deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MS08-078 Microsoft Internet Explorer Data Binding Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/ms08_078_xml_corruption.rb
Platform: win
Disclosure date: 2008-12-07
References: CVE-2008-4844, OSVDB-50622, BID-32721, MSB-MS08-078, URL-https://web.archive.org/web/[PII_REDACTED]4223/http://taossa.com/archive/bh08sotirovdowd.pdf

Description:
This module exploits a vulnerability in the data binding feature of Internet
          Explorer. In order to execute code reliably, this module uses the .NET DLL
          memory technique pioneered by Alexander Sotirov and Mark Dowd. This method is
          used to create a fake vtable at a known location with all methods pointing
          to our payload. Since the .text segment of the .NET DLL is non-writable, a
          prefixed code stub is used to copy the payload into a new memory segment and
          continue execution from there.
Metasploit Module: MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access
Type: exploit
Path: modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb
Platform: win
Disclosure date: 2013-03-12
References: CVE-2013-0074, CVE-2013-3896, OSVDB-91147, OSVDB-98223, BID-58327, BID-62793, MSB-MS13-022, MSB-MS13-087

Description:
This module exploits a vulnerability in Microsoft Silverlight. The vulnerability exists on
          the Initialize() method from System.Windows.Browser.ScriptObject, which access memory in an
          unsafe manner. Since it is accessible for untrusted code (user controlled) it's possible
          to dereference arbitrary memory which easily leverages to arbitrary code execution. In order
          to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class
          from System.Windows.dll. This module has been tested successfully on IE6 - IE10, Windows XP
          SP3 / Windows 7 SP1.
Metasploit Module: Novell GroupWise Client gwcls1.dll ActiveX Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/novell_groupwise_gwcls1_actvx.rb
Platform: win
Disclosure date: 2013-01-30
References: CVE-2012-0439, OSVDB-89700, BID-57658, ZDI-13-008, URL-http://www.novell.com/support/kb/doc.php?id=7011688

Description:
This module exploits a vulnerability in the Novell GroupWise Client gwcls1.dll
          ActiveX. Several methods in the GWCalServer control use user provided data as
          a pointer, which allows to read arbitrary memory and execute arbitrary code. This
          module has been tested successfully with GroupWise Client 2012 on IE6 - IE9. The
          JRE6 needs to be installed to achieve ASLR bypass.
Metasploit Module: Adobe Collab.getIcon() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_geticon.rb
Platform: win
Disclosure date: 2009-03-24
References: CVE-2009-0927, OSVDB-53647, ZDI-09-014, URL-http://www.adobe.com/support/security/bulletins/apsb09-04.html

Description:
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat.
          Affected versions include < 7.1.1, < 8.1.3, and < 9.1. By creating a specially
          crafted pdf that a contains malformed Collab.getIcon() call, an attacker may
          be able to execute arbitrary code.
Metasploit Module: Kazaa Altnet Download Manager ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/kazaa_altnet_heap.rb
Platform: win
Disclosure date: 2007-10-03
References: CVE-2007-5217, OSVDB-37785, URL-http://web.archive.org/web/[PII_REDACTED]1150/http://secunia.com:80/advisories/26970

Description:
This module exploits a stack buffer overflow in the Altnet Download Manager ActiveX
          Control (amd4.dll) bundled with Kazaa Media Desktop 3.2.7.
          By sending an overly long string to the "Install()" method, an attacker may be
          able to execute arbitrary code.
Metasploit Module: Siemens Solid Edge ST4 SEListCtrlX ActiveX Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb
Platform: win
Disclosure date: 2013-05-26
References: OSVDB-93696, EDB-25712

Description:
This module exploits the SEListCtrlX ActiveX installed with the Siemens Solid Edge product.
          The vulnerability exists on several APIs provided by the control, where user supplied input
          is handled as a memory pointer without proper validation, allowing an attacker to read and
          corrupt memory from the target process. This module abuses the methods NumChildren() and
          DeleteItem() in order to achieve memory info leak and remote code execution respectively.
          This module has been tested successfully on IE6-IE9 on Windows XP SP3 and Windows 7 SP1,
          using Solid Edge 10.4.
Metasploit Module: MS13-080 Microsoft Internet Explorer CDisplayPointer Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms13_080_cdisplaypointer.rb
Platform: win
Disclosure date: 2013-10-08
References: CVE-2013-3897, OSVDB-98207, MSB-MS13-080, URL-http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx, URL-http://jsunpack.jeek.org/?report=847afb154a4e876d61f93404842d9a1b93a774fb

Description:
This module exploits a vulnerability found in Microsoft Internet Explorer. It was originally
          found being exploited in the wild targeting Japanese and Korean IE8 users on Windows XP,
          around the same time frame as CVE-2013-3893, except this was kept out of the public eye by
          multiple research companies and the vendor until the October patch release.

