deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ms06_001_wmf_setabortproc.rb
Platform: win
Disclosure date: 2005-12-27
References: CVE-2005-4560, OSVDB-21987, MSB-MS06-001, BID-16074, URL-http://wvware.sourceforge.net/caolan/ora-wmf.html

Description:
This module exploits a vulnerability in the GDI library included with
          Windows XP and 2003. This vulnerability uses the 'Escape' metafile function
          to execute arbitrary code through the SetAbortProc procedure. This module
          generates a random WMF record stream for each request.
Metasploit Module: RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/barcode_ax49.rb
Platform: win
Disclosure date: 2007-06-22
References: EDB-4094, OSVDB-37482, BID-24596, CVE-2007-3435

Description:
This module exploits a stack buffer overflow in RKD Software Barcode Application
          ActiveX Control 'BarCodeAx.dll'. By sending an overly long string to the BeginPrint
          method of BarCodeAx.dll v4.9, an attacker may be able to execute arbitrary code.
Metasploit Module: Java MixerSequencer Object GM_Song Structure Handling Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/java_mixer_sequencer.rb
Platform: win
Disclosure date: 2010-03-30
References: CVE-2010-0842, OSVDB-63493, BID-39077, ZDI-10-060, URL-http://web.archive.org/web/[PII_REDACTED]4250/http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/

Description:
This module exploits a flaw within the handling of MixerSequencer objects
          in Java 6u18 and before.

          Exploitation id done by supplying a specially crafted MIDI file within an RMF
          File. When the MixerSequencer objects is used to play the file, the GM_Song
          structure is populated with a function pointer provided by a SONG block in the
          RMF. A Midi block that contains a MIDI with a specially crafted controller event
          is used to trigger the vulnerability.

          When triggering the vulnerability "ebx" points to a fake event in the MIDI file
          which stores the shellcode. A "jmp ebx" from msvcr71.dll is used to make the
          exploit reliable over java updates.
Metasploit Module: Windows Media Encoder 9 wmex.dll ActiveX Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ms08_053_mediaencoder.rb
Platform: win
Disclosure date: 2008-09-09
References: CVE-2008-3008, OSVDB-47962, BID-31065, MSB-MS08-053

Description:
This module exploits a stack buffer overflow in Windows Media Encoder 9. When
          sending an overly long string to the GetDetailsString() method of wmex.dll
          an attacker may be able to execute arbitrary code.
Metasploit Module: GOM Player ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/gom_openurl.rb
Platform: win
Disclosure date: 2007-10-27
References: CVE-2007-5779, OSVDB-38282, URL-http://web.archive.org/web/[PII_REDACTED]1455/http://secunia.com:80/advisories/27418/

Description:
This module exploits a stack buffer overflow in GOM Player 2.1.6.3499.
          By sending an overly long string to the "OpenUrl()" method located
          in the GomWeb3.dll Control, an attacker may be able to execute
          arbitrary code.
Metasploit Module: Novell iPrint Client ActiveX Control target-frame Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/novelliprint_target_frame.rb
Platform: win
Disclosure date: 2009-12-08
References: CVE-2009-1568, BID-37242, OSVDB-60803, URL-http://web.archive.org/web/[PII_REDACTED]3630/http://secunia.com:80/advisories/37169

Description:
This module exploits a stack buffer overflow in Novell iPrint Client 5.30. When
          passing an overly long string via the "target-frame" parameter to ienipp.ocx
          an attacker can execute arbitrary code.

          NOTE: The "operation" variable must be set to a valid command in order to reach this
          vulnerability.
Metasploit Module: MS13-069 Microsoft Internet Explorer CCaret Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms13_069_caret.rb
Platform: win
Disclosure date: 2013-09-10
References: CVE-2013-3205, OSVDB-97094, MSB-MS13-069, ZDI-13-217

