Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Datesort ascending Title Description Vulnerabilty Category Platform
08.27.2015 Zimbra Collaboration Server skin Local File Include Exploit Update Zimbra is vulnerable to a Local File Inclusion vulnerability that allows attacker to get LDAP credentials which we may use for upload a JSP file allowing us to install an agent. This update workarounds a problem when proxying and using HTTPSConnection. CVE-2013-7091 Exploits/Remote Linux
08.27.2015 Adobe Reader X AdobeCollabSync Buffer Overflow Sandbox Bypass Exploit Update This module allows an agent running in the context of AcroRd32.exe with Low Integrity Level/AppContainer Integrity Level to escalate privileges in order to install a new agent that will run with Medium Integrity Level. This update fixes an issue related to highlight preconditions when running against x86-64 targets. CVE-2013-2730 Exploits/Local Windows
08.26.2015 Microsoft Windows OLE Package Manager Code Execution Exploit (MS14-064) Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document. CVE-2014-6352 Exploits/Client Side Windows
08.26.2015 SolarWinds Firewall Security Manager userlogin Exploit Solarwinds FSM is vulnerable to an authentication bypass in userlogin.jsp that allows attacker to upload an agent via a weekness in the username atribute in settings-new.jsp allowing us to install an agent. CVE-2015-2284 Exploits/Remote Windows
08.26.2015 IBM Tivoli Storage Manager FastBack Server GetJobByUserFriendlyString Exploit The specific flaw exists within the JOB_S_GetJobByUserFriendlyString function. By sending a crafted packet on TCP port 11460 CVE-2015-1930 Exploits/Remote Windows
08.19.2015 Linux libuser passwd file handling Privilege Escalation Exploit A flaw was found in the way the libuser library handled the /etc/passwd file. A local attacker could use an application compiled against libuser (for example, userhelper) to manipulate the /etc/passwd file, which could result in a denial of service or possibly allow the attacker to escalate their privileges to root. CVE-2015-3246 Exploits/Local Linux
08.13.2015 Usermin Email Signature Command Injection Exploit The Usermin Control Panel is vulnerable to command injection due to the function get_signature in usermin/mailbox/mailbox-lib.pl, which calls open() without any prior validation. This vulnerability allows authenticated users to execute arbitrary code on the affected Usermin versions. CVE-2015-2079 Exploits/Remote Solaris, Linux
08.12.2015 SolarWinds Application Monitor TSUnicodeGraphEditorControl factory Buffer Overflow Exploit Update The specific flaw exists within the 'factory' object's loadExtensionFactory method. The issue lies in a failure to validate the size of an attacker-supplied input before copying it into a fixed-size buffer on the stack. An attacker can leverage this vulnerability to execute code under the context of the current process. This version add x86_64 support. CVE-2015-1500 Exploits/Client Side Windows
08.11.2015 Microsoft Windows Group Policy Remote Code Execution Vulnerability Exploit (MS15-011) Update This module exploits, via a "Man In The Middle" attack, a security flaw in the Domain Controller policies downloaded by clients during the logging process This update adds support to Windows 8.1 and Windows 2012 R2 and improves the network stability. CVE-2015-0008 Exploits/Remote Windows
08.11.2015 QEMU Floppy Disk Controller fdctrl_handle_drive_specification_command Virtual Machine Escape Exploit (VENOM) Update The fdctrl_handle_drive_specification_command() function in the code that emulates the Floppy Disk Controller in QEMU does not properly reset the index within a buffer when processing user-controlled data, leading to a heap-based buffer overflow in the QEMU process that runs on the Host system. An attacker running code within a Guest operating system can exploit this vulnerability in order to escape from the QEMU virtual machine and execute arbitrary code on the Host operating system. This update adds support for exploiting 64-bit guest systems. CVE-2015-3456 Exploits/Local Linux
08.03.2015 Microsoft Windows Win32k ClientCopyImage Privilege Escalation Exploit(MS15-051) An elevation of privilege vulnerability exists when the Win32k.sys kernel-mode driver improperly handles objects in memory. The vulnerability exists in the Windows OS process of creating windows for applications. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. CVE-2015-1701 Exploits/Local Windows
08.03.2015 ISC BIND TKEY assert DoS This module exploits a vulnerability while handling TKEY queries in the BIND service to cause a DoS. CVE-2015-5477 Denial of Service/Remote Solaris, Linux
07.29.2015 IBM Lotus Domino BMP parsing Buffer Overflow Exploit Update 2 IBM Domino is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when parsing BMP images. By sending a specially-crafted bitmap image, a remote attacker could overflow a buffer and execute arbitrary code on the system or make the application crash. This version add encryption. CVE-2015-1903 Exploits/Remote Windows
07.27.2015 Microsoft Windows Kernel Use After Free Vulnerability Exploit (MS15-061) This module exploits an "Use After Free" vulnerability in win32k.sys by calling to "SetClassLong" function with crafted parameters CVE-2015-1724 Exploits/Local Windows
07.23.2015 Microsoft Windows OpenType Font Driver Vulnerability Exploit (MS15-078) This module exploits a vulnerability in "atmfd.dll" Windows driver by loading a crafted OTF font. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-2426 Exploits/Local Windows
07.14.2015 Adobe Flash Player AS3 ConvolutionFilter Use-After-Free Exploit This module exploits a Use-After-Free vulnerability in Adobe Flash Player. The specific flaw exists within the processing of AS3 ConvolutionFilter objects. By manipulating the matrix property of a ConvolutionFilter object, an attacker can force a dangling pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. This vulnerability was one of the 2015's Pwn2Own challenges. CVE-2015-0349 Exploits/Client Side Windows
