deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Chrome 72.0.3626.119 FileReader UaF exploit for Windows 7 x86
Type: exploit
Path: modules/exploits/windows/browser/chrome_filereader_uaf.rb
Platform: windows
Disclosure date: 2019-03-21
References: CVE-2019-5786, URL-https://github.com/exodusintel/CVE-2019-5786, URL-https://blog.exodusintel.com/2019/03/20/cve-2019-5786-analysis-and-exploitation/, URL-https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/, URL-https://security.googleblog.com/2019/03/disclosing-vulnerabilities-to-protect.html

Description:
This exploit takes advantage of a use after free vulnerability in Google
          Chrome 72.0.3626.119 running on Windows 7 x86.
          The FileReader.readAsArrayBuffer function can return multiple references to the
          same ArrayBuffer object, which can be freed and overwritten with sprayed objects.
          The dangling ArrayBuffer reference can be used to access the sprayed objects,
          allowing arbitrary memory access from Javascript. This is used to write and
          execute shellcode in a WebAssembly object.
          The shellcode is executed within the Chrome sandbox, so you must explicitly
          disable the sandbox for the payload to be successful.
Metasploit Module: Adobe Reader ToolButton Use After Free
Type: exploit
Path: modules/exploits/windows/browser/adobe_toolbutton.rb
Platform: win
Disclosure date: 2013-08-08
References: CVE-2013-3346, OSVDB-96745, ZDI-13-212, URL-http://www.adobe.com/support/security/bulletins/apsb13-15.html, URL-http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html

Description:
This module exploits an use after free condition on Adobe Reader versions 11.0.2, 10.1.6
          and 9.5.4 and prior. The vulnerability exists while handling the ToolButton object, where
          the cEnable callback can be used to early free the object memory. Later use of the object
          allows triggering the use after free condition. This module has been tested successfully
          on Adobe Reader 11.0.2 and 10.0.4, with IE and Windows XP SP3, as exploited in the wild in
          November, 2013. At the moment, this module doesn't support Adobe Reader 9 targets; in order
          to exploit Adobe Reader 9 the fileformat version of the exploit can be used.
Metasploit Module: AdminStudio LaunchHelp.dll ActiveX Arbitrary Code Execution
Type: exploit
Path: modules/exploits/windows/browser/zenworks_helplauncher_exec.rb
Platform: win
Disclosure date: 2011-10-19
References: CVE-2011-2657, OSVDB-76700, BID-50274, ZDI-11-318, URL-http://www.novell.com/support/viewContent.do?externalId=7009570&sliceId=1

Description:
This module exploits a vulnerability in AdminStudio LaunchHelp.dll ActiveX control. The
          LaunchProcess function found in LaunchHelp.HelpLauncher.1 allows remote attackers to run
          arbitrary commands on the victim machine. This module has been successfully tested with the
          ActiveX installed with AdminStudio 9.5, which also comes with Novell ZENworks Configuration
          Management 10 SP2, on IE 6 and IE 8 over Windows XP SP 3.
Metasploit Module: Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/apple_quicktime_smil_debug.rb
Platform: win
Disclosure date: 2010-08-12
References: CVE-2010-1799, OSVDB-66636, BID-41962, URL-http://web.archive.org/web/[PII_REDACTED]3247/http://secunia.com:80/advisories/40729, URL-http://support.apple.com/kb/HT4290

Description:
This module exploits a buffer overflow in Apple QuickTime
          7.6.6. When processing a malformed SMIL uri, a stack-based buffer
          overflow can occur when logging an error message.
Metasploit Module: Amaya Browser v11.0 'bdo' Tag Overflow
Type: exploit
Path: modules/exploits/windows/browser/amaya_bdo.rb
Platform: win
Disclosure date: 2009-01-28
References: CVE-2009-0323, OSVDB-55721, BID-33046, BID-33047

Description:
This module exploits a stack buffer overflow in the Amaya v11 Browser.
          By sending an overly long string to the "bdo"
          tag, an attacker may be able to execute arbitrary code.
Metasploit Module: Adobe Flash Player MP4 'cprt' Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb
Platform: win
Disclosure date: 2012-02-15
References: CVE-2012-0754, OSVDB-79300, BID-52034, URL-http://contagiodump.blogspot.com/2012/03/mar-2-cve-2012-0754-irans-oil-and.html, URL-http://www.adobe.com/support/security/bulletins/apsb12-03.html

Description:
This module exploits a vulnerability found in Adobe Flash
          Player.  By supplying a corrupt .mp4 file loaded by Flash, it
          is possible to gain arbitrary remote code execution under the
          context of the user.