Description:
This module exploits a use-after-free vulnerability found in Internet Explorer,
          specifically in how the browser handles the caret (text cursor) object. In IE's standards
          mode, the caret handling's vulnerable state can be triggered by first setting up an
          editable page with an input field, and then we can force the caret to update in an
          onbeforeeditfocus event by setting the body's innerHTML property. In this event handler,
          mshtml!CCaret::`vftable' can be freed using a document.write() function, however,
          mshtml!CCaret::UpdateScreenCaret remains unaware of this change, and still uses the
          same reference to the CCaret object. When the function tries to use this invalid reference
          to call a virtual function at offset 0x2c, it finally results a crash. Precise control of
          the freed object allows arbitrary code execution under the context of the user.
Metasploit Module: Sun Java Web Start BasicServiceImpl Code Execution
Type: exploit
Path: modules/exploits/windows/browser/java_basicservice_impl.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2010-3563, OSVDB-69043, URL-http://mk41ser.blogspot.com
Targets: Windows x86, Generic (Java Payload)

Description:
This module exploits a vulnerability in Java Runtime Environment
          that allows an attacker to escape the Java Sandbox. By injecting
          a parameter into a javaws call within the BasicServiceImpl class
          the default java sandbox policy file can be therefore overwritten.
          The vulnerability affects version 6 prior to update 22.

          NOTE: Exploiting this vulnerability causes several sinister-looking
          popup windows saying that Java is "Downloading application."
Metasploit Module: MS11-081 Microsoft Internet Explorer Option Element Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms11_081_option.rb
Platform: win
Disclosure date: 2012-10-11
References: CVE-2011-1996, OSVDB-76208, MSB-MS11-081, URL-http://ifsec.blogspot.com/2011/10/internet-explorer-option-element-remote.html, URL-http://pastebin.com/YLH725Aj

Description:
This module exploits a vulnerability in Microsoft Internet Explorer.  A memory
          corruption may occur when the Option cache isn't updated properly, which allows
          other JavaScript methods to access a deleted Option element, and results in code
          execution under the context of the user.
Metasploit Module: MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/ms06_067_keyframe.rb
Platform: win
Disclosure date: 2006-11-14
References: CVE-2006-4777, OSVDB-28842, BID-20047, MSB-MS06-067

Description:
This module exploits a heap overflow vulnerability in the KeyFrame method of the
          direct animation ActiveX control.  This is a port of the exploit implemented by
          Alexander Sotirov.
Metasploit Module: Winamp Playlist UNC Path Computer Name Overflow
Type: exploit
Path: modules/exploits/windows/browser/winamp_playlist_unc.rb
Platform: win
Disclosure date: 2006-01-29
References: CVE-2006-0476, OSVDB-22789, BID-16410

Description:
This module exploits a vulnerability in the Winamp media player.
          This flaw is triggered when an audio file path is specified, inside a
          playlist, that consists of a UNC path with a long computer name. This
          module delivers the playlist via the browser. This module has only
          been successfully tested on Winamp 5.11 and 5.12.
Metasploit Module: IBM Access Support ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ibmegath_getxmlvalue.rb
Platform: win
Disclosure date: 2009-03-24
References: CVE-2009-0215, OSVDB-52958, BID-34228

Description:
This module exploits a stack buffer overflow in IBM Access Support. When
          sending an overly long string to the GetXMLValue() method of IbmEgath.dll
          (3.20.284.0) an attacker may be able to execute arbitrary code.
Metasploit Module: Yahoo! Messenger 8.1.0.249 ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/yahoomessenger_server.rb
Platform: win
Disclosure date: 2007-06-05
References: CVE-2007-3147, OSVDB-37082

Description:
This module exploits a stack buffer overflow in the Yahoo! Webcam Upload ActiveX
          Control (ywcupl.dll) provided by Yahoo! Messenger version 8.1.0.249.
          By sending an overly long string to the "Server()" method, and then calling
          the "Send()" method, an attacker may be able to execute arbitrary code.
          Using the payloads "windows/shell_bind_tcp" and "windows/shell_reverse_tcp"
          yield for the best results.
Metasploit Module: SAP AG SAPgui EAI WebViewer3D Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/sapgui_saveviewtosessionfile.rb
Platform: win
Disclosure date: 2009-03-31
References: CVE-2007-4475, OSVDB-53066, US-CERT-VU-985449

Description:
This module exploits a stack buffer overflow in Siemens Unigraphics Solutions
          Teamcenter Visualization EAI WebViewer3D ActiveX control that is bundled
          with SAPgui. When passing an overly long string the SaveViewToSessionFile()
          method, arbitrary code may be executed.
Metasploit Module: Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/yahoomessenger_fvcom.rb
Platform: win
Disclosure date: 2007-08-30
References: CVE-2007-4515, OSVDB-37739, BID-25494, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=591

