deardaniel/secdata-raw huggingface dataset:
Metasploit Module: FlipViewer FViewerLoading ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ebook_flipviewer_fviewerloading.rb
Platform: win
Disclosure date: 2007-06-06
References: CVE-2007-2919, OSVDB-37042, BID-24328

Description:
This module exploits a stack buffer overflow in E-BOOK Systems FlipViewer 4.0.
          The vulnerability is caused due to a boundary error in the
          FViewerLoading (FlipViewerX.dll) ActiveX control when handling the
          "LoadOpf()" method.
Metasploit Module: Symantec Altiris Deployment Solution ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/symantec_altirisdeployment_runcmd.rb
Platform: win
Disclosure date: 2009-11-04
References: CVE-2009-3033, BID-37092, OSVDB-60496

Description:
This module exploits a stack buffer overflow in Symantec Altiris Deployment Solution.
          When sending an overly long string to RunCmd() method of
          AeXNSConsoleUtilities.dll (6.0.0.1426) an attacker may be able to execute arbitrary
          code.
Metasploit Module: MS10-022 Microsoft Internet Explorer Winhlp32.exe MsgBox Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb
Platform: win
Disclosure date: 2010-02-26
References: CVE-2010-0483, OSVDB-62632, MSB-MS10-022, URL-https://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx, URL-https://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt

Description:
This module exploits a code execution vulnerability that occurs when a user
          presses F1 on MessageBox originated from VBscript within a web page. When the
          user hits F1, the MessageBox help functionality will attempt to load and use
          a HLP file from an SMB or WebDAV (if the WebDAV redirector is enabled) server.

          This particular version of the exploit implements a WebDAV server that will
          serve HLP file as well as a payload EXE. During testing warnings about the
          payload EXE being unsigned were witnessed. A future version of this module
          might use other methods that do not create such a warning.
Metasploit Module: Norton AntiSpam 2004 SymSpamHelper ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/nis2004_antispam.rb
Platform: win
Disclosure date: 2004-03-19
References: CVE-2004-0363, OSVDB-6249, BID-9916

Description:
This module exploits a stack buffer overflow in Norton AntiSpam 2004. When
          sending an overly long string to the LaunchCustomRuleWizard() method
          of symspam.dll (2004.1.0.147) an attacker may be able to execute
          arbitrary code.
Metasploit Module: CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ca_brightstor_addcolumn.rb
Platform: win
Disclosure date: 2008-03-16
References: CVE-2008-1472, OSVDB-43214

Description:
The CA BrightStor ARCserve Backup ActiveX control (ListCtrl.ocx) is vulnerable to a stack-based
          buffer overflow. By passing an overly long argument to the AddColumn() method, a remote attacker
          could overflow a buffer and execute arbitrary code on the system.
Metasploit Module: IBM Lotus iNotes dwa85W ActiveX Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/inotes_dwa85w_bof.rb
Platform: win
Disclosure date: 2012-06-01
References: CVE-2012-2175, OSVDB-82755, BID-53879, ZDI-12-132, URL-http://www-304.ibm.com/support/docview.wss?uid=swg21596862

Description:
This module exploits a buffer overflow vulnerability on the UploadControl
          ActiveX. The vulnerability exists in the handling of the "Attachment_Times"
          property, due to the insecure usage of the _swscanf. The affected ActiveX is
          provided by the dwa85W.dll installed with the IBM Lotus iNotes ActiveX installer.

          This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7,
          using the dwa85W.dll 85.3.3.0 as installed with Lotus Domino 8.5.3.

