deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Java RMIConnectionImpl Deserialization Privilege Escalation
Type: exploit
Path: modules/exploits/multi/browser/java_rmi_connection_impl.rb
Disclosure date: 2010-03-31
References: CVE-2010-0094, OSVDB-63484, URL-http://slightlyrandombrokenthoughts.blogspot.com/2010/04/java-rmiconnectionimpl-deserialization.html
Targets: Generic (Java Payload)

Description:
This module exploits a vulnerability in the Java Runtime Environment
          that allows to deserialize a MarshalledObject containing a custom
          classloader under a privileged context. The vulnerability affects
          version 6 prior to update 19 and version 5 prior to update 23.
Metasploit Module: Java storeImageArray() Invalid Array Indexing Vulnerability
Type: exploit
Path: modules/exploits/multi/browser/java_storeimagearray.rb
Platform: java
Disclosure date: 2013-08-12
References: CVE-2013-2465, OSVDB-96269, EDB-27526, URL-http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040
Targets: Generic (Java Payload), Windows Universal, Linux x86

Description:
This module abuses an Invalid Array Indexing Vulnerability on the
          static function storeImageArray() function in order to cause a
          memory corruption and escape the Java Sandbox. The vulnerability
          affects Java version 7u21 and earlier. The module, which doesn't bypass
          click2play, has been tested successfully on Java 7u21 on Windows and
          Linux systems.
Metasploit Module: Adobe Flash Player NetConnection Type Confusion
Type: exploit
Path: modules/exploits/multi/browser/adobe_flash_net_connection_confusion.rb
Platform: win
Disclosure date: 2015-03-12
References: CVE-2015-0336, URL-https://helpx.adobe.com/security/products/flash-player/apsb15-05.html, URL-http://googleprojectzero.blogspot.com/2015/04/a-tale-of-two-exploits.html, URL-http://malware.dontneedcoffee.com/2015/03/cve-2015-0336-flash-up-to-1600305-and.html, URL-https://www.fireeye.com/blog/threat-research/2015/03/cve-2015-0336_nuclea.html, URL-https://blog.malwarebytes.org/exploits-2/2015/03/nuclear-ek-leverages-recently-patched-flash-vulnerability/

Description:
This module exploits a type confusion vulnerability in the NetConnection class on
          Adobe Flash Player. When using a correct memory layout this vulnerability allows
          to corrupt arbitrary memory. It can be used to overwrite dangerous objects, like
          vectors, and ultimately accomplish remote code execution. This module has been tested
          successfully on:
          * Windows 7 SP1 (32-bit), IE 8, IE11 and Adobe Flash 16.0.0.305.
          * Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 16.0.0.305.
          * Windows 8.1, Firefox 38.0.5 and Adobe Flash 16.0.0.305.
          * Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.424.
          * Ubuntu 14.04.2 LTS, Firefox 33.0 and Adobe Flash 11.2.202.442.
Metasploit Module: Mozilla Suite/Firefox Navigator Object Code Execution
Type: exploit
Path: modules/exploits/multi/browser/mozilla_navigatorjava.rb
Platform: win
Disclosure date: 2006-07-25
Authors: hdm
References: CVE-2006-3677, OSVDB-27559, BID-19192, URL-http://www.mozilla.org/security/announce/mfsa2006-45.html
Targets: Firefox 1.5.0.4 Windows x86, Firefox 1.5.0.4 Linux x86, Firefox 1.5.0.4 Mac OS X PPC, Firefox 1.5.0.4 Mac OS X x86

Description:
This module exploits a code execution vulnerability in the Mozilla
          Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit
          requires the Java plugin to be installed.
Metasploit Module: Mozilla Suite/Firefox compareTo() Code Execution
Type: exploit
Path: modules/exploits/multi/browser/mozilla_compareto.rb
Platform: win
Disclosure date: 2005-07-13
Authors: hdm
References: CVE-2005-2265, OSVDB-17968, BID-14242, URL-http://www.mozilla.org/security/announce/mfsa2005-50.html
Targets: Firefox < 1.0.5, Mozilla < 1.7.10, Windows

