Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Datesort ascending Title Description Vulnerabilty Category Platform
06.30.2015 Adobe Flash Player Drawing Fill Shader Memory Corruption Exploit This module exploits a memory corruption vulnerability in Adobe Flash Player. The specific flaw exists when a Shader is applied as a drawing fill allowing an attacker to take control of a vulnerable machine and execute arbitrary code. This vulnerability was found exploited in the wild on June 2015. CVE-2015-3105 Exploits/Client Side Windows
06.29.2015 Adobe Flash Player FLV Parsing Memory Corruption Exploit This module exploits a buffer overflow vulnerability in Adobe Flash Player when parsing malformed FLV objects. Attackers exploiting the vulnerability can corrupt memory and gain remote code execution. This vulnerability has been found exploited in the wild in June 2015 in the Operation Clandestine Wolf campaign. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-3113 Exploits/Client Side Windows
06.24.2015 Adobe Flash Player ShaderJob Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in Adobe Flash Player. The specific flaw exists when the "width" attribute of a ShaderJob is modified after starting the job allowing to an attacker to control the size of a destination buffer and the lenght of the copy operation. CVE-2015-3090 Exploits/Client Side Windows
06.24.2015 IBM Lotus Domino LDAP ModifyRequest Add Exploit The specific flaw exists within LDAP handling functionality which listens by default on TCP port 389. The vulnerable code blindly copies attacker supplied data from a specially formatted LDAP ModifyRequest packet to a fixed length stack buffer. CVE-2015-0117 Exploits/Remote Windows
06.18.2015 Adobe Flash Player AS2 NetConnection Type Confusion Exploit This module exploits a Type Confusion vulnerability in Adobe Flash Player. The specific flaw exist in the ActionScript 2 NetConnection class. When a NetConnection method is called with a parameter that is a native function object, its native data can be specified as a Number by the caller, but be interpreted as a pointer. This allows to overwrite different objects like vectors and finally accomplish remote code execution. CVE-2015-0336 Exploits/Client Side Windows
06.18.2015 Linux Overlayfs Local Privilege Escalation Exploit This module exploits a vulnerability in Linux. The overlayfs filesystem does not correctly check file permissions when creating new files in the upper filesystem directory. This can be exploited by an unprivileged process in kernels with CONFIG_USER_NS=y and where overlayfs has the FS_USERNS_MOUNT flag, which allows the mounting of overlayfs inside unprivileged mount namespaces. CVE-2015-1328 Exploits/Local Linux
06.15.2015 VMware Workstation Printer Escape Vulnerability Exploit This module exploits a vulnerability in the VMware printer virtual device from the guest OS and install an agent in the host computer. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released versionin order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-2336 Exploits/Local Windows
06.11.2015 QEMU Floppy Disk Controller fdctrl_handle_drive_specification_command Virtual Machine Escape Exploit (VENOM) The fdctrl_handle_drive_specification_command() function in the code that emulates the Floppy Disk Controller in QEMU does not properly reset the index within a buffer when processing user-controlled data, leading to a heap-based buffer overflow in the QEMU process that runs on the Host system. An attacker running code within a Guest operating system can exploit this vulnerability in order to escape from the QEMU virtual machine and execute arbitrary code on the Host operating system. CVE-2015-3456 Exploits/Local Linux
06.10.2015 Microsoft Windows Ancillary Function Driver Double Free Vulnerability Exploit (MS14-040) Update 4 This module exploits a double-free vulnerability in "afd.sys" by calling to "AfdTransmiteFile" function with crafted parameters. This update improves the exploit reliability when 64-bit targets have more than 4GB of RAM memory. CVE-2014-1767 Exploits/Local Windows
