deardaniel/secdata-raw huggingface dataset:
Metasploit Module: America Online ICQ ActiveX Control Arbitrary File Download and Execute
Type: exploit
Path: modules/exploits/windows/browser/aol_icq_downloadagent.rb
Platform: win
Disclosure date: 2006-11-06
References: CVE-2006-5650, OSVDB-30220, BID-20930, ZDI-06-037

Description:
This module allows remote attackers to download and execute arbitrary files
          on a users system via the DownloadAgent function of the ICQPhone.SipxPhoneManager ActiveX control.
Metasploit Module: ASUS Net4Switch ipswcom.dll ActiveX Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/asus_net4switch_ipswcom.rb
Platform: win
Disclosure date: 2012-02-17
References: CVE-2012-4924, OSVDB-79438, URL-http://dsecrg.com/pages/vul/show.php?id=417

Description:
This module exploits a vulnerability found in ASUS Net4Switch's ipswcom.dll
          ActiveX control.  A buffer overflow condition is possible in multiple places due
          to the use of the CxDbgPrint() function, which allows remote attackers to gain
          arbitrary code execution under the context of the user.
Metasploit Module: NTR ActiveX Control StopModule() Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ntr_activex_stopmodule.rb
Platform: win
Disclosure date: 2012-01-11
References: CVE-2012-0267, OSVDB-78253, BID-51374, URL-http://web.archive.org/web/[PII_REDACTED]5846/http://secunia.com:80/secunia_research/2012-2

Description:
This module exploits a vulnerability found in the NTR ActiveX 1.1.8. The
          vulnerability exists in the StopModule() method, where the lModule parameter is
          used to dereference memory to get a function pointer, which leads to code execution
          under the context of the user visiting a malicious web page.
Metasploit Module: Real Networks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution
Type: exploit
Path: modules/exploits/windows/browser/real_arcade_installerdlg.rb
Platform: win
Disclosure date: 2011-04-03
References: CVE-2011-10028, OSVDB-71559, EDB-17105

Description:
This module exploits a vulnerability in Real Networks Arcade Game's ActiveX control. The "exec"
          function found in InstallerDlg.dll (v2.6.0.445) allows remote attackers to run arbitrary commands
          on the victim machine.
Metasploit Module: Firefox onreadystatechange Event DocumentViewerImpl Use After Free
Type: exploit
Path: modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb
Platform: win
Disclosure date: 2013-06-25
References: CVE-2013-1690, OSVDB-94584, BID-60778, URL-https://www.mozilla.org/security/announce/2013/mfsa2013-53.html, URL-https://lists.torproject.org/pipermail/tor-announce/2013-August/000089.html, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=901365, URL-http://krash.in/ffn0day.txt, URL-http://hg.mozilla.org/releases/mozilla-esr17/rev/2d5a85d7d3ae

Description:
This module exploits a vulnerability found on Firefox 17.0.6, specifically a use
          after free of a DocumentViewerImpl object, triggered via a specially crafted web
          page using onreadystatechange events and the window.stop() API, as exploited in the
          wild on 2013 August to target Tor Browser users.
Metasploit Module: Viscom Software Movie Player Pro SDK ActiveX 6.8
Type: exploit
Path: modules/exploits/windows/browser/viscom_movieplayer_drawtext.rb
Platform: win
Disclosure date: 2010-01-12
References: CVE-2010-0356, OSVDB-61634, EDB-12320

Description:
Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control
          in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player Pro SDK ActiveX 6.8 allows
          remote attackers to execute arbitrary code via a long strFontName parameter to the
          DrawText method.

          The victim will first be required to trust the publisher Viscom Software.
          This module has been designed to bypass DEP and ASLR under XP IE8, Vista and Win7
          with Java support.
Metasploit Module: Cisco Linksys PlayerPT ActiveX Control SetSource sURL Argument Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/cisco_playerpt_setsource_surl.rb
Platform: win
Disclosure date: 2012-07-17
References: CVE-2012-0284, OSVDB-84309, BID-54588, URL-http://web.archive.org/web/[PII_REDACTED]0045/http://secunia.com:80/secunia_research/2012-25/

Description:
This module exploits a vulnerability found in Cisco Linksys PlayerPT 1.0.0.15
          as the installed with the web interface of Cisco Linksys WVC200 Wireless-G PTZ
          Internet Video Camera. The vulnerability, due to the insecure usage of sprintf in
          the SetSource method, when handling a specially crafted sURL argument, allows to
          trigger a stack based buffer overflow which leads to code execution under the
          context of the user visiting a malicious web page.
Metasploit Module: RealPlayer ierpplug.dll ActiveX Control Playlist Name Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/realplayer_import.rb
Platform: win
Disclosure date: 2007-10-18
References: CVE-2007-5601, OSVDB-41430, BID-26130