Description:
This module exploits a code execution vulnerability in the Mozilla
          Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit
          module is a direct port of Aviv Raff's HTML PoC.
Metasploit Module: Java Applet Method Handle Remote Code Execution
Type: exploit
Path: modules/exploits/multi/browser/java_jre17_method_handle.rb
Platform: java
Disclosure date: 2012-10-16
References: CVE-2012-5088, OSVDB-86352, BID-56057, URL-http://www.security-explorations.com/materials/SE-2012-01-ORACLE-5.pdf, URL-http://www.security-explorations.com/materials/se-2012-01-report.pdf
Targets: Generic (Java Payload), Windows x86 (Native Payload), Mac OS X x86 (Native Payload), Linux x86 (Native Payload)

Description:
This module abuses the Method Handle class from a Java Applet to run arbitrary
          Java code outside of the sandbox. The vulnerability affects Java version 7u7 and
          earlier.
Metasploit Module: Java AtomicReferenceArray Type Violation Vulnerability
Type: exploit
Path: modules/exploits/multi/browser/java_atomicreferencearray.rb
Platform: java
Disclosure date: 2012-02-14
References: CVE-2012-0507, OSVDB-80724, BID-52161, URL-http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3, URL-http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx, URL-http://schierlm.users.sourceforge.net/TypeConfusion.html, URL-https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0507, URL-https://www.rapid7.com/blog/post/2012/03/29/cve-2012-0507--java-strikes-again
Targets: Generic (Java Payload), Windows x86 (Native Payload), Mac OS X PPC (Native Payload), Mac OS X x86 (Native Payload), Linux x86 (Native Payload)

Description:
This module exploits a vulnerability due to the fact that
          AtomicReferenceArray uses the Unsafe class to store a reference in an
          array directly, which may violate type safety if not used properly.
          This allows a way to escape the JRE sandbox, and load additional classes
          in order to perform malicious operations.
Metasploit Module: Opera 9 Configuration Overwrite
Type: exploit
Path: modules/exploits/multi/browser/opera_configoverwrite.rb
Platform: win
Disclosure date: 2007-03-05
References: OSVDB-66472
Targets: Opera < 9.10 Unix Cmd

Description:
Opera web browser in versions <= 9.10 allows unrestricted script
            access to its configuration page, opera:config, allowing an
            attacker to change settings and potentially execute arbitrary
            code.
Metasploit Module: Java Applet JAX-WS Remote Code Execution
Type: exploit
Path: modules/exploits/multi/browser/java_jre17_jaxws.rb
Platform: win
Disclosure date: 2012-10-16
References: CVE-2012-5076, OSVDB-86363, BID-56054, URL-http://www.oracle.com/technetwork/topics/security/javacpuoct2[PII_REDACTED].html, URL-http://malware.dontneedcoffee.com/2012/11/cool-ek-hello-my-friend-cve-2012-5067.html, URL-http://blogs.technet.com/b/mmpc/archive/2012/11/15/a-technical-analysis-on-new-java-vulnerability-cve-2012-5076.aspx
Targets: Generic (Java Payload), Windows Universal, Linux x86

Description:
This module abuses the JAX-WS classes from a Java Applet to run arbitrary Java
          code outside of the sandbox as exploited in the wild in November of 2012. The
          vulnerability affects Java version 7u7 and earlier.
Metasploit Module: Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution
Type: exploit
Path: modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb
Disclosure date: 2007-06-27
References: URL-https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/, URL-https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/, URL-https://support.mozilla.org/en-US/kb/frequently-asked-questions-firefox-addon, URL-https://web.archive.org/web/[PII_REDACTED]5940/https://developer.mozilla.org/en-US/Add-ons/Bootstrapped_extensions, URL-https://web.archive.org/web/[PII_REDACTED]4439/https://dvlabs.tippingpoint.com/blog/2007/06/27/xpi-the-next-malware-vector

Description:
Mozilla Firefox before version 41 allowed users to install
          unsigned browser extensions from arbitrary web servers.

          This module dynamically creates an unsigned .xpi addon file.
          The resulting bootstrapped Firefox addon is presented to
          the victim via a web page. The victim's Firefox browser
          will pop a dialog asking if they trust the addon.

          Once the user clicks "install", the addon is installed and
          executes the payload with full user permissions. As of Firefox
          4, this will work without a restart as the addon is marked to
          be "bootstrapped". As the addon will execute the payload after
          each Firefox restart, an option can be given to automatically
          uninstall the addon once the payload has been executed.

          As of Firefox 41, unsigned extensions can still be installed
          on Firefox Nightly, Unbranded and Development builds when
          configured with `xpinstall.signatures.required` set to `false`.

