{"vulnerability": "cve-2020-1185", "sightings": [{"uuid": "1aeabad6-039b-4988-a8a8-1faa3e738ef2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11859", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113436415782139875", "content": "", "creation_timestamp": "2024-11-06T14:12:57.500265Z"}, {"uuid": "3c7ae2a4-d453-472e-b9a8-482c5b3bad83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11853", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "1a409e77-d383-4efc-8bf9-681632fd8024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11855", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "6c6e70a1-4932-494a-a669-829dfc8590fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11858", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "c1e9b65b-6bdd-4007-8dea-6b297b2d68ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "7f2ea1df-7392-4b45-a107-b1d0322c52ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11857", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "57b338e3-1e3e-452a-b068-ee9822735320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-05)", "content": "", "creation_timestamp": "2025-01-05T00:00:00.000000Z"}, {"uuid": "ff532545-bf9e-44eb-9494-07dfacbafff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-07)", "content": "", "creation_timestamp": "2025-01-07T00:00:00.000000Z"}, {"uuid": "0e5d4da1-b9f4-4955-982b-ead9fc8a3b28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-01)", "content": "", "creation_timestamp": "2025-02-01T00:00:00.000000Z"}, {"uuid": "e56bf063-4487-4422-9f8a-67afa9dce8f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11853", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:22.000000Z"}, {"uuid": "4d643702-4541-405f-99a5-af3bfd9c767a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:22.000000Z"}, {"uuid": "768f378f-8d26-4009-913c-7fa1a3b80fc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11855", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:22.000000Z"}, {"uuid": "b4ccf2c3-8f2d-41fa-8081-14ad86bfd8d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11857", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:22.000000Z"}, {"uuid": "6599ef47-ceaa-4a6b-ad23-9abf58be10e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11858", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:22.000000Z"}, {"uuid": "4ce1b2da-1fd8-4d7e-934b-ed52165d6c63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-22)", "content": "", "creation_timestamp": "2025-02-22T00:00:00.000000Z"}, {"uuid": "13cf0876-d345-4d2c-a018-569bd665cb7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11858", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/microfocus_operations_privesc.rb", "content": "", "creation_timestamp": "2021-02-15T10:31:11.000000Z"}, {"uuid": "ed28ba32-8ce8-4225-b606-29c7fde9bfe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-11)", "content": "", "creation_timestamp": "2025-11-11T00:00:00.000000Z"}, {"uuid": "61525636-6800-4010-adbb-967ac679639b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11853", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb", "content": "", "creation_timestamp": "2021-01-27T15:07:52.000000Z"}, {"uuid": "41375eb9-d75d-465f-a489-b2330d64ece0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11857", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/microfocus_obr_shrboadmin.rb", "content": "", "creation_timestamp": "2021-04-29T15:54:48.000000Z"}, {"uuid": "c92d1e20-23b6-47ef-8cee-4652e4f209c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11853", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_obm_auth_rce.rb", "content": "", "creation_timestamp": "2021-02-09T17:33:51.000000Z"}, {"uuid": "3dcd958a-5a29-4be6-b47a-7cb9fa3d2560", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb", "content": "", "creation_timestamp": "2021-01-27T15:07:52.000000Z"}, {"uuid": "29a9560e-ef67-4358-9926-9c6b2f4cf781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11855", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/microfocus_operations_privesc.rb", "content": "", "creation_timestamp": "2021-02-15T10:31:11.000000Z"}, {"uuid": "805dba22-4e2b-4001-89cf-818fb44a2777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-15)", "content": "", "creation_timestamp": "2026-02-15T00:00:00.000000Z"}, {"uuid": "62887717-c36f-41f6-8d75-020d881fbd61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-27)", "content": "", "creation_timestamp": "2026-03-27T00:00:00.000000Z"}, {"uuid": "e484933d-2bdd-4763-9ce0-56adf75a7827", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-27)", "content": "", "creation_timestamp": "2026-03-27T00:00:00.000000Z"}, {"uuid": "7e5c1a05-470f-4ac9-a4ad-3a9831eb4214", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11859", "type": "seen", "source": "https://t.me/cvedetector/10007", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2020-11859 - Improper Input Validation vulnerability in OpenTex\", \n  \"Content\": \"CVE ID : CVE-2020-11859 \nPublished : Nov. 6, 2024, 2:15 p.m. | 34\u00a0minutes ago \nDescription : Improper Input Validation vulnerability in OpenText iManager allows Cross-Site Scripting (XSS).