          In order to bypass ASLR the no aslr compatible module dwabho.dll is used. This one
          is installed with the iNotes ActiveX.
Metasploit Module: Symantec ConsoleUtilities ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/symantec_consoleutilities_browseandsavefile.rb
Platform: win
Disclosure date: 2009-11-02
References: CVE-2009-3031, OSVDB-59597, BID-36698, URL-http://sotiriu.de/adv/NSOADV-2009-001.txt, URL-http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091102_00

Description:
This module exploits a stack buffer overflow in Symantecs ConsoleUtilities.
          By sending an overly long string to the "BrowseAndSaveFile()" method located
          in the AeXNSConsoleUtilities.dll (6.0.0.1846) Control, an attacker may be able to
          execute arbitrary code
Metasploit Module: MS13-059 Microsoft Internet Explorer CFlatMarkupPointer Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb
Platform: win
Disclosure date: 2013-06-27
References: CVE-2013-3184, OSVDB-96182, MSB-MS13-059, BID-61668, ZDI-13-194, ZDI-13-195

Description:
This is a memory corruption bug found in Microsoft Internet Explorer. On IE 9,
          it seems to only affect certain releases of mshtml.dll, ranging from a newly
          installed IE9 (9.0.8112.16446), to 9.00.8112.16502 (July 2013 update). IE8
          requires a different way to trigger the vulnerability, but not currently covered
          by this module.

          The issue is specific to the browser's IE7 document compatibility, which can be
          defined in X-UA-Compatible, and the content editable mode must be enabled. An
          "onmove" event handler is also necessary to be able to trigger the bug, and the
          event will be run twice before the crash. The first time is due to the position
          change of the body element, which is also when a MSHTML!CFlatMarkupPointer::`vftable'
          object is created during a "SelectAll" command, and this object will be used later
          on for the crash. The second onmove event seems to be triggered by a InsertButton
          (or Insert-whatever) command, which is also responsible for the free of object
          CFlatMarkupPointer during page rendering. The EnsureRecalcNotify() function will
          then still return an invalid reference to CFlatMarkupPointer (stored in EBX), and
          then passes this on to the next functions (GetLineInfo -> QIClassID).  When this
          reference arrives in function QIClassID, an access violation finally occurs when
          the function is trying to call QueryInterface() with the bad reference, and this
          results a crash. Successful control of the freed memory may leverage arbitrary code
          execution under the context of the user.

          Note: It is also possible to see a different object being freed and used, doesn't
          always have to be CFlatMarkupPointer.
Metasploit Module: Black Ice Cover Page ActiveX Control Arbitrary File Download
Type: exploit
Path: modules/exploits/windows/browser/blackice_downloadimagefileurl.rb
Platform: win
Disclosure date: 2008-06-05
References: CVE-2008-2683, OSVDB-46007, BID-29577, EDB-5750

Description:
This module allows remote attackers to place arbitrary files on a users file system
          by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX
          Control (BIImgFrm.ocx 12.0.0.0).  Code execution can be achieved by first uploading the
          payload to the remote machine, and then upload another mof file, which enables Windows
          Management Instrumentation service to execute the binary. Please note that this module
          currently only works for Windows before Vista.  Also, a similar issue is reported in
          BIDIB.ocx (10.9.3.0) within the Barcode SDK.
Metasploit Module: MS09-002 Microsoft Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/ms09_002_memory_corruption.rb
Platform: win
Disclosure date: 2009-02-10
References: CVE-2009-0075, OSVDB-51839, MSB-MS09-002

Description:
This module exploits an error related to the CFunctionPointer function when attempting
          to access uninitialized memory. A remote attacker could exploit this vulnerability to
          corrupt memory and execute arbitrary code on the system with the privileges of the victim.
Metasploit Module: Adobe Shockwave rcsL Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb
Platform: win
Disclosure date: 2010-10-21
References: CVE-2010-3653, OSVDB-68803, URL-http://www.adobe.com/support/security/bulletins/apsb10-25.html

Description:
This module exploits a weakness in the Adobe Shockwave player's handling of
          Director movies (.DIR). A memory corruption vulnerability occurs through an undocumented
          rcsL chunk.
Metasploit Module: Exodus Wallet (ElectronJS Framework) remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/exodus.rb
Platform: win
Disclosure date: 2018-01-25
References: EDB-43899, BID-102796, CVE-2[PII_REDACTED]
Targets: PSH (Binary)

Description:
This module exploits a Remote Code Execution vulnerability in Exodus Wallet,
          a vulnerability in the ElectronJS Framework protocol handler can be used to
          get arbitrary command execution if the user clicks on a specially crafted URL.
Metasploit Module: Internet Explorer 11 VBScript Engine Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/ms16_051_vbscript.rb
Platform: win
Disclosure date: 2016-05-10
References: CVE-2016-0189, MSB-MS16-051