          Note: this module generates legacy extensions which are
          supported only in Firefox before version 57.
Metasploit Module: Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free
Type: exploit
Path: modules/exploits/multi/browser/adobe_flash_uncompress_zlib_uaf.rb
Platform: win
Disclosure date: 2014-04-28
References: CVE-2015-0311, URL-https://helpx.adobe.com/security/products/flash-player/apsa15-01.html, URL-http://blog.hacklab.kr/flash-cve-2015-0311-%EB%B6%84%EC%84%9D/, URL-http://blog.coresecurity.com/2015/03/04/exploiting-cve-2015-0311-a-use-after-free-in-adobe-flash-player/

Description:
This module exploits a use after free vulnerability in Adobe Flash Player. The
          vulnerability occurs in the ByteArray::UncompressViaZlibVariant method, when trying
          to uncompress() a malformed byte stream. This module has been tested successfully
          on:
          * Windows 7 SP1 (32 bits), IE 8 to IE 11 and Flash 16.0.0.287, 16.0.0.257 and 16.0.0.235.
          * Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 16.0.0.287.
          * Windows 8.1, Firefox 38.0.5 and Adobe Flash 16.0.0.305.
          * Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Flash 11.2.202.424.
Metasploit Module: Adobe Flash opaqueBackground Use After Free
Type: exploit
Path: modules/exploits/multi/browser/adobe_flash_opaque_background_uaf.rb
Platform: win
Disclosure date: 2015-07-06
References: CVE-2015-5122, URL-http://web.archive.org/web/[PII_REDACTED]5917/https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html, URL-https://helpx.adobe.com/security/products/flash-player/apsa15-04.html, URL-https://helpx.adobe.com/security/products/flash-player/apsb15-18.html

Description:
This module exploits an use after free on Adobe Flash Player. The vulnerability,
          discovered by Hacking Team and made public as part of the July 2015 data leak, was
          described as an Use After Free while handling the opaqueBackground property
          7 setter of the flash.display.DisplayObject class. This module is an early release
          tested on:

          Windows XP SP3, IE8 and Flash 18.0.0.194,
          Windows XP SP3, IE 8 and Flash 18.0.0.203,
          Windows XP SP3, Firefox and Flash 18.0.0.203,
          Windows Vista SP2 + IE 9 and Flash 18.0.0.203,
          Windows Vista SP2 + Firefox 39.0 and Flash 18.0.0.203,
          Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.203,
          Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.194,
          Windows 7 SP1 (32-bit), IE9 and Adobe Flash 18.0.0.203,
          Windows 7 SP1 (32-bit), Firefox and Adobe Flash 18.0.0.194,
          Windows 8.1 (32-bit), IE11 and Adobe Flash 18.0.0.194,
          windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.203,
          Windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.160 and
          Windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.194
          Windows 10 Build 10240 (32-bit) IE11, Firefox 39.0 and Adobe Flash 18.0.0.203
Metasploit Module: Firefox location.QueryInterface() Code Execution
Type: exploit
Path: modules/exploits/multi/browser/firefox_queryinterface.rb
Platform: osx
Disclosure date: 2006-02-02
Authors: hdm
References: CVE-2006-0295, OSVDB-22893, BID-16476, URL-http://www.mozilla.org/security/announce/mfsa2006-04.html
Targets: Firefox 1.5.0.0 Mac OS X, Firefox 1.5.0.0 Linux

Description:
This module exploits a code execution vulnerability in the Mozilla
          Firefox browser. To reliably exploit this vulnerability, we need to fill
          almost a gigabyte of memory with our nop sled and payload. This module has
          been tested on OS X 10.3 with the stock Firefox 1.5.0 package.
Metasploit Module: Firefox WebIDL Privileged Javascript Injection
Type: exploit
Path: modules/exploits/multi/browser/firefox_webidl_injection.rb
Platform: firefox
Disclosure date: 2014-03-17
References: CVE-2014-1510, CVE-2014-1511
Targets: Universal (Javascript XPCOM Shell)

Description:
This exploit gains remote code execution on Firefox 22-27 by abusing two
          separate privilege escalation vulnerabilities in Firefox's Javascript
          APIs.
Metasploit Module: Apple OS X iTunes 8.1.1 ITMS Overflow
Type: exploit
Path: modules/exploits/multi/browser/itms_overflow.rb
Disclosure date: 2009-06-01
References: CVE-2009-0950, OSVDB-54833, URL-http://support.apple.com/kb/HT3592, URL-http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html
Targets: OS X

