deardaniel/secdata-raw huggingface dataset:
Metasploit Module: eSignal and eSignal Pro File Parsing Buffer Overflow in QUO
Type: exploit
Path: modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb
Platform: win
Disclosure date: 2011-09-06
References: CVE-2011-3494, OSVDB-75456, BID-49600, URL-http://aluigi.altervista.org/adv/esignal_1-adv.txt, EDB-17837

Description:
The software is unable to handle the "<StyleTemplate>" files (even those
          original included in the program) like those with the registered
          extensions QUO, SUM and POR. Successful exploitation of this
          vulnerability may take up to several seconds due to the use of
          egghunter. Also, DEP bypass is unlikely due to the limited space for
          payload. This vulnerability affects versions 10.6.2425.1208 and earlier.
Metasploit Module: Microsoft Office Word MSDTJS
Type: exploit
Path: modules/exploits/windows/fileformat/word_msdtjs_rce.rb
Platform: win
Disclosure date: 2022-05-29
References: CVE-2022-30190, URL-https://www.reddit.com/r/blueteamsec/comments/v06w2o/suspected_microsoft_word_zero_day_in_the_wild/, URL-https://twitter.com/nao_sec/status/[PII_REDACTED]79401984?t=3Pjrpdog_H6OfMHVLMR5eQ&s=19, URL-https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/, URL-https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, URL-https://twitter.com/GossiTheDog/status/[PII_REDACTED]09367040, URL-https://github.com/JMousqueton/PoC-CVE-2022-30190

Description:
This module generates a malicious Microsoft Word document that when loaded, will leverage the remote template
          feature to fetch an `HTML` document and then use the `ms-msdt` scheme to execute `PowerShell` code.
Metasploit Module: SasCam Webcam Server v.2.6.5 Get() Method Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/sascam_get.rb
Platform: win
Disclosure date: 2008-12-29
References: CVE-2008-6898, OSVDB-55945, BID-33053

Description:
The SasCam Webcam Server ActiveX control is vulnerable to a buffer overflow.
          By passing an overly long argument via the Get method, a remote attacker could
          overflow a buffer and execute arbitrary code on the system with the privileges
          of the user. This control is not marked safe for scripting, please choose your
          attack vector carefully.
Metasploit Module: Audiotran PLS File Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/audiotran_pls_1424.rb
Platform: win
Disclosure date: 2010-09-09
References: CVE-2009-0476, EDB-14961

Description:
This module exploits a stack-based buffer overflow in Audiotran 1.4.2.4.
          An attacker must send the file to victim and the victim must open the file.
          Alternatively, it may be possible to execute code remotely via an embedded
          PLS file within a browser when the PLS extension is registered to Audiotran.
          This alternate vector has not been tested and cannot be exercised directly
          with this module.
Metasploit Module: WM Downloader 3.1.2.2 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/wm_downloader_m3u.rb
Platform: win
Disclosure date: 2010-07-28
References: CVE-2010-10017, OSVDB-66911, EDB-14497

Description:
This module exploits a buffer overflow in WM Downloader v3.1.2.2. When
          the application is used to import a specially crafted m3u file, a buffer overflow occurs
          allowing arbitrary code execution.
Metasploit Module: MS13-096 Microsoft Tagged Image File Format (TIFF) Integer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/mswin_tiff_overflow.rb
Platform: win
Disclosure date: 2013-11-05
References: CVE-2013-3906, MSB-MS13-096, OSVDB-99376, URL-http://technet.microsoft.com/en-us/security/advisory/2896666, URL-http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx

Description:
This module exploits a vulnerability found in Microsoft's Tagged Image File Format.
          It was originally discovered in the wild, targeting Windows XP and Windows Server 2003
          users running Microsoft Office, specifically in the Middle East and South Asia region.

