deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Heroes of Might and Magic III .h3m Map file Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/homm3_h3m.rb
Platform: win
Disclosure date: 2015-07-29
References: CVE-2025-34124, EDB-37716

Description:
This module embeds an exploit into an uncompressed map file (.h3m) for
          Heroes of Might and Magic III. Once the map is started in-game, a
          buffer overflow occurring when loading object sprite names leads to
          shellcode execution.
Metasploit Module: Microsoft Windows Contact File Format Arbitary Code Execution
Type: exploit
Path: modules/exploits/windows/fileformat/microsoft_windows_contact.rb
Platform: win
Disclosure date: 2019-01-17
References: EDB-46188, URL-http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CONTACT-FILE-INSUFFECIENT-UI-WARNING-WEBSITE-LINK-ARBITRARY-CODE-EXECUTION.txt, ZDI-19-013

Description:
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows.
          User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw is due to the processing of ".contact" files <c:Url> node param which takes an expected website value, however if an attacker references an
          executable file it will run that instead without warning instead of performing expected web navigation. This is dangerous and would be unexpected to an end user.
          Executable files can live in a sub-directory so when the ".contact" website link is clicked it traverses directories towards the executable and runs.
          Making matters worse is if the files are compressed then downloaded "mark of the web" (MOTW) may potentially not work as expected with certain archive utilitys.
          The ".\" chars allow directory traversal to occur in order to run the attackers supplied executable sitting unseen in the attackers directory.
          This advisory is a duplicate issue that currently affects Windows .VCF files, and released for the sake of completeness as it affects Windows .contact files as well.
Metasploit Module: Lotus Notes 8.0.x - 8.5.2 FP2 - Autonomy Keyview (.lzh Attachment)
Type: exploit
Path: modules/exploits/windows/fileformat/lotusnotes_lzh.rb
Platform: win
Disclosure date: 2011-05-24
References: CVE-2011-1213, OSVDB-72706, BID-48018, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=904, URL-http://www.ibm.com/support/docview.wss?uid=swg21500034

Description:
This module exploits a stack buffer overflow in Lotus Notes 8.5.2 when
          parsing a malformed, specially crafted LZH file. This vulnerability was
          discovered binaryhouse.net
Metasploit Module: WinRAR CVE-2023-38831 Exploit
Type: exploit
Path: modules/exploits/windows/fileformat/winrar_cve_2023_38831.rb
Platform: win
Disclosure date: 2023-08-23
Authors: Alexander "xaitax" Hagenah
References: CVE-2023-38831, URL-https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/, URL-https://b1tg.github.io/post/cve-2023-38831-winrar-analysis/

Description:
This module exploits a vulnerability in WinRAR (CVE-2023-38831). When a user opens a crafted RAR file and its
          embedded document, the decoy document is executed, leading to code execution.
Metasploit Module: Apple Quicktime 7 Invalid Atom Length Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/apple_quicktime_rdrf.rb
Platform: win
Disclosure date: 2013-05-22
References: CVE-2013-1017, OSVDB-93625, BID-60097, URL-http://support.apple.com/kb/HT5770, ZDI-13-110

Description:
This module exploits a vulnerability found in Apple QuickTime. The flaw is
          triggered when QuickTime fails to properly handle the data length for certain
          atoms such as 'rdrf' or 'dref' in the Alis record, which may result a buffer
          overflow by loading a specially crafted .mov file, and allows arbitrary
          code execution under the context of the current user. Please note: Since an egghunter
          is used to search for the payload, this may require additional time for
          the exploit to complete.
Metasploit Module: Orbital Viewer ORB File Parsing Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/orbital_viewer_orb.rb
Platform: win
Disclosure date: 2010-02-27
References: BID-38436, OSVDB-62580, CVE-2010-0688, URL-http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-011-orbital-viewer-orb-buffer-overflow/, EDB-11581

