deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Zenturi ProgramChecker ActiveX Control Arbitrary File Download
Type: exploit
Path: modules/exploits/windows/browser/zenturiprogramchecker_unsafe.rb
Platform: win
Disclosure date: 2007-05-29
References: CVE-2007-2987, OSVDB-36715, BID-24217

Description:
This module allows remote attackers to place arbitrary files on a users file system
          via the Zenturi ProgramChecker sasatl.dll (1.5.0.531) ActiveX Control.
Metasploit Module: Malwarebytes Anti-Malware and Anti-Exploit Update Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/malwarebytes_update_exec.rb
Platform: win
Disclosure date: 2014-12-16
References: CVE-2014-4936, OSVDB-116050, URL-http://web.archive.org/web/[PII_REDACTED]4255/http://blog.0x3a.com/post/[PII_REDACTED]9/cve-2014-4936-malwarebytes-anti-malware-and

Description:
This module exploits a vulnerability in the update functionality of
          Malwarebytes Anti-Malware consumer before 2.0.3 and Malwarebytes
          Anti-Exploit consumer 1.03.1.1220.
          Due to the lack of proper update package validation, a man-in-the-middle
          (MITM) attacker could execute arbitrary code by spoofing the update server
          data-cdn.mbamupdates.com and uploading an executable. This module has
          been tested successfully with MBAM 2.0.2.1012 and MBAE 1.03.1.1220.
Metasploit Module: XMPlay 3.3.0.4 (ASX Filename) Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/xmplay_asx.rb
Platform: win
Disclosure date: 2006-11-21
Authors: MC
References: CVE-2006-6063, OSVDB-30537, BID-21206, URL-http://web.archive.org/web/[PII_REDACTED]4818/http://secunia.com:80/advisories/22999

Description:
This module exploits a stack buffer overflow in XMPlay 3.3.0.4.
          The vulnerability is caused due to a boundary error within
          the parsing of playlists containing an overly long file name.
          This module uses the ASX file format.
Metasploit Module: Facebook Photo Uploader 4 ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/facebook_extractiptc.rb
Platform: win
Disclosure date: 2008-01-31
References: CVE-2008-5711, OSVDB-41073, BID-27534, EDB-5049

Description:
This module exploits a stack buffer overflow in Facebook Photo Uploader 4.
          By sending an overly long string to the "ExtractIptc()" property located
          in the ImageUploader4.ocx (4.5.57.0) Control, an attacker may be able to execute
          arbitrary code.
Metasploit Module: Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ms08_070_visual_studio_msmask.rb
Platform: win
Disclosure date: 2008-08-13
References: BID-30674, CVE-2008-3704, EDB-6244, EDB-6317, OSVDB-47475, MSB-MS08-070, URL-https://exchange.xforce.ibmcloud.com/vulnerabilities/44444

Description:
This module exploits a stack buffer overflow in Microsoft Visual
          Studio 6.0. When passing a specially crafted string to the Mask
          parameter of the Mdmask32.ocx ActiveX Control, an attacker may
          be able to execute arbitrary code.
Metasploit Module: Adobe Flash Player casi32 Integer Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_casi32_int_overflow.rb
Platform: win
Disclosure date: 2014-10-14
References: ZDI-14-365, CVE-2014-0569, OSVDB-113199, URL-https://helpx.adobe.com/security/products/flash-player/apsb14-22.html, URL-http://malware.dontneedcoffee.com/2014/10/cve-2014-0569.html

Description:
This module exploits an integer overflow in Adobe Flash Player. The vulnerability occurs in
          the casi32 method, where an integer overflow occurs if a ByteArray of length 0 is setup as
          domainMemory for the current application domain. This module has been tested successfully
          on Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 15.0.0.167.
Metasploit Module: Honeywell Tema Remote Installer ActiveX Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/honeywell_tema_exec.rb
Platform: win
Disclosure date: 2011-10-20
References: OSVDB-76681, BID-50078, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-285-01