Description:
This modules exploits a stack-based buffer overflow in iTunes
          itms:// URL parsing.  It is accessible from the browser and
          in Safari, itms urls will be opened in iTunes automatically.
          Because iTunes is multithreaded, only vfork-based payloads should
          be used.
Metasploit Module: Java Statement.invoke() Trusted Method Chain Privilege Escalation
Type: exploit
Path: modules/exploits/multi/browser/java_trusted_chain.rb
Platform: win
Disclosure date: 2010-03-31
References: CVE-2010-0840, OSVDB-63483, URL-http://slightlyrandombrokenthoughts.blogspot.com/2010/04/java-trusted-method-chaining-cve-2010.html
Targets: Generic (Java Payload), Windows Universal, Linux x86

Description:
This module exploits a vulnerability in Java Runtime Environment
          that allows an untrusted method to run in a privileged context.  The
          vulnerability affects version 6 prior to update 19 and version 5
          prior to update 23.
Metasploit Module: Java Applet JMX Remote Code Execution
Type: exploit
Path: modules/exploits/multi/browser/java_jre17_jmxbean_2.rb
Platform: java
Disclosure date: 2013-01-19
References: CVE-2013-0431, OSVDB-89613, BID-57726, URL-http://www.security-explorations.com/materials/SE-2012-01-ORACLE-8.pdf, URL-http://www.security-explorations.com/materials/SE-2012-01-ORACLE-9.pdf, URL-http://security-obscurity.blogspot.com.es/2013/01/about-new-java-0-day-vulnerability.html, URL-http://pastebin.com/QWU1rqjf, URL-http://malware.dontneedcoffee.com/2013/02/cve-2013-0431-java-17-update-11.html
Targets: Generic (Java Payload), Windows x86 (Native Payload), Mac OS X x86 (Native Payload), Linux x86 (Native Payload)

Description:
This module abuses the JMX classes from a Java Applet to run arbitrary Java code
          outside of the sandbox as exploited in the wild in February of 2013. Additionally,
          this module bypasses default security settings introduced in Java 7 Update 10 to run
          unsigned applet without displaying any warning to the user.
Metasploit Module: Firefox MCallGetProperty Write Side Effects Use After Free Exploit
Type: exploit
Path: modules/exploits/multi/browser/firefox_jit_use_after_free.rb
Platform: linux
Disclosure date: 2020-11-18
References: CVE-2020-26950, URL-https://www.mozilla.org/en-US/security/advisories/mfsa2020-49/#CVE-2020-26950, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=1675905, URL-https://www.sentinelone.com/labs/firefox-jit-use-after-frees-exploiting-cve-2020-26950/

Description:
This modules exploits CVE-2020-26950, a use after free exploit in Firefox.
          The MCallGetProperty opcode can be emitted with unmet assumptions resulting
          in an exploitable use-after-free condition.

          This exploit uses a somewhat novel technique of spraying ArgumentsData
          structures in order to construct primitives. The shellcode is forced into
          executable memory via the JIT compiler, and executed by writing to the JIT
          region pointer.

          This exploit does not contain a sandbox escape, so firefox must be run
          with the MOZ_DISABLE_CONTENT_SANDBOX environment variable set, in order
          for the shellcode to run successfully.

          This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and
          Thunderbird < 78.4.2, however only Firefox <= 79 is supported as a target.
          Additional work may be needed to support other versions such as Firefox 82.0.1.
Metasploit Module: Java Applet AverageRangeStatisticImpl Remote Code Execution
Type: exploit
Path: modules/exploits/multi/browser/java_jre17_glassfish_averagerangestatisticimpl.rb
Platform: java
Disclosure date: 2012-10-16
References: CVE-2012-5076, OSVDB-86363, BID-56054, URL-http://www.oracle.com/technetwork/topics/security/javacpuoct2[PII_REDACTED].html, URL-https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5076, URL-http://www.security-explorations.com/materials/se-2012-01-report.pdf
Targets: Generic (Java Payload), Windows x86 (Native Payload), Mac OS X x86 (Native Payload), Linux x86 (Native Payload)