06.03.2015 IBM Lotus Domino BMP parsing Buffer Overflow Exploit Update IBM Domino is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when parsing BMP images. By sending a specially-crafted bitmap image, a remote attacker could overflow a buffer and execute arbitrary code on the system or make the application crash. This version adds support for several Windows versions. CVE-2015-1903 Exploits/Remote Windows
06.03.2015 Microsoft Windows Win32k Privilege Escalation Exploit(MS15-010) win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." CVE-2015-0003 Exploits/Local Windows
05.26.2015 SMB Relay Update This update improves the SMB relay attack when SMB is signed. CVE-2008-4037 Exploits/Tools Windows
05.25.2015 Linux apport Race Condition Privilege Escalation Exploit This module exploits a vulnerability in the Linux apport application. The apport application can be forced to drop privileges to uid 0 and write a corefile anywhere on the system. This can be used to write a corefile with crafted contents in a suitable location to gain root privileges. CVE-2015-1325 Exploits/Local Linux
05.20.2015 IBM Lotus Domino BMP parsing Buffer Overflow Exploit IBM Domino is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when parsing BMP images. By sending a specially-crafted bitmap image, a remote attacker could overflow a buffer and execute arbitrary code on the system or make the application crash. CVE-2015-1903 Exploits/Remote Windows
05.19.2015 Schneider Electric ProClima MetaDraw ObjLinks Property Exploit The MetaDraw ActiveX control's ObjLinks property can be assigned an attacker-supplied memory address and the control will redirect execution flow to this given memory address. This update add some Av Evasion capabilities CVE-2014-8514 Exploits/Client Side Windows
05.18.2015 Microsoft Windows HTTP.sys Range Integer Overflow Memory Disclosure Exploit (MS15-034) The code that handles the 'Range' HTTP header in the HTTP.sys driver in Microsoft Windows, which is used by Internet Information Services (IIS), is prone to an integer overflow vulnerability when processing a specially crafted HTTP request with a very long upper range. This integer overflow vulnerability can be leveraged to generate a memory disclosure condition, in which the HTTP.sys driver will return more data than it should from kernel memory, thus allowing remote unauthenticated attackers to obtain potentially sensitive information from the affected server. CVE-2015-1635 Exploits/Remote Windows
05.14.2015 Microsoft Windows Group Policy Remote Code Execution Vulnerability Exploit (MS15-011) This module exploits, via a "Man In The Middle" attack, a security flaw in the Domain Controller policies downloaded by clients during the logging process CVE-2015-0008 Exploits/Remote Windows
05.13.2015 Control Microsystems ClearSCADA Remote DoS Update This module exploits a vulnerability in the ClearSCADA Server service by sending a malformed packet to the 5481/TCP port to crash the application. This Update increases the MAX TRIES default value because it has not been reliable. CVE-2011-3143 Denial of Service/Remote Windows
05.12.2015 IBM Tivoli Storage Manager FastBackMount GetVaultDump Buffer Overflow Exploit Update The specific flaw exists within FastBackMount.exe which listens by default on TCP port 30051. When handling opcode 0x09 packets, the process blindly copies user supplied data into a stack-based buffer within CMountDismount::GetVaultDump. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user. This exploit add support for x86_64. CVE-2015-0119 Exploits/Remote Windows
05.11.2015 Wordpress Comments XSS Exploit A cross-site scripting vulnerability exists in the comments rendering in Wordpress 4.1.1 and previous versions. This exploit abuses a persistent cross site scripting vulnerability in Wordpress to install an OS Agent in the server running the Wordpress installation. This update includes a module that posts a comment with the cross site scripting code as a comment in a Wordpress post. The javascript code will attempt to install a Wordpress plugin everytime the post comment is rendered. The plugin will in turn install an OS agent in the server running Wordpress. This update adds the option to use the module in a verification mode, so a comment can be posted to verify if it would be moderated with the current webapps scenario in use. NOCVE-9999-71907 Exploits/Cross Site Scripting (XSS)/Known Vulnerabilities Linux