Description:
This module exploits a vulnerability found in the Honeywell Tema ActiveX Remote
          Installer.  This ActiveX control can be abused by using the DownloadFromURL()
          function to install an arbitrary MSI from a remote location without checking source
          authenticity or user notification. This module has been tested successfully with
          the Remote Installer ActiveX installed with Honeywell EBI R410.1 - TEMA 5.3.0 and
          Internet Explorer 6, 7 and 8 on Windows XP SP3.
Metasploit Module: NCTAudioFile2 v2.x ActiveX Control SetFormatLikeSample() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/nctaudiofile2_setformatlikesample.rb
Platform: win
Disclosure date: 2007-01-24
References: CVE-2007-0018, OSVDB-32032, BID-22196, US-CERT-VU-292713

Description:
This module exploits a stack buffer overflow in the NCTAudioFile2.Audio ActiveX
          Control provided by various audio applications. By sending an overly long
          string to the "SetFormatLikeSample()" method, an attacker may be able to
          execute arbitrary code.
Metasploit Module: Firefox nsSVGValue Out-of-Bounds Access Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/mozilla_nssvgvalue.rb
Platform: win
Disclosure date: 2011-12-06
References: CVE-2011-3658, OSVDB-77953, ZDI-12-056, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=708186

Description:
This module exploits an out-of-bounds access flaw in Firefox 7 and 8 (<= 8.0.1).
          The notification of nsSVGValue observers via nsSVGValue::NotifyObservers(x,y)
          uses a loop which can result in an out-of-bounds access to attacker-controlled memory.
          The mObserver ElementAt() function (which picks up pointers), does not validate
          if a given index is out of bound. If a custom observer of nsSVGValue is created,
          which removes elements from the original observer,
          and memory layout is manipulated properly, the ElementAt() function might pick up
          an attacker provided pointer, which can be leveraged to gain remote arbitrary
          code execution.
Metasploit Module: VMWare OVF Tools Format String Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/ovftool_format_string.rb
Platform: win
Disclosure date: 2012-11-08
References: CVE-2012-3569, OSVDB-87117, BID-56468, URL-https://www.vmware.com/security/advisories/VMSA-2012-0015.html

Description:
This module exploits a format string vulnerability in VMWare OVF Tools 2.1 for
          Windows. The vulnerability occurs when printing error messages while parsing a
          a malformed OVF file. The module has been tested successfully with VMWare OVF Tools
          2.1 on Windows XP SP3.
Metasploit Module: Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_otf_font.rb
Platform: win
Disclosure date: 2012-08-09
References: CVE-2012-1535, OSVDB-84607, BID-55009, URL-http://labs.alienvault.com/labs/index.php/2012/cve-2012-1535-adobe-flash-being-exploited-in-the-wild/, URL-https://developer.apple.com/fonts/TTRefMan/RM06/Chap6.html, URL-http://contagiodump.blogspot.com.es/2012/08/cve-2012-1535-samples-and-info.html, URL-https://www.rapid7.com/blog/post/2012/08/17/adobe-flash-player-exploit-cve-2012-1535-now-available-for-metasploit, URL-http://www.adobe.com/support/security/bulletins/apsb12-18.html

Description:
This module exploits a vulnerability found in the ActiveX component of Adobe
          Flash Player before 11.3.300.271. By supplying a specially crafted .otf font file
          with a large nTables value in the 'kern' header, it is possible to trigger an
          integer overflow, which results in remote code execution under the context of the
          user.  This vulnerability has also been exploited in the wild in limited targeted
          attacks.  Please note in order to ensure reliability, the exploit is forced to
          modify your URIPATH parameter to less than 3 characters, which may cause possible
          URIPATH collisions.
Metasploit Module: Novell iPrint Client ActiveX Control call-back-url Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/novelliprint_callbackurl.rb
Platform: win
Disclosure date: 2010-08-20
References: CVE-2010-1527, OSVDB-67411, URL-http://web.archive.org/web/[PII_REDACTED]4359/http://secunia.com:80/secunia_research/2010-104, EDB-15042

Description:
This module exploits a stack-based buffer overflow in Novell iPrint Client 5.42.
          When sending an overly long string to the 'call-back-url' parameter in an
          op-client-interface-version action of ienipp.ocx an attacker may be able to
          execute arbitrary code.
Metasploit Module: MS14-064 Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ms14_064_ole_code_execution.rb
Platform: win
Disclosure date: 2014-11-13
References: CVE-2014-6332, MSB-MS14-064, OSVDB-114533, EDB-35229, EDB-35308, URL-http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows, URL-https://forsec.nl/2014/11/cve-2014-6332-internet-explorer-msf-module

Description:
This module exploits the Windows OLE Automation array vulnerability, CVE-2014-6332.
          The vulnerability is known to affect Internet Explorer 3.0 until version 11 within
          Windows 95 up to Windows 10, and no patch for Windows XP. However, this exploit will
          only target Windows XP and Windows 7 box due to the Powershell limitation.