          This issue is a use-after-free vulnerability in CDisplayPointer via the use of a
          "onpropertychange" event handler. To set up the appropriate buggy conditions, we first craft
          the DOM tree in a specific order, where a CBlockElement comes after the CTextArea element.
          If we use a select() function for the CTextArea element, two important things will happen:
          a CDisplayPointer object will be created for CTextArea, and it will also trigger another
          event called "onselect". The "onselect" event will allow us to set up for the actual event
          handler we want to abuse - the "onpropertychange" event. Since the CBlockElement is a child
          of CTextArea, if we do a node swap of CBlockElement in "onselect", this will trigger
          "onpropertychange".  During "onpropertychange" event handling, a free of the CDisplayPointer
          object can be forced by using an "Unselect" (other approaches also apply), but a reference
          of this freed memory will still be kept by CDoc::ScrollPointerIntoView, specifically after
          the CDoc::GetLineInfo call, because it is still trying to use that to update
          CDisplayPointer's position. When this invalid reference arrives in QIClassID, a crash
          finally occurs due to accessing the freed memory. By controlling this freed memory, it is
          possible to achieve arbitrary code execution under the context of the user.
Metasploit Module: X360 VideoPlayer ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/x360_video_player_set_text_bof.rb
Platform: win
Disclosure date: 2015-01-30
References: CVE-2025-34128, EDB-35948, URL-https://rh0dev.github.io/blog/2015/fun-with-info-leaks/

Description:
This module exploits a buffer overflow in the VideoPlayer.ocx ActiveX installed with the
          X360 Software. By setting an overly long value to 'ConvertFile()', an attacker can overrun
          a .data buffer to bypass ASLR/DEP and finally execute arbitrary code.
Metasploit Module: Ubisoft uplay 2.0.3 ActiveX Control Arbitrary Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb
Platform: win
Disclosure date: 2012-07-29
References: CVE-2012-4177, OSVDB-84402, URL-https://seclists.org/fulldisclosure/2012/Jul/375, URL-http://forums.ubi.com/showthread.php/699940-Uplay-PC-Patch-2-0-4-Security-fix

Description:
The uplay ActiveX component allows an attacker to execute any command line action.
          User must sign in, unless auto-sign in is enabled and uplay must not already be
          running.  Due to the way the malicious executable is served (WebDAV), the module
          must be run on port 80, so please make sure you have enough privilege to do that.
          Ubisoft released patch 2.04 as of Mon 20th July.
Metasploit Module: Mozilla Firefox "nsTreeRange" Dangling Pointer Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/mozilla_nstreerange.rb
Platform: win
Disclosure date: 2011-02-02
References: CVE-2011-0073, OSVDB-72087, BID-47663, ZDI-11-157, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=630919, URL-http://www.mozilla.org/security/announce/2011/mfsa2011-13.html
Targets: Firefox Runtime, fails with ASLR, Java Runtime (7.10.3052.4), best against ASLR, Java JVM (20.1.0.02), Java Regutils (6.0.260.3)

Description:
This module exploits a code execution vulnerability in Mozilla Firefox
          3.6.x <= 3.6.16 and 3.5.x <= 3.5.17 found in nsTreeSelection.
          By overwriting a subfunction of invalidateSelection it is possible to free the
          nsTreeRange object that the function currently operates on.
          Any further operations on the freed object can result in remote code execution.
          Utilizing the call setup the function provides it's possible to bypass DEP
          without the need for a ROP. Sadly this exploit is still either dependent
          on Java or bound by ASLR because Firefox doesn't employ any ASLR-free
          modules anymore.
Metasploit Module: Orbit Downloader Connecting Log Creation Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/orbit_connecting.rb
Platform: win
Disclosure date: 2009-02-03
References: CVE-2009-0187, OSVDB-52294, BID-33894