          The flaw is due to a DWORD value extracted from the TIFF file that is embedded as a
          drawing in Microsoft Office, and how it gets calculated with user-controlled inputs,
          and stored in the EAX register. The 32-bit register will run out of storage space to
          represent the large value, which ends up being 0, but it still gets pushed as a
          dwBytes argument (size) for a HeapAlloc call. The HeapAlloc function will allocate a
          chunk anyway with size 0, and the address of this chunk is used as the destination buffer
          of a memcpy function, where the source buffer is the EXIF data (an extended image format
          supported by TIFF), and is also user-controlled. A function pointer in the chunk returned
          by HeapAlloc will end up being overwritten by the memcpy function, and then later used
          in OGL!GdipCreatePath. By successfully controlling this function pointer, and the
          memory layout using ActiveX, it is possible to gain arbitrary code execution under the
          context of the user.
Metasploit Module: TFM MMPlayer (m3u/ppl File) Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb
Platform: win
Disclosure date: 2012-03-23
References: CVE-2009-2566, OSVDB-80532, BID-52698, EDB-18656, EDB-18657

Description:
This module exploits a buffer overflow in MMPlayer 2.2
          The vulnerability is triggered when opening a malformed M3U/PPL file
          that contains an overly long string, which results in overwriting a
          SEH record, thus allowing arbitrary code execution under the context
          of the user.
Metasploit Module: VideoLAN Client (VLC) Win32 smb:// URI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/vlc_smb_uri.rb
Platform: win
Disclosure date: 2009-06-24
References: BID-35500, OSVDB-55509, CVE-2009-2484, URL-http://git.videolan.org/?p=vlc.git;a=commit;h=e60a9038b13b5eb805a76755efc5c6d5e080180f, EDB-9029

Description:
This module exploits a stack-based buffer overflow in the Win32AddConnection
          function of the VideoLAN VLC media player. Versions 0.9.9 through 1.0.1 are
          reportedly affected.

          This vulnerability is only present in Win32 builds of VLC.

          This payload was found to work with the windows/exec and
          windows/meterpreter/reverse_tcp payloads. However, the
          windows/meterpreter/reverse_ord_tcp was found not to work.
Metasploit Module: MOXA MediaDBPlayback ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/moxa_mediadbplayback.rb
Platform: win
Disclosure date: 2010-10-19
References: CVE-2010-4742, OSVDB-68986, URL-http://www.moxa.com

Description:
This module exploits a stack buffer overflow in MOXA_ActiveX_SDK. When
          sending an overly long string to the PlayFileName() of MediaDBPlayback.DLL (2.2.0.5)
          an attacker may be able to execute arbitrary code.
Metasploit Module: VUPlayer M3U Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/vuplayer_m3u.rb
Platform: win
Disclosure date: 2009-08-18
References: CVE-2006-6251, OSVDB-31710

Description:
This module exploits a stack over flow in VUPlayer <= 2.49. When
          the application is used to open a specially crafted m3u file, an buffer is overwritten allowing
          for the execution of arbitrary code.
Metasploit Module: RealPlayer RealMedia File Handling Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/real_player_url_property_bof.rb
Platform: win
Disclosure date: 2012-12-14
References: CVE-2012-5691, OSVDB-88486, BID-56956, URL-http://service.real.com/realplayer/security/12142012_player/en/

Description:
This module exploits a stack based buffer overflow on RealPlayer <=15.0.6.14.
          The vulnerability exists in the handling of real media files, due to the insecure
          usage of the GetPrivateProfileString function to retrieve the URL property from an
          InternetShortcut section.

          This module generates a malicious rm file which must be opened with RealPlayer via
          drag and drop or double click methods. It has been tested successfully on Windows
          XP SP3 with RealPlayer 15.0.5.109.
Metasploit Module: EMC ApplicationXtender (KeyWorks) ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/emc_appextender_keyworks.rb
Platform: win
Disclosure date: 2009-09-29
References: CVE-2012-2515, OSVDB-58423, BID-36546

Description:
This module exploits a stack buffer overflow in the KeyWorks KeyHelp ActiveX Control
          (KeyHelp.ocx 1.2.3120.0). This ActiveX Control comes bundled with EMC's
          Documentation ApplicationXtender 5.4.
Metasploit Module: CyberLink Power2Go name Attribute (p2g) Stack Buffer Overflow Exploit
Type: exploit
Path: modules/exploits/windows/fileformat/cyberlink_p2g_bof.rb
Platform: win
Disclosure date: 2011-09-12
References: CVE-2011-5171, BID-50997, OSVDB-77600, EDB-18220, US-CERT-VU-158003

Description:
This module exploits a stack buffer overflow in CyberLink Power2Go version 8.x
          The vulnerability is triggered when opening a malformed p2g file containing an overly
          long string in the 'name' attribute of the file element. This results in overwriting a
          structured exception handler record.
Metasploit Module: Greenshot .NET Deserialization Fileformat Exploit
Type: exploit
Path: modules/exploits/windows/fileformat/greenshot_deserialize_cve_2023_34634.rb
Platform: win
Disclosure date: 2023-07-26
References: CVE-2023-34634, EDB-51633

