Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Date Title Description Vulnerabilty Categorysort descending Platform
02.03.2013 Novell eDirectory ndsd Remote Buffer Overflow Exploit This module exploits a remote buffer overflow in Novell eDirectory by sending a malformed packet to the 524/TCP port. CVE-2012-0432 Exploits/Remote Linux
08.06.2014 Atlassian JIRA Issue Collector Plugin Path Traversal Vulnerability Exploit A path traversal vulnerability affects the Issue Collector plugin in Atlassian JIRA. This module exploits that vulnerability to achieve remote code execution. The installed agent will have SYSTEM privileges. CVE-2014-2314 Exploits/Remote Windows
11.28.2006 MSRPC WKSSVC NetpManageIPCConnect exploit A remote code execution vulnerability exists in the Workstation service that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system. CVE-2006-4691 Exploits/Remote Windows
07.21.2013 MinaliC Webserver GET Buffer Overflow Exploit The vulnerability is caused due to a boundary error in the handling of HTTP "GET" requests. This can be exploited to cause a buffer overflow by sending a specially crafted overly long request. This request must avoid some special characters in order to cause the overflow. NOCVE-9999-58667 Exploits/Remote Windows
05.16.2010 CA XOsoft Control Service entry_point.aspx Remote Buffer Overflow Exploit This module exploits a remote buffer overflow vulnerability in the entry_point.aspx login page of CA XOsoft Control Service. CVE-2010-1223 Exploits/Remote Windows
03.04.2010 OpenX Remote Code Execution Exploit The vulnerability is caused due to the banner-edit.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to e.g. execute arbitrary PHP code by uploading a specially crafted PHP script that contains the GIF magic number. CVE-2009-4098 Exploits/Remote Solaris, Linux, Mac OS X
03.03.2013 freeSSHd SSH Server Authentication Bypass Remote Code Execution Exploit A vulnerability in the freeSSHd SSH Server allows remote attackers to bypass authentication via a crafted session. This module exploits the vulnerability and installs an agent into the target host. CVE-2012-6066 Exploits/Remote Windows
07.25.2011 Zend Server Java Bridge Design Flaw Remote Code Execution Exploit This module exploits a vulnerability in Java Bridge component of Zend Server. NOCVE-9999-47690 Exploits/Remote Windows, Linux, Mac OS X
03.29.2015 HP Network NNMi PMD Buffer Overflow Exploit This module exploits a stack-based buffer overflow in HP Network Node Manager I (NNMi). The PMD service in HP NNMi is vulnerable to a stack-based buffer overflow when handling a specially crafted stack_option packet. CVE-2014-2624 Exploits/Remote Linux
06.05.2012 Samba Username Map Script Command Injection Exploit Update The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the SamrChangePassword function, when the "username map script" smb.conf option is enabled. This update adds Solaris support. CVE-2007-2447 Exploits/Remote Solaris, Linux
01.30.2012 Plone popen2 Remote Command Execution Exploit This module exploits a remote command execution vulnerability in the Zope web application server used by Plone, by sending a specially crafted HTTP request to the affected web site. The vulnerability exists because it is possible to remotely invoke the popen2 function from the Python os package with arbitrary arguments in the context of the affected server. This can be exploited by remote unauthenticated attackers to execute arbitrary code on the vulnerable machine. CVE-2011-3587 Exploits/Remote Linux, FreeBSD
02.10.2009 FileCopa LIST Command Remote Buffer Overflow Exploit FileCopa FTP Server is prone to a buffer-overflow vulnerability when handling data through the LIST command, a large amount of data can trigger an overflow in a finite-sized internal memory buffer. CVE-2006-3726 Exploits/Remote Windows
09.04.2014 OpenSSL TLS Heartbeat Read Overrun Memory Disclosure Exploit Update A missing boundary check in the TLS Heartbeat extension in OpenSSL can be abused by remote attackers to read up to 64 kb of memory from the server. This memory disclosure vulnerability can be used by remote unauthenticated attackers to obtain sensitive information from the affected server, including private keys and session cookies. This update adds features to the module, like the ability to read 64 kb of data from vulnerable services, reporting the results in the Module Output window, and saving the memory dumps to disk. It also improves the compatibility with OpenSSL services and adds support for FTPS. CVE-2014-0160 Exploits/Remote Linux
01.15.2007 CA BrightStor Tape Engine buffer overflow exploit This module exploits a buffer overflow in CA Brightstor Tape Engine in BrightStor ARCserve Backup v11.5 CVE-2007-0168 Exploits/Remote Windows
08.08.2011 Citrix Provisioning Services streamprocess Remote Buffer Overflow Exploit Update This module exploits a remote buffer overflow in the streamprocess.exe service included in the Citrix Provisioning Services application by sending a malformed packet to the 6905/UDP port. This update fixes an issue in the agent connector. NOCVE-9999-46895 Exploits/Remote Windows
