deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MailEnable IMAPD (1.54) STATUS Request Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/mailenable_status.rb
Platform: win
Disclosure date: 2005-07-13
References: CVE-2005-2278, OSVDB-17844, BID-14243, URL-http://www.nessus.org/plugins/index.php?view=single&id=19193

Description:
MailEnable's IMAP server contains a buffer overflow
          vulnerability in the STATUS command. With proper
          credentials, this could allow for the execution of arbitrary
          code.
Metasploit Module: Novell NetMail IMAP AUTHENTICATE Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/novell_netmail_auth.rb
Platform: win
Disclosure date: 2007-01-07
References: CVE-2005-1758, OSVDB-55175

Description:
This module exploits a stack buffer overflow in Novell's NetMail 3.52 IMAP AUTHENTICATE
          GSSAPI command. By sending an overly long string, an attacker can overwrite the
          buffer and control program execution. Using the PAYLOAD of windows/shell_bind_tcp
          or windows/shell_reverse_tcp allows for the most reliable results.
Metasploit Module: Qualcomm WorldMail 3.0 IMAPD LIST Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/eudora_list.rb
Platform: win
Disclosure date: 2005-12-20
References: CVE-2005-4267, OSVDB-22097, BID-15980

Description:
This module exploits a stack buffer overflow in the Qualcomm WorldMail IMAP Server
          version 3.0 (builds 6.1.19.0 through 6.1.22.0). Version 6.1.22.1 fixes this
          particular vulnerability.

          NOTE: The service does NOT restart automatically by default. You may be limited to
          only one attempt, so choose wisely!

Check method (fingerprinting):
targ = auto_target
    disconnect

    return Exploit::CheckCode::Appears('Vulnerable Eudora WorldMail IMAP server detected') if (targ)

    return Exploit::CheckCode::Safe('Eudora WorldMail IMAP server not detected')
  end
Metasploit Module: Mercur v5.0 IMAP SP3 SELECT Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/mercur_imap_select_overflow.rb
Platform: win
Disclosure date: 2006-03-17
References: CVE-2006-1255, OSVDB-23950, BID-17138

Description:
Mercur v5.0 IMAP server is prone to a remotely exploitable
          stack-based buffer overflow vulnerability. This issue is due
          to a failure of the application to properly bounds check
          user-supplied data prior to copying it to a fixed size memory buffer.
          Credit to Tim Taylor for discover the vulnerability.
Metasploit Module: Novell NetMail IMAP STATUS Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/novell_netmail_status.rb
Platform: win
Disclosure date: 2005-11-18
References: CVE-2005-3314, OSVDB-20956, BID-15491

Description:
This module exploits a stack buffer overflow in Novell's NetMail 3.52 IMAP STATUS
          verb. By sending an overly long string, an attacker can overwrite the
          buffer and control program execution.
Metasploit Module: Mercur Messaging 2005 IMAP Login Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/mercur_login.rb
Platform: win
Disclosure date: 2006-03-17
References: CVE-2006-1255, OSVDB-23950, BID-17138, URL-http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1104.html

Description:
This module exploits a stack buffer overflow in Atrium Mercur IMAP 5.0 SP3.
          Since the room for shellcode is small, using the reverse ordinal payloads
          yields the best results.
Metasploit Module: Novell NetMail IMAP SUBSCRIBE Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/novell_netmail_subscribe.rb
Platform: win
Disclosure date: 2006-12-23
References: CVE-2006-6761, OSVDB-31360, BID-21728, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=454

Description:
This module exploits a stack buffer overflow in Novell's NetMail 3.52 IMAP SUBSCRIBE
          verb. By sending an overly long string, an attacker can overwrite the
          buffer and control program execution.
Metasploit Module: MailEnable IMAPD W3C Logging Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/mailenable_w3c_select.rb
Platform: win
Disclosure date: 2005-10-03
References: CVE-2005-3155, OSVDB-19842, BID-15006

Description:
This module exploits a buffer overflow in the W3C logging
          functionality of the MailEnable IMAPD service. Logging is
          not enabled by default and this exploit requires a valid
          username and password to exploit the flaw. MailEnable
          Professional version 1.6 and prior and MailEnable Enterprise
          version 1.1 and prior are affected.