05.10.2015 AVG Remote Administration StoreServerConfig Command Remote Code Execution Exploit The AVG Administration Server is vulnerable to arbitrary configuration settings. Due to insufficient input validation, an attacker can use the StoreServerConfig command (command id 0x27) to set the value of the ClientLibraryName parameter to a UNC path. The provided value can be a path to a network share containing a malicious .dll file. This .dll file will be executed in the context of the AVG Administration Server service which runs as SYSTEM. NOCVE-9999-64522 Exploits/Remote Windows
05.10.2015 OracleDB DBMS AW.EXECUTE CDA Command Remote Stack Overflow Exploit Oracle Database Server Core RDBMS component is prone to a remote vulnerability that allows attackers to exploit a stack-based buffer overflow in the EXECUTE procedure of DBMS_AW. Using an overly long parameter in the CDA command with the previous procedure, a stack-based buffer overflow will occur, overwriting the saved return address. This module requires database user credentials with 'Create Session' privilege. CVE-2014-6567 Exploits/Remote Windows
05.10.2015 Symantec Endpoint Protection Kernel Pool Overflow Privilege Escalation Exploit Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b, and Small Business Edition before SEP 12.1, allows local users to execute arbitrary code via a long argument to a 0x00222084 IOCTL call. CVE-2014-3434 Exploits/Local Windows
05.06.2015 Ubuntu Linux USBCreator D-Bus Service KVMTest Privilege Escalation Exploit The KVMTest method in the com.ubuntu.USBCreator D-Bus service in Ubuntu Linux can invoke the kvm binary with root privileges using an arbitrary environment provided by an unprivileged user. This flaw can be leveraged by a local unprivileged attacker to gain root privileges. NOCVE-9999-71867 Exploits/Local Linux
04.29.2015 Citrix NetScaler SOAP Handler Remote Code Execution Exploit Update This module exploits a vulnerability in Citrix NetScaler server. Citrix NetScaler is prone to a memory-corruption vulnerability when handling certain SOAP requests. This update improves exploit reliability. NOCVE-9999-69407 Exploits/Remote FreeBSD
04.26.2015 OracleDB CSA Remote Code Execution Exploit AV Evasion Update This update updates AV evasion for OracleDB CSA Remote Code Execution Exploit module. CVE-2010-3600 Exploits/Remote Windows, Linux
04.22.2015 Adobe Flash Player shared ByteArray Use-After-Free Exploit Update This module exploits a Use-After-Free vulnerability in Adobe Flash Player. The method ByteArray::clear does not notify the suscriber when frees the memory assigned to a ByteArray object leaving a dangling pointer that can be later dereferenced. This vulnerability allows attackers to execute arbitrary code on vulnerable machines by enticing unsuspecting users to visit a website serving a specially crafted SWF Flash file. This vulnerability was found exploited in the wild in February 2015. This updates adds support for Windows 8 and 8.1. CVE-2015-0313 Exploits/Client Side Windows
04.19.2015 Citrix NetScaler SOAP Handler Remote Code Execution Exploit This module exploits a vulnerability in Citrix NetScaler server. Citrix NetScaler is prone to a memory-corruption vulnerability when handling certain SOAP requests. NOCVE-9999-69407 Exploits/Remote FreeBSD
04.19.2015 Micorosft Internet Explorer SetMouseCapture Use-After-Free Exploit Update This module exploits a use after free in Internet Explorer by using a SetMouseCapture vulnerability in MSHTML. This update fix an encryptAgent problem. CVE-2013-3893 Exploits/Client Side Windows
04.14.2015 IBM Tivoli Storage Manager FastBackMount GetVaultDump Buffer Overflow Exploit The specific flaw exists within FastBackMount.exe which listens by default on TCP port 30051. When handling opcode 0x09 packets, the process blindly copies user supplied data into a stack-based buffer within CMountDismount::GetVaultDump. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user. CVE-2015-0119 Exploits/Remote Windows

Pages