deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MS12-027 MSCOMCTL ActiveX Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ms12_027_mscomctl_bof.rb
Platform: win
Disclosure date: 2012-04-10
References: CVE-2012-0158, OSVDB-81125, BID-52911, MSB-MS12-027, URL-http://contagiodump.blogspot.com.es/2012/04/cve2012-0158-south-china-sea-insider.html

Description:
This module exploits a stack buffer overflow in MSCOMCTL.OCX. It uses a malicious
          RTF to embed the specially crafted MSComctlLib.ListViewCtrl.2 Control as exploited
          in the wild on April 2012.

          This module targets Office 2007 and Office 2010 targets. The DEP/ASLR bypass on Office
          2010 is done with the Ikazuchi ROP chain proposed by Abysssec. This chain uses
          "msgr3en.dll", which will load after office got load, so the malicious file must
          be loaded through "File / Open" to achieve exploitation.
Metasploit Module: RealNetworks RealPlayer Version Attribute Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb
Platform: win
Disclosure date: 2013-12-20
References: BID-64695, EDB-30468, OSVDB-101356, CVE-2013-7260, US-CERT-VU-698278, URL-http://service.real.com/realplayer/security/12202013_player/en/

Description:
This module exploits a stack-based buffer overflow vulnerability in
          version 16.0.3.51 and 16.0.2.32 of RealNetworks RealPlayer, caused by
          improper bounds checking of the version and encoding attributes inside
          the XML declaration.

          By persuading the victim to open a specially-crafted .RMP file, a
          remote attacker could execute arbitrary code on the system or cause
          the application to crash.
Metasploit Module: Winamp MAKI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/winamp_maki_bof.rb
Platform: win
Disclosure date: 2009-05-20
References: CVE-2009-1831, OSVDB-54902, BID-35052, EDB-8783, EDB-8772, EDB-8770, EDB-8767, URL-http://vrt-sourcefire.blogspot.com/2009/05/winamp-maki-parsing-vulnerability.html

Description:
This module exploits a stack based buffer overflow in Winamp 5.55. The flaw
          exists in the gen_ff.dll and occurs while parsing a specially crafted MAKI file,
          where memmove is used in an insecure way with user controlled data.

          To exploit the vulnerability the attacker must convince the victim to install the
          generated mcvcore.maki file in the "scripts" directory of the default "Bento" skin,
          or generate a new skin using the crafted mcvcore.maki file. The module has been
          tested successfully on Windows XP SP3 and Windows 7 SP1.
Metasploit Module: MPlayer SAMI Subtitle File Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/mplayer_sami_bof.rb
Platform: win
Disclosure date: 2011-05-19
References: CVE-2011-3625, BID-49149, OSVDB-74604, URL-http://labs.mwrinfosecurity.com/files/Advisories/mwri_mplayer-sami-subtitles_2011-08-12.pdf

Description:
This module exploits a stack-based buffer overflow found in the handling
          of SAMI subtitles files in MPlayer SVN Versions before 33471. It currently
          targets SMPlayer 0.6.8, which is distributed with a vulnerable version of MPlayer.

          The overflow is triggered when an unsuspecting victim opens a movie file first,
          followed by loading the malicious SAMI subtitles file from the GUI. Or, it can also
          be done from the console with the MPlayer "-sub" option.
Metasploit Module: ActiveFax (ActFax) 4.3 Client Importer Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/actfax_import_users_bof.rb
Platform: win
Disclosure date: 2012-08-28
References: CVE-2012-10043, OSVDB-85175, EDB-20915, URL-http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html

Description:
This module exploits a vulnerability in ActiveFax Server. The vulnerability is
          a stack based buffer overflow in the "Import Users from File" function, due to the
          insecure usage of strcpy while parsing the csv formatted file. The module creates a
          .exp file that must be imported with ActiveFax Server. It must be imported with the
          default character set 'ECMA-94 / Latin 1 (ISO 8859)'. The module has been tested
          successfully on ActFax Server 4.32 over Windows XP SP3 and Windows 7 SP1. In the
          Windows XP case, when ActFax runs as a service, it will execute as SYSTEM.
Metasploit Module: TugZip 3.5 Zip File Parsing Buffer Overflow Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/tugzip.rb
Disclosure date: 2008-10-28
References: OSVDB-49371, CVE-2008-4779, BID-31913, EDB-12008

