deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Adobe Flash Player AVM Verification Logic Array Indexing Code Execution
Type: exploit
Path: modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb
Platform: win
Disclosure date: 2012-06-21
References: CVE-2011-2110, OSVDB-73007, BID-48268, URL-http://www.adobe.com/devnet/swf.html, URL-http://www.adobe.com/support/security/bulletins/apsb11-18.html, URL-http://www.accessroot.com/arteam/site/download.php?view.331, URL-http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20110617

Description:
This module exploits a vulnerability in Adobe Flash Player versions 10.3.181.23
          and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification
          logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same
          vulnerability that was used for attacks against Korean based organizations.

          Specifically, this issue occurs when indexing an array using an arbitrary value,
          memory can be referenced and later executed. Taking advantage of this issue does not rely
          on heap spraying as the vulnerability can also be used for information leakage.

          Currently this exploit works for IE6, IE7, IE8, Firefox 10.2 and likely several
          other browsers under multiple Windows platforms. This exploit bypasses ASLR/DEP and
          is very reliable.
Metasploit Module: HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/hp_easy_printer_care_xmlsimpleaccessor.rb
Platform: win
Disclosure date: 2011-08-16
References: CVE-2011-2404, OSVDB-74510, BID-49100, ZDI-11-261

Description:
This module allows remote attackers to place arbitrary files on a users file
          system by abusing via Directory Traversal attack the "saveXML" method from the
          "XMLSimpleAccessor" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control
          (HPTicketMgr.dll 2.7.2.0).

          Code execution can be achieved by first uploading the payload to the remote
          machine embeddeding a vbs file, and then upload another mof file, which enables Windows
          Management Instrumentation service to execute the vbs. Please note that this
          module currently only works for Windows before Vista.
Metasploit Module: Green Dam URL Processing Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/greendam_url.rb
Platform: win
Disclosure date: 2009-06-11
References: CVE-2009-20008, OSVDB-55126, URL-http://web.archive.org/web/[PII_REDACTED]0759/http://www.cse.umich.edu/~jhalderm/pub/gd/, EDB-8938, URL-http://taossa.com/archive/bh08sotirovdowd.pdf

Description:
This module exploits a stack-based buffer overflow in Green Dam Youth Escort
          version 3.17 in the way it handles overly long URLs.
          By setting an overly long URL, an attacker can overrun a buffer and execute
          arbitrary code. This module uses the .NET DLL memory technique by Alexander
          Sotirov and Mark Dowd and should bypass DEP, NX and ASLR.
Metasploit Module: HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/hp_easy_printer_care_xmlcachemgr.rb
Platform: win
Disclosure date: 2012-01-11
References: CVE-2011-4786, OSVDB-78306, BID-51396, ZDI-12-013

Description:
This module allows remote attackers to place arbitrary files on a users file
          system by abusing the "CacheDocumentXMLWithId" method from the "XMLCacheMgr"
          class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll
          2.7.2.0).

          Code execution can be achieved by first uploading the payload to the remote
          machine embeddeding a vbs file, and then upload another mof file, which enables
          Windows Management Instrumentation service to execute the vbs. Please note that
          this module currently only works for Windows before Vista.
Metasploit Module: Synactis PDF In-The-Box ConnectToSynactic Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/synactis_connecttosynactis_bof.rb
Platform: win
Disclosure date: 2013-05-30
References: CVE-2013-10057, OSVDB-93754, EDB-25835

Description:
This module exploits a vulnerability found in Synactis' PDF In-The-Box ActiveX
          component, specifically PDF_IN_1.ocx.  When a long string of data is given
          to the ConnectToSynactis function, which is meant to be used for the ldCmdLine
          argument of a WinExec call, a strcpy routine can end up overwriting a TRegistry
          class pointer saved on the stack, resulting in arbitrary code execution under the
          context of the user.

          Also note that since the WinExec function is used to call the default browser,
          you must be aware that: 1) The default must be Internet Explorer, and 2) when the
          exploit runs, another browser will pop up.

