Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Date Title Description Vulnerabilty Categorysort descending Platform
04.28.2014 EMC Data Protection Advisor DPA Illuminator EJBInvokerServlet Remote Code Execution Exploit This module exploits a remote code execution vulnerability in EMC Data Protection Advisor (DAP). Vulnerable installations of EMC DPA exposes the EJBInvokerServlet invoker servlet which does not require any type of authentication by default on certain profiles and allow remote attackers to invoke MBean methods and execute arbitrary code. CVE-2012-0874 Exploits/Remote Windows
12.25.2006 MSRPC Netware Client CSNW Overflow exploit update This module exploits a buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows allows remote attackers to execute arbitrary code via crafted messages. CVE-2006-4688 Exploits/Remote Windows
08.30.2009 Joomla 1.5.12 Remote Code Execution Exploit A vulnerability exists in the TinyMCE editor, included in the tiny browser plugin, which allows uploading files without authentication. This can be exploited to upload files with multiple extensions and execute arbitrary PHP code. NOCVE-9999-39524 Exploits/Remote Solaris, Linux, Windows
12.12.2005 VERITAS NetBackup BPJava Exploit NetBackup Java user-interface is affected by a remote format string vulnerability. An attacker can exploit this vulnerability by crafting a malicious request that contains format specifiers. This module exploits this vulnerability and installs an agent. CVE-2005-2715 Exploits/Remote Windows, Linux
02.19.2009 RealNetworks Helix DNA Server Remote Heap Overflow Exploit This module exploits a remote heap overflow in the Helix DNA Server (rmserver.exe) by sending a specially crafted RTSP packet to the 554/TCP port. CVE-2008-5911 Exploits/Remote Windows
01.28.2010 OracleDB sys_context Remote Stack Overflow Exploit A buffer overflow vulnerability was found in the SYS_CONTEXT procedure in Oracle Database Server allows a valid database user to execute arbitrary code. The vulnerability can be exploited by any valid database user with CONNECT privileges. The buffer overflow can then be exploited by calling the SYS_CONTEXT() function. This module has two uses: One as a Remote Exploit, which needs authentication, and another as an SQL Injection OS Agent installer module, which needs an Oracle SQL Agent as a target. CVE-2004-1364 Exploits/Remote Linux
09.29.2013 Bifrost Server Buffer Overflow Exploit Bifrost Server is prone to a buffer overflow vulnerability which can be exploited remotely by sending a specially crafted packet to port TCP/81. NOCVE-9999-58713 Exploits/Remote Windows
10.27.2009 InterSystems Cache Argument Buffer Overflow Exploit This module exploits a stack overflow in InterSystems Cache by sending a specially crafted GET request. NOCVE-9999-40435 Exploits/Remote Windows
06.05.2013 Wordpress W3 Total Cache PHP Remote Code Execution Exploit This module exploits a vulnerability in W3 Total Cache plugin for Wordpress. Certain macros such as mfunc allow to inject PHP code into comments. By injecting a crafted comment into a valid post an attacker can execute arbitrary PHP code on systems running vulnerable installations of W3 Total Cache. CVE-2013-2010 Exploits/Remote Linux
03.18.2007 OpenBSD IPv6 mbuf Remote Exploit This module exploits a buffer overflow vulnerability in the OpenBSD kernel; the exploit uses fragmented ICMPv6 packets to take complete control of a target system. CVE-2007-1365 Exploits/Remote OpenBSD
12.17.2007 IBM Lotus Domino LSUB IMAP Server Buffer Overflow Exploit Exploits a stack buffer overflow in the Lotus Domino IMAP Server for windows version 7.0.2FP1 after authentication. CVE-2007-3510 Exploits/Remote Windows
12.04.2012 VCMS Image Arbitrary Upload Exploit A unrestricted file upload vulnerability exists in includes/inline_image_upload.php within AutoSec Tools V-CMS 1.0. This allows remote attackers to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request to the file in temp. CVE-2011-4828 Exploits/Remote Solaris, Linux, Windows, Mac OS X
07.23.2012 FlexNet License Server Manager lmgrd Buffer Overflow Exploit A stack buffer overflow exist in FlexNet License Server Manager due to the insecure usage of memcpy in the lmgrd service when handling crafted network packets. NOCVE-9999-52540 Exploits/Remote Windows
12.29.2008 NaviCOPA Web Server Remote Buffer Overflow Exploit The vulnerability is caused due to a boundary error within the handling of HTTP GET requests. This may allow execution of arbitrary code by sending an overly long, specially crafted HTTP GET request to the server. CVE-2006-5112 Exploits/Remote Windows
02.21.2010 Easy FTP Server Multiple Remote Buffer Overflow An internal memory buffer of Easy FTP Server may be overrun while handling long "APPE" command. This condition may be exploited by attackers to ultimately execute instructions with the privileges of the ftpbasicsvr.exe process. NOCVE-9999-42134 Exploits/Remote Windows
