Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Date Title Description Vulnerabilty Categorysort descending Platform
12.05.2011 Zen Cart record_company Remote Code Execution Exploit Update This update adds support for Mac OS X and Solaris platforms. CVE-2009-2255 Exploits/Remote Solaris, Linux, Mac OS X
11.30.2009 OracleDB AUTH_SESSKEY Remote Buffer Overflow Exploit This module exploits a vulnerability in the Oracle Database Server. The vulnerability is triggered when the server processes a long string inside the AUTH_SESSKEY property resulting in a stack-based buffer overflow. CVE-2009-1979 Exploits/Remote Windows
02.01.2009 Microsoft SQL Server sp_replwritetovarbin Remote Heap Overflow Exploit This module exploits a heap-based buffer overflow in the Microsoft SQL Server by sending a specially crafted SQL query. It has two uses: One as a Remote Exploit which needs authentication, and another as an SQL Injection Agent installer module, which needs an SQL Agent as a target. CVE-2008-5416 Exploits/Remote Windows
08.31.2011 Cisco NX-OS CDP Remote Exploit A vulnerability has been reported as Cisco Bug ID CSCtf08873 which states that a CDP packet with a long Device ID crashes CDPD on N7k. Our research indicated that the vulnerability corrupts the state of the heap, leading to an exploitable scenario, which allows to gain administrator privileges. This module exploits such vulnerability in order to install an agent. This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. NOCVE-9999-48401 Exploits/Remote
02.12.2008 Microsoft IGMPv3 DoS (MS08-001) This modules causes a Denial of Service in Microsoft Windows. CVE-2007-0069 Exploits/Remote Windows
07.12.2007 mDNSResponder buffer overflow exploit This module exploits a buffer overflow vulnerability in the mDNSResponder service running on certain versions of Apple Mac OS X. The vulnerability is exploited remotely by sending a specially crafted UPnP Internet Gateway Device (IGD) packet and installing an agent. CVE-2007-2386 Exploits/Remote Mac OS X
01.06.2008 SynCE Command Injection exploit This module exploits a command injection error in the function runScripts in vdccm (SynCE daemon), reached through an information message remote request. CVE-2008-1136 Exploits/Remote FreeBSD, Linux
09.04.2013 Graphite Pickle Remote Code Execution Exploit This module exploits an unsafe pickle operation of Graphite in order to install an agent. CVE-2013-5093 Exploits/Remote Linux
07.11.2010 Microsoft Windows Print Spooler Buffer Overflow Exploit (MS09-022) Update This module exploits a buffer overflow vulnerability in the EnumeratePrintShares function in the Print Spooler Service in Microsoft Windows to install an agent in the target machine. This update adds TCP Spoofing Listener capabilities. CVE-2009-0228 Exploits/Remote Windows
05.25.2009 XBMC GET Request Remote Buffer Overflow Exploit This module exploits a vulnerability in XBMC by sending a specially crafted, overly long HTTP GET request to the application's web server which causes a stack-based buffer overflow, allowing arbitrary code execution. NOCVE-9999-37459 Exploits/Remote Windows
03.19.2012 AT TFTP Server Long Filename Buffer Overflow Exploit Update The vulnerability is caused due to a boundary error during the processing of TFTP Read/Write request packet types. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet with an overly long filename field. This update ensures that the program receives all data. CVE-2006-6184 Exploits/Remote Windows
10.24.2012 Identity Viewer Protocol Fix This fixes a misspelling in the identity.xml file. Exploits/Remote
09.17.2014 Kolibri Web Server Get Request Buffer Overflow Exploit Buffer overflow in Kolibri Web Server allows remote attackers to execute arbitrary code via a long URI in a GET request. CVE-2014-4158 Exploits/Remote Windows
04.17.2008 CA BrightStor Tape Engine Buffer Overflow Exploit update This module exploits a buffer overflow in CA Brightstor Tape Engine in BrightStor ARCserve Backup v11.5. This package makes a slight change in the documentation of the module. CVE-2007-0168 Exploits/Remote Windows
11.04.2008 MSRPC Server Service Remote Buffer Overflow Exploit (MS08-067) Update This module exploits a vulnerability in the Microsoft Server service sending a specially crafted RPC request. This module improves the reliability of the exploit on Windows 2000 and adds support for Windows XP SP3. CVE-2008-4250 Exploits/Remote Windows