          Synactis PDF In-The-Box is also used by other software such as Logic Print 2013,
          which is how the vulnerability was found and publicly disclosed.
Metasploit Module: Apple QuickTime 7.7.2 MIME Type Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/apple_quicktime_mime_type.rb
Platform: win
Disclosure date: 2012-11-07
References: CVE-2012-3753, OSVDB-87088, BID-56438, URL-http://support.apple.com/kb/HT5581, URL-http://asintsov.blogspot.com.es/2012/11/heapspray.html

Description:
This module exploits a buffer overflow in Apple QuickTime 7.7.2. The stack
          based overflow occurs when processing a malformed Content-Type header. The module
          has been tested successfully on Safari 5.1.7 and 5.0.7 on Windows XP SP3.
Metasploit Module: Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/nis2004_get.rb
Platform: win
Disclosure date: 2007-05-16
References: CVE-2007-1689, OSVDB-36164, URL-http://securityresponse.symantec.com/avcenter/security/Content/2007.05.16.html

Description:
This module exploits a stack buffer overflow in the ISAlertDataCOM ActiveX
          Control (ISLAert.dll) provided by Symantec Norton Internet Security 2004.
          By sending an overly long string to the "Get()" method, an attacker may be
          able to execute arbitrary code.
Metasploit Module: BaoFeng Storm mps.dll ActiveX OnBeforeVideoDownload Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/baofeng_storm_onbeforevideodownload.rb
Platform: win
Disclosure date: 2009-04-30
References: CVE-2009-1612, OSVDB-54169, BID-34789, EDB-8579

Description:
This module exploits a buffer overflow in BaoFeng's Storm media Player ActiveX
          control. Versions of mps.dll including 3.9.4.27 and lower are affected. When passing
          an overly long string to the method "OnBeforeVideoDownload" an attacker can execute
          arbitrary code.
Metasploit Module: VLC AMV Dangling Pointer Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/vlc_amv.rb
Platform: win
Disclosure date: 2011-03-23
References: CVE-2010-3275, OSVDB-71277, URL-http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files, URL-http://web.archive.org/web/[PII_REDACTED]0348/http://git.videolan.org/?p=vlc/vlc-1.1.git;a=commitdiff;h=fe44129dc6509b3347113ab0e1a0524af1e0dd11

Description:
This module exploits VLC media player when handling a .AMV file. By flipping
          the 0x41st byte in the file format (video width/height), VLC crashes due to an
          invalid pointer, which allows remote attackers to gain arbitrary code execution.
          The vulnerable packages include: VLC 1.1.4, VLC 1.1.5, VLC 1.1.6, VLC 1.1.7. Also,
          please note that IE 8 targets require Java support in order to run properly.
Metasploit Module: MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free
Type: exploit
Path: modules/exploits/windows/browser/ms10_018_ie_behaviors.rb
Platform: win
Disclosure date: 2010-03-09
References: CVE-2010-0806, OSVDB-62810, BID-38615, URL-https://web.archive.org/web/[PII_REDACTED]5343/http://www.avertlabs.com/research/blog/index.php/2010/03/09/targeted-internet-explorer-0day-attack-announced-cve-2010-0806/, URL-https://web.archive.org/web/[PII_REDACTED]4253/http://eticanicomana.blogspot.com/2010/03/aleatory-persitent-threat.html, MSB-MS10-018

Description:
This module exploits a use-after-free vulnerability within the DHTML behaviors
          functionality of Microsoft Internet Explorer versions 6 and 7. This bug was
          discovered being used in-the-wild and was previously known as the "iepeers"
          vulnerability. The name comes from Microsoft's suggested workaround to block
          access to the iepeers.dll file.

          According to Nico Waisman, "The bug itself is when trying to persist an object
          using the setAttribute, which end up calling VariantChangeTypeEx with both the
          source and the destination being the same variant. So if you send as a variant
          an IDISPATCH the algorithm will try to do a VariantClear of the destination before
          using it. This will end up on a call to PlainRelease which deref the reference
          and clean the object."

          NOTE: Internet Explorer 8 and Internet Explorer 5 are not affected.
Metasploit Module: Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb
Platform: win
Disclosure date: 2011-04-11
References: CVE-2011-0611, OSVDB-71686, BID-47314, URL-http://www.adobe.com/support/security/bulletins/apsb11-07.html, URL-http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx, URL-http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html, URL-http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html, URL-http://web.archive.org/web/[PII_REDACTED]4057/http://secunia.com:80/blog/210/