Description:
This module exploits a stack-based buffer overflow vulnerability
          in the latest version 3.5 of TugZip archiving utility.
          In order to trigger the vulnerability, an attacker must convince someone
          to load a specially crafted zip file with TugZip by double click or file open.
          By doing so, an attacker can execute arbitrary code as the victim user.
Metasploit Module: IBM Personal Communications iSeries Access WorkStation 5.9 Profile
Type: exploit
Path: modules/exploits/windows/fileformat/ibm_pcm_ws.rb
Platform: win
Disclosure date: 2012-02-28
Authors: TecR0c <roccogiovannicalvi[at]gmail.com>
References: CVE-2012-0201, OSVDB-79657, URL-https://www-304.ibm.com/support/docview.wss?uid=swg21586166

Description:
The IBM Personal Communications I-Series application WorkStation is susceptible to a
          stack-based buffer overflow vulnerability within file parsing in which data copied to a
          location in memory exceeds the size of the reserved destination area. The buffer is located
          on the runtime program stack.

          When the WorkStation file is opened it will reach the code path at 0x67575180 located in
          pcspref.dll which conducts string manipulation and validation on the data supplied in the
          WorkStation file. The application will first check if 'Profile' header exists and appends
          a dot with the next parameter within the file. It will then measure the character length
          of the header by calling strcspn with a dot as its null-terminated character.

          It will then write the header into memory and ensure the header ends with a NUL character.
          The parameter character array is passed to the strcpy() function. The application has
          declared a 52-element character array for the destination for strcpy function. The
          function does not perform bounds checking therefore, data can be written paste the end of
          the buffer variable resulting in corruption of adjacent variables including other local
          variables, program state information and function arguments. You will notice that the
          saved RETURN address at offset 0x6c is overwritten by the data written past the buffer.

          To ensure we can perform arbitrary code execution we must we provide a valid pointer at
          0x74 which is used as an argument for the called function at 0x675751ED as an id file
          extension parameter. Once the caller regains control we will reach our RETURN. The Ret
          instruction will be used to pop the overwritten saved return address which was corrupted.

          This exploit has been written to bypass 2 mitigations DEP and ASLR on a Windows platform.

          Versions tested:
          IBM System i Access for Windows V6R1M0 version 06.01.0001.0000a
          Which bundles pcsws.exe version 5090.27271.709

          Tested on:
          Microsoft Windows XP     [Version 5.1.2600]
          Microsoft Windows Vista  [Version 6.0.6002]
          Microsoft Windows 7      [Version 6.1.7600]
Metasploit Module: Documalis Free PDF Editor and Scanner JPEG Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/documalis_pdf_editor_and_scanner.rb
Platform: win
Disclosure date: 2020-05-22
References: CVE-2020-7374

Description:
Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not
          appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit
          this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the
          user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.
Metasploit Module: ERS Viewer 2013 ERS File Handling Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb
Platform: win
References: CVE-2013-3482, OSVDB-93650, URL-http://web.archive.org/web/[PII_REDACTED]5637/http://secunia.com:80/advisories/53620

Description:
This module exploits a buffer overflow vulnerability found in ERS Viewer 2013.
          The vulnerability exists in the module ermapper_u.dll, where the function
          rf_report_error handles user provided data in an insecure way. It results in
          arbitrary code execution under the context of the user viewing a specially crafted
          .ers file. This module has been tested successfully with ERS Viewer 2013 (versions
          13.0.0.1151) on Windows XP SP3 and Windows 7 SP1.
Metasploit Module: Adobe Illustrator CS4 v14.0.0
Type: exploit
Path: modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb
Platform: win
Disclosure date: 2009-12-03
References: CVE-2009-4195, BID-37192, OSVDB-60632, EDB-10281

Description:
Adobe Illustrator CS4 (V14.0.0) Encapsulated Postscript (.eps)
          overlong DSC Comment Buffer Overflow Exploit
Metasploit Module: ACDSee FotoSlate PLP File id Parameter Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/acdsee_fotoslate_string.rb
Platform: win
Disclosure date: 2011-09-12
References: CVE-2011-2595, OSVDB-75425, BID-49558