07.12.2015 Adobe Flash Player opaqueBackground property Use-After-Free Exploit This module exploits a Use-After-Free vulnerability in Adobe Flash Player. The specific flaw is in the opaqueBackground property within the setter of the flash.display.DisplayObject class. This vulnerability was found in the HackingTeam's leak on July 2015. ARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-5122 Exploits/Client Side Windows
07.12.2015 Microsoft Windows Kernel ATMFD Font Vulnerability Exploit This module exploits a vulnerability in atmfd.sys module by loading a crafted OTF font. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. NOCVE-9999-73027 Exploits/Local Windows
07.07.2015 Adobe Flash Player ByteArray valueOf Use-After-Free Exploit This module exploits a Use-After-Free vulnerability in Adobe Flash Player. This vulnerability was found on the HackingTeam's leak on July 2015. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-5119 Exploits/Client Side Windows
07.02.2015 Adobe Flash Player FLV Nellymoser Decoding Heap Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in Adobe Flash Player when parsing malformed FLV objects. Attackers exploiting the vulnerability can corrupt memory and gain remote code execution. CVE-2015-3043 Exploits/Client Side Windows
07.01.2015 Zimbra Collaboration Server skin Local File Include Exploit Zimbra is vulnerable to a Local File Inclusion vulnerability that allows attacker to get LDAP credentials which we may use for upload a JSP file allowing us to install an agent. CVE-2013-7091 Exploits/Remote Linux
07.01.2015 Adobe Flash Player ByteArray write method Use-After-Free Exploit This module exploits a Use-After-Free vulnerability in Adobe Flash Player. The specific flaw exists when the suscriber is not notified if a ByteArray assigned to the ApplicationDomain is freed from an ActionScript worker. By forcing a reallocation by copying more contents than the original capacity to the shared buffer by using the ByteArray::writeBytes method call, the ApplicationDomain pointer is not updated leading to a use-after-free vulnerability. This allows to overwrite different objects like vectors and finally accomplish remote code execution. CVE-2015-0359 Exploits/Client Side Windows
06.30.2015 Adobe Flash Player Drawing Fill Shader Memory Corruption Exploit This module exploits a memory corruption vulnerability in Adobe Flash Player. The specific flaw exists when a Shader is applied as a drawing fill allowing an attacker to take control of a vulnerable machine and execute arbitrary code. This vulnerability was found exploited in the wild on June 2015. CVE-2015-3105 Exploits/Client Side Windows
06.29.2015 Adobe Flash Player FLV Parsing Memory Corruption Exploit This module exploits a buffer overflow vulnerability in Adobe Flash Player when parsing malformed FLV objects. Attackers exploiting the vulnerability can corrupt memory and gain remote code execution. This vulnerability has been found exploited in the wild in June 2015 in the Operation Clandestine Wolf campaign. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-3113 Exploits/Client Side Windows
06.24.2015 Adobe Flash Player ShaderJob Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in Adobe Flash Player. The specific flaw exists when the "width" attribute of a ShaderJob is modified after starting the job allowing to an attacker to control the size of a destination buffer and the lenght of the copy operation. CVE-2015-3090 Exploits/Client Side Windows
06.24.2015 IBM Lotus Domino LDAP ModifyRequest Add Exploit The specific flaw exists within LDAP handling functionality which listens by default on TCP port 389. The vulnerable code blindly copies attacker supplied data from a specially formatted LDAP ModifyRequest packet to a fixed length stack buffer. CVE-2015-0117 Exploits/Remote Windows
06.18.2015 Adobe Flash Player AS2 NetConnection Type Confusion Exploit This module exploits a Type Confusion vulnerability in Adobe Flash Player. The specific flaw exist in the ActionScript 2 NetConnection class. When a NetConnection method is called with a parameter that is a native function object, its native data can be specified as a Number by the caller, but be interpreted as a pointer. This allows to overwrite different objects like vectors and finally accomplish remote code execution. CVE-2015-0336 Exploits/Client Side Windows
06.18.2015 Linux Overlayfs Local Privilege Escalation Exploit This module exploits a vulnerability in Linux. The overlayfs filesystem does not correctly check file permissions when creating new files in the upper filesystem directory. This can be exploited by an unprivileged process in kernels with CONFIG_USER_NS=y and where overlayfs has the FS_USERNS_MOUNT flag, which allows the mounting of overlayfs inside unprivileged mount namespaces. CVE-2015-1328 Exploits/Local Linux
06.15.2015 VMware Workstation Printer Escape Vulnerability Exploit This module exploits a vulnerability in the VMware printer virtual device from the guest OS and install an agent in the host computer. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released versionin order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-2336 Exploits/Local Windows
06.11.2015 QEMU Floppy Disk Controller fdctrl_handle_drive_specification_command Virtual Machine Escape Exploit (VENOM) The fdctrl_handle_drive_specification_command() function in the code that emulates the Floppy Disk Controller in QEMU does not properly reset the index within a buffer when processing user-controlled data, leading to a heap-based buffer overflow in the QEMU process that runs on the Host system. An attacker running code within a Guest operating system can exploit this vulnerability in order to escape from the QEMU virtual machine and execute arbitrary code on the Host operating system. CVE-2015-3456 Exploits/Local Linux

Pages