Description:
This module exploits a vulnerability in Adobe Flash Player that was discovered,
          and has been exploited actively in the wild.  By embedding a specially crafted .swf
          file, Adobe Flash crashes due to an invalid use of an object type, which allows
          attackers to overwrite a pointer in memory, and results arbitrary code execution.
          Please note for IE 8 targets, Java Runtime Environment must be available on the
          victim machine in order to work properly.
Metasploit Module: IBM Rational ClearQuest CQOle Remote Code Execution
Type: exploit
Path: modules/exploits/windows/browser/clear_quest_cqole.rb
Platform: win
Disclosure date: 2012-05-19
References: CVE-2012-0708, BID-53170, OSVDB-81443, ZDI-12-113, URL-http://www-304.ibm.com/support/docview.wss?uid=swg21591705, URL-https://www.rapid7.com/blog/post/2012/07/11/it-isnt-always-about-buffer-overflow

Description:
This module exploits a function prototype mismatch on the CQOle ActiveX
          control in IBM Rational ClearQuest < 7.1.1.9, < 7.1.2.6 or < 8.0.0.2 which
          allows reliable remote code execution when DEP isn't enabled.
Metasploit Module: MS11-050 IE mshtml!CObjectElement Use After Free
Type: exploit
Path: modules/exploits/windows/browser/ms11_050_mshtml_cobjectelement.rb
Platform: win
Disclosure date: 2011-06-16
References: CVE-2011-1260, OSVDB-72950, MSB-MS11-050, URL-http://d0cs4vage.blogspot.com/2011/06/insecticides-dont-kill-bugs-patch.html

Description:
This module exploits a use-after-free vulnerability in Internet Explorer. The
          vulnerability occurs when an invalid <object> tag exists and other elements
          overlap/cover where the object tag should be when rendered (due to their
          styles/positioning). The mshtml!CObjectElement is then freed from memory because
          it is invalid. However, the mshtml!CDisplay object for the page continues to keep
          a reference to the freed <object> and attempts to call a function on it, leading
          to the use-after-free.

          Please note that for IE 8 targets, JRE (Java Runtime Environment) is required
          to bypass DEP (Data Execution Prevention).
Metasploit Module: AOL Instant Messenger goaway Overflow
Type: exploit
Path: modules/exploits/windows/browser/aim_goaway.rb
Platform: win
Disclosure date: 2004-08-09
References: CVE-2004-0636, OSVDB-8398, BID-10889, URL-http://www.idefense.com/application/poi/display?id=121&type=vulnerabilities

Description:
This module exploits a flaw in the handling of AOL Instant
          Messenger's 'goaway' URI handler.  An attacker can execute
          arbitrary code by supplying an overly sized buffer as the
          'message' parameter.  This issue is known to affect AOL Instant
          Messenger 5.5.
Metasploit Module: Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/creative_software_cachefolder.rb
Platform: win
Disclosure date: 2008-05-28
References: CVE-2008-0955, OSVDB-45655

Description:
This module exploits a stack buffer overflow in Creative Software AutoUpdate Engine. When
          sending an overly long string to the cachefolder() property of CTSUEng.ocx
          an attacker may be able to execute arbitrary code.
Metasploit Module: RealPlayer rmoc3260.dll ActiveX Control Heap Corruption
Type: exploit
Path: modules/exploits/windows/browser/realplayer_console.rb
Platform: win
Disclosure date: 2008-03-08
References: CVE-2008-1309, OSVDB-42946, BID-28157, URL-http://web.archive.org/web/[PII_REDACTED]3656/http://secunia.com:80/advisories/29315/

Description:
This module exploits a heap corruption vulnerability in the RealPlayer ActiveX control.
          By sending a specially crafted string to the 'Console' property
          in the rmoc3260.dll control, an attacker may be able to execute
          arbitrary code.
Metasploit Module: Sun Java Web Start Plugin Command Line Argument Injection
Type: exploit
Path: modules/exploits/windows/browser/java_ws_vmargs.rb
Platform: win
Disclosure date: 2012-02-14
Authors: jduck
References: CVE-2012-0500, OSVDB-79227, BID-52015, URL-https://seclists.org/fulldisclosure/2012/Feb/251, URL-http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html
Targets: Java Runtime on Windows x86

Description:
This module exploits a flaw in the Web Start component of the Sun Java
          Runtime Environment. The arguments passed to Java Web Start are not properly
          validated, allowing injection of arbitrary arguments to the JVM.

          By utilizing the lesser known -J option, an attacker can take advantage of
          the -XXaltjvm option, as discussed previously by Ruben Santamarta. This method
          allows an attacker to execute arbitrary code in the context of an unsuspecting
          browser user.

