Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Date Title Description Vulnerabilty Categorysort descending Platform
06.12.2007 Apache Tomcat buffer overflow exploit This module exploits a buffer overflow vulnerability in the Apache Tomcat JK Web Server Connector and installs an agent. An attacker can use an overly long URL to trigger a buffer overflow in the URL work map routine (map_uri_to_worker()) in the mod_jk.so library, resulting in the compromise of the target system. CVE-2007-0774 Exploits/Remote Linux
09.17.2014 Openfiler Remote Code Execution Exploit Update Insufficient sanitization in Openfile's /admin/system.html 'Hostname' field, leads to remote code execution. This update fixes the exploit category. NOCVE-9999-65590 Exploits/Remote Linux
12.02.2008 FutureSoft TFTP Server 2000 Buffer Overflow Exploit This module exploits a buffer overflow in FutureSoft TFTP Server, that allows remote attackers to execute arbitrary code via a long malformed filename. CVE-2005-1812 Exploits/Remote Windows
04.06.2014 Schneider Electric Serial Modbus Driver Buffer Overflow Exploit The vulnerability is a buffer overflow in Schneider Electric OPC factory Suite which bundle the vulnerable component Schneider Electric Modbus Serial Driver (ModbusDrv.exe). CVE-2013-0662 Exploits/Remote Windows
09.29.2013 Adobe ColdFusion APSB13-03 Remote Code Execution Exploit Adobe ColdFusion is vulnerable to a remote authentication-bypass, allowing the attacker to upload an agent and execute it. The agent may have SYSTEM privileges if ColdFusion is installed as a service in Windows. CVE-2013-0625 Exploits/Remote Windows
01.08.2008 MySQL yaSSL Exploit This module exploits a remote buffer-overflow in MySQL servers using yaSSL. CVE-2008-0226 Exploits/Remote Windows, Linux, FreeBSD
09.01.2011 ActFax Server FTP User Buffer Overflow Exploit This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of software utilizing ActFax Server. The vulnerability is caused due to a boundary error when processing an overly long USER name on the FTP Server. This can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted argument passed to the affected command. NOCVE-9999-49018 Exploits/Remote Windows
05.25.2011 7T Interactive Graphical SCADA System IGSSdataServer Remote Buffer Overflow Exploit Update This module exploits a remote stack-based buffer overflow in IGSSdataServer by sending a malformed packet to the 12401/TCP port. This version add CVE. CVE-2011-1567 Exploits/Remote Windows
10.20.2008 Microsoft Windows SMB Buffer Underflow DoS (MS08-063) This module exploits a remote vulnerability on the FIND_FIRTS2 SMB subcommand on the srv.sys driver. CVE-2008-4038 Exploits/Remote Windows
07.26.2012 Simple Web Server GET Request Buffer Overflow Exploit The vulnerability is caused due to a boundary error within Simple Web Server when processing HTTP GET Request. This can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted argument passed to the affected command. NOCVE-9999-53352 Exploits/Remote Windows
05.15.2014 Apache Struts ClassLoader Manipulation Remote Code Execution Exploit This module exploits a vulnerability in Apache Struts. The specific vulnerability is in the ParametersInterceptor, which allows a direct manipulation of the ClassLoader and as a result an attacker can execute arbitrary Java code in the target machine. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2014-0094 Exploits/Remote Linux
04.23.2012 LotusCMS router PHP Command Injection Exploit Input passed via the "page" parameter to index.php is not properly sanitised in the "Router()" function in core/lib/router.php before being used in an "eval()" call. This can be exploited to execute arbitrary PHP code. NOCVE-9999-51709 Exploits/Remote Solaris, Linux
10.20.2013 TP-Link Camera servetest Command Injection Exploit This module exploits an OS command injection vulnerability in the /cgi-bin/admin/servetest file of several TP-Link surveillance cameras. This vulnerability allows remote authenticated users to execute arbitrary commands on affected cameras. CVE-2013-2578 Exploits/Remote
01.05.2012 CoDeSys SCADA Webserver Buffer Overflow Exploit webserver.exe is a component in 3S CoDeSys for handling the HTTP connections on port 8080. The process is affected by a buffer overflow that copies the input URI in a limited buffer allowing code execution. NOCVE-9999-50546 Exploits/Remote Windows