Description:
This module exploits the memory corruption vulnerability (CVE-2016-0189)
          present in the VBScript engine of Internet Explorer 11.
Metasploit Module: MS13-038 Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/ie_cgenericelement_uaf.rb
Platform: win
Disclosure date: 2013-05-03
References: CVE-2013-1347, OSVDB-92993, MSB-MS13-038, US-CERT-VU-237655, URL-http://blogs.technet.com/b/msrc/archive/2013/05/03/microsoft-releases-security-advisory-2847140.aspx, URL-http://r-7.co/IE8-DOL

Description:
This module exploits a vulnerability found in Microsoft Internet Explorer. A
          use-after-free condition occurs when a CGenericElement object is freed, but a
          reference is kept on the Document and used again during rendering, an invalid
          memory that's controllable is used, and allows arbitrary code execution under the
          context of the user.

          Please note: This vulnerability has been exploited in the wild on 2013 May, in
          the compromise of the Department of Labor (DoL) Website.
Metasploit Module: WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/webex_ucf_newobject.rb
Platform: win
Disclosure date: 2008-08-06
References: CVE-2008-3558, OSVDB-47344, BID-30578, EDB-6220, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=849, URL-http://www.trapkit.de/advisories/TKADV2008-009.txt, URL-http://tk-blog.blogspot.com/2008/09/vulnerability-rediscovery-xss-and-webex.html, URL-http://archives.neohapsis.com/archives/fulldisclosure/2008-08/0084.html, URL-http://www.cisco.com/en/US/products/products_security_advisory09186a00809e2006.shtml

Description:
This module exploits a stack-based buffer overflow in WebEx's WebexUCFObject
          ActiveX Control. If a long string is passed to the 'NewObject' method, a stack-
          based buffer overflow will occur when copying attacker-supplied data using the
          sprintf function.

          It is noteworthy that this vulnerability was discovered and reported by multiple
          independent researchers. To quote iDefense's advisory, "Before this issue was
          publicly reported, at least three independent security researchers had knowledge
          of this issue; thus, it is reasonable to believe that even more people were aware
          of this issue before disclosure."

          NOTE: Due to input restrictions, this exploit uses a heap-spray to get the payload
          into memory unmodified.
Metasploit Module: MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow
Type: exploit
Path: modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb
Platform: win
Disclosure date: 2010-04-13
References: CVE-2010-0480, OSVDB-63749, BID-39303, MSB-MS10-026, URL-http://web.archive.org/web/[PII_REDACTED]5030/http://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-overflow/, URL-http://www.phreedom.org/research/bypassing-browser-memory-protections/

Description:
This module exploits a buffer overflow in l3codecx.ax while processing a
          AVI files with MPEG Layer-3 audio contents. The overflow only allows to overwrite
          with 0's so the three least significant bytes of EIP saved on stack are
          overwritten and shellcode is mapped using the .NET DLL memory technique pioneered
          by Alexander Sotirov and Mark Dowd.

          Please note on IE 8 targets, your malicious URL must be a trusted site in order
          to load the .Net control.
Metasploit Module: Autodesk IDrop ActiveX Control Heap Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/autodesk_idrop.rb
Platform: win
Disclosure date: 2009-04-02
References: OSVDB-53265, BID-34352, EDB-8560, URL-http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4736

Description:
This module exploits a heap-based memory corruption vulnerability in
          Autodesk IDrop ActiveX control (IDrop.ocx) version 17.1.51.160.
          An attacker can execute arbitrary code by triggering a heap use after
          free condition using the Src, Background, PackageXml properties.
Metasploit Module: Samsung Security Manager 1.4 ActiveMQ Broker Service PUT Method Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/samsung_security_manager_put.rb
Platform: win
Disclosure date: 2016-08-05
References: URL-http://www.zerodayinitiative.com/advisories/ZDI-15-156/, URL-http://www.zerodayinitiative.com/advisories/ZDI-16-481/