Description:
This module exploits a stack-based buffer overflow in David Manthey's
          Orbital Viewer. When processing .ORB files, data is read from file into
          a fixed-size stack buffer using the fscanf function. Since no bounds
          checking is done, a buffer overflow can occur. Attackers can execute
          arbitrary code by convincing their victim to open an ORB file.
Metasploit Module: MS14-064 Microsoft Windows OLE Package Manager Code Execution
Type: exploit
Path: modules/exploits/windows/fileformat/ms14_064_packager_run_as_admin.rb
Platform: win
Disclosure date: 2014-10-21
References: CVE-2014-6352, MSB-MS14-064, BID-70690, URL-http://blogs.mcafee.com/mcafee-labs/bypassing-microsofts-patch-sandworm-zero-day-even-editing-dangerous

Description:
This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE)
          allowing arbitrary code execution, publicly exploited in the wild as MS14-060 patch bypass.
          The Microsoft update tried to fix the vulnerability publicly known as "Sandworm". Platforms
          such as Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known
          to be vulnerable. However, based on our testing, the most reliable setup is on Windows
          platforms running Office 2013 and Office 2010 SP2. Please keep in mind that some other
          setups such as using Office 2010 SP1 might be less stable, and may end up with a
          crash due to a failure in the CPackage::CreateTempFileName function.
Metasploit Module: LNK Code Execution Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/cve_2017_8464_lnk_rce.rb
Platform: win
Disclosure date: 2017-06-13
References: CVE-2017-8464, URL-https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464, URL-http://www.vxjump.net/files/vuln_analysis/cve-2017-8464.txt, URL-https://msdn.microsoft.com/en-us/library/dd871305.aspx, URL-http://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm, URL-https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
Targets: Automatic, Windows x64, Windows x86

Description:
This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK)
          that contain a dynamic icon, loaded from a malicious DLL.

          This vulnerability is a variant of MS15-020 (CVE-2015-0096). The created LNK file is
          similar except an additional SpecialFolderDataBlock is included. The folder ID set
          in this SpecialFolderDataBlock is set to the Control Panel. This is enough to bypass
          the CPL whitelist. This bypass can be used to trick Windows into loading an arbitrary
          DLL file.

          If no PATH is specified, the module will use drive letters D through Z so the files
          may be placed in the root path of a drive such as a shared VM folder or USB drive.
Metasploit Module: AOL 9.5 Phobos.Playlist Import() Stack-based Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/aol_phobos_bof.rb
Platform: win
Disclosure date: 2010-01-20
References: CVE-2010-10015, OSVDB-61964, EDB-11204, URL-http://www.rec-sec.com/2010/01/25/aol-playlist-class-buffer-overflow/

Description:
This module exploits a stack-based buffer overflow within Phobos.dll of AOL 9.5.
          By setting an overly long value to 'Import()', an attacker can overrun a buffer
          and execute arbitrary code.

          NOTE: This ActiveX control is NOT marked safe for scripting or initialization.
Metasploit Module: Audio Workstation 6.4.2.4.3 pls Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/audio_wkstn_pls.rb
Platform: win
Disclosure date: 2009-12-08
References: CVE-2009-0476, OSVDB-55424, EDB-10353

Description:
This module exploits a buffer overflow in Audio Workstation 6.4.2.4.3.
          When opening a malicious pls file with the Audio Workstation,
          a remote attacker could overflow a buffer and execute
          arbitrary code.
Metasploit Module: WinRAR Filename Spoofing
Type: exploit
Path: modules/exploits/windows/fileformat/winrar_name_spoofing.rb
Disclosure date: 2009-09-28
References: CVE-2014-125119, OSVDB-62610, BID-66383, URL-http://securityaffairs.co/wordpress/23623/hacking/winrar-zero-day.html, URL-http://an7isec.blogspot.co.il/

Description:
This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists
          when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from
          the central directory, but the file names used to extract and open contents come from the
          Local File Header. This inconsistency allows to spoof file names when opening ZIP files
          with WinRAR, which can be abused to execute arbitrary code, as exploited in the wild in
          March 2014
Metasploit Module: gAlan 0.2.1 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/galan_fileformat_bof.rb
Platform: win
Disclosure date: 2009-12-07
References: CVE-2009-20004, OSVDB-60897, EDB-10339

Description:
This module exploits a stack buffer overflow in gAlan 0.2.1
          by creating a specially crafted galan file.
Metasploit Module: MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb
Platform: win
Disclosure date: 2010-02-09
References: CVE-2010-0033, OSVDB-62241, MSB-MS10-004, ZDI-10-017

Description:
This module exploits a stack buffer overflow vulnerability in the handling of
          the TextBytesAtom records by Microsoft PowerPoint Viewer. According to Microsoft,
          the PowerPoint Viewer distributed with Office 2003 SP3 and earlier, as well as
          Office 2004 for Mac, are vulnerable.