Description:
This module exploits a stack buffer overflow in the Yahoo! Messenger ActiveX
          Control (YVerInfo.dll <= 2006.8.24.1). By sending an overly long string
          to the "fvCom()" method from a yahoo.com domain, an attacker may be able
          to execute arbitrary code.
Metasploit Module: MS13-009 Microsoft Internet Explorer SLayoutRun Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms13_009_ie_slayoutrun_uaf.rb
Platform: win
Disclosure date: 2013-02-13
References: CVE-2013-0025, OSVDB-90122, MSB-MS13-009, URL-http://security-assessment.com/files/documents/advisory/ie_slayoutrun_uaf.pdf

Description:
This module exploits a use-after-free vulnerability in Microsoft Internet Explorer
          where a CParaElement node is released but a reference is still kept
          in CDoc. This memory is reused when a CDoc relayout is performed.
Metasploit Module: Citrix Gateway ActiveX Control Stack Based Buffer Overflow Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/citrix_gateway_actx.rb
Platform: win
Disclosure date: 2011-07-14
References: CVE-2011-2882, OSVDB-74191, URL-https://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=929

Description:
This module exploits a stack based buffer overflow in the Citrix Gateway
          ActiveX control. Exploitation of this vulnerability requires user interaction.
          The victim must click a button in a dialog to begin a scan. This is typical
          interaction that users should be accustom to.

          Exploitation results in code execution with the privileges of the user who
          browsed to the exploit page.
Metasploit Module: Honeywell HSC Remote Deployer ActiveX Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
Platform: win
Disclosure date: 2013-02-22
References: CVE-2013-0108, OSVDB-90583, BID-58134, URL-https://www.rapid7.com/blog/post/2013/03/11/cve-2013-0108-honeywell-ebi, URL-http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf

Description:
This module exploits a vulnerability found in the Honeywell HSC Remote Deployer
          ActiveX. This control can be abused by using the LaunchInstaller() function to
          execute an arbitrary HTA from a remote location. This module has been tested
          successfully with the HSC Remote Deployer ActiveX installed with Honeywell EBI
          R410.1.
Metasploit Module: Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb
Platform: win
Disclosure date: 2012-11-07
References: OSVDB-87087, CVE-2012-3752, BID-56557, URL-http://support.apple.com/kb/HT5581

Description:
This module exploits a vulnerability found in Apple QuickTime. When handling
          a TeXML file, it is possible to trigger a stack-based buffer overflow, and then
          gain arbitrary code execution under the context of the user.  This is due to the
          QuickTime3GPP.gtx component not handling certain Style subfields properly, as the
          font-table field, which is used to trigger the overflow in this module. Because of
          QuickTime restrictions when handling font-table fields, only 0x31-0x39 bytes can be
          used to overflow, so at the moment DEP/ASLR bypass hasn't been provided. The module
          has been tested successfully on IE6 and IE7 browsers (Windows XP and Vista).
Metasploit Module: WinDVD7 IASystemInfo.DLL ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/windvd7_applicationtype.rb
Platform: win
Disclosure date: 2007-03-20
References: CVE-2007-0348, OSVDB-34315, BID-23071

Description:
This module exploits a stack buffer overflow in IASystemInfo.dll ActiveX
          control in InterVideo WinDVD 7. By sending an overly long string
          to the "ApplicationType()" property, an attacker may be able to
          execute arbitrary code.
Metasploit Module: Roxio CinePlayer ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/roxio_cineplayer.rb
Platform: win
Disclosure date: 2007-04-11
References: CVE-2007-1559, OSVDB-34779, BID-23412

Description:
This module exploits a stack-based buffer overflow in SonicPlayer ActiveX
          control (SonicMediaPlayer.dll) 3.0.0.1 installed by Roxio CinePlayer 3.2.
          By setting an overly long value to 'DiskType', an attacker can overrun
          a buffer and execute arbitrary code.
Metasploit Module: Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/tumbleweed_filetransfer.rb
Platform: win
Disclosure date: 2008-04-07
Authors: aushack
References: CVE-2008-1724, OSVDB-44252, URL-http://www.aushack.com/200708-tumbleweed.txt