Description:
This is an exploit against Samsung Security Manager that bypasses the patch in ZDI-15-156 & ZDI-16-481
          by exploiting the vulnerability against the client-side. This exploit has been tested successfully using
          IE, FireFox and Chrome by abusing a GET request XSS to bypass CORS and reach the vulnerable PUT. Finally
          a traversal is used in the PUT request to upload the code just where we want it and gain RCE as SYSTEM.
Metasploit Module: Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ea_checkrequirements.rb
Platform: win
Disclosure date: 2007-10-08
References: CVE-2007-4466, OSVDB-37723

Description:
This module exploits a stack buffer overflow in Electronic Arts SnoopyCtrl
          ActiveX Control (NPSnpy.dll 1.1.0.36. When sending an overly long
          string to the CheckRequirements() method, an attacker may be able
          to execute arbitrary code.
Metasploit Module: Novell iPrint Client ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/novelliprint_getdriversettings.rb
Platform: win
Disclosure date: 2008-06-16
References: CVE-2008-2908, OSVDB-46194, URL-http://web.archive.org/web/[PII_REDACTED]0916/http://secunia.com:80/advisories/30709/

Description:
This module exploits a stack buffer overflow in Novell iPrint Client 4.34. When
          sending an overly long string to the GetDriverSettings() property of ienipp.ocx
          an attacker may be able to execute arbitrary code.
Metasploit Module: Adobe Flash Player Regular Expression Heap Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_regex_value.rb
Platform: win
Disclosure date: 2013-02-08
References: CVE-2013-0634, OSVDB-89936, BID-57787, URL-http://malwaremustdie.blogspot.ru/2013/02/cve-2013-0634-this-ladyboyle-is-not.html, URL-http://malware.dontneedcoffee.com/2013/03/cve-2013-0634-adobe-flash-player.html, URL-http://www.fireeye.com/blog/technical/cyber-exploits/2013/02/lady-boyle-comes-to-town-with-a-new-exploit.html, URL-http://labs.alienvault.com/labs/index.php/2013/adobe-patches-two-vulnerabilities-being-exploited-in-the-wild/, URL-http://eromang.zataz.com/tag/cve-2013-0634/

Description:
This module exploits a vulnerability found in the ActiveX component of Adobe
          Flash Player before 11.5.502.149. By supplying a specially crafted swf file
          with special regex value, it is possible to trigger a memory corruption, which
          results in remote code execution under the context of the user, as exploited in
          the wild in February 2013. This module has been tested successfully with Adobe
          Flash Player 11.5 before 11.5.502.149 on Windows XP SP3 and Windows 7 SP1 before
          MS13-063, since it takes advantage of a predictable SharedUserData in order to
          leak ntdll and bypass ASLR.
Metasploit Module: Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_sps.rb
Platform: win
Disclosure date: 2011-08-09
References: CVE-2011-2140, OSVDB-74439, BID-49083, ZDI-11-276, URL-http://www.kahusecurity.com/2011/cve-2011-2140-caught-in-the-wild/, URL-http://www.adobe.com/support/security/bulletins/apsb11-21.html, URL-http://web.archive.org/web/[PII_REDACTED]2134/http://0x1byte.blogspot.com:80/2011/11/analysis-of-cve-2011-2140-adobe-flash.html

Description:
This module exploits a vulnerability found in Adobe Flash Player's Flash10u.ocx
          component.  When processing a MP4 file (specifically the Sequence Parameter Set),
          Flash will see if pic_order_cnt_type is equal to 1, which sets the
          num_ref_frames_in_pic_order_cnt_cycle field, and then blindly copies data in
          offset_for_ref_frame on the stack, which allows arbitrary remote code execution
          under the context of the user.  Numerous reports also indicate that this
          vulnerability has been exploited in the wild.
Metasploit Module: MS13-055 Microsoft Internet Explorer CAnchorElement Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms13_055_canchor.rb
Platform: win
Disclosure date: 2013-07-09
References: CVE-2013-3163, OSVDB-94981, MSB-MS13-055, URL-https://speakerd.s3.amazonaws.com/presentations/0df98910d26c0130e8927e81ab71b214/for-share.pdf