          NOTE: The vulnerable code path is not reachable on versions of Windows prior to
          Windows Vista.
Metasploit Module: IcoFX Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/icofx_bof.rb
Disclosure date: 2013-12-10
References: CVE-2013-4988, OSVDB-100826, BID-64221, EDB-30208, URL-http://www.coresecurity.com/advisories/icofx-buffer-overflow-vulnerability

Description:
This module exploits a stack-based buffer overflow vulnerability in version 2.1
          of IcoFX. The vulnerability exists while parsing .ICO files, where a specially
          crafted ICONDIR header providing an arbitrary long number of images in the file
          can be used to trigger the overflow when reading the ICONDIRENTRY structures.
Metasploit Module: MS15-100 Microsoft Windows Media Center MCL Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb
Platform: win
Disclosure date: 2015-09-08
References: CVE-2015-2509, MSB-MS15-100

Description:
This module exploits a vulnerability in Windows Media Center. By supplying
          an UNC path in the *.mcl file, a remote file will be automatically downloaded,
          which can result in arbitrary code execution.
Metasploit Module: Adobe Flash Player "newfunction" Invalid Pointer Use
Type: exploit
Path: modules/exploits/windows/fileformat/adobe_flashplayer_newfunction.rb
Platform: win
Disclosure date: 2010-06-04
References: CVE-2010-1297, OSVDB-65141, BID-40586, URL-http://www.adobe.com/support/security/advisories/apsa10-01.html, URL-http://feliam.wordpress.com/2010/02/11/flash-on-a-pdf-with-minipdf-py/

Description:
This module exploits a vulnerability in the DoABC tag handling within
          versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also
          vulnerable, as are any other applications that may embed Flash player.

          Arbitrary code execution is achieved by embedding a specially crafted Flash
          movie into a PDF document. An AcroJS heap spray is used in order to ensure
          that the memory used by the invalid pointer issue is controlled.

          NOTE: This module uses a similar DEP bypass method to that used within the
          adobe_libtiff module. This method is unlikely to work across various
          Windows versions due a the hardcoded syscall number.
Metasploit Module: Cool PDF Image Stream Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/coolpdf_image_stream_bof.rb
Platform: win
Disclosure date: 2013-01-18
References: CVE-2012-4914, OSVDB-89349, EDB-24463, URL-http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=70&Itemid=70

Description:
This module exploits a stack buffer overflow in Cool PDF Reader prior to version
          3.0.2.256. The vulnerability is triggered when opening a malformed PDF file that
          contains a specially crafted image stream. This module has been tested successfully
          on Cool PDF 3.0.2.256 over Windows XP SP3 and Windows 7 SP1.
Metasploit Module: Adobe JBIG2Decode Memory Corruption
Type: exploit
Path: modules/exploits/windows/fileformat/adobe_jbig2decode.rb
Platform: win
Disclosure date: 2009-02-19
References: CVE-2009-0658, OSVDB-52073

Description:
This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier.
          This module relies upon javascript for the heap spray.
Metasploit Module: Chasys Draw IES Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/chasys_draw_ies_bmp_bof.rb
Platform: win
Disclosure date: 2013-07-26
References: CVE-2013-3928, OSVDB-95689, BID-61463, URL-http://web.archive.org/web/[PII_REDACTED]3457/http://secunia.com/advisories/53773/, URL-http://longinox.blogspot.com/2013/08/explot-stack-based-overflow-bypassing.html

