Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Datesort ascending Title Description Vulnerabilty Category Platform
03.05.2009 Sami FTP Server Authentication Buffer Overflow Exploit The vulnerability is caused due to a boundary error within the authentication process. This can be exploited to cause a stack-based buffer overflow by sending an overly long, specially-crafted password to the affected server and waiting for the administrator of Sami FTP Server to set focus on the GUI of the program in order to deploy an agent. CVE-2006-2212 Exploits/Remote Windows
03.03.2009 BlazeHDTV PLF Playlist Buffer Overflow Exploit This module exploits a vulnerability caused due to a boundary error in BlazeHDTV when handling Playlist files. This can be exploited to cause a stack-based buffer overflow via a specially crafted PLF file. CVE-2006-6396 Exploits/Client Side Windows
03.03.2009 WebApps Exploit Generator Update v8.0 rev 1 Update solving a conflict between new XSS Exploits and XSS Exploit Generator Exploits/Cross Site Scripting (XSS)
03.02.2009 Free Download Manager Torrent Parsing Buffer Overflow Exploit This module exploits a vulnerability in Free Download Manager. The vulnerability is caused due to a boundary error within the processing of torrent files. This can be exploited to cause a stack-based buffer overflow when a specially crafted file is opened. CVE-2009-0184 Exploits/Client Side Windows
03.01.2009 Typo3 Cross Site Scripting Exploit This module exploits insecure randomness vulnerability in Typo3, which leads to XSS attacks. This module tries to guess the Typo3 encryptionKey by exploiting its insecure randomness. If guessed, it will install an XSS Agent. Exploits/Cross Site Scripting (XSS)/Known Vulnerabilities
02.27.2009 Chilkat ActiveX Remote Code Execution Exploit This module exploits a Remote Arbitrary File Creation/Execution vulnerability in the AppendBinary and SaveToFile function in Chilkat to deploy an agent. CVE-2008-5002 Exploits/Client Side Windows
02.26.2009 Novell GroupWise Internet Agent Remote Buffer Overflow Exploit This module exploits an off-by-one condition by sending a specially crafted RCPT verb argument to a Novell GroupWise Internet Agent. CVE-2009-0410 Exploits/Remote Windows
02.24.2009 PHPMyAdmin Server_databases Remote Code Execution Exploit This module exploits a vulnerability in PHPMyAdmin. server_databases.php fails when it attemps to sanitize the sort_by parameter. It allows an attacker to inject code, and execute it on the web server with www-data privileges. CVE-2008-4096 Exploits/Remote Linux
02.23.2009 Microsoft HTML Help Workshop HHP Buffer Overflow Exploit This module exploits a vulnerability in Microsoft HTML Workshop. The vulnerability is caused due to a boundary error in Microsoft HTML Help Workshop within the processing of .HHP files. This can be exploited to cause a stack-based buffer overflow when a specially crafted file is opened. CVE-2006-0564 Exploits/Client Side Windows
02.23.2009 Adobe Reader JBIG2Decode Memory Corruption Exploit This module exploits an array indexing vulnerability in Adobe Reader when handling a specially crafted PDF file. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-0658 Exploits/Client Side Windows
02.22.2009 VLC Media Player RealText Processing Stack Overflow Exploit This module exploits a vulnerability in VideoLan Media Player (VLC). A stack-based buffer overflow in the ParseRealText function in the Subtitle demux plugin (modules\demux\subtitle.c) in VLC Media Player 0.9.4 allows remote attackers to execute arbitrary code via a realtext RT media file with a header containing a crafted size value. CVE-2008-5036 Exploits/Client Side Windows
02.22.2009 EasyHDR FITS Buffer Overflow Exploit A stack-based buffer overflow in easyHDR PRO allows an attacker to execute arbitrary code via an invalid Flexible Image Transport System (FITS) file. CVE-2009-0254 Exploits/Client Side Windows
02.22.2009 SNORT SMB Fragmentation Buffer Overflow Exploit Update 2 This module exploits a stack buffer overflow vulnerability in the Sourcefire Snort DCE/RPC preprocessor. An unauthenticated, remote attacker can exploit this vulnerability to execute arbitrary code with the privileges of the Snort process. This update improves the reliability for Redhat Enterprise Linux 4 and FreeBSD 6.2 on Impact 8.0 CVE-2006-5276 Exploits/Remote Linux, FreeBSD
02.19.2009 RealNetworks Helix DNA Server Remote Heap Overflow Exploit This module exploits a remote heap overflow in the Helix DNA Server (rmserver.exe) by sending a specially crafted RTSP packet to the 554/TCP port. CVE-2008-5911 Exploits/Remote Windows
02.19.2009 Total Video Player M3U Playlist Buffer Overflow Exploit Total Video Player contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in Total Video Player when handling .M3U files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .M3U file CVE-2007-0949 Exploits/Client Side Windows
02.18.2009 Microsoft Internet Explorer CFunctionPointer Memory Corruption Exploit (MS09-002) This module exploits a memory corruption vulnerability in Internet Explorer 7 when handling a malformed HTML document. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-0075 Exploits/Client Side Windows