          This vulnerability has been exploited in the wild as part of
          the "Iran's Oil and Nuclear Situation.doc" e-mail attack.
          According to the advisory, 10.3.183.15 and 11.x before
          11.1.102.62 are affected.
Metasploit Module: TRENDnet SecurView Internet Camera UltraMJCam OpenFileDlg Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ultramjcam_openfiledig_bof.rb
Platform: win
Disclosure date: 2012-03-28
References: CVE-2012-4876, OSVDB-80661, EDB-18675

Description:
This module exploits a vulnerability found in TRENDnet SecurView Internet
          Camera's ActiveX control.  By supplying a long string of data as the sFilter
          argument of the OpenFileDlg() function, it is possible to trigger a buffer
          overflow condition due to WideCharToMultiByte (which converts unicode back to)
          overwriting the stack more than it should, which results arbitrary code execution
          under the context of the user.
Metasploit Module: Adobe Flash Player Integer Underflow Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_avm2.rb
Platform: win
Disclosure date: 2014-02-05
References: CVE-2014-0497, OSVDB-102849, BID-65327, URL-http://helpx.adobe.com/security/products/flash-player/apsb14-04.html, URL-http://blogs.technet.com/b/mmpc/archive/2014/02/17/a-journey-to-cve-2014-0497-exploit.aspx

Description:
This module exploits a vulnerability found in the ActiveX component of Adobe Flash Player
          before 12.0.0.43. By supplying a specially crafted swf file it is possible to trigger an
          integer underflow in several avm2 instructions, which can be turned into remote code
          execution under the context of the user, as exploited in the wild in February 2014. This
          module has been tested successfully with Adobe Flash Player 11.7.700.202 on Windows XP
          SP3, Windows 7 SP1 and Adobe Flash Player 11.3.372.94 on Windows 8 even when it includes
          rop chains for several Flash 11 versions, as exploited in the wild.
Metasploit Module: MS11-093 Microsoft Windows OLE Object File Handling Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ms11_093_ole32.rb
Platform: win
Disclosure date: 2011-12-13
References: MSB-MS11-093, CVE-2011-3400, OSVDB-77663, BID-50977, URL-http://aluigi.org/adv/ole32_1-adv.txt, URL-http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=966

Description:
This module exploits a type confusion vulnerability in the OLE32 component of
          Windows XP SP3. The vulnerability exists in the CPropertyStorage::ReadMultiple
          function.

          A Visio document with a specially crafted Summary Information Stream embedded allows
          to get remote code execution through Internet Explorer, on systems with Visio Viewer
          installed.
Metasploit Module: Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download
Type: exploit
Path: modules/exploits/windows/browser/ms08_041_snapshotviewer.rb
Platform: win
Disclosure date: 2008-07-07
References: CVE-2008-2463, OSVDB-46749, MSB-MS08-041, BID-30114

Description:
This module allows remote attackers to place arbitrary files on a users file system
          via the Microsoft Office Snapshot Viewer ActiveX Control.
Metasploit Module: Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute
Type: exploit
Path: modules/exploits/windows/browser/symantec_appstream_unsafe.rb
Platform: win
Disclosure date: 2009-01-15
References: CVE-2008-4388, OSVDB-51410

Description:
This module exploits a vulnerability in Symantec AppStream Client 5.x. The vulnerability
          is in the LaunchObj ActiveX control (launcher.dll 5.1.0.82) containing the "installAppMgr()"
          method. The insecure method can be exploited to download and execute arbitrary files in the
          context of the currently logged-on user.
Metasploit Module: MS10-002 Microsoft Internet Explorer Object Memory Use-After-Free
Type: exploit
Path: modules/exploits/windows/browser/ms10_002_ie_object.rb
Platform: win
Disclosure date: 2010-01-21
References: MSB-MS10-002, CVE-2010-0248, OSVDB-61914, URL-http://dvlabs.tippingpoint.com/blog/2012/03/15/pwn2own-2012-challenge-writeup, ZDI-10-014

Description:
This module exploits a vulnerability found in Internet Explorer's
          mshtml component.  Due to the way IE handles objects in memory, it is
          possible to cause a pointer in CTableRowCellsCollectionCacheItem::GetNext
          to be used even after it gets freed, therefore allowing remote code
          execution under the context of the user.