Check method (fingerprinting):
connect
    disconnect

    if (banner and banner =~ /MailEnable Service, Version: 0-1\.54/)
      return Exploit::CheckCode::Appears('MailEnable IMAP version 0-1.54 detected')
    end

    return Exploit::CheckCode::Safe('MailEnable IMAP version 0-1.54 not detected')
  end
Metasploit Module: IMail IMAP4D Delete Overflow
Type: exploit
Path: modules/exploits/windows/imap/imail_delete.rb
Platform: win
Disclosure date: 2004-11-12
References: CVE-2004-1520, OSVDB-11838, BID-11675

Description:
This module exploits a buffer overflow in the 'DELETE'
          command of the IMail IMAP4D service. This vulnerability
          can only be exploited with a valid username and password.
          This flaw was patched in version 8.14.
Metasploit Module: Mercury/32 4.01 IMAP LOGIN SEH Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/mercury_login.rb
Platform: win
Disclosure date: 2007-03-06
References: CVE-2007-1373, EDB-3418

Description:
This module exploits a stack buffer overflow in Mercury/32 <= 4.01b IMAPD
          LOGIN verb. By sending a specially crafted login command, a buffer
          is corrupted, and code execution is possible. This vulnerability was
          discovered by (mu-b at digit-labs.org).

Check method (fingerprinting):
connect
    resp = sock.get_once
    disconnect
    return CheckCode::Vulnerable('Mercury/32 v4.01a or v4.01b IMAP server detected') if resp =~ %r{Mercury/32 v4\.01[ab]}

    Exploit::CheckCode::Safe('Mercury/32 v4.01a or v4.01b IMAP server not detected')
  end
Metasploit Module: Mercury/32 v4.01a IMAP RENAME Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/mercury_rename.rb
Platform: win
Disclosure date: 2004-11-29
References: CVE-2004-1211, OSVDB-12508, BID-11775, URL-http://www.nessus.org/plugins/index.php?view=single&id=15867

Description:
This module exploits a stack buffer overflow vulnerability in the
          Mercury/32 v.4.01a IMAP service.

Check method (fingerprinting):
connect
    resp = sock.get_once
    disconnect

    if (resp =~ /Mercury\/32 v4\.01a/)
      return Exploit::CheckCode::Appears('Mercury/32 v4.01a IMAP server detected')
    end

    return Exploit::CheckCode::Safe('Mercury/32 v4.01a IMAP server not detected')
  end
Metasploit Module: MailEnable IMAPD (2.34/2.35) Login Request Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/mailenable_login.rb
Platform: win
Disclosure date: 2006-12-11
References: CVE-2006-6423, OSVDB-32125, BID-21492

Description:
MailEnable's IMAP server contains a buffer overflow
          vulnerability in the Login command.
Metasploit Module: MDaemon 9.6.4 IMAPD FETCH Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/mdaemon_fetch.rb
Platform: win
Disclosure date: 2008-03-13
References: CVE-2008-1358, OSVDB-43111, BID-28245, EDB-5248

Description:
This module exploits a stack buffer overflow in the Alt-N MDaemon IMAP Server
          version 9.6.4 by sending an overly long FETCH BODY command. Valid IMAP
          account credentials are required. Credit to Matteo Memelli

Check method (fingerprinting):
connect
    disconnect

    if (banner and banner =~ /IMAP4rev1 MDaemon 9\.6\.4 ready/)
      return Exploit::CheckCode::Appears('MDaemon 9.6.4 IMAP server detected')
    end

    return Exploit::CheckCode::Safe('MDaemon 9.6.4 IMAP server not detected')
  end
Metasploit Module: Novell NetMail IMAP APPEND Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/novell_netmail_append.rb
Platform: win
Disclosure date: 2006-12-23
References: CVE-2006-6425, OSVDB-31362, BID-21723, ZDI-06-054

Description:
This module exploits a stack buffer overflow in Novell's Netmail 3.52 IMAP APPEND
          verb. By sending an overly long string, an attacker can overwrite the
          buffer and control program execution.
Metasploit Module: Mdaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow
Type: exploit
Path: modules/exploits/windows/imap/mdaemon_cram_md5.rb
Platform: win
Disclosure date: 2004-11-12
References: CVE-2004-1520, OSVDB-11838, BID-11675

Description:
This module exploits a buffer overflow in the CRAM-MD5
          authentication of the MDaemon IMAP service. This
          vulnerability was discovered by Muts.
Metasploit Module: Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow
Type: exploit
Path: modules/exploits/windows/oracle/tns_auth_sesskey.rb
Platform: win
Disclosure date: 2009-10-20
References: CVE-2009-1979, OSVDB-59110, BID-36747, URL-http://blogs.conus.info/node/28, URL-http://blogs.conus.info/node/35, URL-http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html

Description:
This module exploits a stack buffer overflow in Oracle. When
          sending a specially crafted packet containing a long AUTH_SESSKEY value
          to the TNS service, an attacker may be able to execute arbitrary code.