Description:
This module abuses the AverageRangeStatisticImpl from a Java Applet to run
          arbitrary Java code outside of the sandbox, a different exploit vector than the one
          exploited in the wild in November of 2012. The vulnerability affects Java version
          7u7 and earlier.
Metasploit Module: Firefox 3.5 escape() Return Value Memory Corruption
Type: exploit
Path: modules/exploits/multi/browser/firefox_escape_retval.rb
Platform: win
Disclosure date: 2009-07-13
References: CVE-2009-2477, OSVDB-55846, BID-35660, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=503286
Targets: Firefox 3.5.0 on Windows XP SP0-SP3, Firefox 3.5.0 on Mac OS X 10.5.7 (Intel)

Description:
This module exploits a memory corruption vulnerability in the Mozilla
          Firefox browser. This flaw occurs when a bug in the javascript interpreter
          fails to preserve the return value of the escape() function and results in
          uninitialized memory being used instead. This module has only been tested
          on Windows, but should work on other platforms as well with the current
          targets.
Metasploit Module: Google Chrome 80 JSCreate side-effect type confusion exploit
Type: exploit
Path: modules/exploits/multi/browser/chrome_jscreate_sideeffect.rb
Platform: win
Disclosure date: 2020-02-19
References: CVE-2020-6418, URL-https://bugs.chromium.org/p/chromium/issues/detail?id=1053604, URL-https://blog.exodusintel.com/2020/02/24/a-eulogy-for-patch-gapping, URL-https://ray-cp.github.io/archivers/browser-pwn-cve-2020-6418%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90

Description:
This module exploits an issue in Google Chrome 80.0.3987.87 (64 bit). The exploit
          corrupts the length of a float array (float_rel), which can then be used for out
          of bounds read and write on adjacent memory.
          The relative read and write is then used to modify a UInt64Array (uint64_aarw)
          which is used for read and writing from absolute memory.
          The exploit then uses WebAssembly in order to allocate a region of RWX memory,
          which is then replaced with the payload shellcode.
          The payload is executed within the sandboxed renderer process, so the browser
          must be run with the --no-sandbox option for the payload to work correctly.
Metasploit Module: Firefox PDF.js Privileged Javascript Injection
Type: exploit
Path: modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb
Platform: firefox
Disclosure date: 2015-03-31
References: CVE-2015-0816, CVE-2015-0802
Targets: Universal (Javascript XPCOM Shell)

Description:
This module gains remote code execution on Firefox 35-36 by abusing a
          privilege escalation bug in resource:// URIs. PDF.js is used to exploit
          the bug. This exploit requires the user to click anywhere on the page to
          trigger the vulnerability.
Metasploit Module: Java 7 Applet Remote Code Execution
Type: exploit
Path: modules/exploits/multi/browser/java_jre17_exec.rb
Platform: java
Disclosure date: 2012-08-26
References: CVE-2012-4681, OSVDB-84867, URL-http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html, URL-http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html, URL-http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/, URL-http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html, URL-http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4[PII_REDACTED].html, URL-https://www.rapid7.com/blog/post/2012/08/27/lets-start-the-week-with-a-new-java-0day, URL-https://bugzilla.redhat.com/show_bug.cgi?id=852051
Targets: Generic (Java Payload), Windows Universal, Linux x86

Description:
The exploit takes advantage of two issues in JDK 7: The ClassFinder and
          MethodFinder.findMethod().  Both were newly introduced in JDK 7.  ClassFinder is a
          replacement for classForName back in JDK 6. It allows untrusted code to obtain a
          reference and have access to a restricted package in JDK 7, which can be used to
          abuse sun.awt.SunToolkit (a restricted package).  With sun.awt.SunToolkit, we can
          actually invoke getField() by abusing findMethod() in Statement.invokeInternal()
          (but getField() must be public, and that's not always the case in JDK 6) in order
          to access Statement.acc's private field, modify AccessControlContext, and then
          disable Security Manager. Once Security Manager is disabled, we can execute
          arbitrary Java code.

          Our exploit has been tested successfully against multiple platforms, including:
          IE, Firefox, Safari, Chrome; Windows, Ubuntu, OS X, Solaris, etc.
Metasploit Module: Opera historysearch XSS
Type: exploit
Path: modules/exploits/multi/browser/opera_historysearch.rb
Platform: win
Disclosure date: 2008-10-23
References: CVE-2008-4696, OSVDB-49472, BID-31869, URL-http://www.opera.com/support/kb/view/903/
Targets: Opera < 9.61 Unix Cmd

Description:
Certain constructs are not escaped correctly by Opera's History
          Search results.  These can be used to inject scripts into the
          page, which can then be used to modify configuration settings
          and execute arbitrary commands.  Affects Opera versions between
          9.50 and 9.61.