Description:
In IE8 standards mode, it's possible to cause a use-after-free condition by first
          creating an illogical table tree, where a CPhraseElement comes after CTableRow,
          with the final node being a sub table element. When the CPhraseElement's outer
          content is reset by using either outerText or outerHTML through an event handler,
          this triggers a free of its child element (in this case, a CAnchorElement, but
          some other objects apply too), but a reference is still kept in function
          SRunPointer::SpanQualifier. This function will then pass on the invalid reference
          to the next functions, eventually used in mshtml!CElement::Doc when it's trying to
          make a call to the object's SecurityContext virtual function at offset +0x70, which
          results a crash. An attacker can take advantage of this by first creating an
          CAnchorElement object, let it free, and then replace the freed memory with another
          fake object. Successfully doing so may allow arbitrary code execution under the
          context of the user.

          This bug is specific to Internet Explorer 8 only. It was originally discovered by
          Jose Antonio Vazquez Gonzalez and reported to iDefense, but was discovered again
          by Orange Tsai at Hitcon 2013.
Metasploit Module: SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/sonicwall_addrouteentry.rb
Platform: win
Disclosure date: 2007-11-01
References: CVE-2007-5603, OSVDB-39069, URL-http://www.sec-consult.com/303.html

Description:
This module exploits a stack buffer overflow in SonicWall SSL-VPN NetExtender.
          By sending an overly long string to the "AddRouteEntry()" method located
          in the NELaunchX.dll (1.0.0.26) Control, an attacker may be able to execute
          arbitrary code.
Metasploit Module: Symantec BackupExec Calendar Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/symantec_backupexec_pvcalendar.rb
Platform: win
Disclosure date: 2008-02-28
References: CVE-2007-6016, OSVDB-42358, BID-26904, URL-http://web.archive.org/web/[PII_REDACTED]2347/http://secunia.com:80/advisories/27885/

Description:
This module exploits a stack buffer overflow in Symantec BackupExec Calendar Control.
          By sending an overly long string to the "_DOWText0" property located
          in the pvcalendar.ocx control, an attacker may be able to execute
          arbitrary code.
Metasploit Module: MS12-004 midiOutPlayNextPolyEvent Heap Overflow
Type: exploit
Path: modules/exploits/windows/browser/ms12_004_midi.rb
Platform: win
Disclosure date: 2012-01-10
References: MSB-MS12-004, CVE-2012-0003, OSVDB-78210, BID-51292

Description:
This module exploits a heap overflow vulnerability in the Windows Multimedia
          Library (winmm.dll). The vulnerability occurs when parsing specially crafted
          MIDI files.  Remote code execution can be achieved by using the Windows Media Player
          ActiveX control.

          Exploitation is done by supplying a specially crafted MIDI file with
          specific events, causing the offset calculation being higher than what is
          available on the heap (0x400 allocated by WINMM!winmmAlloc), and then allowing
          us to either "inc al" or "dec al" a byte.  This can be used to corrupt an array
          (CImplAry) we setup, and force the browser to confuse types from tagVARIANT objects,
          which leverages remote code execution under the context of the user.

          Note: At this time, for IE 8 target, msvcrt ROP is used by default. However,
          if you know your target's patch level, you may also try the 'MSHTML' advanced
          option for an info leak based attack.  Currently, this module only supports two
          MSHTML builds: 8.0.6001.18702, which is often seen in a newly installed XP SP3.
          Or 8.0.6001.19120, which is patch level before the MS12-004 fix.

          Also, based on our testing, the vulnerability does not seem to trigger when
          the victim machine is operated via rdesktop.
Metasploit Module: MS06-055 Microsoft Internet Explorer VML Fill Method Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ms06_055_vml_method.rb
Platform: win
Disclosure date: 2006-09-19
References: CVE-2006-4868, OSVDB-28946, MSB-MS06-055, BID-20096

Description:
This module exploits a code execution vulnerability in Microsoft Internet Explorer using
          a buffer overflow in the VML processing code (VGX.dll). This module has been tested on
          Windows 2000 SP4, Windows XP SP0, and Windows XP SP2.