\u00a0This issue affects iManager before 3.2.3 \nSeverity: 7.6 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"06 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-06T15:49:58.000000Z"}, {"uuid": "361bb84c-7b5a-4ef8-b1ea-ce927f712c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11850", "type": "seen", "source": "https://t.me/cvedetector/3766", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2020-11850 - OpenText Self Service Password Reset XSS\", \n  \"Content\": \"CVE ID : CVE-2020-11850 \nPublished : Aug. 21, 2024, 1:15 p.m. | 28\u00a0minutes ago \nDescription : Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS).\u00a0This issue affects Self Service Password Reset before 4.5.0.2 and\u00a04.4.0.6 \nSeverity: 7.3 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-21T15:44:12.000000Z"}, {"uuid": "b8996d1a-6753-4c64-9186-2c2ac8ea7277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11851", "type": "published-proof-of-concept", "source": "Telegram/g9Czzvvwo4GrketHVNn0AaDRZvTAJnLYcD15PFEbW5nnQw", "content": "", "creation_timestamp": "2021-01-14T12:36:08.000000Z"}, {"uuid": "54b88d82-fffb-4ca0-a1d5-a13ea94f67db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11853", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/539", "content": "CVE-2020-11853 Micro Focus Operations Bridge Manager \u9060\u7a0b\u547d\u4ee4\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-11853_Micro_Focus_Operations_Bridge_Manager_%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-30T02:53:38.000000Z"}, {"uuid": "867c92af-c86a-4e23-ab07-a2a90cb8cb8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11858", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/542", "content": "CVE-2020-11858 Micro Focus Operations Bridge Manager \u672c\u5730\u6b0a\u9650\u63d0\u5347\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-11858_Micro_Focus_Operations_Bridge_Manager_%E6%9C%AC%E5%9C%B0%E6%AC%8A%E9%99%90%E6%8F%90%E5%8D%87%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-30T02:57:38.000000Z"}, {"uuid": "67f3bdd2-0a57-4126-89ae-6c9e45546a33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11852", "type": "seen", "source": "https://t.me/cibsecurity/13978", "content": "ATENTION\u203c New - CVE-2020-11852\n\nDKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-08-07T20:55:23.000000Z"}, {"uuid": "1006319e-edd5-45fb-aafc-e8f5800da8e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11858", "type": "seen", "source": "https://t.me/cibsecurity/15620", "content": "\u203c CVE-2020-11858 \u203c\n\nCode execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-27T19:31:09.000000Z"}, {"uuid": "798d05f0-faf7-47ce-9b14-dfeca3724cf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11851", "type": "seen", "source": "https://t.me/cibsecurity/16417", "content": "\u203c CVE-2020-11851 \u203c\n\nArbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in the execution of arbitrary code.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-17T07:38:21.000000Z"}, {"uuid": "dcef7434-9070-450f-bb8e-6260b0f24602", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "https://t.me/cibsecurity/15619", "content": "\u203c CVE-2020-11854 \u203c\n\nArbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-27T19:31:08.000000Z"}, {"uuid": "25f5fc6a-09f7-4d35-97f1-c807d961a6f8", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e67f727e-fec1-43be-b400-b595e1da20f6", "content": "", "creation_timestamp": "2026-06-19T12:45:40.004935Z"}, {"uuid": "fd444f57-3910-4372-9ea5-e4aa8efec646", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f67bab2a-b0aa-43c1-9134-3b35553bc15a", "content": "", "creation_timestamp": "2026-06-23T14:03:07.563772Z"}, {"uuid": "d7635b22-3638-4067-a103-e58d5452374a", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-11854", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fe01a997-e2ab-4e36-b043-b2b1e7b01f78", "content": "", "creation_timestamp": "2026-06-30T09:23:38.961850Z"}, {"uuid": "421d3515-f7b1-4111-a489-26fce0b50ca6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-31)", "content": "", "creation_timestamp": "2026-09-01T10:15:09.711133Z"}, {"uuid": "8f88bad3-b331-4e37-a46e-eef31dd336da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11857", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/microfocus_obr_shrboadmin.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module abuses a known default password on Micro Focus Operations Bridge Reporter.