Description:
This module exploits a buffer overflow in ACDSee FotoSlate 4.0 Build 146 via
          a specially crafted id parameter in a String element.  When viewing a malicious
          PLP file with the ACDSee FotoSlate product, a remote attacker could overflow a
          buffer and execute arbitrary code. This exploit has been tested on systems such as
          Windows XP SP3, Windows Vista, and Windows 7.
Metasploit Module: MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/ms12_005.rb
Platform: win
Disclosure date: 2012-01-10
References: CVE-2012-0013, OSVDB-78207, MSB-MS12-005, BID-51284, URL-http://support.microsoft.com/default.aspx?scid=kb;EN-US;2584146, URL-http://exploitshop.wordpress.com/2012/01/14/ms12-005-embedded-object-package-allow-arbitrary-code-execution/

Description:
This module exploits a vulnerability found in Microsoft Office's ClickOnce
          feature.  When handling a Macro document, the application fails to recognize
          certain file extensions as dangerous executables, which can be used to bypass
          the warning message.  This can allow attackers to trick victims into opening the
          malicious document, which will load up either a python or ruby payload, and
          finally, download and execute an executable.
Metasploit Module: HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/hhw_hhp_contentfile_bof.rb
Platform: win
Disclosure date: 2006-02-06
References: CVE-2006-0564, OSVDB-22941, EDB-1470, EDB-1495

Description:
This module exploits a stack buffer overflow in HTML Help Workshop 4.74
          by creating a specially crafted hhp file.
Metasploit Module: BACnet OPC Client Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/bacnet_csv.rb
Platform: win
Disclosure date: 2010-09-16
References: CVE-2010-4740, OSVDB-68096, BID-43289, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-10-264-01

Description:
This module exploits a stack buffer overflow in SCADA
          Engine BACnet OPC Client v1.0.24. When the BACnet OPC Client
          parses a specially crafted csv file, arbitrary code may be
          executed.
Metasploit Module: VideoLAN VLC ModPlug ReadS3M Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/vlc_modplug_s3m.rb
Platform: win
Disclosure date: 2011-04-07
References: CVE-2011-1574, OSVDB-72143, URL-http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=aecef259828a89bb00c2e6f78e89de7363b2237b, URL-https://seclists.org/fulldisclosure/2011/Apr/113

Description:
This module exploits an input validation error in libmod_plugin as
          included with VideoLAN VLC 1.1.8. All versions prior to version 1.1.9
          are affected. By creating a malicious S3M file, a remote attacker
          could execute arbitrary code.

          Although other products that bundle libmodplug may be vulnerable, this
          module was only tested against VLC.

          NOTE: As of July 1st, 2010, VLC now calls SetProcessDEPPoly to
          permanently enable NX support on machines that support it. As such,
          this module is capable of bypassing DEP, but not ASLR.
Metasploit Module: MS14-017 Microsoft Word RTF Object Confusion
Type: exploit
Path: modules/exploits/windows/fileformat/ms14_017_rtf.rb
Platform: win
Disclosure date: 2014-04-01
References: CVE-2014-1761, MSB-MS14-017, URL-http://blogs.mcafee.com/mcafee-labs/close-look-rtf-zero-day-attack-cve-2014-1761-shows-sophistication-attackers, URL-https://www.virustotal.com/en/file/e378eef9f4ea1511aa5e368cb0e52a8a68995000b8b1e6207717d9ed09e8555a/analysis/

Description:
This module creates a malicious RTF file that when opened in
          vulnerable versions of Microsoft Word will lead to code execution.
          The flaw exists in how a listoverridecount field can be modified
          to treat one structure as another.