          Windows XP by defaults supports VBS, therefore it is used as the attack vector. On other
          newer Windows systems, the exploit will try using Powershell instead.
Metasploit Module: MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb
Platform: win
Disclosure date: 2010-03-09
References: CVE-2010-0805, OSVDB-63329, BID-39025, ZDI-10-034, MSB-MS10-018

Description:
This module exploits a memory corruption vulnerability in the Internet Explorer
          Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet
          Explorer are vulnerable.

          By specifying a long value as the "DataURL" parameter to this control, it is possible
          to write a NUL byte outside the bounds of an array. By targeting control flow data
          on the stack, an attacker can execute arbitrary code.
Metasploit Module: Sun Java Runtime New Plugin docbase Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/java_docbase_bof.rb
Platform: win
Disclosure date: 2010-10-12
Authors: jduck
References: CVE-2010-3552, OSVDB-68873, BID-44023, URL-http://blog.harmonysecurity.com/2010/10/oracle-java-ie-browser-plugin-stack.html, ZDI-10-206, URL-http://code.google.com/p/skylined/issues/detail?id=23, URL-http://web.archive.org/web/[PII_REDACTED]2812/http://skypher.com:80/index.php/2010/10/13/issue-2-oracle-java-object-launchjnlp-docbase/, URL-http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html

Description:
This module exploits a flaw in the new plugin component of the Sun Java
          Runtime Environment before v6 Update 22. By specifying specific parameters
          to the new plugin, an attacker can cause a stack-based buffer overflow and
          execute arbitrary code.

          When the new plugin is invoked with a "launchjnlp" parameter, it will
          copy the contents of the "docbase" parameter to a stack-buffer using the
          "sprintf" function. A string of 396 bytes is enough to overflow the 256
          byte stack buffer and overwrite some local variables as well as the saved
          return address.

          NOTE: The string being copied is first passed through the "WideCharToMultiByte".
          Due to this, only characters which have a valid localized multibyte
          representation are allowed. Invalid characters will be replaced with
          question marks ('?').

          This vulnerability was originally discovered independently by both Stephen
          Fewer and Berend Jan Wever (SkyLined). Although exhaustive testing hasn't
          been done, all versions since version 6 Update 10 are believed to be affected
          by this vulnerability.

          This vulnerability was patched as part of the October 2010 Oracle Patch
          release.
Metasploit Module: Quest InTrust Annotation Objects Uninitialized Pointer
Type: exploit
Path: modules/exploits/windows/browser/intrust_annotatex_add.rb
Platform: win
Disclosure date: 2012-03-28
References: CVE-2012-5896, OSVDB-80662, BID-52765, EDB-18674

Description:
This module exploits an uninitialized variable vulnerability in the
          Annotation Objects ActiveX component. The ActiveX component loads into memory without
          opting into ALSR so this module exploits the vulnerability against windows Vista and
          Windows 7 targets. A large heap spray is required to fulfill the requirement that EAX
          points to part of the ROP chain in a heap chunk and the calculated call will hit the
          pivot in a separate heap chunk. This will take some time in the users browser.
Metasploit Module: TeeChart Professional ActiveX Control Trusted Integer Dereference
Type: exploit
Path: modules/exploits/windows/browser/teechart_pro.rb
Platform: win
Disclosure date: 2011-08-11
References: CVE-2011-4034, OSVDB-74446, URL-http://www.stratsec.net/Research/Advisories/TeeChart-Professional-Integer-Overflow

Description:
This module exploits an integer overflow in TeeChart Pro ActiveX control. When
          sending an overly large/negative integer value to the AddSeries() property of
          TeeChart2010.ocx, the code will perform an arithmetic operation that wraps the
          value and is later directly trusted and called upon.

          This module has been designed to bypass DEP only under IE8 with Java support. Multiple
          versions (including the latest version) are affected by this vulnerability that date
          back to as far as 2001.