          This particular vulnerability was also one of 2012's Pwn2Own
          challenges, and was later explained by Peter Vreugdenhil with exploitation
          details.  Instead of Peter's method, this module uses heap spraying like
          the 99% to store a specially crafted memory layout before re-using the
          freed memory.
Metasploit Module: Juniper SSL-VPN IVE JuniperSetupDLL.dll ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/juniper_sslvpn_ive_setupdll.rb
Platform: win
Disclosure date: 2006-04-26
Authors: aushack
References: CVE-2006-2086, OSVDB-25001, BID-17712, URL-http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0743.html

Description:
This module exploits a stack buffer overflow in the JuniperSetupDLL.dll
          library which is called by the JuniperSetup.ocx ActiveX	control,
          as part of the Juniper SSL-VPN (IVE) appliance. By specifying an
          overly long string to the ProductName object parameter, the stack
          is overwritten.
Metasploit Module: MS13-037 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb
Platform: win
Disclosure date: 2013-03-06
References: CVE-2013-2551, OSVDB-91197, BID-58570, MSB-MS13-037, URL-http://binvul.com/viewthread.php?tid=311

Description:
This module exploits an integer overflow vulnerability on Internet Explorer.
          The vulnerability exists in the handling of the dashstyle.array length for vml
          shapes on the vgx.dll module.

          The exploit has been built and tested specifically against Windows 7 SP1 with
          Internet Explorer 8. It uses either JRE6 or an information leak (to ntdll) to
          bypass ASLR, and by default the info leak is used. To make sure the leak is
          successful, the ntdll version should be either v6.1.7601.17514 (the default dll
          version on a newly installed/unpatched Windows 7 SP1), or ntdll.dll v6.1.7601.17725
          (installed after apply MS12-001). If the target doesn't have the version the exploit
          wants, it will refuse to attack by sending a fake 404 message (webpage not found).

          If you wish to try the JRE6 component instead to bypass ASLR, you can set the
          advanced datastore option to 'JRE6'. If JRE6 is chosen but the target doesn't
          have this particular component, the exploit will also refuse to attack by
          sending a 404 message.
Metasploit Module: Sun Java Web Start Plugin Command Line Argument Injection
Type: exploit
Path: modules/exploits/windows/browser/java_ws_arginject_altjvm.rb
Platform: win
Disclosure date: 2010-04-09
Authors: jduck
References: CVE-2010-0886, CVE-2010-1423, OSVDB-63648, BID-39346, URL-http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0122.html, URL-http://www.reversemode.com/index.php?option=com_content&task=view&id=67&Itemid=1
Targets: Java Runtime on Windows x86

Description:
This module exploits a flaw in the Web Start plugin component of Sun Java
          Web Start. The arguments passed to Java Web Start are not properly validated.
          By passing the lesser known -J option, an attacker can pass arbitrary options
          directly to the Java runtime. By utilizing the -XXaltjvm option, as discussed
          by Ruben Santamarta, an attacker can execute arbitrary code in the context of
          an unsuspecting browser user.

          This vulnerability was originally discovered independently by both Ruben
          Santamarta and Tavis Ormandy. Tavis reported that all versions since version
          6 Update 10 "are believed to be affected by this vulnerability."