          This bug was originally seen being exploited in the wild starting
          in April 2014. This module was created by reversing a public
          malware sample.
Metasploit Module: Csound hetro File Handling Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/csound_getnum_bof.rb
Platform: win
Disclosure date: 2012-02-23
References: CVE-2012-0270, OSVDB-79491, BID-52144, URL-http://web.archive.org/web/[PII_REDACTED]4556/http://secunia.com/secunia_research/2012-3/, URL-http://csound.git.sourceforge.net/git/gitweb.cgi?p=csound/csound5.git;a=commit;h=7d617a9551fb6c552ba16874b71266fcd90f3a6f

Description:
This module exploits a buffer overflow in Csound before 5.16.6.
          The overflow occurs when trying to import a malicious hetro file
          from tabular format.
          In order to achieve exploitation the user should import the malicious
          file through csound with a command like "csound -U het_import msf.csd file.het".
          This exploit doesn't work if the "het_import" command is used directly
          to convert the file.
Metasploit Module: MS10-087 Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)
Type: exploit
Path: modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb
Platform: win
Disclosure date: 2010-11-09
References: CVE-2010-3333, OSVDB-69085, MSB-MS10-087, BID-44652, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880

Description:
This module exploits a stack-based buffer overflow in the handling of the
          'pFragments' shape property within the Microsoft Word RTF parser. All versions
          of Microsoft Office 2010, 2007, 2003, and XP prior to the release of the
          MS10-087 bulletin are vulnerable.

          This module does not attempt to exploit the vulnerability via Microsoft Outlook.

          The Microsoft Word RTF parser was only used by default in versions of Microsoft
          Word itself prior to Office 2007. With the release of Office 2007, Microsoft
          began using the Word RTF parser, by default, to handle rich-text messages within
          Outlook as well. It was possible to configure Outlook 2003 and earlier to use
          the Microsoft Word engine too, but it was not a default setting.

          It appears as though Microsoft Office 2000 is not vulnerable. It is unlikely that
          Microsoft will confirm or deny this since Office 2000 has reached its support
          cycle end-of-life.
Metasploit Module: S.O.M.P.L 1.0 Player Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/somplplayer_m3u.rb
Platform: win
Disclosure date: 2010-01-22
References: CVE-2012-10053, OSVDB-64368, EDB-11219

Description:
This module exploits a buffer overflow in Simple Open Music Player v1.0. When
          the application is used to import a specially crafted m3u file, a buffer overflow occurs
          allowing arbitrary code execution.
Metasploit Module: Fat Player Media Player 0.6b0 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/fatplayer_wav.rb
Platform: win
Disclosure date: 2010-10-18
References: CVE-2009-4962, OSVDB-57343, EDB-15279

Description:
This module exploits a buffer overflow in Fat Player 0.6b. When
          the application is used to import a specially crafted wav file, a buffer overflow occurs
          allowing arbitrary code execution.
Metasploit Module: Microsoft Office Word Malicious Hta Execution
Type: exploit
Path: modules/exploits/windows/fileformat/office_word_hta.rb
Platform: win
Disclosure date: 2017-04-14
References: CVE-2017-0199, URL-https://securingtomorrow.mcafee.com/mcafee-labs/critical-office-zero-day-attacks-detected-wild/, URL-https://www.fireeye.com/blog/threat-research/2017/04/acknowledgement_ofa.html, URL-https://www.helpnetsecurity.com/2017/04/10/ms-office-zero-day/, URL-https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html, URL-https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0251.html, URL-https://github.com/nccgroup/Cyber-Defence/blob/master/Technical%20Notes/Office%20zero-day%20(April%202017)/2017-04%20Office%20OLE2Link%20zero-day%20v0.4.pdf, URL-https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/, URL-https://www.hybrid-analysis.com/sample/ae48d23e39bf4619881b5c4dd2712b8fabd4f8bd6beb0ae167647995ba68100e?environmentId=100, URL-https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/

Description:
This module creates a malicious RTF file that when opened in
          vulnerable versions of Microsoft Word will lead to code execution.
          The flaw exists in how a olelink object can make a http(s) request,
          and execute hta code in response.

          This bug was originally seen being exploited in the wild starting
          in Oct 2016. This module was created by reversing a public
          malware sample.
Metasploit Module: Malicious Windows Script Host VBScript (.vbs) File
Type: exploit
Path: modules/exploits/windows/fileformat/windows_script_host_vbscript.rb
Platform: win
Disclosure date: 1998-06-25

Description:
This module creates a Windows Script Host (WSH) VBScript (.vbs) file.
Metasploit Module: MicroP 0.1.1.1600 (MPPL File) Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/microp_mppl.rb
Platform: win
Disclosure date: 2010-08-23
References: CVE-2010-5299, OSVDB-73627, EDB-14720