          The following controls are vulnerable:

          TeeChart5.ocx Version 5.0.1.0 (clsid: B6C10489-FB89-11D4-93C9-006008A7EED4);
          TeeChart6.ocx Version 6.0.0.5 (clsid: 536600D3-70FE-4C50-92FB-640F6BFC49AD);
          TeeChart7.ocx Version 7.0.1.4 (clsid: FAB9B41C-87D6-474D-AB7E-F07D78F2422E);
          TeeChart8.ocx Version 8.0.0.8 (clsid: BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196);
          TeeChart2010.ocx Version 2010.0.0.3 (clsid: FCB4B50A-E3F1-4174-BD18-54C3B3287258).

          The controls are deployed under several SCADA based systems including:

          Unitronics OPC server v1.3;
          BACnet Operator Workstation Version 1.0.76
Metasploit Module: Chilkat Crypt ActiveX WriteFile Unsafe Method
Type: exploit
Path: modules/exploits/windows/browser/chilkat_crypt_writefile.rb
Platform: win
Disclosure date: 2008-11-03
References: CVE-2008-5002, OSVDB-49510, BID-32073, EDB-6963

Description:
This module allows attackers to execute code via the 'WriteFile' unsafe method of
          Chilkat Software Inc's Crypt ActiveX control.

          This exploit is based on shinnai's exploit that uses an hcp:// protocol URI to
          execute our payload immediately. However, this method requires that the victim user
          be browsing with Administrator. Additionally, this method will not work on newer
          versions of Windows.

          NOTE: This vulnerability is still unpatched. The latest version of Chilkat Crypt at
          the time of this writing includes ChilkatCrypt2.DLL version 4.4.4.0.
Metasploit Module: Samsung NET-i Viewer Multiple ActiveX BackupToAvi() Remote Overflow
Type: exploit
Path: modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb
Platform: win
Disclosure date: 2012-04-21
References: CVE-2012-4333, OSVDB-81453, BID-53193, URL-http://aluigi.altervista.org/adv/netiware_1-adv.txt

Description:
This module exploits a vulnerability in the CNC_Ctrl.dll ActiveX control installed
          with the Samsung NET-i viewer 1.37.

          Specifically, when supplying a long string for the fname parameter to the
          BackupToAvi method, an integer overflow occurs, which leads to a posterior buffer
          overflow due to the use of memcpy with an incorrect size, resulting in remote code
          execution under the context of the user.
Metasploit Module: Firefox nsSMILTimeContainer::NotifyTimeChange() RCE
Type: exploit
Path: modules/exploits/windows/browser/firefox_smil_uaf.rb
Platform: win
Disclosure date: 2016-11-30
References: CVE-2016-9079, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=1321066, URL-https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/
Targets: Mozilla Firefox 38 to 41

Description:
This module exploits an out-of-bounds indexing/use-after-free condition present in
          nsSMILTimeContainer::NotifyTimeChange() across numerous versions of Mozilla Firefox
          on Microsoft Windows.
Metasploit Module: Trend Micro Internet Security Pro 2010 ActiveX extSetOwner() Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/trendmicro_extsetowner.rb
Platform: win
Disclosure date: 2010-08-25
References: CVE-2010-3189, OSVDB-67561, ZDI-10-165, EDB-14878

Description:
This module exploits a remote code execution vulnerability in Trend Micro
          Internet Security Pro 2010 ActiveX.
          When sending an invalid pointer to the extSetOwner() function of UfPBCtrl.dll
          an attacker may be able to execute arbitrary code.
Metasploit Module: Microsoft Help Center XSS and Command Execution
Type: exploit
Path: modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb
Platform: win
Disclosure date: 2010-06-09
References: CVE-2010-1885, OSVDB-65264, MSB-MS10-042

Description:
Help and Support Center is the default application provided to access online
          documentation for Microsoft Windows. Microsoft supports accessing help documents
          directly via URLs by installing a protocol handler for the scheme "hcp". Due to
          an error in validation of input to hcp:// combined with a local cross site
          scripting vulnerability and a specialized mechanism to launch the XSS trigger,
          arbitrary command execution can be achieved.