Description:
This module exploits a stack buffer overflow in Orbit Downloader 2.8.4. When an
          attacker serves up a malicious web site, arbitrary code may be executed.
          The PAYLOAD windows/shell_bind_tcp works best.
Metasploit Module: Winamp Ultravox Streaming Metadata (in_mp3.dll) Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/winamp_ultravox.rb
Platform: win
Disclosure date: 2008-01-18
Authors: MC
References: CVE-2008-0065, OSVDB-41707, BID-27344

Description:
This module exploits a stack buffer overflow in Winamp 5.24. By
          sending an overly long artist tag, a remote attacker may
          be able to execute arbitrary code. This vulnerability can be
          exploited from the browser or the Winamp client itself.
Metasploit Module: Tom Sawyer Software GET Extension Factory Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb
Platform: win
Disclosure date: 2011-05-03
References: CVE-2011-2217, OSVDB-73211, BID-48099, URL-http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=911

Description:
This module exploits a remote code execution vulnerability in the tsgetx71ex553.dll
          ActiveX control installed with Tom Sawyer GET Extension Factory due to an incorrect
          initialization under Internet Explorer.

          While the Tom Sawyer GET Extension Factory is installed with some versions of VMware
          Infrastructure Client, this module has been tested only with the versions installed
          with Embarcadero Technologies ER/Studio XE2 / Embarcadero Studio Portal 1.6. The ActiveX
          control tested is tsgetx71ex553.dll, version 5.5.3.238.

          This module achieves DEP and ASLR bypass using the well known msvcr71.dll rop chain. The
          dll is installed by default with the Embarcadero software, and loaded by the targeted
          ActiveX.
Metasploit Module: Mozilla Firefox Array.reduceRight() Integer Overflow
Type: exploit
Path: modules/exploits/windows/browser/mozilla_reduceright.rb
Platform: win
Disclosure date: 2011-06-21
References: CVE-2011-2371, OSVDB-73184, EDB-17974, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=664009

Description:
This module exploits a vulnerability found in Mozilla Firefox 3.6. When an
          array object is configured with a large length value, the reduceRight() method
          may cause an invalid index being used, allowing arbitrary remote code execution.
          Please note that the exploit requires a longer amount of time (compare to a
          typical browser exploit) in order to gain control of the machine.
Metasploit Module: EnjoySAP SAP GUI ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/enjoysapgui_preparetoposthtml.rb
Platform: win
Disclosure date: 2007-07-05
References: CVE-2007-3605, OSVDB-37690, BID-24772

Description:
This module exploits a stack buffer overflow in SAP KWEdit ActiveX
          Control (kwedit.dll 6400.1.1.41) provided by EnjoySAP GUI. By sending
          an overly long string to the "PrepareToPostHTML()" method, an attacker
          may be able to execute arbitrary code.
Metasploit Module: MS10-002 Microsoft Internet Explorer "Aurora" Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/ms10_002_aurora.rb
Platform: win
Disclosure date: 2010-01-14
References: MSB-MS10-002, CVE-2010-0249, OSVDB-61697, URL-https://web.archive.org/web/[PII_REDACTED]3233/http://wepawet.iseclab.org/view.php?hash=1aea206aa64ebeabb07237f1e2230d0f&type=js

Description:
This module exploits a memory corruption flaw in Internet Explorer. This
          flaw was found in the wild and was a key component of the "Operation Aurora"
          attacks that lead to the compromise of a number of high profile companies. The
          exploit code is a direct port of the public sample published to the Wepawet
          malware analysis site. The technique used by this module is currently identical
          to the public sample, as such, only Internet Explorer 6 can be reliably exploited.
Metasploit Module: IBM Tivoli Provisioning Manager Express for Software Distribution Isig.isigCtl.1 ActiveX RunAndUploadFile() Method Overflow
Type: exploit
Path: modules/exploits/windows/browser/ibm_tivoli_pme_activex_bof.rb
Platform: win
Disclosure date: 2012-03-01
References: CVE-2012-0198, OSVDB-79735, BID-52252, ZDI-12-040

Description:
This module exploits a buffer overflow vulnerability in the
          Isig.isigCtl.1 ActiveX installed with IBM Tivoli Provisioning
          Manager Express for Software Distribution 4.1.1.