06.08.2009 EMC AlphaStor Server Agent Buffer Overflow Exploit Multiple stack-based buffer overflows in the Command Line Interface process in the Server Agent in EMC AlphaStor 3.1 for Windows allow remote attackers to execute arbitrary code via crafted TCP packets to port 41025. CVE-2008-2158 Exploits/Remote Windows
07.21.2010 Asterisk T.38 buffer Overflow Exploit Update This module exploits a buffer overflow vulnerability in the T38FaxRateManagement parameter when parsing SIP/SDP requests in 1.4.x prior to 1.4.3. This update improves the reliability of the module. CVE-2007-2293 Exploits/Remote Linux
06.08.2011 HP Rational Quality Manager Backdoor Account Code Execution Exploit This module exploits a remote code execution vulnerability in HP Rational Quality Manager by using an undocumented user account to upload an arbitrary file. CVE-2010-4094 Exploits/Remote Windows
03.08.2011 Symantec AMS Intel Alert Handler Pin Number Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the Intel Handler Service. CVE-2010-0111 Exploits/Remote Windows
12.14.2009 HP Operations Manager Server Backdoor Account Exploit This module exploits a remote code execution vulnerability in HP Operations Manager by using an undocumented user account to upload an arbitrary file. CVE-2009-3843 Exploits/Remote Windows
06.02.2014 Dassault Systemes Catia CATV5_Backbone_Bus Buffer Overflow Exploit A stack buffer overflow occurs when copying a user supplied input to a fixed size stack buffer. The copying procedure stops when a null byte is found and no size check is proceeded. NOCVE-9999-62708 Exploits/Remote Windows
08.29.2005 Exchange X-LINK2STATE CHUNK Exploit This module exploits a heap based buffer overflow handling the X-LINK2STATE command in the SMTP service of Exchange Server. CVE-2005-0560 Exploits/Remote Windows
02.16.2014 IBM Director CIM Server Remote Code Execution Exploit update This update resolves an issue related to the use of Impact's WebDAV server by this module. Exploits/Remote
10.17.2010 Joomla 1.5.12 Remote Execution Exploit Update 3 A vulnerability exists in the TinyMCE editor, included in the tiny browser plugin, which allows uploading files without authentication. This can be exploited to upload files with multiple extensions and execute arbitrary PHP code. This update adds support for Solaris platforms. NOCVE-9999-39524 Exploits/Remote Solaris, Linux, Windows
06.05.2008 MDaemon IMAP Fetch Exploit Update This module exploits a stack-based buffer overflow in the MDaemon Email Server 9.64. CVE-2008-1358 Exploits/Remote Windows
06.22.2009 AIX libtt.a rpc.ttdbserver Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the ToolTalk library libtt.a. After successful exploitation an agent running as root will be installed on the target machine. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. NOCVE-9999-38844 Exploits/Remote AIX
07.18.2010 mDNSResponder buffer overflow exploit Update This module exploits a buffer overflow vulnerability in the mDNSResponder service running on certain versions of Apple Mac OS X. The vulnerability is exploited remotely by sending a specially crafted UPnP Internet Gateway Device (IGD) packet and installing an agent. This update adds port parameter. CVE-2007-2386 Exploits/Remote Mac OS X
06.23.2011 DATAC RealWin SCADA Server Login Buffer Overflow Exploit DATAC Realwin is prone to a buffer-overflow when processing On_FC_CONNECT_FCS_LOGIN packets with an overly long user name. CVE-2011-1563 Exploits/Remote Windows
05.04.2010 Microsoft WINS Name Validation Exploit Update Exploits a buffer overflow vulnerability in Microsoft WINS server. This update improves the reliability of the exploit when using Reuse Connection method. CVE-2004-0567 Exploits/Remote Windows
01.15.2007 CA BrightStor Tape Engine buffer overflow exploit This module exploits a buffer overflow in CA Brightstor Tape Engine in BrightStor ARCserve Backup v11.5 CVE-2007-0168 Exploits/Remote Windows
01.13.2010 Savant Web Server Remote Buffer Overflow Exploit A remote buffer-overflow vulnerability affects Savant Web Server. This issue occurs because the application fails to validate the length of user-supplied strings before copying them into finite process buffers. CVE-2005-0338 Exploits/Remote Windows

Pages