          On IE7 on XP SP2 or SP3, code execution is automatic. If WMP9 is installed, it
          can be used to launch the exploit automatically. If IE8 and WMP11, either can
          be used to launch the attack, but both pop dialog boxes asking the user if
          execution should continue. This exploit detects if non-intrusive mechanisms are
          available and will use one if possible. In the case of both IE8 and WMP11, the
          exploit defaults to using an iframe on IE8, but is configurable by setting the
          DIALOGMECH option to "none" or "player".

          This module creates a WebDAV service from which the payload is copied to the
          victim machine.
Metasploit Module: Apple Safari Webkit libxslt Arbitrary File Creation
Type: exploit
Path: modules/exploits/windows/browser/safari_xslt_output.rb
Platform: win
Disclosure date: 2011-07-20
Authors: Nicolas Gregoire
References: CVE-2011-1774, OSVDB-74017, URL-http://lists.apple.com/archives/Security-announce/2011/Jul/msg00002.html

Description:
This module exploits a file creation vulnerability in the Webkit
          rendering engine. It is possible to redirect the output of a XSLT
          transformation to an arbitrary file. The content of the created file must be
          ASCII or UTF-8. The destination path can be relative or absolute. This module
          has been tested on Safari and Maxthon. Code execution can be achieved by first
          uploading the payload to the remote machine in VBS format, and then upload a MOF
          file, which enables Windows Management Instrumentation service to execute the VBS.
Metasploit Module: Firefox 8/9 AttributeChildRemoved() Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/mozilla_attribchildremoved.rb
Platform: win
Disclosure date: 2011-12-06
References: CVE-2011-3659, OSVDB-78736, ZDI-12-110, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=708198

Description:
This module exploits a use-after-free vulnerability in Firefox 8/8.0.1 and 9/9.0.1.
          Removal of child nodes from the nsDOMAttribute can allow for a child
          to still be accessible after removal due to a premature notification
          of AttributeChildRemoved. Since mFirstChild is not set to NULL until
          after this call is made, this means the removed child will be accessible
          after it has been removed. By carefully manipulating the memory layout,
          this can lead to arbitrary code execution.
Metasploit Module: Persits XUpload ActiveX AddFile Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/hp_loadrunner_addfile.rb
Platform: win
Disclosure date: 2008-01-25
References: CVE-2008-0492, OSVDB-40762, BID-27456, EDB-4987

Description:
This module exploits a stack buffer overflow in Persits Software Inc's
          XUpload ActiveX control(version 3.0.0.3) thats included in HP LoadRunner 9.5.
          By passing an overly long string to the AddFile method, an attacker may be
          able to execute arbitrary code.
Metasploit Module: Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution
Type: exploit
Path: modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb
Platform: win
Disclosure date: 2010-08-30
References: CVE-2010-1818, OSVDB-67705, URL-http://reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1

Description:
This module exploits a memory trust issue in Apple QuickTime
          7.6.7. When processing a specially-crafted HTML page, the QuickTime ActiveX
          control will treat a supplied parameter as a trusted pointer. It will
          then use it as a COM-type pUnknown and lead to arbitrary code execution.

          This exploit utilizes a combination of heap spraying and the
          QuickTimeAuthoring.qtx module to bypass DEP and ASLR. This module does not
          opt-in to ASLR. As such, this module should be reliable on all Windows
          versions.

          NOTE: The addresses may need to be adjusted for older versions of QuickTime.
Metasploit Module: Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ask_shortformat.rb
Platform: win
Disclosure date: 2007-09-24
References: CVE-2007-5107, OSVDB-37735

Description:
This module exploits a stack buffer overflow in Ask.com Toolbar 4.0.2.53.
          An attacker may be able to execute arbitrary code by sending an overly
          long string to the "ShortFormat()" method in askbar.dll.
Metasploit Module: HP LoadRunner lrFileIOService ActiveX Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/hp_loadrunner_writefilebinary.rb
Platform: win
Disclosure date: 2013-07-24
References: CVE-2013-2370, OSVDB-95640, BID-61441, ZDI-13-182, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03862772

Description:
This module exploits a vulnerability on the lrFileIOService ActiveX, as installed
          with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method
          where user provided data is used as a memory pointer.  This module has been tested
          successfully on IE6-IE9 on Windows XP, Vista and 7, using the LrWebIERREWrapper.dll
          11.50.2216.0. In order to bypass ASLR the no aslr compatible module msvcr71.dll is
          used. This one is installed with HP LoadRunner.