Check method (fingerprinting):
version = tns_version
    if (not version)
      vprint_error("Unable to detect the Oracle version!")
      return Exploit::CheckCode::Unknown('Unable to detect the Oracle version')
    end
    vprint_status("Oracle version reply: " + version)
    return Exploit::CheckCode::Appears("Oracle version #{version} may be vulnerable") if (version =~ /32-bit Windows: Version 10\.2\.0\.1\.0/)
    return Exploit::CheckCode::Appears("Oracle version #{version} may be vulnerable") if (version =~ /32-bit Windows: Version 10\.2\.0\.4\.0/)

    return Exploit::CheckCode::Safe('Oracle version is not vulnerable')
  end
Metasploit Module: Oracle 8i TNS Listener SERVICE_NAME Buffer Overflow
Type: exploit
Path: modules/exploits/windows/oracle/tns_service_name.rb
Platform: win
Disclosure date: 2002-05-27
References: CVE-2002-0965, OSVDB-5041, BID-4845, URL-http://www.oracle.com/technology/deploy/security/pdf/net9_dos_alert.pdf

Description:
This module exploits a stack buffer overflow in Oracle. When
          sending a specially crafted packet containing a long SERVICE_NAME
          to the TNS service, an attacker may be able to execute arbitrary code.

Check method (fingerprinting):
connect

    version = "(CONNECT_DATA=(COMMAND=VERSION))"
    pkt = tns_packet(version)
    sock.put(pkt)

    sock.get_once
    res = sock.get_once(-1, 1)

    disconnect

    if (res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/)
      return Exploit::CheckCode::Appears('Oracle TNS Listener version 8.1.7.0.0 detected')
    end

    return Exploit::CheckCode::Safe('Oracle TNS Listener version 8.1.7.0.0 not detected')
  end
Metasploit Module: Oracle Database Client System Analyzer Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/oracle/client_system_analyzer_upload.rb
Disclosure date: 2011-01-18
References: CVE-2010-3600, OSVDB-70546, BID-45883, ZDI-11-018, URL-http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

Description:
This module exploits an arbitrary file upload vulnerability on the Client
          Analyzer component as included in Oracle Database 11g, which allows remote
          attackers to upload and execute arbitrary code. This module has been tested
          successfully on Oracle Database 11g 11.2.0.1.0 on Windows 2003 SP2, where execution
          through the Windows Management Instrumentation service has been used.

Check method (fingerprinting):
file_name = rand_text_alpha(rand(5) + 5)
    file_contents = rand_text_alpha(rand(20) + 20)

    data = "sessionID=#{file_name}.txt\x00.xml"
    data << "\x0d\x0a"
    data << Rex::Text.uri_encode(file_contents)

    print_status("Uploading the CSA#{file_name}.txt file")
    res = upload_file(data)
    if not res or res.code != 200 or (res.body !~ /posted data was written to placeholder file/ and res.body !~ /csaPostStatus=0/)
      vprint_error("The test file could not be uploaded")
      return Exploit::CheckCode::Safe('Test file could not be uploaded')
    end

    print_status("Checking uploaded contents...")
    res = send_request_raw({ 'uri' => "/em/CSA#{file_name}.txt" })

    if res and res.code == 200 and res.body =~ /#{file_contents}/
      return Exploit::CheckCode::Vulnerable('Successfully uploaded and verified test file')
    end

    return Exploit::CheckCode::Appears('File upload succeeded but content verification failed')
  end
Metasploit Module: Oracle Job Scheduler Named Pipe Command Execution
Type: exploit
Path: modules/exploits/windows/oracle/extjob.rb
Platform: win
Disclosure date: 2007-01-01
References: URL-http://www.amazon.com/Oracle-Hackers-Handbook-Hacking-Defending/dp/[PII_REDACTED]

Description:
This module exploits the Oracle Job Scheduler to execute arbitrary commands. The Job
          Scheduler is implemented via the component extjob.exe which listens on a named pipe
          called "orcljsex<SID>" and execute arbitrary commands received over this channel via
          CreateProcess(). In order to connect to the Named Pipe remotely, SMB access is required.
          Note that the Job Scheduler is disabled in default installations.