Description:
There exists a .NET deserialization vulnerability in Greenshot version 1.3.274
          and below.  The deserialization allows the execution of commands when a user opens
          a Greenshot file.  The commands execute under the same permissions as the Greenshot
          service.  Typically, is the logged in user.
Metasploit Module: Foxit PDF Reader 4.2 Javascript File Write
Type: exploit
Path: modules/exploits/windows/fileformat/foxit_reader_filewrite.rb
Platform: win
Disclosure date: 2011-03-05
References: CVE-2011-10030, OSVDB-71104, URL-http://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.html

Description:
This module exploits an unsafe Javascript API implemented in Foxit PDF Reader
          version 4.2. The createDataObject() Javascript API function allows for writing
          arbitrary files to the file system. This issue was fixed in version 4.3.1.0218.

          Note: This exploit uses the All Users directory currently, which required
          administrator privileges to write to. This means an administrative user has to
          open the file to be successful. Kind of lame but thats how it goes sometimes in
          the world of file write bugs.
Metasploit Module: Lattice Semiconductor ispVM System XCF File Handling Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb
Platform: win
Disclosure date: 2012-05-16
References: CVE-2012-10057, OSVDB-82000, BID-53562, URL-http://web.archive.org/web/[PII_REDACTED]2756/http://secunia.com/advisories/48740/

Description:
This module exploits a vulnerability found in ispVM System 18.0.2.  Due to the way
          ispVM handles .xcf files, it is possible to cause a buffer overflow with a specially
          crafted file, when a long value is supplied for the version attribute of the ispXCF
          tag. It results in arbitrary code execution under the context of the user.
Metasploit Module: VideoLAN VLC MKV Memory Corruption
Type: exploit
Path: modules/exploits/windows/fileformat/vlc_webm.rb
Platform: win
Disclosure date: 2011-01-31
References: OSVDB-70698, CVE-2011-0531, BID-46060, URL-http://git.videolan.org/?p=vlc.git&a=commitdiff&h=59491dcedffbf97612d2c572943b56ee4289dd07&hp=f085cfc1c95b922e3c750ee93ec58c3f2d5f7456, URL-http://www.videolan.org/security/sa1102.html

Description:
This module exploits an input validation error in VideoLAN VLC
          < 1.1.7.  By creating a malicious MKV or WebM file, a remote attacker
          could execute arbitrary code.

          NOTE: As of July 1st, 2010, VLC now calls SetProcessDEPPoly to
          permanently enable NX support on machines that support it.
Metasploit Module: McAfee SaaS MyCioScan ShowReport Remote Command Execution
Type: exploit
Path: modules/exploits/windows/fileformat/mcafee_showreport_exec.rb
Platform: win
Disclosure date: 2012-01-12
References: OSVDB-78310, BID-51397, ZDI-12-012

Description:
This module exploits a vulnerability found in McAfee Security-as-a-Service.
          The ShowReport() function (located in the myCIOScn.dll ActiveX component) fails
          to check the FileName argument, and passes it on to a ShellExecuteW() function,
          therefore allows any malicious attacker to execute any process that's on the
          local system.  However, if the victim machine is connected to a remote share
          (or something similar), then it's also possible to execute arbitrary code.
          Please note that a custom template is required for the payload, because the
          default Metasploit template is detectable by McAfee -- any Windows binary, such
          as calc.exe or notepad.exe, should bypass McAfee fine.
Metasploit Module: GTA SA-MP server.cfg Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/gta_samp.rb
Platform: win
Disclosure date: 2011-09-18
References: CVE-2011-10014, OSVDB-83433, EDB-17893

Description:
This module exploits a stack-based buffer overflow in GTA SA-MP Server.
          This buffer overflow occurs when the application attempts to open a malformed
          server.cfg file.  To exploit this vulnerability, an attacker must send the
          victim a server.cfg file and have them run samp-server.exe.
Metasploit Module: DJ Studio Pro 5.1 .pls Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/djstudio_pls_bof.rb
Platform: win
Disclosure date: 2009-12-30
References: CVE-2009-4656, OSVDB-58159, EDB-10827