06.01.2010 HP OpenView NNM snmpviewer CGI Buffer Overflow Exploit This module exploits a stack-based buffer overflow in the snmpviewer.exe CGI application, a component of HP OpenView Network Node Manager, by sending an HTTP request with an invalid value for the act and app parameters. CVE-2010-1552 Exploits/Remote Windows
04.06.2010 Symantec Veritas VRTSweb Remote Exploit This module exploits a code execution vulnerability in the Veritas Web Server service by sending a specially crafted authentication request to the 14300/TCP port. CVE-2009-3027 Exploits/Remote Windows
02.24.2009 PHPMyAdmin Server_databases Remote Code Execution Exploit This module exploits a vulnerability in PHPMyAdmin. server_databases.php fails when it attemps to sanitize the sort_by parameter. It allows an attacker to inject code, and execute it on the web server with www-data privileges. CVE-2008-4096 Exploits/Remote Linux
09.06.2013 Sophos Web Protection Appliance sblistpack Command Injection Exploit The /opt/ws/bin/sblistpack Perl script in Sophos Web Protection Appliance, which can be reached from the web interface, is vulnerable to OS command injection because its get_referers() function does not escape the first argument of the script before using it within a string that will be executed as a command by using backticks. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary code in the affected appliance with the privileges of the "spiderman" operating system user. A second vulnerability in the Sophos Web Protection Appliance (an OS command injection in the /opt/cma/bin/clear_keys.pl script, which can be executed by the "spiderman" user with the sudo command without password) allows an attacker who successfully compromised the appliance to escalate privileges from "spiderman" to root. CVE-2013-4983 Exploits/Remote Linux
12.05.2011 Zen Cart record_company Remote Code Execution Exploit Update This update adds support for Mac OS X and Solaris platforms. CVE-2009-2255 Exploits/Remote Solaris, Linux, Mac OS X
11.30.2008 Easy File Sharing FTP Server PASS Buffer Overflow Exploit The vulnerability is caused due to a boundary error with the handling of passwords. This can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted passwords passed to the affected server. CVE-2006-3952 Exploits/Remote Windows
05.04.2010 RealNetworks Helix Server AgentX Remote Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow vulnerability in AgentX++, as distributed with Helix Server, by sending multiple blocks of data to the port 705/TCP. CVE-2010-1318 Exploits/Remote Windows
08.12.2014 Supported services list update This package updates the list of network service TCP and UDP ports known to the Impact exploits framework. Exploits/Remote
07.09.2009 Zabbix 1.6.2 Remote Code Execution Exploit A Remote Code Execution issue has been found in Zabbix version 1.6.2 and no authentication is required in order to exploit this vulnerability. Magic Quotes must be turned off in order to exploit this vulnerability. NOTE: Magic quotes is no longer supported by PHP starting with PHP 6.0 NOCVE-9999-37058 Exploits/Remote Linux
03.19.2012 AT TFTP Server Long Filename Buffer Overflow Exploit Update The vulnerability is caused due to a boundary error during the processing of TFTP Read/Write request packet types. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet with an overly long filename field. This update ensures that the program receives all data. CVE-2006-6184 Exploits/Remote Windows
10.15.2008 MSRPC Microsoft Host Integration Remote Command Execution Exploit (MS08-059) This module exploits a remote command injection in the SNA RPC service included in Microsoft Host Integration Server. A remote attacker can exploit this vulnerability to execute arbitrary code and completely compromise the computer. CVE-2008-3466 Exploits/Remote
06.09.2013 MongoDB nativeHelper Remote Code Execution Exploit This module exploits a vulnerability in MongoDB server. An arbitrary value passed as a parameter to the nativeHelper function in MongoDB server allows an attacker to control the execution flows to achieve remote code execution. CVE-2013-1892 Exploits/Remote Linux
06.07.2011 Oracle VM Server Virtual Server Agent Command Injection Exploit By including shell meta characters within the second parameter to the 'urt_test_url' XML-RPC methodCall, an attacker can execute arbitrary commands. The service typically runs with root privileges. CVE-2010-3585 Exploits/Remote Linux
01.28.2010 Net Transport eDonkey Protocol Buffer Overflow Exploit The vulnerability is caused due to a boundary error in the processing of eDonkey "OP_LOGINREQUEST" packets. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet to the ed2k port of an affected system. NOCVE-9999-41933 Exploits/Remote Windows
01.08.2013 IBM Director CIM Server Remote Code Execution Exploit IBM Director is prone to a remote code execution vulnerability that affects the CIM server. Attackers can leverage this issue to execute arbitrary code with elevated privileges in the context of the CIM server process. CVE-2009-0880 Exploits/Remote Windows

Pages