Description:
This module exploits a buffer overflow vulnerability found in Chasys Draw IES
          (version 4.10.01). The vulnerability exists in the module flt_BMP.dll, while
          parsing BMP files, where the ReadFile function is used to store user provided data
          on the stack in an insecure way. It results in arbitrary code execution under the
          context of the user viewing a specially crafted BMP file. This module has been
          tested successfully with Chasys Draw IES 4.10.01 on Windows XP SP3 and Windows 7
          SP1.
Metasploit Module: MS11-021 Microsoft Office 2007 Excel .xlb Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb
Platform: win
Disclosure date: 2011-08-09
References: CVE-2011-0105, OSVDB-71765, MSB-MS11-021, ZDI-11-121

Description:
This module exploits a vulnerability found in Excel of Microsoft Office 2007.
          By supplying a malformed .xlb file, an attacker can control the content (source)
          of a memcpy routine, and the number of bytes to copy, therefore causing a stack-
          based buffer overflow.  This results in arbitrary code execution under the context of
          the user.
Metasploit Module: ERS Viewer 2011 ERS File Handling Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb
Platform: win
Disclosure date: 2013-04-23
References: CVE-2013-0726, OSVDB-92694, BID-59379, URL-http://web.archive.org/web/[PII_REDACTED]1047/http://secunia.com/advisories/51725/

Description:
This module exploits a buffer overflow vulnerability found in ERS Viewer 2011
          (version 11.04). The vulnerability exists in the module ermapper_u.dll where the
          function ERM_convert_to_correct_webpath handles user provided data in an insecure
          way. It results in arbitrary code execution under the context of the user viewing
          a specially crafted .ers file. This module has been tested successfully with ERS
          Viewer 2011 (version 11.04) on Windows XP SP3 and Windows 7 SP1.
Metasploit Module: Millenium MP3 Studio 2.0 (PLS File) Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/millenium_mp3_pls.rb
Platform: win
Disclosure date: 2009-07-30
References: CVE-2009-20002, OSVDB-56574, EDB-9618, EDB-10240

Description:
This module exploits a stack-based buffer overflow in Millenium MP3 Studio 2.0.
          An attacker must send the file to victim and the victim must open the file.
          Alternatively it may be possible to execute code remotely via an embedded
          PLS file within a browser, when the PLS extension is registered to Millenium MP3 Studio.
          This functionality has not been tested in this module.
Metasploit Module: Mini-Stream RM-MP3 Converter v3.1.2.1 PLS File Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/mini_stream_pls_bof.rb
Platform: win
Disclosure date: 2010-07-16
References: CVE-2010-5081, OSVDB-78078, EDB-14373, BID-34514

Description:
This module exploits a stack based buffer overflow found in Mini-Stream RM-MP3
          Converter v3.1.2.1. The overflow is triggered when an unsuspecting victim
          opens the malicious PLS file.
Metasploit Module: Xion Audio Player 1.0.126 Unicode Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/xion_m3u_sehbof.rb
Platform: win
Disclosure date: 2010-11-23
References: CVE-2010-20042, OSVDB-66912, EDB-14517, EDB-14633, EDB-15598

Description:
This module exploits a stack buffer overflow in Xion Audio Player prior to version
          1.0.126. The vulnerability is triggered when opening a malformed M3U file that
          contains an overly long string. This results in overwriting a
          structured exception handler record.
Metasploit Module: HT-MP3Player 1.0 HT3 File Parsing Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ht_mp3player_ht3_bof.rb
Platform: win
Disclosure date: 2009-06-29
References: CVE-2009-2485, OSVDB-55449, EDB-9034, EDB-9038

Description:
This module exploits a stack buffer overflow in HT-MP3Player 1.0.
          Arbitrary code execution could occur when parsing a specially crafted
          .HT3 file.