\\n          The 'shrboadmin' user, installed by default by the product has the password of 'shrboadmin',\\n          and allows an attacker to login to the server via SSH.\\n          This module has been tested with Micro Focus Operations Bridge Manager 10.40. Earlier\\n          versions are most likely affected too.\\n          Note that this is only exploitable in Linux installations.\", \"disclosure_date\": \"2020-09-21\", \"fullname\": \"exploit/linux/ssh/microfocus_obr_shrboadmin\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"Micro Focus Operations Bridge Reporter shrboadmin default password\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/ssh/microfocus_obr_shrboadmin.rb\", \"platform\": \"Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/ssh/microfocus_obr_shrboadmin\", \"references\": [\"CVE-2020-11857\", \"ZDI-20-1215\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md\", \"URL-https://softwaresupport.softwaregrp.com/doc/KM03710590\"], \"rport\": 22, \"session_types\": false, \"targets\": [\"Micro Focus Operations Bridge Reporter (Linux) versions <= 10.40\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:24.246517Z"}, {"uuid": "92283a89-f07b-4cc5-b119-43e9d2f508fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11853", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits two vulnerabilities, that when chained allow an attacker\\n          to achieve unauthenticated remote code execution in Micro Focus UCMDB.\\n          UCMDB included in versions 2020.05 and below of Operations Bridge Manager are affected,\\n          but this module can probably also be used to exploit Operations Bridge Manager\\n          (containerized) and Application Performance Management.\\n          Check the advisory and module documentation for details.\\n          The first vulnerability is a hardcoded password for the \\\"diagnostics\\\" user, which\\n          allows us to login to UCMDB. The second vulnerability is a run-of-the-mill Java\\n          deserialization, which can be exploited with ysoserial's CommonsBeanutils1 payload.\\n          Both Windows and Linux installations are vulnerable.\", \"disclosure_date\": \"2020-10-28\", \"fullname\": \"exploit/multi/http/microfocus_ucmdb_unauth_deser\", \"is_install_path\": true, \"mod_time\": \"2026-07-25 19:22:12 +0000\", \"name\": \"Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb\", \"platform\": \"Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/microfocus_ucmdb_unauth_deser\", \"references\": [\"URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md\", \"CVE-2020-11853\", \"CVE-2020-11854\", \"ZDI-20-1287\", \"ZDI-20-1288\"], \"rport\": 8443, \"session_types\": false, \"targets\": [\"Windows\", \"Linux\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:02.623174Z"}, {"uuid": "083b228c-1e06-46d5-bd7a-1c605fa973e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11854", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits two vulnerabilities, that when chained allow an attacker\\n          to achieve unauthenticated remote code execution in Micro Focus UCMDB.\\n          UCMDB included in versions 2020.05 and below of Operations Bridge Manager are affected,\\n          but this module can probably also be used to exploit Operations Bridge Manager\\n          (containerized) and Application Performance Management.\\n          Check the advisory and module documentation for details.\\n          The first vulnerability is a hardcoded password for the \\\"diagnostics\\\" user, which\\n          allows us to login to UCMDB. The second vulnerability is a run-of-the-mill Java\\n          deserialization, which can be exploited with ysoserial's CommonsBeanutils1 payload.\\n          Both Windows and Linux installations are vulnerable.\", \"disclosure_date\": \"2020-10-28\", \"fullname\": \"exploit/multi/http/microfocus_ucmdb_unauth_deser\", \"is_install_path\": true, \"mod_time\": \"2026-07-25 19:22:12 +0000\", \"name\": \"Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb\", \"platform\": \"Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/microfocus_ucmdb_unauth_deser\", \"references\": [\"URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md\", \"CVE-2020-11853\", \"CVE-2020-11854\", \"ZDI-20-1287\", \"ZDI-20-1288\"], \"rport\": 8443, \"session_types\": false, \"targets\": [\"Windows\", \"Linux\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:02.705877Z"}, {"uuid": "7443f116-f8fb-4274-8c68-7b612b52a0c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11853", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_obm_auth_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authenticated Java deserialization that affects a truckload of Micro\\n          Focus products: Operations Bridge Manager, Application Performance Management, Data Center Automation,\\n          Universal CMDB, Hybrid Cloud Management and Service Management Automation. However this module\\n          was only tested on Operations Bridge Manager.