{"metadata": {"vulnerability": "CVE-2016-9299", "count": 27, "kinds": {"milestone": 4, "sighting": 9, "kev": 0, "other": 14}}, "data": [{"timestamp": "2016-11-11T00:00:00Z", "date_only": false, "value": "2016-11-11T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / mitre", "record": "CVE-2016-9299", "field": "containers.cna.datePublic"}, {"timestamp": "2016-11-14T00:00:00Z", "date_only": false, "value": "2016-11-14T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2016-9299", "field": "cveMetadata.dateReserved"}, {"timestamp": "2016-11-15T00:00:00Z", "date_only": true, "value": "2016-11-15", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2016-11319", "record": "CNVD-2016-11319", "field": "submitTime"}, {"timestamp": "2016-11-21T00:00:00Z", "date_only": true, "value": "2016-11-21", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2016-11319", "record": "CNVD-2016-11319", "field": "openTime"}, {"timestamp": "2017-01-12T23:00:00Z", "date_only": false, "value": "2017-01-12T23:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2016-9299", "field": "cveMetadata.datePublished"}, {"timestamp": "2017-01-12T23:59:00Z", "date_only": false, "value": "2017-01-12T23:59:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2X9H-H3C4-WQQH", "record": "GHSA-2X9H-H3C4-WQQH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2017-01-12T23:59:00Z", "date_only": false, "value": "2017-01-12T23:59Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2016-9299", "record": "GSD-2016-9299", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2017-01-12T23:59:00.527Z", "date_only": false, "value": "2017-01-12T23:59:00.527", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2016-9299", "record": "FKIE_CVE-2016-9299", "field": "published"}, {"timestamp": "2018-05-17T00:00:00Z", "date_only": false, "value": "2018-05-17T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://www.exploit-db.com/exploits/44642", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "3b3ee0c8-0ce5-4526-8f49-aedb276fcba0", "url": "https://www.exploit-db.com/exploits/44642"}, {"timestamp": "2018-05-19T09:57:01Z", "date_only": false, "value": "2018-05-19T09:57:01.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2016-9299", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2018-05-29T15:50:33Z", "date_only": false, "value": "2018-05-29T15:50:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "83a9b0b4-9d8e-4074-a500-22efc5636ff5", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb"}, {"timestamp": "2019-05-22T15:06:00Z", "date_only": false, "value": "2019-05-22T15:06Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2016-9299", "record": "GSD-2016-9299", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-05-12T22:17:01Z", "date_only": false, "value": "2022-05-12T22:17:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/350", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "f07bd5ed-2700-4359-9564-6ad0519cebda", "content": "(https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui))  C1 CMS (CVE-2019-18211 (https://medium.com/@frycos/yet-another-net-deserialization-35f6ce048df7))  Jenkins (CVE-2016-9299 (https://nvd.nist.gov/vuln/detail/CVE-2016-9299))  What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability. (https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/) \u2013 @breenmachine, FoxGloveSecurity (2015)    Talks and Write-Ups    PSA: Log4Shell and the current state of JNDI injection (https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/) - Moritz Bechler (2021)  This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits (https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits) \u2013 Chris Glyer, Dan Perez, Sarah Jones, Steve Miller (2020)  Deep Dive into .NET ViewState deserialization and its exploitation (https://swapneildash.medium.com/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817) \u2013 Swapneil Dash (2019)  Exploiting  (https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)Deserialization (https://www.kitploit.com/search/label/Deserialization) in ASP.NET via ViewState \u2013 Soroush Dalili (2019)  Use of Deserialization in .NET Framework Methods and Classes (https://research.nccgroup.com/wp-content/uploads/2020/07/whitepaper-new.pdf) \u2013 Soroush Dalili(2018)  Friday the 13th, JSON Attacks (https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf) \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2017)  Exploiting .NET Managed DCOM (https://googleprojectzero.blogspot.com/2017/04/exploiting-net-managed-dcom.html) \u2013 James Forshaw, Project Zero (2017)  Java Unmarshaller Security (https://github.com/frohoff/marshalsec/blob/master/marshalsec.pdf) \u2013 Moritz Bechler (2017)  Deserialize My Shorts (https://www.slideshare.net/frohoff1/deserialize-my-shorts-or-how-i-learned-to-start-worrying-and-hate-java-object-deserialization) \u2013 Chris Frohoff (2016)  Pwning Your Java Messaging with Deserialization Vulnerabilities (https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf) \u2013 Matthias Kaiser (2016)  Journey from JNDI/LDAP  (https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf)Manipulation (https://www.kitploit.com/search/label/Manipulation) to Remote Code Execution (https://www.kitploit.com/search/label/Remote%20Code%20Execution) Dream Land \u2013 Alvaro Mu\u00f1os and Oleksandr Mirosh (2016)  Marshalling Pickles (https://www.youtube.com/watch?v=KSA7vUkXGSg) \u2013 Chris Frohoff and Gabriel Lawrence (2015)  Are you my Type? Breaking .NET Through Serialization (https://github.com/VulnerableGhost/.Net-Sterilized--Deserialization-Exploitation/blob/master/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf) \u2013 James Forshaw (2012)  A Spirited Peek into ViewState (https://deadliestwebattacks.com/2011/05/13/a-spirited-peek-into-viewstate-part-i/) \u2013 Mike Shema (2011)    \nAuthor:\u00a0Alyssa Rahman @ramen0x3fCreated:\u00a02021-10-27Last Updated:\u00a02021-12-02Blog:\u00a0https://www.mandiant.com/resources/hunting-deserialization-exploitsFor more details on this tool and the research process behind it, check out\u00a0our blog (https://www.mandiant.com/resources/hunting-deserialization-exploits)!\n\nDownload Heyserial (https://github.com/mandiant/heyserial)", "url": "https://t.me/ETHICALHACKERSCOMMUNITY2/350"}, {"timestamp": "2022-05-14T00:00:00Z", "date_only": true, "value": "2022-05-14", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2016-9299", "record": "GSD-2016-9299", "field": "namespaces.gitlab.com.advisories.0.pubdate"}, {"timestamp": "2022-05-14T01:00:43Z", "date_only": false, "value": "2022-05-14T01:00:43Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2X9H-H3C4-WQQH", "record": "GHSA-2X9H-H3C4-WQQH", "field": "published"}, {"timestamp": "2022-07-06T00:00:00Z", "date_only": true, "value": "2022-07-06", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2016-9299", "record": "GSD-2016-9299", "field": "namespaces.gitlab.com.advisories.0.date"}, {"timestamp": "2023-12-13T01:21:21.648Z", "date_only": false, "value": "2023-12-13T01:21:21.648044Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2016-9299", "record": "GSD-2016-9299", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-03-12T14:24:42Z", "date_only": false, "value": "2024-03-12T14:24:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2X9H-H3C4-WQQH", "record": "GHSA-2X9H-H3C4-WQQH", "field": "modified"}, {"timestamp": "2024-08-06T02:50:36.759Z", "date_only": false, "value": "2024-08-06T02:50:36.759Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2016-9299", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-06T02:50:36.759Z", "date_only": false, "value": "2024-08-06T02:50:36.759Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2016-9299", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-06T03:13:42Z", "date_only": false, "value": "2025-02-06T03:13:42.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "ec27180d-4776-4a3e-a5ce-ac8c01448caf"}, {"timestamp": "2025-02-23T04:09:50Z", "date_only": false, "value": "2025-02-23T04:09:50.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "14137637-e78b-47d6-ae0f-293ddab18b75"}, {"timestamp": "2026-06-17T00:55:48.190Z", "date_only": false, "value": "2026-06-17T00:55:48.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2016-9299", "record": "FKIE_CVE-2016-9299", "field": "lastModified"}, {"timestamp": "2026-09-01T20:01:40.663Z", "date_only": false, "value": "2026-09-01T20:01:40.663236Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/53237", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "557cd1df-8e04-43bf-b641-866c95060369", "url": "https://t.me/hacking_Attack/53237"}, {"timestamp": "2026-09-01T20:01:40.827Z", "date_only": false, "value": "2026-09-01T20:01:40.827349Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/53232", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "a99fd216-a0c9-4968-9929-aa50fd13f783", "url": "https://t.me/hacking_Attack/53232"}, {"timestamp": "2026-09-05T21:00:05.794Z", "date_only": false, "value": "2026-09-05T21:00:05.794171Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/53232", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "72674de4-81a8-49be-a1e7-c9a626b8d6d3", "url": "https://t.me/hacking_Attack/53232"}, {"timestamp": "2026-09-05T21:00:05.953Z", "date_only": false, "value": "2026-09-05T21:00:05.953235Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/53237", "record": "CVE-2016-9299", "field": "creation_timestamp", "uuid": "2d206436-555a-4648-9069-ccb17659ad27", "url": "https://t.me/hacking_Attack/53237"}]}