Check method (fingerprinting):
begin
      connect()
      smb_login()
      pipe = simple.create_pipe("\\orcljsex#{datastore['SID']}")
      pipe.write("cmd.exe /q /c dir")
      result = pipe.read() # Exit Code
      pipe.close
      disconnect
    rescue
      return Exploit::CheckCode::Safe('Could not connect to the named pipe')
    end

    if result == "1" # Exit Code should be 1
      return Exploit::CheckCode::Vulnerable('Successfully executed command via extjob named pipe')
    end

    return Exploit::CheckCode::Safe('Command execution via extjob named pipe failed')
  end
Metasploit Module: Oracle 8i TNS Listener (ARGUMENTS) Buffer Overflow
Type: exploit
Path: modules/exploits/windows/oracle/tns_arguments.rb
Platform: win
Disclosure date: 2001-06-28
References: CVE-2001-0499, OSVDB-9427, BID-2941

Description:
This module exploits a stack buffer overflow in Oracle 8i. When
          sending a specially crafted packet containing an overly long
          ARGUMENTS string to the TNS service, an attacker may be able
          to execute arbitrary code.

Check method (fingerprinting):
connect
    version = "(CONNECT_DATA=(COMMAND=VERSION))"
    pkt = tns_packet(version)
    sock.put(pkt)
    sock.get_once
    res = sock.get_once(-1, 1)
    disconnect

    if (res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/)
      return Exploit::CheckCode::Appears('Oracle TNS Listener version 8.1.7.0.0 detected')
    end

    return Exploit::CheckCode::Safe('Oracle TNS Listener version 8.1.7.0.0 not detected')
  end
Metasploit Module: Oracle Secure Backup NDMP_CONNECT_CLIENT_AUTH Buffer Overflow
Type: exploit
Path: modules/exploits/windows/oracle/osb_ndmp_auth.rb
Platform: win
Disclosure date: 2009-01-14
References: CVE-2008-5444, OSVDB-51340, URL-http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html

Description:
The module exploits a stack buffer overflow in Oracle Secure Backup.
          When sending a specially crafted NDMP_CONNECT_CLIENT_AUTH packet,
          an attacker may be able to execute arbitrary code.
Metasploit Module: Allied Telesyn TFTP Server 1.9 Long Filename Overflow
Type: exploit
Path: modules/exploits/windows/tftp/attftp_long_filename.rb
Platform: win
Disclosure date: 2006-11-27
References: CVE-2006-6184, OSVDB-11350, BID-21320, EDB-2887

Description:
This module exploits a stack buffer overflow in AT-TFTP v1.9, by sending a
          request (get/write) for an overly long file name.
Metasploit Module: D-Link TFTP 1.0 Long Filename Buffer Overflow
Type: exploit
Path: modules/exploits/windows/tftp/dlink_long_filename.rb
Platform: win
Disclosure date: 2007-03-12
References: CVE-2007-1435, OSVDB-33977, BID-22923

Description:
This module exploits a stack buffer overflow in D-Link TFTP 1.0.
          By sending a request for an overly long file name, an attacker
          could overflow a buffer and execute arbitrary code. For best results,
          use bind payloads with nonx (No NX).
Metasploit Module: Distinct TFTP 3.10 Writable Directory Traversal Execution
Type: exploit
Path: modules/exploits/windows/tftp/distinct_tftp_traversal.rb
Platform: win
Disclosure date: 2012-04-08
References: OSVDB-80984, EDB-18718, URL-http://www.spentera.com/advisories/2012/SPN-01-2012.pdf, CVE-2012-6664

Description:
This module exploits a directory traversal vulnerability in the TFTP
          Server component of Distinct Intranet Servers version 3.10 which
          allows a remote attacker to write arbitrary files to the server file
          system, resulting in code execution under the context of 'SYSTEM'.
          This module has been tested successfully on TFTP Server version 3.10
          on Windows XP SP3 (EN).
Metasploit Module: OpenTFTP SP 1.4 Error Packet Overflow
Type: exploit
Path: modules/exploits/windows/tftp/opentftp_error_code.rb
Platform: win
Disclosure date: 2008-07-05
References: CVE-2008-2161, OSVDB-44904, BID-29111, URL-http://downloads.securityfocus.com/vulnerabilities/exploits/29111.pl

Description:
This module exploits a buffer overflow in OpenTFTP Server SP 1.4.  The vulnerable
          condition triggers when the TFTP opcode is configured as an error packet, the TFTP
          service will then format the message using a sprintf() function, which causes an
          overflow, therefore allowing remote code execution under the context of SYSTEM.