          In order for this module to work, it must be run as root on a server that
          does not serve SMB. Additionally, the target host must have the WebClient
          service (WebDAV Mini-Redirector) enabled.
Metasploit Module: Mozilla Firefox Interleaved document.write/appendChild Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/mozilla_interleaved_write.rb
Platform: win
Disclosure date: 2010-10-25
References: CVE-2010-3765, OSVDB-68905, BID-15352, EDB-15352, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=607222, URL-http://www.mozilla.org/security/announce/2010/mfsa2010-73.html
Targets: Firefox 3.6.8 - 3.6.11, Windows XP/Windows Server 2003

Description:
This module exploits a code execution vulnerability in Mozilla
          Firefox caused by interleaved calls to document.write and appendChild.
          This module was written based on a live exploit found in the wild.
Metasploit Module: Hyleos ChemView ActiveX Control Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/hyleos_chemviewx_activex.rb
Platform: win
Disclosure date: 2010-02-10
References: CVE-2010-0679, OSVDB-62276, URL-http://www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Activex.pdf, EDB-11422

Description:
This module exploits a stack-based buffer overflow within version 1.9.5.1 of Hyleos
          ChemView (HyleosChemView.ocx). By calling the 'SaveAsMolFile' or 'ReadMolFile' methods
          with an overly long first argument, an attacker can overrun a buffer and execute
          arbitrary code.
Metasploit Module: VLC MMS Stream Handling Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/vlc_mms_bof.rb
Platform: win
Disclosure date: 2012-03-15
References: CVE-2012-1775, OSVDB-80188, URL-http://www.videolan.org/security/sa1201.html, URL-http://web.archive.org/web/[PII_REDACTED]1447/http://git.videolan.org/?p=vlc/vlc-2.0.git;a=commit;h=11a95cce96fffdbaba1be6034d7b[PII_REDACTED]1c

Description:
This module exploits a buffer overflow in VLC media player VLC media player prior
          to 2.0.0. The vulnerability is due to a dangerous use of sprintf which can result
          in a stack buffer overflow when handling a malicious MMS URI.

          This module uses the browser as attack vector. A specially crafted MMS URI is
          used to trigger the overflow and get flow control through SEH overwrite. Control
          is transferred to code located in the heap through a standard heap spray.

          The module only targets IE6 and IE7 because no DEP/ASLR bypass has been provided.
Metasploit Module: Novell iPrint Client ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/novelliprint_getdriversettings_2.rb
Platform: win
Disclosure date: 2010-11-15
References: CVE-2010-4321, BID-44966, OSVDB-69357, ZDI-10-256, EDB-16014, URL-http://www.novell.com/support/viewContent.do?externalId=7007234

Description:
This module exploits a stack buffer overflow in Novell iPrint Client 5.52. When
          sending an overly long string to the GetDriverSettings() property of ienipp.ocx
          an attacker may be able to execute arbitrary code.
Metasploit Module: MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption
Type: exploit
Path: modules/exploits/windows/browser/msxml_get_definition_code_exec.rb
Platform: win
Disclosure date: 2012-06-12
References: CVE-2012-1889, BID-53934, OSVDB-82873, MSB-MS12-043, URL-http://technet.microsoft.com/en-us/security/advisory/2719615, URL-http://www.zdnet.com/blog/security/state-sponsored-attackers-using-ie-zero-day-to-hijack-gmail-accounts/12462, URL-https://www.rapid7.com/blog/post/2012/06/18/metasploit-exploits-critical-microsoft-vulnerabilities

Description:
This module exploits a memory corruption flaw in Microsoft XML Core Services
          when trying to access an uninitialized Node with the getDefinition API, which
          may corrupt memory allowing remote code execution.
Metasploit Module: MS06-057 Microsoft Internet Explorer WebViewFolderIcon setSlice() Overflow
Type: exploit
Path: modules/exploits/windows/browser/ms06_057_webview_setslice.rb
Platform: win
Disclosure date: 2006-07-17
References: CVE-2006-3730, OSVDB-27110, MSB-MS06-057, BID-19030

Description:
This module exploits a flaw in the WebViewFolderIcon ActiveX control
          included with Windows 2000, Windows XP, and Windows 2003. This flaw was published
          during the Month of Browser Bugs project (MoBB #18).
Metasploit Module: Trend Micro OfficeScan Client ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/trendmicro_officescan.rb
Platform: win
Disclosure date: 2007-02-12
References: CVE-2007-0325, OSVDB-33040, BID-22585