Description:
This module exploits a stack buffer overflow in RealOne Player V2 Gold Build 6.0.11.853 and
          RealPlayer 10.5 Build 6.0.12.1483. By sending an overly long string to the "Import()"
          method, an attacker may be able to execute arbitrary code.
Metasploit Module: MS06-071 Microsoft Internet Explorer XML Core Services HTTP Request Handling
Type: exploit
Path: modules/exploits/windows/browser/ms06_071_xml_core.rb
Platform: win
Disclosure date: 2006-10-10
References: CVE-2006-5745, OSVDB-29425, MSB-MS06-071, BID-20915

Description:
This module exploits a code execution vulnerability in Microsoft XML Core Services which
          exists in the XMLHTTP ActiveX control. This module is the modified version of
          http://www.milw0rm.com/exploits/2743 - credit to str0ke. This module has been successfully
          tested on Windows 2000 SP4, Windows XP SP2, Windows 2003 Server SP0 with IE6
          + Microsoft XML Core Services 4.0 SP2.
Metasploit Module: Macrovision InstallShield Update Service ActiveX Unsafe Method
Type: exploit
Path: modules/exploits/windows/browser/macrovision_unsafe.rb
Platform: win
Disclosure date: 2007-10-20
References: CVE-2007-5660, OSVDB-38347, BID-26280

Description:
This module allows attackers to execute code via an unsafe method in Macrovision InstallShield 2008.
Metasploit Module: Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow
Type: exploit
Path: modules/exploits/windows/browser/crystal_reports_printcontrol.rb
Platform: win
Disclosure date: 2010-12-14
References: CVE-2010-2590, OSVDB-69917, BID-45387, EDB-15733

Description:
This module exploits a heap based buffer overflow in the CrystalPrintControl
          ActiveX, while handling the ServerResourceVersion property. The affected control
          can be found in the PrintControl.dll component as included with Crystal Reports
          2008. This module has been tested successfully on IE 6, 7 and 8 on Windows XP SP3
          and IE 8 on Windows 7 SP1. The module uses the msvcr71.dll library, loaded by the
          affected ActiveX control, to bypass DEP and ASLR.
Metasploit Module: Microsoft WMI Administration Tools ActiveX Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/wmi_admintools.rb
Platform: win
Disclosure date: 2010-12-21
References: OSVDB-69942, CVE-2010-3973, BID-45546, URL-http://wooyun.org/bug.php?action=view&id=1006, URL-http://web.archive.org/web/[PII_REDACTED]3011/http://secunia.com:80/advisories/42693, URL-http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6430f853-1120-48db-8cc5-f2abdc3ed314

Description:
This module exploits a memory trust issue in the Microsoft WMI
          Administration tools ActiveX control. When processing a specially crafted
          HTML page, the WEBSingleView.ocx ActiveX Control (1.50.1131.0) will treat
          the 'lCtxHandle' parameter to the 'AddContextRef' and 'ReleaseContext' methods
          as a trusted pointer. It makes an indirect call via this pointer which leads
          to arbitrary code execution.

          This exploit utilizes a combination of heap spraying and the
          .NET 2.0 'mscorie.dll' module to bypass DEP and ASLR. This module does not
          opt-in to ASLR. As such, this module should be reliable on all Windows
          versions.

          The WMI Administrative Tools are a standalone download & install (linked in the
          references).
Metasploit Module: EnjoySAP SAP GUI ActiveX Control Arbitrary File Download
Type: exploit
Path: modules/exploits/windows/browser/enjoysapgui_comp_download.rb
Platform: win
Disclosure date: 2009-04-15
References: CVE-2008-4830, OSVDB-53680, URL-http://dsecrg.com/files/pub/pdf/HITB%20-%20Attacking%20SAP%20Users%20with%20Sapsploit.pdf

Description:
This module allows remote attackers to place arbitrary files on a users file system
          by abusing the "Comp_Download" method in the SAP KWEdit ActiveX Control (kwedit.dll 6400.1.1.41).
Metasploit Module: Advantech WebAccess dvs.ocx GetColor Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/advantech_webaccess_dvs_getcolor.rb
Platform: win
Disclosure date: 2014-07-17
References: CVE-2014-2364, ZDI-14-255, URL-http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02