12.12.2014 Kerberos Checksum Remote Privilege Escalation Exploit (MS14-068) A vulnerability in Microsoft's implementation of the Kerberos authentication protocol allows to modify a Kerberos ticket to remotely escalate privileges. This module exploits the vulnerability impersonating a user of the domain's Administrators group to install an agent in the domain controller with System privileges. This update introduces the option to use NTLM hashes for authentication and Network RPT-AP integration. CVE-2014-6324 Exploits/Remote Windows
04.12.2012 Netmechanica NetDecision HTTP Server Buffer Overflow Exploit A buffer overflow in NetDecision's HTTP service is exploited when a long URL is managed by the HTTP Server's active window. For successfull exploitation, the victim need to have the HttpSvr's window open. CVE-2012-1465 Exploits/Remote Windows
10.15.2013 TP-Link Camera uploadfile Unauthenticated File Upload Exploit This module exploits an unauthenticated file upload vulnerability on TP-Link IP cameras. Due to improper access restrictions, it is possible for a remote unauthenticated attacker to upload an arbitrary file to the /mnt/mtd directory on the camera by issuing a POST request against the file /cgi-bin/uploadfile. CVE-2013-2580 Exploits/Remote
06.15.2014 HP SiteScope issueSiebelCmd Remote Code Execution Exploit This module exploits a remote code execution vulnerability in HP SiteScope. The vulnerability exists in the APISiteScopeImpl web service, specifically in the issueSiebelCmd method, which allows the user to execute arbitrary commands without authentication. CVE-2013-4835 Exploits/Remote Windows, Linux
06.06.2007 LANDesk Management Suite Alert Service Exploit This module exploits a buffer overflow vulnerability in the Alert Service (aolnsrvr.exe) component of LANDesk Management Suite 8.7 and installs an agent if successful. This vulnerability can be exploited remotely by sending a specially crafted packet to port UDP/65535. CVE-2007-1674 Exploits/Remote Windows
02.15.2011 Citrix Provisioning Services streamprocess Remote Buffer Overflow Exploit This module exploits a remote buffer overflow in the streamprocess.exe service included in the Citrix Provisioning Services application by sending a malformed packet to the 6905/UDP port. NOCVE-9999-46895 Exploits/Remote Windows
04.18.2011 Progea Movicon SCADA-HMI TCPUploadServer Remote Exploit This module exploits a remote vulnerability in the TCPUploadServer service included in the Movicon 11 application to install an agent by writing and running an executable file. NOCVE-9999-47538 Exploits/Remote Windows
08.26.2012 Ricoh DC DL-10 SR10 FTP USER Command Buffer Overflow Exploit Ricoh DC's DL-10 SR10 FTP Server is prone to a buffer-overflow vulnerability when handling data through the USER command. This can be exploited by supplying a long string of data to the affected command. NOCVE-9999-53623 Exploits/Remote Windows
07.05.2009 Novell Client NetIdentity Agent Buffer Overflow Exploit This module exploits a vulnerability in Novell Netware Client when sending a specially crafted RPC packet over the XTIERRPCPIPE named pipe. CVE-2009-1350 Exploits/Remote Windows
05.16.2012 CA Total Defense UNCWS Web Service DeleteReports Remote Code Execution Exploit The UNCWS Web Service component of CA Total Defense listens for SOAP requests. The DeleteReports method makes use of the uncsp_DeleteReports stored procedure, which is vulnerable to SQL Injection. A remote unauthenticated attacker can exploit this to execute arbitrary code on a vulnerable machine with SYSTEM privileges. CVE-2011-1653 Exploits/Remote Windows
07.21.2014 HP AutoPass License Server Remote Code Execution Exploit This module exploits a remote code execution vulnerability in HP AutoPass License Server. The CommunicationServlet component in HP AutoPass License Server does not enforce authentication and has a directory traversal vulnerability allowing a remote attacker to execute arbitrary code trough a JSP page uploaded to the vulnerable server. CVE-2013-6221 Exploits/Remote Windows
08.07.2011 MSRPC RRAS Exploit Update This module exploits a stack-based buffer overflow in the Windows Routing and Remote Access Service. This update fixes an issue in the agent connector. CVE-2006-2370 Exploits/Remote Windows
09.28.2011 Microsoft Office SharePoint Server 2007 Document Conversions Exploit Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP port 8082 CVE-2010-3964 Exploits/Remote Windows
08.29.2006 MailEnable IMAPD W3C Logging Buffer Overflow Exploit This module exploits a buffer overflow in the W3C logging for MailEnable Enterprise 1.1 allows remote attackers to execute arbitrary code. CVE-2005-3155 Exploits/Remote Windows
03.17.2008 Trend Micro OfficeScan Buffer Overflow Exploit The vulnerability is caused due to a boundary error within Trend Micro OfficeScan Corporate Edition when processing passwords with cgiChkMasterPwd.exe vulnerable module. This can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted argument passed to this module. CVE-2008-1365 Exploits/Remote Windows

Pages