02.17.2009 Moodle Tex Filter Remote Code Execution Exploit A Remote Code Execution (RCE) vulnerability has been found in filter/tex/texed.php. Due to the fact this file does not properly check the input parameters, it is possible to exploit this vulnerability in order to execute arbitrary commands on the target server. This module starts a web server on the CORE IMPACT Console to publish the agent, which is downloaded from the target. In order to exploit this vulnerability register_globals must be enabled (in PHP) and the TeX Notation filter in Moodle must be turned on. NOCVE-9999-35969 Exploits/Remote Linux
02.17.2009 Mantis Manage_proj_page Remote Code Execution This module exploits a Remote Code Execution vulnerability in Mantis version 1.1.3 caused by Mantis handling the sort parameter in manage_proj_page without the proper validation. This allows for remote code execution on Mantis' Web server. CVE-2008-4687 Exploits/Remote Linux
02.12.2009 Mercury SMTPD CRAM-MD5 Pre-Auth Buffer Overflow Exploit Update This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Mercury Mail Transport System. The vulnerability is caused due to a boundary error within Mercury/32 SMTP Server Module (mercurys.dll) when processing arguments to the AUTH CRAM-MD5 command. This can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted argument passed to the affected command. This update adds support for DEP (Data Execution Prevention). CVE-2007-4440 Exploits/Remote Windows
02.12.2009 Zinf Audio Player PLS Buffer Overflow Exploit The vulnerability is caused due to a boundary error within the handling of .PLS files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .PLS file. CVE-2007-0707 Exploits/Client Side Windows
02.12.2009 Debian OpenSSL Predictable Random Number Generation Exploit Update 2 This module exploits the random number generator in Debian's OpenSSL package being predictable. This vulnerability is used to generate SSH keys and to install an agent into the target host. The exploit will generate the complete vulnerable keyspace, and will try to log as the provided user. If the user is root, the agent will have superuser capabilities. This update improves exploit performance when used through Network Attack and Penetration RPT. CVE-2008-0166 Exploits/Remote Linux
02.12.2009 Oracle Secure Backup Command Injection Exploit This module exploits a command injection error in the Oracle Secure Backup Administration server. CVE-2008-5449 Exploits/Remote Windows, Linux
02.11.2009 GOM Player ASX Playlist Buffer Overflow Exploit The vulnerability is caused due to a boundary error within the handling of a .ASX file with a long URI in the ref href tag. This can be exploited to cause a stack-based buffer overflow via a specially crafted .ASX file. CVE-2007-0707 Exploits/Client Side Windows
02.10.2009 FileCopa LIST Command Remote Buffer Overflow Exploit FileCopa FTP Server is prone to a buffer-overflow vulnerability when handling data through the LIST command, a large amount of data can trigger an overflow in a finite-sized internal memory buffer. CVE-2006-3726 Exploits/Remote Windows
02.08.2009 CA BrightStor ARCserve Backup Media Server Exploit Update This module exploits a buffer overflow in the handling of RPC data in the Computer Associates BrightStor ARCServe Backup Media Server service (mediasvr.exe) which is a component of BrightStor ARCserve Backup Tape Engine. This update adds support for Windows 2003 SP1 and SP2, Windows Vista SP1 and Windows XP SP3. CVE-2007-1785 Exploits/Remote Windows
02.08.2009 Fujitsu SystemcastWizard Lite PXE Remote Buffer Overflow Exploit This module exploits a remote buffer overflow in the Fujitsu SystemcastWizard application by sending a specially crafted packet to the port 4011/UDP. CVE-2009-0270 Exploits/Remote Windows
02.08.2009 GlobalSCAPE Secure FTP Server Remote Buffer Overflow Exploit This vulnerability allows remote attackers to execute arbitrary code on installations with GlobalSCAPE Secure FTP Server,which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error with the handling of overly long commands. This can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted command passed to the affected server. CVE-2005-1415 Exploits/Remote Windows
02.08.2009 Microsoft Windows SMB Trans Buffer Overflow DoS (MS09-001) This module exploits a remote vulnerability on Trans operation via a malformed CreateWithSdOrEa SMB command on the srv.sys driver. CVE-2008-4834 Denial of Service/Remote Windows
02.04.2009 Squid Web Proxy Cache HTTP Version Number DoS This module sends HTTP requests that causes the Squid Web Proxy to stop running. NOCVE-9999-35968 Denial of Service/Remote Linux
02.01.2009 Destiny Media Player Playlist Buffer Overflow Exploit Destiny Media Player contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in Destiny Media Player when handling .LST files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .LST file. NOCVE-9999-35962 Exploits/Client Side Windows

Pages