Description:
This module exploits a buffer overflow vulnerability in Advantec WebAccess. The
          vulnerability exists in the dvs.ocx ActiveX control, where a dangerous call to
          sprintf can be reached with user controlled data through the GetColor function.
          This module has been tested successfully on Windows XP SP3 with IE6 and Windows
          7 SP1 with IE8 and IE 9.
Metasploit Module: McAfee Visual Trace ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/mcafeevisualtrace_tracetarget.rb
Platform: win
Disclosure date: 2007-07-07
References: CVE-2006-6707, OSVDB-32399, URL-http://web.archive.org/web/[PII_REDACTED]2405/http://secunia.com:80/advisories/23463/

Description:
This module exploits a stack buffer overflow in the McAfee Visual Trace 3.25 ActiveX
          Control (NeoTraceExplorer.dll 1.0.0.1). By sending an overly long string to the
          "TraceTarget()" method, an attacker may be able to execute arbitrary code.
Metasploit Module: SonicWALL Aventail epi.dll AuthCredential Format String
Type: exploit
Path: modules/exploits/windows/browser/aventail_epi_activex.rb
Platform: win
Disclosure date: 2010-08-19
References: OSVDB-67286, URL-http://sotiriu.de/adv/NSOADV-2010-005.txt

Description:
This module exploits a format string vulnerability within version 10.0.4.x and
          10.5.1 of the SonicWALL Aventail SSL-VPN Endpoint Interrogator/Installer ActiveX
          control (epi.dll). By calling the 'AuthCredential' method with a specially
          crafted Unicode format string, an attacker can cause memory corruption and
          execute arbitrary code.

          Unfortunately, it does not appear to be possible to indirectly re-use existing
          stack data for more reliable exploitation. This is due to several particulars
          about this vulnerability. First, the format string must be a Unicode string,
          which uses two bytes per character. Second, the buffer is allocated on the
          stack using the 'alloca' function. As such, each additional format specifier (%x)
          will add four more bytes to the size allocated. This results in the inability to
          move the read pointer outside of the buffer.

          Further testing showed that using specifiers that pop more than four bytes does
          not help. Any number of format specifiers will result in accessing the same value
          within the buffer.

          NOTE: It may be possible to leverage the vulnerability to leak memory contents.
          However, that has not been fully investigated at this time.
Metasploit Module: Persits XUpload ActiveX MakeHttpRequest Directory Traversal
Type: exploit
Path: modules/exploits/windows/browser/persits_xupload_traversal.rb
Platform: win
Disclosure date: 2009-09-29
References: CVE-2009-3693, OSVDB-60001

Description:
This module exploits a directory traversal in Persits Software Inc's
          XUpload ActiveX control(version 3.0.0.3) that's included in HP LoadRunner 9.5.
          By passing a string containing "..\" sequences to the MakeHttpRequest method,
          an attacker is able to write arbitrary files to arbitrary locations on disk.

          Code execution occurs by writing to the All Users Startup Programs directory.
          You may want to combine this module with the use of exploit/multi/handler since a
          user would have to log for the payload to execute.
Metasploit Module: IBM Lotus Domino Web Access Upload Module Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/ibmlotusdomino_dwa_uploadmodule.rb
Platform: win
Disclosure date: 2007-12-20
References: CVE-2007-4474, OSVDB-40954, BID-26972, EDB-4820

Description:
This module exploits a stack buffer overflow in IBM Lotus Domino Web Access Upload Module.
          By sending an overly long string to the "General_ServerName()" property located
          in the dwa7w.dll and the inotes6w.dll control, an attacker may be able to execute
          arbitrary code.
Metasploit Module: Microsoft Windows Shell LNK Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb
Platform: win
Disclosure date: 2010-07-16
References: CVE-2010-2568, OSVDB-66387, MSB-MS10-046

Description:
This module exploits a vulnerability in the handling of Windows
          Shortcut files (.LNK) that contain an icon resource pointing to a
          malicious DLL. This module creates a WebDAV service that can be used
          to run an arbitrary payload when accessed as a UNC path.
Metasploit Module: MS05-054 Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/ms05_054_onload.rb
Platform: win
Disclosure date: 2005-11-21
References: MSB-MS05-054, CVE-2005-1790, OSVDB-17094, BID-13799