          The offset (to EIP) is specific to how the TFTP was started (as a 'Stand Alone',
          or 'Service').  By default the target is set to 'Service' because that's the default
          configuration during OpenTFTP Server SP 1.4's installation.
Metasploit Module: 3CTftpSvc TFTP Long Mode Buffer Overflow
Type: exploit
Path: modules/exploits/windows/tftp/threectftpsvc_long_mode.rb
Platform: win
Disclosure date: 2006-11-27
Authors: MC
References: CVE-2006-6183, OSVDB-30758, BID-21301, URL-http://web.archive.org/web/[PII_REDACTED]4920/http://secunia.com:80/advisories/23113

Description:
This module exploits a stack buffer overflow in 3CTftpSvc 2.0.1. By
          sending a specially crafted packet with an overly long mode
          field, a remote attacker could overflow a buffer and execute
          arbitrary code on the system.
Metasploit Module: TFTPD32 Long Filename Buffer Overflow
Type: exploit
Path: modules/exploits/windows/tftp/tftpd32_long_filename.rb
Platform: win
Disclosure date: 2002-11-19
Authors: MC
References: CVE-2002-2226, OSVDB-45903, BID-6199

Description:
This module exploits a stack buffer overflow in TFTPD32 version 2.21
          and prior. By sending a request for an overly long file name
          to the tftpd32 server, a remote attacker could overflow a buffer and
          execute arbitrary code on the system.
Metasploit Module: Quick FTP Pro 2.1 Transfer-Mode Overflow
Type: exploit
Path: modules/exploits/windows/tftp/quick_tftp_pro_mode.rb
Platform: win
Disclosure date: 2008-03-27
Authors: Saint Patrick
References: CVE-2008-1610, OSVDB-43784, BID-28459, URL-http://web.archive.org/web/[PII_REDACTED]0001/http://secunia.com:80/advisories/29494/

Description:
This module exploits a stack buffer overflow in the Quick TFTP Pro server
          product. MS Update KB926436 screws up the opcode address being used in oledlg.dll resulting
          in a DoS.  This is a port of a sploit by Mati "muts" Aharoni.
Metasploit Module: NetDecision 4.2 TFTP Writable Directory Traversal Execution
Type: exploit
Path: modules/exploits/windows/tftp/netdecision_tftp_traversal.rb
Platform: win
Disclosure date: 2009-05-16
References: CVE-2009-1730, OSVDB-54607, BID-35002

Description:
This module exploits a vulnerability found in NetDecision 4.2 TFTP server. The
          software contains a directory traversal vulnerability that allows a remote attacker
          to write arbitrary file to the file system, which results in code  execution under
          the context of user executing the TFTP Server.
Metasploit Module: FutureSoft TFTP Server 2000 Transfer-Mode Overflow
Type: exploit
Path: modules/exploits/windows/tftp/futuresoft_transfermode.rb
Platform: win
Disclosure date: 2005-05-31
Authors: MC
References: CVE-2005-1812, OSVDB-16954, BID-13821

Description:
This module exploits a stack buffer overflow in the FutureSoft TFTP Server
          2000 product. By sending an overly long transfer-mode string, we were able
          to overwrite both the SEH and the saved EIP. A subsequent write-exception
          that will occur allows the transferring of execution to our shellcode
          via the overwritten SEH. This module has been tested against Windows
          2000 Professional and for some reason does not seem to work against
          Windows 2000 Server (could not trigger the overflow at all).
Metasploit Module: TFTPDWIN v0.4.2 Long Filename Buffer Overflow
Type: exploit
Path: modules/exploits/windows/tftp/tftpdwin_long_filename.rb
Platform: win
Disclosure date: 2006-09-21
References: CVE-2006-4948, OSVDB-29032, BID-20131, EDB-3132

Description:
This module exploits the ProSysInfo TFTPDWIN threaded TFTP Server. By sending
          an overly long file name to the tftpd.exe server, the stack can be overwritten.
Metasploit Module: TFTP Server for Windows 1.4 ST WRQ Buffer Overflow
Type: exploit
Path: modules/exploits/windows/tftp/tftpserver_wrq_bof.rb
Platform: win
Disclosure date: 2008-03-26
References: CVE-2008-1611, OSVDB-43785, BID-18345, EDB-5314

Description:
This module exploits a vulnerability found in TFTP Server 1.4 ST.  The flaw
          is due to the way TFTP handles the filename parameter extracted from a WRQ request.
          The server will append the user-supplied filename to TFTP server binary's path
          without any bounds checking, and then attempt to check this path with a fopen().
          Since this isn't a valid file path, fopen() returns null, which allows the
          corrupted data to be used in a strcmp() function, causing an access violation.

          Since the offset is sensitive to how the TFTP server is launched, you must know
          in advance if your victim machine launched the TFTP as a 'Service' or 'Standalone'
          , and then manually select your target accordingly. A successful attempt will lead
          to remote code execution under the context of SYSTEM if run as a service, or
          the user if run as a standalone. A failed attempt will result a denial-of-service.