Description:
This module exploits a stack-based buffer overflow in DJ Studio Pro 5.1.6.5.2.
          When handling a .pls file, DJ Studio will copy the user-supplied data on the stack
          without any proper bounds checking done beforehand, therefore allowing code
          execution under the context of the user.
Metasploit Module: MJM QuickPlayer 1.00 Beta 60a / QuickPlayer 2010 .s3m Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/mjm_quickplayer_s3m.rb
Platform: win
Disclosure date: 2011-04-30
References: CVE-2011-10023, OSVDB-72102, URL-http://www.corelan.be/advisories.php?id=CORELAN-11-003

Description:
This module exploits a stack buffer overflow in MJM QuickPlayer 1.00 beta 60a
          and QuickPlayer 2010 (Multi-target exploit).  When opening a malicious s3m file in
          one of these 2 applications, a stack buffer overflow can be triggered, resulting in
          arbitrary code execution.

          This exploit bypasses DEP & ASLR, and works on XP, Vista & Windows 7.
Metasploit Module: Wireshark wiretap/mpeg.c Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/wireshark_mpeg_overflow.rb
Platform: win
Disclosure date: 2014-03-20
References: CVE-2014-2299, URL-https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843, URL-http://www.wireshark.org/security/wnpa-sec-2014-04.html, BID-66066

Description:
This module triggers a stack buffer overflow in Wireshark <= 1.8.12/1.10.5
          by generating a malicious file.
Metasploit Module: Microsoft Office Visio VISIODWG.DLL DXF File Handling Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/visio_dxf_bof.rb
Platform: win
Disclosure date: 2010-05-04
References: CVE-2010-1681, OSVDB-64446, BID-39836, URL-http://www.coresecurity.com/content/ms-visio-dxf-buffer-overflow, URL-http://web.archive.org/web/[PII_REDACTED]2001/http://www.exploit-db.com:80/moaub-8-microsoft-office-visio-dxf-file-stack-overflow/

Description:
This module exploits a stack based overflow vulnerability in the handling
          of the DXF files by Microsoft Visio 2002. Revisions prior to the release of
          the MS bulletin MS10-028 are vulnerable. The overflow occurs when the application
          is used to import a specially crafted DXF file, while parsing the HEADER section
          of the DXF file.

          To trigger the vulnerability an attacker must convince someone to insert a
          specially crafted DXF file to a new document, go to 'Insert' -> 'CAD Drawing'
Metasploit Module: Microsoft Windows Shell LNK Code Execution
Type: exploit
Path: modules/exploits/windows/fileformat/ms15_020_shortcut_icon_dllloader.rb
Platform: win
Disclosure date: 2015-03-10
References: CVE-2015-0096, MSB-MS15-020, URL-http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-2015-0096-and-the-failed-MS10-046-Stuxnet/ba-p/6718459#.VQBOymTF9so, URL-https://github.com/rapid7/metasploit-framework/pull/4911

Description:
This module exploits a vulnerability in the MS10-046 patch to abuse (again) the handling
          of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious
          DLL. This module creates the required files to exploit the vulnerability. They must be
          uploaded to an UNC path accessible by the target. This module has been tested successfully
          on Windows 2003 SP2 with MS10-046 installed and Windows 2008 SP2 (32 bits) with MS14-027
          installed.
Metasploit Module: ScadaTEC ScadaPhone Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/scadaphone_zip.rb
Disclosure date: 2011-09-12
References: CVE-2011-4535, OSVDB-75375, URL-http://www.scadatec.com/, EDB-17817

Description:
This module exploits a stack-based buffer overflow vulnerability in
          version 5.3.11.1230 of scadaTEC's ScadaPhone.

          In order for the command to be executed, an attacker must convince someone to
          load a specially crafted project zip file with ScadaPhone.
          By doing so, an attacker can execute arbitrary code as the victim user.
Metasploit Module: CCMPlayer 1.5 m3u Playlist Stack Based Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ccmplayer_m3u_bof.rb
Platform: win
Disclosure date: 2011-11-30
Authors: Rh0
References: CVE-2011-5170, OSVDB-77453, EDB-18178

Description:
This module exploits a stack based buffer overflow in CCMPlayer 1.5. Opening
          a m3u playlist with a long track name, a SEH exception record can be overwritten
          with parts of the controllable buffer. SEH execution is triggered after an
          invalid read of an injectable address, thus allowing arbitrary code execution.
          This module works on multiple Windows platforms including: Windows XP SP3,
          Windows Vista, and Windows 7.
Metasploit Module: Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/foxit_title_bof.rb
Platform: win
Disclosure date: 2010-11-13
References: CVE-2010-20010, OSVDB-68648, EDB-15532, URL-http://www.corelan.be:8800/index.php/2010/11/13/offensive-security-exploit-weekend/

Description:
This module exploits a stack buffer overflow in Foxit PDF Reader prior to version
          4.2.0.0928. The vulnerability is triggered when opening a malformed PDF file that
          contains an overly long string in the Title field. This results in overwriting a
          structured exception handler record.