          In order for this module to work, it must be ran as root on a server that
          does not serve SMB. Additionally, the target host must have the WebClient
          service (WebDAV Mini-Redirector) enabled.
Metasploit Module: Adobe Flash Player UncompressViaZlibVariant Uninitialized Memory
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_uncompress_zlib_uninitialized.rb
Platform: win
Disclosure date: 2014-11-11
References: CVE-2014-8440, URL-https://helpx.adobe.com/security/products/flash-player/apsb14-24.html, URL-http://malware.dontneedcoffee.com/2014/11/cve-2014-8440.html, URL-http://www.verisigninc.com/en_US/cyber-security/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1081

Description:
This module exploits an uninitialized memory vulnerability in Adobe Flash Player. The
          vulnerability occurs in the ByteArray::UncompressViaZlibVariant method, which fails
          to initialize allocated memory. When using a correct memory layout this vulnerability
          leads to a ByteArray object corruption, which can be abused to access and corrupt memory.
          This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 and IE11 with
          Flash 15.0.0.189.
Metasploit Module: McAfee Subscription Manager Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb
Platform: %{ win }
Disclosure date: 2006-08-01
References: CVE-2006-3961, OSVDB-27698, BID-19265

Description:
This module exploits a flaw in the McAfee Subscription Manager ActiveX control.
          Due to an unsafe use of vsprintf, it is possible to trigger a stack buffer overflow by
          passing a large string to one of the COM-exposed routines, such as IsAppExpired.
          This vulnerability was discovered by Karl Lynn of eEye.
Metasploit Module: Adobe util.printf() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_utilprintf.rb
Platform: win
Disclosure date: 2008-02-08
References: CVE-2008-2992, OSVDB-49520

Description:
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional
          < 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf()
          entry, an attacker may be able to execute arbitrary code.
Metasploit Module: Adobe Flash Player domainMemory ByteArray Use After Free
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_domain_memory_uaf.rb
Platform: win
Disclosure date: 2014-04-14
References: CVE-2015-0359, URL-https://helpx.adobe.com/security/products/flash-player/apsb15-06.html, URL-https://www.fireeye.com/blog/threat-research/2015/04/angler_ek_exploiting.html, URL-http://malware.dontneedcoffee.com/2015/04/cve-2015-0359-flash-up-to-1700134-and.html, URL-https://git.hacklab.kr/snippets/13, URL-http://pastebin.com/Wj3NViUu

Description:
This module exploits a use-after-free vulnerability in Adobe Flash Player. The
          vulnerability occurs when the ByteArray assigned to the current ApplicationDomain
          is freed from an ActionScript worker, when forcing a reallocation by copying more
          contents than the original capacity, but Flash forgets to update the domainMemory
          pointer, leading to a use-after-free situation when the main worker references the
          domainMemory again. This module has been tested successfully on Windows 7 SP1
          (32-bit), IE 8 and IE11 with Flash 17.0.0.134.
Metasploit Module: MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/ms10_090_ie_css_clip.rb
Platform: win
Disclosure date: 2010-11-03
References: CVE-2010-3962, OSVDB-68987, BID-44536, EDB-15421, MSB-MS10-090

Description:
This module exploits a memory corruption vulnerability within Microsoft's
          HTML engine (mshtml). When parsing an HTML page containing a specially
          crafted CSS tag, memory corruption occurs that can lead arbitrary code
          execution.

          It seems like Microsoft code inadvertently increments a vtable pointer to
          point to an unaligned address within the vtable's function pointers. This
          leads to the program counter being set to the address determined by the
          address "[vtable+0x30+1]". The particular address depends on the exact
          version of the mshtml library in use.

          Since the address depends on the version of mshtml, some versions may not
          be exploitable. Specifically, those ending up with a program counter value
          within another module, in kernel space, or just not able to be reached with
          various memory spraying techniques.

          Also, since the address is not controllable, it is unlikely to be possible
          to use ROP to bypass non-executable memory protections.
Metasploit Module: Microsoft Whale Intelligent Application Gateway ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/mswhale_checkforupdates.rb
Platform: win
Disclosure date: 2009-04-15
References: CVE-2007-2238, OSVDB-53933, URL-http://technet.microsoft.com/en-us/library/dd282918.aspx

Description:
This module exploits a stack buffer overflow in Microsoft Whale Intelligent Application
          Gateway Whale Client. When sending an overly long string to CheckForUpdates()
          method of WhlMgr.dll (3.1.502.64) an attacker may be able to execute
          arbitrary code.
Metasploit Module: Sun Java Applet2ClassLoader Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/java_codebase_trust.rb
Platform: java
Disclosure date: 2011-02-15
References: CVE-2010-4452, OSVDB-71193, ZDI-11-084, URL-http://fhoguin.com/2011/03/oracle-java-unsigned-applet-applet2classloader-remote-code-execution-vulnerability-zdi-11-084-explained/, URL-http://www.oracle.com/technetwork/topics/security/javacpufeb2011-304611.html
Targets: Generic (Java Payload), Windows x86

Description:
This module exploits a vulnerability in the Java Runtime Environment
          that allows an attacker to run an applet outside of the Java Sandbox. When
          an applet is invoked with:

          1. A "codebase" parameter that points at a trusted directory
          2. A "code" parameter that is a URL that does not contain any dots

          the applet will run outside of the sandbox.