06.01.2011 OracleDB CSA Remote Code Execution Exploit This module exploits a vulnerability in the Client System Analyzer component of the Oracle Database Server. CVE-2010-3600 Exploits/Remote Windows, Linux
04.08.2014 OpenSSL TLS Heartbeat Read Overrun Memory Disclosure Exploit A missing boundary check in the TLS Heartbeat extension in OpenSSL can be abused by remote attackers to read up to 64 kb of memory from the server. This memory disclosure vulnerability can be used by remote unauthenticated attackers to obtain sensitive information from the affected server, including private keys and session cookies. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2014-0160 Exploits/Remote Linux
09.02.2009 Remote Exploits Invalid Characters Update This update corrects a typo defining invalid characters for the egg in some remote exploits, and improves the reliability of Now SMS MMS Gateway Web Authorization Buffer Overflow Exploit on Windows 2000 targets. CVE-2007-4440 Exploits/Remote Windows
09.30.2013 Exim With Dovecot LDA Remote Code Execution Exploit The Dovecot documentation contains an example using a dangerous configuration option for Exim, which leads to a remote command execution vulnerability. NOCVE-9999-59209 Exploits/Remote Linux
04.28.2008 Arkeia Network Backup buffer overflow exploit update This package updates the Arkeia Network Backup exploit. CVE-2005-0491 Exploits/Remote Windows, Linux
09.28.2011 Procyon Core Server HMI Scada Coreservice Buffer Overflow Exploit Vulnerability in the coreservice.exe component of Procyon Core Server versions 1.13 and below. While processing a password, the application fails to do proper bounds checking before copying data into a buffer on the stack. This causes a buffer overflow and allows it to overwrite a structured exception handling record, allowing for unauthenticated remote code execution. CVE-2011-3322 Exploits/Remote Windows
10.27.2014 Improvements to Bash Environment Variable Injection Exploits This update add verification for CVE-2014-6278 to all available attack vectors. CVE-2014-6271 Exploits/Remote Solaris, Linux
05.15.2008 TFTPServer SP Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the handling of Error Packet for overwrite all the .bss section and some portion of the .idata section. CVE-2008-2161 Exploits/Remote Windows
10.24.2013 PineApp Mail-SeCure ldapsynchnow.php Remote Code Execution Exploit This module exploits a vulnerability present in PineApp Mail-SeCure. The specific flaw exists within the component ldapsynchnow.php, which lacks proper sanitization, thus allowing command injection. NOCVE-9999-59234 Exploits/Remote Linux
08.03.2010 HP OpenView NNM OvJavaLocale Buffer Overflow Exploit This module exploits a stack-based buffer overflow in the webappmon.exe CGI application, a component of HP OpenView Network Node Manager, by sending an HTTP request with an invalid value for the OvJavaLocale parameter. CVE-2010-2709 Exploits/Remote Windows
09.18.2007 Surgemail Search Exploit This module exploits a stack-based buffer overflow in the Surgemail Server 3.x and deploys an agent when successful. The exploit triggers a buffer-overflow vulnerability due to insufficient bounds checking of user supplied input allowing remote attackers to execute arbitrary code on the remote machine. CVE-2007-4377 Exploits/Remote Windows
02.07.2010 Serv-U Web Client HTTP Request Remote Buffer Overflow Exploit This module exploits a stack overflow in Serv-U Web Client by sending a specially crafted POST request. CVE-2009-4873 Exploits/Remote Windows
10.06.2011 HP iNode Management Center iNodeMngChecker Remote Code Execution Exploit The flaw exists within the iNodeMngChecker.exe component which listens by default on TCP port 9090. When handling the 0x0A0BF007 packet type the process blindly copies user supplied data into a fixed-length buffer on the stack. CVE-2011-1867 Exploits/Remote Windows
06.29.2011 HP Data Protector Omniinet.exe Remote Buffer Overflow This module exploits a buffer overflow vulnerability in HP Data Protector by sending a specially crafted packet to the vulnerable Omniinet.exe service. CVE-2011-1865 Exploits/Remote Windows
11.05.2014 Apache Struts ClassLoader Manipulation Remote Code Execution Exploit Update This module exploits a vulnerability in Apache Struts. The specific vulnerability is in the ParametersInterceptor, which allows a direct manipulation of the ClassLoader and as a result an attacker can execute arbitrary Java code in the target machine. This update adds support for Apache Struts 2.3.16, Windows (x86 and x64) and Linux (x64) platforms. CVE-2014-0094 Exploits/Remote Windows, Linux

Pages