          NOTE: The player installation does not register the file type to be
          handled. Therefore, a user must take extra steps to load this file.
Metasploit Module: Digital Music Pad Version 8.2.3.3.4 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/digital_music_pad_pls.rb
Platform: win
Disclosure date: 2010-09-17
References: CVE-2010-20111, OSVDB-68178, URL-http://web.archive.org/web/[PII_REDACTED]4433/http://secunia.com:80/advisories/41519, EDB-15134

Description:
This module exploits a buffer overflow in Digital Music Pad Version 8.2.3.3.4
          When opening a malicious pls file with the Digital Music Pad,
          a remote attacker could overflow a buffer and execute
          arbitrary code.
Metasploit Module: Adobe FlateDecode Stream Predictor 02 Integer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb
Platform: win
Disclosure date: 2009-10-08
References: CVE-2009-3459, BID-36600, OSVDB-58729, URL-http://web.archive.org/web/[PII_REDACTED]1443/https://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html/, URL-http://www.adobe.com/support/security/bulletins/apsb09-15.html

Description:
This module exploits an integer overflow vulnerability in Adobe Reader and Adobe
          Acrobat Professional versions before 9.2.
Metasploit Module: PDF Shaper Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/shaper_pdf_bof.rb
Platform: win
Disclosure date: 2015-10-03
References: CVE-2025-34106, EDB-37760

Description:
PDF Shaper is prone to a security vulnerability when processing PDF files.
          The vulnerability appears when we use Convert PDF to Image and use a specially
          crafted PDF file. This module has been tested successfully on Win XP, Win 7,
          Win 8, Win 10.
Metasploit Module: Apple QuickTime PICT PnSize Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/apple_quicktime_pnsize.rb
Platform: win
Disclosure date: 2011-08-08
References: CVE-2011-0257, OSVDB-74687, EDB-17777, BID-49144

Description:
This module exploits a vulnerability in Apple QuickTime Player 7.60.92.0.
          When opening a .mov file containing a specially crafted PnSize value, an attacker
          may be able to execute arbitrary code.
Metasploit Module: Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/syncbreeze_xml.rb
Platform: win
Disclosure date: 2017-03-29
References: CVE-2017-7310, EDB-41773

Description:
This module exploits a buffer overflow in Sync Breeze Enterprise 9.5.16
          by using the import command option to import a specially crafted xml file.
Metasploit Module: Irfanview JPEG2000 jp2 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb
Disclosure date: 2012-01-16
References: CVE-2012-0897, OSVDB-78333, BID-51426, URL-http://www.greyhathacker.net/?p=525

Description:
This module exploits a stack-based buffer overflow vulnerability in
          version <= 4.3.2.0 of Irfanview's JPEG2000.dll plugin. This exploit has
          been tested on a specific version of irfanview (v4.3.2), although other
          versions may work also. The vulnerability is triggered via parsing an
          invalid qcd chunk structure and specifying a malformed qcd size and
          data.

          Payload delivery and vulnerability trigger can be executed in multiple
          ways. The user can double click the file, use the file dialog, open via
          the icon and drag/drop the file into Irfanview's window. An egg hunter
          is used for stability.
Metasploit Module: eZip Wizard 3.0 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ezip_wizard_bof.rb
Disclosure date: 2009-03-09
References: CVE-2009-1028, OSVDB-52815, BID-34044, URL-http://www.edisys.com/, EDB-8180, EDB-12059

Description:
This module exploits a stack-based buffer overflow vulnerability in
          version 3.0 of ediSys Corp.'s eZip Wizard.

          In order for the command to be executed, an attacker must convince someone to
          open a specially crafted zip file with eZip Wizard, and access the specially
          file via double-clicking it. By doing so, an attacker can execute arbitrary
          code as the victim user.
Metasploit Module: MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python
Type: exploit
Path: modules/exploits/windows/fileformat/ms14_064_packager_python.rb
Platform: python
Disclosure date: 2014-11-12
References: CVE-2014-6352, MSB-MS14-064, BID-70690, URL-http://blogs.mcafee.com/mcafee-labs/bypassing-microsofts-patch-for-the-sandworm-zero-day-even-editing-can-cause-harm

Description:
This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE)
          allowing arbitrary code execution, bypassing the patch MS14-060, for the vulnerability
          publicly known as "Sandworm", on systems with Python for Windows installed. Windows Vista
          SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable.
          However, based on our testing, the most reliable setup is on Windows platforms running
          Office 2013 and Office 2010 SP2. Please keep in mind that some other setups such as
          those using Office 2010 SP1 may be less stable, and may end up with a crash due to a
          failure in the CPackage::CreateTempFileName function.