.000000Z"}, {"uuid": "1888c2ba-b5ee-4a13-b7b5-2be0074d40da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/523c662f-2958-4aaf-a65e-4005950d2109", "content": "", "creation_timestamp": "2013-09-23T09:59:38.000000Z"}, {"uuid": "0e536b8a-3e96-47e7-9a92-95b6700d24f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/53804616-c6a8-48ea-b511-dbf1950d210b", "content": "", "creation_timestamp": "2014-05-24T07:23:08.000000Z"}, {"uuid": "e767fbe6-ec84-4cdc-907c-1053d49fb160", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "c4701b9e-9bff-4a28-a3ba-bdfc8fd83231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971639", "content": "", "creation_timestamp": "2024-12-24T20:32:12.365726Z"}, {"uuid": "053ffbdd-8323-499d-9336-77e0ec3848cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:40.000000Z"}, {"uuid": "16549e83-46c1-46c5-a31b-0b8c8e70be90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:02.000000Z"}, {"uuid": "395afd5a-b810-481b-9389-54a75a67afc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:04.000000Z"}, {"uuid": "71fbc336-0d81-47e4-a1fe-1a659b2df70d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:12:40.000000Z"}, {"uuid": "0c4ff3b3-c1e7-43ce-995c-6edc29a53663", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:52.000000Z"}, {"uuid": "3147f6c4-81c5-4da9-96d2-89b9cde5bebc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "dc014bb5-0ca2-426a-b599-34ba19519b04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2012-1889", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/19186", "content": "", "creation_timestamp": "2012-06-16T00:00:00.000000Z"}, {"uuid": "61f060bc-d550-484f-b6c5-009facfe602e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2012-1889", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d3f63bbf-9cf1-48bb-a61d-55da8b935074", "content": "", "creation_timestamp": "2026-02-02T12:27:23.493076Z"}, {"uuid": "9a1ef407-8ab6-42c9-84b4-fa6247956a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "Telegram/4CSO9wVSWojMWZaLZZtKXkz_dHNQIBcd1ESCTpOoiCxyZf5Z", "content": "", "creation_timestamp": "2025-02-06T02:42:29.000000Z"}, {"uuid": "48675d6c-a8ed-464a-a62d-f04aed4d2811", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "Telegram/Xsj52U1zKvCeEHZ4EvCdAQjprUDQJy1nn2QjvvPAF2rfdvFR", "content": "", "creation_timestamp": "2025-02-06T02:41:39.000000Z"}, {"uuid": "1dc1e1e4-798a-4056-ba6c-84be683629e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "https://t.me/arpsyndicate/949", "content": "#ExploitObserverAlert\n\nCVE-2012-1889\n\nDESCRIPTION: Exploit Observer has 13 entries related to CVE-2012-1889. Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.\n\nFIRST-EPSS: 0.974740000\nNVD-IS: 10.0\nNVD-ES: 8.6", "creation_timestamp": "2023-12-03T14:00:59.000000Z"}, {"uuid": "408d0167-bd1c-4aad-9057-6e9fd6c6ee03", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9d86b8fb-35fe-45d0-98e4-48572c20ac9e", "content": "", "creation_timestamp": "2026-06-19T12:47:10.368137Z"}, {"uuid": "63b5a57a-1e00-4db6-b08e-1e4fb80532dc", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/faf2338d-0268-44e4-af35-7b555b3fae33", "content": "", "creation_timestamp": "2026-06-23T14:05:28.067418Z"}, {"uuid": "12c8a681-9cb6-4b55-a7a8-2d3452ff7edc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-1889", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"inking26\", \"binjo\", \"sinn3r \", \"juan vazquez \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a memory corruption flaw in Microsoft XML Core Services\\n          when trying to access an uninitialized Node with the getDefinition API, which\\n          may corrupt memory allowing remote code execution.\", \"disclosure_date\": \"2012-06-12\", \"fullname\": \"exploit/windows/browser/msxml_get_definition_code_exec\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"windows/browser/msxml_get_definition_code_exec\", \"references\": [\"CVE-2012-1889\", \"BID-53934\", \"OSVDB-82873\", \"MSB-MS12-043\", \"URL-http://technet.microsoft.com/en-us/security/advisory/2719615\", \"URL-http://www.zdnet.com/blog/security/state-sponsored-attackers-using-ie-zero-day-to-hijack-gmail-accounts/12462\", \"URL-https://www.rapid7.com/blog/post/2012/06/18/metasploit-exploits-critical-microsoft-vulnerabilities\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Automatic\", \"IE 6 on Windows XP SP3\", \"IE 7 on Windows XP SP3 / Vista SP2\", \"IE 8 on Windows XP SP3\", \"IE 8 with Java 6 on Windows XP SP3\", \"IE 8 with Java 6 on Windows 7 SP1/Vista SP2\", \"IE 9 with Java 6 on Windows 7 SP1\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:11.413274Z"}]}