Description:
This bug is triggered when the browser handles a JavaScript 'onLoad' handler in
          conjunction with an improperly initialized 'window()' JavaScript function.
          This exploit results in a call to an address lower than the heap. The javascript
          prompt() places our shellcode near where the call operand points to.  We call
          prompt() multiple times in separate iframes to place our return address.
          We hide the prompts in a popup window behind the main window. We spray the heap
          a second time with our shellcode and point the return address to the heap. I use
          a fairly high address to make this exploit more reliable. IE will crash when the
          exploit completes.  Also, please note that Internet Explorer must allow popups
          in order to continue exploitation.
Metasploit Module: Adobe Flash Player copyPixelsToByteArray Method Integer Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_copy_pixels_to_byte_array.rb
Platform: win
Disclosure date: 2014-09-23
References: CVE-2014-0556, OSVDB-111110, URL-http://googleprojectzero.blogspot.com/2014/09/exploiting-cve-2014-0556-in-flash.html, URL-https://code.google.com/p/google-security-research/issues/detail?id=46, URL-http://hacklab.kr/cve-2014-0556-%EB%B6%84%EC%84%9D/, URL-http://malware.dontneedcoffee.com/2014/10/cve-2014-0556-adobe-flash-player.html, URL-https://helpx.adobe.com/security/products/flash-player/apsb14-21.html

Description:
This module exploits an integer overflow in Adobe Flash Player. The vulnerability occurs
          in the copyPixelsToByteArray method from the BitmapData object. The position field of the
          destination ByteArray can be used to cause an integer overflow and write contents out of
          the ByteArray buffer. This module has been tested successfully on:
          * Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 14.0.0.176, 14.0.0.145, and 14.0.0.125.
          * Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 14.0.0.179.
          * Windows 8.1, Firefox 38.0.5 and Adobe Flash 14.0.0.179.
Metasploit Module: IBM Lotus Notes Client URL Handler Command Injection
Type: exploit
Path: modules/exploits/windows/browser/notes_handler_cmdinject.rb
Platform: win
Disclosure date: 2012-06-18
References: CVE-2012-2174, OSVDB-83063, BID-54070, ZDI-12-154, URL-http://pwnanisec.blogspot.com/2012/10/exploiting-command-injection.html, URL-http://www-304.ibm.com/support/docview.wss?uid=swg21598348

Description:
This module exploits a command injection vulnerability in the URL handler for
          for the IBM Lotus Notes Client <= 8.5.3. The registered handler can be abused with
          a specially crafted notes:// URL to execute arbitrary commands with also arbitrary
          arguments. This module has been tested successfully on Windows XP SP3 with IE8,
          Google Chrome 23.0.1271.97 m and IBM Lotus Notes Client 8.5.2.
Metasploit Module: Aladdin Knowledge System Ltd ChooseFilePath Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/aladdin_choosefilepath_bof.rb
Platform: win
Disclosure date: 2012-04-01
References: OSVDB-86723, EDB-22258, EDB-22301

Description:
This module exploits a vulnerability found in Aladdin Knowledge System's
          ActiveX component.  By supplying a long string of data to the ChooseFilePath()
          function, a buffer overflow occurs, which may result in remote code execution
          under the context of the user.
Metasploit Module: InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow
Type: exploit
Path: modules/exploits/windows/browser/indusoft_issymbol_internationalseparator.rb
Platform: win
Disclosure date: 2012-04-28
References: CVE-2011-0340, OSVDB-72865, BID-47596, ZDI-12-168, URL-http://web.archive.org/web/[PII_REDACTED]3846/http://secunia.com:80/secunia_research/2011-37

Description:
This module exploits a heap overflow found in InduSoft Web Studio <= 61.6.00.00
          SP6. The overflow exists in the ISSymbol.ocx, and can be triggered with a long
          string argument for the InternationalSeparator() method of the ISSymbol control.
          This module uses the msvcr71.dll form the Java JRE6 to bypass ASLR.
Metasploit Module: MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow
Type: exploit
Path: modules/exploits/windows/browser/ms13_090_cardspacesigninhelper.rb
Platform: win
Disclosure date: 2013-11-08
References: CVE-2013-3918, OSVDB-99555, BID-63631, MSB-MS13-090, URL-http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx

Description:
This module exploits a vulnerability on the CardSpaceClaimCollection class from the
          icardie.dll ActiveX control. The vulnerability exists while the handling of the
          CardSpaceClaimCollection object. CardSpaceClaimCollections stores a collection of
          elements on a SafeArray and keeps a size field, counting the number of elements on the
          collection. By calling the remove() method on an empty CardSpaceClaimCollection it is
          possible to underflow the length field, storing a negative integer. Later, a call to
          the add() method will use the corrupted length field to compute the address where write
          into the SafeArray data, allowing to corrupt memory with a pointer to controlled contents.
          This module achieves code execution by using VBScript as discovered in the wild on
          November 2013 to (1) create an array of html OBJECT elements, (2) create holes, (3) create
          a CardSpaceClaimCollection whose SafeArray data will reuse one of the holes, (4) corrupt
          one of the legit OBJECT elements with the described integer overflow and (5) achieve code
          execution by forcing the use of the corrupted OBJECT.
Metasploit Module: Novell iPrint Client ActiveX Control Date/Time Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/novelliprint_datetime.rb
Platform: win
Disclosure date: 2009-12-08
References: CVE-2009-1569, BID-37242, OSVDB-60804, URL-http://web.archive.org/web/[PII_REDACTED]3620/http://secunia.com:80/advisories/35004

Description:
This module exploits a stack buffer overflow in Novell iPrint Client 5.30. When
          passing a specially crafted date/time string via certain parameters to ienipp.ocx
          an attacker can execute arbitrary code.

          NOTE: The "operation" variable must be set to a valid command in order to reach this
          vulnerability.
Metasploit Module: Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/adobe_cooltype_sing.rb
Platform: win
Disclosure date: 2010-09-07
References: CVE-2010-2883, OSVDB-67849, URL-http://contagiodump.blogspot.com/2010/09/cve-david-leadbetters-one-point-lesson.html, URL-http://www.adobe.com/support/security/advisories/apsa10-02.html

Description:
This module exploits a vulnerability in the Smart INdependent Glyplets (SING) table
          handling within versions 8.2.4 and 9.3.4 of Adobe Reader. Prior versions are
          assumed to be vulnerable as well.
Metasploit Module: HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/hp_loadrunner_addfolder.rb
Platform: win
Disclosure date: 2007-12-25
References: CVE-2007-6530, OSVDB-39901, BID-27025

Description:
This module exploits a stack buffer overflow in Persits Software Inc's
          XUpload ActiveX control(version 2.1.0.1) thats included in HP LoadRunner 9.0.
          By passing an overly long string to the AddFolder method, an attacker may be
          able to execute arbitrary code.
Metasploit Module: Oracle AutoVue ActiveX Control SetMarkupMode Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/oracle_autovue_setmarkupmode.rb
Platform: win
Disclosure date: 2012-04-18
References: CVE-2012-0549, BID-53077, OSVDB-81439, URL-http://dvlabs.tippingpoint.com/advisory/TPTI-12-05, URL-http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html, URL-https://www.rapid7.com/blog/post/2012/08/15/the-stack-cookies-bypass-on-cve-2012-0549

Description:
This module exploits a vulnerability found in the AutoVue.ocx ActiveX control.
          The vulnerability, due to the insecure usage of an strcpy like function in the
          SetMarkupMode method, when handling a specially crafted sMarkup argument, allows
          to trigger a stack based buffer overflow which leads to code execution under the
          context of the user visiting a malicious web page.

          The module has been successfully tested against Oracle AutoVue Desktop Version
          20.0.0 (AutoVue.ocx 20.0.0.7330) on IE 6, 7, 8 and 9 (Java 6 needed to DEP and
          ASLR bypass).
Metasploit Module: Microsoft Internet Explorer isComponentInstalled Overflow
Type: exploit
Path: modules/exploits/windows/browser/ie_iscomponentinstalled.rb
Platform: win
Disclosure date: 2006-02-24
References: CVE-2006-1016, OSVDB-31647, BID-16870

Description:
This module exploits a stack buffer overflow in Internet Explorer. This bug was
          patched in Windows 2000 SP4 and Windows XP SP1 according to MSRC.
Metasploit Module: IBM Lotus QuickR qp2 ActiveX Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/quickr_qp2_bof.rb
Platform: win
Disclosure date: 2012-05-23
References: CVE-2012-2176, OSVDB-82166, BID-53678, ZDI-12-134, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21596191

Description:
This module exploits a buffer overflow vulnerability on the UploadControl
          ActiveX. The vulnerability exists in the handling of the "Attachment_Times"
          property, due to the insecure usage of the _swscanf. The affected ActiveX is
          provided by the qp2.dll installed with the IBM Lotus Quickr product.

          This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7,
          using the qp2.dll 8.1.0.1800. In order to bypass ASLR the no aslr compatible module
          msvcr71.dll is used. This one is installed with the qp2 ActiveX.