          The vulnerability is found in the "RunAndUploadFile" method
          where the "OtherFields" parameter with user controlled data
          is used to build a "Content-Disposition" header and attach
          contents in an insecure way which allows to overflow a buffer
          in the stack.
Metasploit Module: AwingSoft Winds3D Player 3.5 SceneURL Download and Execute
Type: exploit
Path: modules/exploits/windows/browser/awingsoft_winds3d_sceneurl.rb
Platform: win
Disclosure date: 2009-11-14
References: CVE-2009-4850, OSVDB-60049

Description:
This module exploits an untrusted program execution vulnerability within the
          Winds3D Player from AwingSoft. The Winds3D Player is a browser plugin for
          IE (ActiveX), Opera (DLL) and Firefox (XPI). By setting the 'SceneURL'
          parameter to the URL to an executable, an attacker can execute arbitrary
          code.

          Testing was conducted using plugin version 3.5.0.9 for Firefox 3.5 and
          IE 8 on Windows XP SP3.
Metasploit Module: Oracle Document Capture 10g ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/oracle_dc_submittoexpress.rb
Platform: win
Disclosure date: 2009-08-28
References: CVE-2007-4607, OSVDB-38335, BID-25467, US-CERT-VU-281977

Description:
This module exploits a stack buffer overflow in Oracle Document Capture 10g (10.1.3.5.0).
          Oracle Document Capture 10g comes bundled with a third party ActiveX control
          emsmtp.dll (6.0.1.0). When passing an overly long string to the method "SubmitToExpress"
          an attacker may be able to execute arbitrary code.
Metasploit Module: MS14-012 Microsoft Internet Explorer TextRange Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms14_012_textrange.rb
Platform: win
Disclosure date: 2014-03-11
References: CVE-2014-0307, MSB-MS14-012

Description:
This module exploits a use-after-free vulnerability found in Internet Explorer. The flaw
          was most likely introduced in 2013, therefore only certain builds of MSHTML are
          affected. In our testing with IE9, these vulnerable builds appear to be between
          9.0.8112.16496 and 9.0.8112.16533, which implies the vulnerability shipped between
          August 2013, when it was introduced, until the fix issued in early March 2014.
Metasploit Module: Macrovision InstallShield Update Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/macrovision_downloadandexecute.rb
Platform: win
Disclosure date: 2007-10-31
References: CVE-2007-5660, OSVDB-38347

Description:
This module exploits a stack buffer overflow in Macrovision InstallShield Update
          Service(Isusweb.dll 6.0.100.54472). By passing an overly long ProductCode string to
          the DownloadAndExecute method, an attacker may be able to execute arbitrary code.
Metasploit Module: Adobe Flash Player Type Confusion Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb
Platform: win
Disclosure date: 2013-12-10
References: CVE-2013-5331, OSVDB-100774, BID-64199, URL-http://helpx.adobe.com/security/products/flash-player/apsb13-28.html, URL-http://blog.malwaretracker.com/2014/01/cve-2013-5331-evaded-av-by-using.html

Description:
This module exploits a type confusion vulnerability found in the ActiveX
          component of Adobe Flash Player. This vulnerability was found exploited
          in the wild in November 2013. This module has been tested successfully
          on IE 6 to IE 10 with Flash 11.7, 11.8 and 11.9 prior to 11.9.900.170
          over Windows XP SP3 and Windows 7 SP1.
Metasploit Module: Worldweaver DX Studio Player shell.execute() Command Execution
Type: exploit
Path: modules/exploits/windows/browser/dxstudio_player_exec.rb
Platform: win
Disclosure date: 2009-06-09
References: CVE-2009-2011, BID-35273, OSVDB-54969, EDB-8922, URL-http://dxstudio.com/guide.aspx

Description:
This module exploits a command execution vulnerability within the DX
          Studio Player from Worldweaver for versions 3.0.29 and earlier. The
          player is a browser plugin for IE (ActiveX) and Firefox (dll). When an
          unsuspecting user visits a web page referring to a specially crafted
          .dxstudio document, an attacker can execute arbitrary commands.