Description:
This module exploits a vulnerability found in MicroP 0.1.1.1600.  A stack-based
          buffer overflow occurs when the content of a .mppl file gets copied onto the stack,
          which overwrites the lpFileName parameter of a CreateFileA() function, and results
          arbitrary code execution under the context of the user.
Metasploit Module: ALLPlayer M3U Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/allplayer_m3u_bof.rb
Platform: win
Disclosure date: 2013-10-09
References: CVE-2013-7409, BID-62926, BID-63896, EDB-28855, EDB-29549, EDB-29798, EDB-32041, OSVDB-98283, URL-http://www.allplayer.org/

Description:
This module exploits a stack-based buffer overflow vulnerability in
          ALLPlayer 5.8.1, caused by a long string in a playlist entry.
          By persuading the victim to open a specially-crafted .M3U file, a
          remote attacker could execute arbitrary code on the system or cause
          the application to crash. This module has been tested successfully on
          Windows 7 SP1.
Metasploit Module: VMWare OVF Tools Format String Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/ovf_format_string.rb
Platform: win
Disclosure date: 2012-11-08
References: CVE-2012-3569, OSVDB-87117, BID-56468, URL-https://www.vmware.com/security/advisories/VMSA-2012-0015.html

Description:
This module exploits a format string vulnerability in VMWare OVF Tools 2.1 for
          Windows. The vulnerability occurs when printing error messages while parsing a
          a malformed OVF file. The module has been tested successfully with VMWare OVF Tools
          2.1 on Windows XP SP3.
Metasploit Module: Zahir Enterprise Plus 6 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/zahir_enterprise_plus_csv.rb
Platform: win
Disclosure date: 2018-09-28
References: CVE-2018-17408, EDB-45505

Description:
This module exploits a stack buffer overflow in Zahir Enterprise Plus version 6 build 10b and below.
          The vulnerability is triggered when opening a CSV file containing CR/LF and overly long string characters
          via Import from other File. This results in overwriting a structured exception handler record.
Metasploit Module: PointDev IDEAL Migration Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ideal_migration_ipj.rb
Platform: win
Disclosure date: 2009-12-05
References: CVE-2009-4265, OSVDB-60681, EDB-10319, EDB-12403, EDB-12404, EDB-12540

Description:
This module exploits a stack buffer overflow in versions v9.7
          through v10.5 of IDEAL Administration and versions 4.5 and 4.51 of
          IDEAL Migration. All versions are suspected to be vulnerable.
          By creating a specially crafted ipj file, an attacker may be able
          to execute arbitrary code.

          NOTE: IDEAL Administration 10.5 is compiled with /SafeSEH
Metasploit Module: Free MP3 CD Ripper 1.1 WAV File Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/free_mp3_ripper_wav.rb
Platform: win
Disclosure date: 2011-08-27
References: CVE-2011-5165, OSVDB-63349, EDB-11975, EDB-17727

Description:
This module exploits a stack based buffer overflow found in Free MP3 CD
          Ripper 1.1.  The overflow is triggered when an unsuspecting user opens a malicious
          WAV file.
Metasploit Module: Adobe Acrobat Bundled LibTIFF Integer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/adobe_libtiff.rb
Platform: win
Disclosure date: 2010-02-16
References: CVE-2010-0188, BID-38195, OSVDB-62526, URL-http://www.adobe.com/support/security/bulletins/apsb10-07.html, URL-http://web.archive.org/web/[PII_REDACTED]2318/http://secunia.com:80/blog/76, URL-http://bugix-security.blogspot.com/2010/03/adobe-pdf-libtiff-working-exploitcve.html

Description:
This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat
          Professional versions 8.0 through 8.2 and 9.0 through 9.3.
Metasploit Module: MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ms10_038_excel_obj_bof.rb
Platform: win
Disclosure date: 2010-06-08
References: CVE-2010-0822, OSVDB-65236, BID-40520, MSB-MS10-038, URL-https://www.exploit-db.com/moaub-24-microsoft-excel-obj-record-stack-overflow/

Description:
This module exploits a vulnerability found in Excel 2002 of Microsoft Office XP.
          By supplying a .xls file with a malformed OBJ (recType 0x5D) record an attacker
          can get the control of the execution flow. This results in arbitrary code execution under
          the context of the user.