Description:
This module exploits a stack buffer overflow in the vcst_eu.dll
          FileTransfer Module (1.0.0.5) ActiveX control in the Tumbleweed
          SecureTransport suite. By sending an overly long string to the
          TransferFile() 'remotefile' function, an attacker may be able
          to execute arbitrary code.
Metasploit Module: Viscom Image Viewer CP Pro 8.0/Gold 6.0 ActiveX Control
Type: exploit
Path: modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb
Platform: win
Disclosure date: 2010-03-03
References: CVE-2010-5193, OSVDB-78102, EDB-15668, URL-http://web.archive.org/web/[PII_REDACTED]3821/http://secunia.com:80/advisories/42445, URL-http://xforce.iss.net/xforce/xfdb/63666

Description:
This module exploits a stack based buffer overflow in the Active control file
          ImageViewer2.OCX by passing an overly long argument to an insecure TifMergeMultiFiles()
          method. Exploitation results in code execution with the privileges of the user who
          browsed to the exploit page.

          The victim will first be required to trust the publisher Viscom Software.
          This module has been designed to bypass DEP and ASLR under XP IE8, Vista and Win7
          with Java support.
Metasploit Module: AOL Radio AmpX ActiveX Control ConvertFile() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/aol_ampx_convertfile.rb
Platform: win
Disclosure date: 2009-05-19
References: CVE-2007-5755, OSVDB-54706, BID-35028, EDB-8733

Description:
This module exploits a stack-based buffer overflow in AOL IWinAmpActiveX
          class (AmpX.dll) version 2.4.0.6 installed via AOL Radio website.
          By setting an overly long value to 'ConvertFile()', an attacker can overrun
          a buffer and execute arbitrary code.
Metasploit Module: VeryPDF PDFView OCX ActiveX OpenPDF Heap Overflow
Type: exploit
Path: modules/exploits/windows/browser/verypdf_pdfview.rb
Platform: win
Disclosure date: 2008-06-16
References: CVE-2008-5492, OSVDB-49871, BID-32313

Description:
The VeryPDF PDFView ActiveX control is prone to a heap buffer-overflow
          because it fails to properly bounds-check user-supplied data before copying
          it into an insufficiently sized memory buffer. An attacker can exploit this issue
          to execute arbitrary code within the context of the affected application.
Metasploit Module: Microsoft OWC Spreadsheet HTMLURL Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ms09_043_owc_htmlurl.rb
Platform: win
Disclosure date: 2009-08-11
References: CVE-2009-1534, OSVDB-56916, BID-35992, MSB-MS09-043, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=819

Description:
This module exploits a buffer overflow in Microsoft's Office Web Components.
          When passing an overly long string as the "HTMLURL" parameter an attacker can
          execute arbitrary code.
Metasploit Module: Sun Java Web Start Double Quote Injection
Type: exploit
Path: modules/exploits/windows/browser/java_ws_double_quote.rb
Platform: win
Disclosure date: 2012-10-16
References: CVE-2012-1533, OSVDB-86348, BID-56046, URL-https://www.oracle.com/security-alerts/javacpuoct2012.html, URL-https://pastebin.com/eUucVage

Description:
This module exploits a flaw in the Web Start component of the Sun Java
          Runtime Environment. Parameters initial-heap-size and max-heap-size in a JNLP
          file can contain a double quote which is not properly sanitized when creating
          the command line for javaw.exe. This allows the injection of the -XXaltjvm
          option to load a jvm.dll from a remote UNC path into the java process. Thus
          an attacker can execute arbitrary code in the context of a browser user.
          This flaw was fixed in Oct. 2012 and affects JRE <= 1.6.35 and <= 1.7.07.

          In order for this module to work, it must be run as root on a server that
          does not serve SMB (In most cases, this means non-Windows hosts). Additionally,
          the target host must have the WebClient service (WebDAV Mini-Redirector) enabled.
          Alternatively, a UNC path containing a jvm.dll can be specified, bypassing
          the Windows limitation for the Metasploit host.
Metasploit Module: Husdawg, LLC. System Requirements Lab ActiveX Unsafe Method
Type: exploit
Path: modules/exploits/windows/browser/systemrequirementslab_unsafe.rb
Platform: win
Disclosure date: 2008-10-16
References: CVE-2008-4385, OSVDB-50122, US-CERT-VU-166651