          Testing was conducted using plugin version 3.0.29.0 for Firefox 2.0.0.20
          and IE 6 on Windows XP SP3. In IE, the user will be prompted if they
          wish to allow the plug-in to access local files. This prompt appears to
          occur only once per server host.

          NOTE: This exploit uses additionally dangerous script features to write
          to local files!
Metasploit Module: GetGo Download Manager HTTP Response Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/getgodm_http_response_bof.rb
Platform: win
Disclosure date: 2014-03-09
References: EDB-32132, OSVDB-103910, CVE-2014-2206

Description:
This module exploits a stack-based buffer overflow vulnerability in
          GetGo Download Manager version 5.3.0.2712 earlier, caused by an
          overly long HTTP response header.

          By persuading the victim to download a file from a malicious server, a
          remote attacker could execute arbitrary code on the system or cause
          the application to crash. This module has been tested successfully on
          Windows XP SP3.
Metasploit Module: Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute
Type: exploit
Path: modules/exploits/windows/browser/cisco_anyconnect_exec.rb
Platform: win
Disclosure date: 2011-06-01
References: CVE-2011-2039, OSVDB-72714, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909, URL-http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml
Targets: Automatic

Description:
This module exploits a vulnerability in the Cisco AnyConnect VPN client
          vpnweb.ocx ActiveX control. This control is typically used to install the
          VPN client. An attacker can set the 'url' property which is where the control
          tries to locate the files needed to install the client.

          The control tries to download two files from the site specified within the
          'url' property. One of these files it will be stored in a temporary directory and
          executed.
Metasploit Module: Adobe Flash Player Object Type Confusion
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_rtmp.rb
Platform: win
Disclosure date: 2012-05-04
References: CVE-2012-0779, OSVDB-81656, BID-53395, URL-http://www.adobe.com/support/security/bulletins/apsb12-09.html, URL-http://contagiodump.blogspot.com.es/2012/05/may-3-cve-2012-0779-world-uyghur.html, URL-https://www.rapid7.com/blog/post/2012/06/22/the-secret-sauce-to-cve-2012-0779-adobe-flash-object-confusion-vulnerability

Description:
This module exploits a vulnerability found in Adobe Flash
          Player.  By supplying a corrupt AMF0 "_error" response, it
          is possible to gain arbitrary remote code execution under
          the context of the user.

          This vulnerability has been exploited in the wild as part of
          the "World Uyghur Congress Invitation.doc" e-mail attack.
          According to the advisory, 10.3.183.19 and 11.x before
          11.2.202.235 are affected.
Metasploit Module: MS13-080 Microsoft Internet Explorer SetMouseCapture Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
Platform: win
Disclosure date: 2013-09-17
References: CVE-2013-3893, OSVDB-97380, MSB-MS13-080, URL-http://technet.microsoft.com/en-us/security/advisory/2887505, URL-http://blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx, URL-https://www.rapid7.com/blog/post/2013/09/30/metasploit-releases-cve-2013-3893-ie-setmousecapture-use-after-free

Description:
This module exploits a use-after-free vulnerability that currents targets Internet
          Explorer 9 on Windows 7, but the flaw should exist in versions 6/7/8/9/10/11.
          It was initially found in the wild in Japan, but other regions such as English,
          Chinese, Korean, etc, were targeted as well.

          The vulnerability is due to how the mshtml!CDoc::SetMouseCapture function handles a
          reference during an event. An attacker first can setup two elements, where the second
          is the child of the first, and then setup a onlosecapture event handler for the parent
          element. The onlosecapture event seems to require two setCapture() calls to trigger,
          one for the parent element, one for the child. When the setCapture() call for the child
          element is called, it finally triggers the event, which allows the attacker to cause an
          arbitrary memory release using document.write(), which in particular frees up a 0x54-byte
          memory.  The exact size of this memory may differ based on the version of IE. After the
          free, an invalid reference will still be kept and pass on to more functions, eventuall
          this arrives in function MSHTML!CTreeNode::GetInterface, and causes a crash (or arbitrary
          code execution) when this function attempts to use this reference to call what appears to
          be a PrivateQueryInterface due to the offset (0x00).

          To mimic the same exploit found in the wild, this module will try to use the same DLL
          from Microsoft Office 2007 or 2010 to leverage the attack.