          This vulnerability affects JRE prior to version 6 update 24.
Metasploit Module: Novell iPrint Client ActiveX Control ExecuteRequest debug Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/novelliprint_executerequest_dbg.rb
Platform: win
Disclosure date: 2010-08-04
References: CVE-2010-3106, OSVDB-66960, URL-http://dvlabs.tippingpoint.com/advisory/TPTI-10-06, EDB-15001

Description:
This module exploits a stack-based buffer overflow in Novell iPrint Client 5.40.
          When sending an overly long string to the 'debug' parameter in ExecuteRequest()
          property of ienipp.ocx an attacker may be able to execute arbitrary code.
Metasploit Module: Cisco WebEx Chrome Extension RCE (CVE-2017-3823)
Type: exploit
Path: modules/exploits/windows/browser/cisco_webex_ext.rb
Platform: win
Disclosure date: 2017-01-21
References: CVE-2017-3823
Targets: Cisco WebEx Extension 1.0.1

Description:
This module exploits a vulnerability present in the Cisco WebEx Chrome Extension
          version 1.0.1 which allows an attacker to execute arbitrary commands on a system.
Metasploit Module: MS03-020 Microsoft Internet Explorer Object Type
Type: exploit
Path: modules/exploits/windows/browser/ms03_020_ie_objecttype.rb
Platform: win
Disclosure date: 2003-06-04
Authors: skape
References: CVE-2003-0344, OSVDB-2967, BID-7806, MSB-MS03-020

Description:
This module exploits a vulnerability in Internet Explorer's
          handling of the OBJECT type attribute.
Metasploit Module: Adobe Doc.media.newPlayer Use After Free Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/adobe_media_newplayer.rb
Platform: win
Disclosure date: 2009-12-14
References: CVE-2009-4324, BID-37331, OSVDB-60980, URL-http://www.adobe.com/support/security/bulletins/apsb10-02.html

Description:
This module exploits a use after free vulnerability in Adobe Reader and Adobe Acrobat
          Professional versions up to and including 9.2.
Metasploit Module: KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/keyhelp_launchtripane_exec.rb
Platform: win
Disclosure date: 2012-06-26
References: CVE-2012-2516, OSVDB-83311, BID-55265, ZDI-12-169, URL-http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14863

Description:
This module exploits a code execution vulnerability in the KeyScript ActiveX
          control from keyhelp.ocx. It is packaged in several products or GE, such as
          Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy
          Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver between 7.20 and 7.42.
          When the control is installed with these products, the function "LaunchTriPane"
          will use ShellExecute to launch "hh.exe", with user controlled data as parameters.
          Because of this, the "-decompile" option can be abused to write arbitrary files on
          the remote system.

          Code execution can be achieved by first uploading the payload to the remote
          machine, and then upload another mof file, which enables Windows Management
          Instrumentation service to execute it. Please note that this module currently only
          works for Windows before Vista.

          On the other hand, the target host must have the WebClient service (WebDAV
          Mini-Redirector) enabled. It is enabled and automatically started by default on
          Windows XP SP3
Metasploit Module: Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb
Platform: win
Disclosure date: 2013-04-16
References: CVE-2013-1559, OSVDB-92386, BID-59122, URL-http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html, ZDI-13-094

Description:
This module exploits a vulnerability found in the Oracle WebCenter Content
          CheckOutAndOpenControl ActiveX. This vulnerability exists in openWebdav(), where
          user controlled input is used to call ShellExecuteExW(). This module abuses the
          control to execute an arbitrary HTA from a remote location. This module has been
          tested successfully with the CheckOutAndOpenControl ActiveX installed with Oracle
          WebCenter Content 11.1.1.6.0.