Description:
This module allows attackers to execute code via an unsafe method in
          Husdawg, LLC. System Requirements Lab ActiveX Control (sysreqlab2.dll 2.30.0.0)
Metasploit Module: Module Name
Type: exploit
Path: modules/exploits/windows/browser/example.rb
Platform: win
Disclosure date: 2013-04-01
References: URL-https://metasploit.com

Description:
This template covers IE8/9/10, and uses the user-agent HTTP header to detect
          the browser version.  Please note IE8 and newer may emulate an older IE version
          in compatibility mode, in that case the module won't be able to detect the
          browser correctly.
Metasploit Module: MS11-003 Microsoft Internet Explorer CSS Recursive Import Use After Free
Type: exploit
Path: modules/exploits/windows/browser/ms11_003_ie_css_import.rb
Platform: win
Disclosure date: 2010-11-29
References: CVE-2010-3971, OSVDB-69796, BID-45246, URL-http://www.wooyun.org/bugs/wooyun-2010-0885, URL-https://seclists.org/fulldisclosure/2010/Dec/110, MSB-MS11-003

Description:
This module exploits a memory corruption vulnerability within Microsoft\'s
          HTML engine (mshtml). When parsing an HTML page containing a recursive CSS
          import, a C++ object is deleted and later reused. This leads to arbitrary
          code execution.

          This exploit utilizes a combination of heap spraying and the
          .NET 2.0 'mscorie.dll' module to bypass DEP and ASLR. This module does not
          opt-in to ASLR. As such, this module should be reliable on all Windows
          versions with .NET 2.0.50727 installed.
Metasploit Module: Apple Quicktime 7 Invalid Atom Length Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/apple_quicktime_rdrf.rb
Platform: win
Disclosure date: 2013-05-22
References: CVE-2013-1017, OSVDB-93625, BID-60097, URL-http://support.apple.com/kb/HT5770, ZDI-13-110

Description:
This module exploits a vulnerability found in Apple Quicktime. The flaw is
          triggered when Quicktime fails to properly handle the data length for certain
          atoms such as 'rdrf' or 'dref' in the Alis record, which may result a buffer
          overflow by loading a specially crafted .mov file, and allows arbitrary
          code execution under the context of the current user.
Metasploit Module: WinZip FileView (WZFILEVIEW.FileViewCtrl.61) ActiveX Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/winzip_fileview.rb
Platform: win
Disclosure date: 2007-11-02
References: CVE-2006-5198, OSVDB-30433, BID-21060

Description:
The FileView ActiveX control (WZFILEVIEW.FileViewCtrl.61) could allow a
          remote attacker to execute arbitrary code on the system. The control contains
          several unsafe methods and is marked safe for scripting and safe for initialization.
          A remote attacker could exploit this vulnerability to execute arbitrary code on the
          victim system. WinZip 10.0 <= Build 6667 are vulnerable.
Metasploit Module: MS06-014 Microsoft Internet Explorer COM CreateObject Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ie_createobject.rb
Platform: win
Disclosure date: 2006-04-11
References: MSB-MS06-014, CVE-2006-0003, OSVDB-24517, MSB-MS06-073, CVE-2006-4704, OSVDB-30155

Description:
This module exploits a generic code execution vulnerability in Internet
          Explorer by abusing vulnerable ActiveX objects.
Metasploit Module: MS12-037 Microsoft Internet Explorer Fixed Table Col Span Heap Overflow
Type: exploit
Path: modules/exploits/windows/browser/ms12_037_ie_colspan.rb
Platform: win
Disclosure date: 2012-06-12
References: CVE-2012-1876, OSVDB-82866, BID-53848, MSB-MS12-037

Description:
This module exploits a heap overflow vulnerability in Internet Explorer caused
          by an incorrect handling of the span attribute for col elements from a fixed table,
          when they are modified dynamically by javascript code.
Metasploit Module: CommuniCrypt Mail 1.16 SMTP ActiveX Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/communicrypt_mail_activex.rb
Platform: win
Disclosure date: 2010-05-19
References: CVE-2010-20119, OSVDB-64839, EDB-12663

Description:
This module exploits a stack buffer overflow in the ANSMTP.dll/AOSMTP.dll
          ActiveX Control provided by CommuniCrypt Mail 1.16.  By sending an overly
          long string to the "AddAttachments()" method, an attacker may be able to
          execute arbitrary code.