Description:
This module exploits a stack buffer overflow in Trend Micro OfficeScan
          Corporate Edition 7.3. By sending an overly long string to the
          "CgiOnUpdate()" method located in the OfficeScanSetupINI.dll Control,
          an attacker may be able to execute arbitrary code.
Metasploit Module: Cisco Linksys PlayerPT ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/cisco_playerpt_setsource.rb
Platform: win
Disclosure date: 2012-03-22
References: CVE-2012-0284, OSVDB-80297, EDB-18641

Description:
This module exploits a vulnerability found in Cisco Linksys PlayerPT 1.0.0.15
          as the installed with the web interface of Cisco Linksys WVC200 Wireless-G PTZ
          Internet Video Camera. The vulnerability, due to the insecure usage of sprintf in
          the SetSource method, allows to trigger a stack based buffer overflow which leads
          to code execution under the context of the user visiting a malicious web page.
Metasploit Module: Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/novelliprint_executerequest.rb
Platform: win
Disclosure date: 2008-02-22
References: CVE-2008-0935, OSVDB-42063, BID-27939

Description:
This module exploits a stack buffer overflow in Novell iPrint Client 4.26. When
          sending an overly long string to the ExecuteRequest() property of ienipp.ocx
          an attacker may be able to execute arbitrary code.
Metasploit Module: Adobe Flash Player ByteArray With Workers Use After Free
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_worker_byte_array_uaf.rb
Platform: win
Disclosure date: 2015-02-02
References: CVE-2015-0313, URL-https://helpx.adobe.com/security/products/flash-player/apsa15-02.html, URL-http://hacklab.kr/flash-cve-2015-0313-%EB%B6%84%EC%84%9D/, URL-http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2015-0313-the-new-flash-player-zero-day/

Description:
This module exploits a use-after-free vulnerability in Adobe Flash Player. The
          vulnerability occurs when the ByteArray assigned to the current ApplicationDomain
          is freed from an ActionScript worker, which can fill the memory and notify the main
          thread to corrupt the new contents. This module has been tested successfully on
          Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 16.0.0.296.
Metasploit Module: iseemedia / Roxio / MGI Software LPViewer ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/lpviewer_url.rb
Platform: win
Disclosure date: 2008-10-06
References: CVE-2008-4384, OSVDB-48946, US-CERT-VU-848873, BID-31604

Description:
This module exploits a stack buffer overflow in LPViewer ActiveX control (LPControll.dll 3.2.0.2). When
          sending an overly long string to the URL() property an attacker may be able to execute arbitrary code.
Metasploit Module: Logitech VideoCall ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/logitechvideocall_start.rb
Platform: win
Disclosure date: 2007-05-31
References: CVE-2007-2918, OSVDB-36820, BID-24254

Description:
This module exploits a stack buffer overflow in the Logitech VideoCall ActiveX
          Control (wcamxmp.dll 2.0.3470.448). By sending an overly long string to the
          "Start()" method, an attacker may be able to execute arbitrary code.
Metasploit Module: Symantec Altiris Deployment Solution ActiveX Control Arbitrary File Download and Execute
Type: exploit
Path: modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb
Platform: win
Disclosure date: 2009-09-09
References: BID-36346, CVE-2009-3028, OSVDB-57893

Description:
This module allows remote attackers to install and execute arbitrary files on a users file system via
          AeXNSPkgDLLib.dll (6.0.0.1418). This module was tested against Symantec Altiris Deployment Solution 6.9 sp3.
Metasploit Module: Firefox XMLSerializer Use After Free
Type: exploit
Path: modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb
Platform: win
Disclosure date: 2013-01-08
References: CVE-2013-0753, OSVDB-89021, BID-57209, ZDI-13-006, URL-http://www.mozilla.org/security/announce/2013/mfsa2013-16.html, URL-https://bugzilla.mozilla.org/show_bug.cgi?id=814001

Description:
This module exploits a vulnerability found on Firefox 17.0 (< 17.0.2), specifically
          a use-after-free of an Element object, when using the serializeToStream method
          with a specially crafted OutputStream defining its own write function. This module
          has been tested successfully with Firefox 17.0.1 ESR, 17.0.1 and 17.0 on Windows XP
          SP3.