          NOTE: This exploit does not use javascript.
Metasploit Module: GlobalSCAPE CuteZIP Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/cutezip_bof.rb
Disclosure date: 2011-02-12
References: OSVDB-85709, EDB-16162, BID-46375

Description:
This module exploits a stack-based buffer overflow vulnerability in version 2.1
          of CuteZIP.

          In order for the command to be executed, an attacker must convince the target user
          to open a specially crafted zip file with CuteZIP. By doing so, an attacker can
          execute arbitrary code as the target user.
Metasploit Module: Microsoft Excel .SLK Payload Delivery
Type: exploit
Path: modules/exploits/windows/fileformat/office_excel_slk.rb
Platform: win
Disclosure date: 2018-10-07
References: URL-https://blog.appriver.com/2018/02/trojan-droppers-using-symbolic-link-files, URL-https://www.twitter.com/StanHacked/status/[PII_REDACTED]03937795, URL-http://www.irongeek.com/i.php?page=videos/derbycon8/track-3-18-the-ms-office-magic-show-stan-hegt-pieter-ceelen

Description:
This module generates a download and execute Powershell
          command to be placed in an .SLK Excel spreadsheet.
          When executed, it will retrieve a payload via HTTP
          from a web server. When the file is opened, the
          user will be prompted to "Enable Content." Once
          this is pressed, the payload will execute.
Metasploit Module: BlazeVideo HDTV Player Pro v6.6 Filename Handling Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb
Platform: win
Disclosure date: 2012-04-03
References: CVE-2012-10031, OSVDB-80896, EDB-18693, EDB-22931

Description:
This module exploits a vulnerability found in BlazeVideo HDTV Player's filename
          handling routine.  When supplying a string of input data embedded in a .plf file,
          the MediaPlayerCtrl.dll component will try to extract a filename by using
          PathFindFileNameA(), and then copies whatever the return value is on the stack by
          using an inline strcpy.  As a result, if this input data is long enough, it can cause
          a stack-based buffer overflow, which may lead to arbitrary code execution under the
          context of the user.
Metasploit Module: VideoCharge Studio Buffer Overflow (SEH)
Type: exploit
Path: modules/exploits/windows/fileformat/videocharge_studio.rb
Platform: win
Disclosure date: 2013-10-27
References: CVE-2025-34123, OSVDB-69616, EDB-29234

Description:
This module exploits a stack based buffer overflow in VideoCharge Studio 2.12.3.685 when
          processing a specially crafted .VSC file. This vulnerability could be
          exploited by a remote attacker to execute arbitrary code on the target
          machine by enticing a user of VideoCharge Studio to open a malicious .VSC file.
Metasploit Module: Zinf Audio Player 2.2.1 (PLS File) Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/zinfaudioplayer221_pls.rb
Platform: win
Disclosure date: 2004-09-24
References: CVE-2004-0964, OSVDB-10416, EDB-7888, BID-11248

Description:
This module exploits a stack-based buffer overflow in the Zinf Audio Player 2.2.1.
          An attacker must send the file to victim and the victim must open the file.
          Alternatively it may be possible to execute code remotely via an embedded
          PLS file within a browser, when the PLS extension is registered to Zinf.
          This functionality has not been tested in this module.
Metasploit Module: activePDF WebGrabber ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/activepdf_webgrabber.rb
Platform: win
Disclosure date: 2008-08-26
References: CVE-2008-20001, OSVDB-64579, URL-http://www.activepdf.com/products/serverproducts/webgrabber/

Description:
This module exploits a stack buffer overflow in activePDF WebGrabber 3.8. When
          sending an overly long string to the GetStatus() method of APWebGrb.ocx (3.8.2.0)
          an attacker may be able to execute arbitrary code. This control is not marked safe
          for scripting, so choose your attack vector accordingly.