\\n          Exploiting this vulnerability will result in remote code execution as the root user on Linux or\\n          the SYSTEM user on Windows.\\n          Authentication is required, the module user needs to login to the application and obtain the\\n          authenticated LWSSO_COOKIE_KEY, which should be fed to the module. Any authenticated user can\\n          exploit this vulnerability, even the lowest privileged ones.\\n          For more information refer to the advisory link below.\", \"disclosure_date\": \"2020-10-28\", \"fullname\": \"exploit/multi/http/microfocus_obm_auth_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"Micro Focus Operations Bridge Manager Authenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/microfocus_obm_auth_rce.rb\", \"platform\": \"Java\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/microfocus_obm_auth_rce\", \"references\": [\"URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md\", \"CVE-2020-11853\", \"ZDI-20-1327\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Micro Focus Operations Bridge Manager <= 2020.05 (and many other MF products)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:02.535817Z"}, {"uuid": "cc39b758-e341-4544-a000-ab5f2572bc9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11855", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/microfocus_operations_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits an incorrectly permissioned folder in Micro Focus Operations Bridge\\n          Manager and Operations Bridge Reporter.\\n          An unprivileged user (such as Guest) can drop a JSP file in an exploded WAR directory and\\n          then access it without authentication by making a request to the OBM / OBR server.\\n          This will result in automatic code execution as SYSTEM. This module has been tested on\\n          OBM 2020.05 and OBR 10.40, but it should work out of the box on earlier versions too.\\n          Note that it is only exploitable on Windows installations.\", \"disclosure_date\": \"2020-10-28\", \"fullname\": \"exploit/windows/local/microfocus_operations_privesc\", \"is_install_path\": true, \"mod_time\": \"2023-02-10 18:04:31 +0000\", \"name\": \"Micro Focus Operations Bridge Manager / Reporter Local Privilege Escalation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/local/microfocus_operations_privesc.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/local/microfocus_operations_privesc\", \"references\": [\"URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md\", \"CVE-2020-11858\", \"CVE-2020-11855\", \"ZDI-20-1326\", \"ZDI-20-1217\"], \"rport\": 443, \"session_types\": [\"meterpreter\"], \"targets\": [\"Micro Focus Operations Bridge Manager (Windows) <= 2020.05\", \"Micro Focus Operations Bridge Reporter (Windows) <= 10.40\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:10.198407Z"}, {"uuid": "d4a45a3a-305c-4ac6-bf92-dfc4ea8732ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11858", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/microfocus_operations_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits an incorrectly permissioned folder in Micro Focus Operations Bridge\\n          Manager and Operations Bridge Reporter.\\n          An unprivileged user (such as Guest) can drop a JSP file in an exploded WAR directory and\\n          then access it without authentication by making a request to the OBM / OBR server.\\n          This will result in automatic code execution as SYSTEM. This module has been tested on\\n          OBM 2020.05 and OBR 10.40, but it should work out of the box on earlier versions too.\\n          Note that it is only exploitable on Windows installations.\", \"disclosure_date\": \"2020-10-28\", \"fullname\": \"exploit/windows/local/microfocus_operations_privesc\", \"is_install_path\": true, \"mod_time\": \"2023-02-10 18:04:31 +0000\", \"name\": \"Micro Focus Operations Bridge Manager / Reporter Local Privilege Escalation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/local/microfocus_operations_privesc.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/local/microfocus_operations_privesc\", \"references\": [\"URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md\", \"CVE-2020-11858\", \"CVE-2020-11855\", \"ZDI-20-1326\", \"ZDI-20-1217\"], \"rport\": 443, \"session_types\": [\"meterpreter\"], \"targets\": [\"Micro Focus Operations Bridge Manager (Windows) <= 2020.05\", \"Micro Focus Operations Bridge Reporter (Windows) <= 10.40\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:10.292675Z"}]}