Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Date Title Description Vulnerabilty Categorysort descending Platform
06.09.2008 Borland InterBase Remote Integer Overflow Exploit This module exploits a buffer overflow vulnerability in the database service (ibserver.exe) of the Borland InterBase 2007 application. The exploit triggers an integer overflow and causes a stack-based buffer overflow by sending a specially crafted packet to port 3050/TCP of the vulnerable system and installs an agent if successful. CVE-2008-2559 Exploits/Remote Windows
10.20.2010 Mantis Manage_proj_page Remote Code Execution Exploit Update 3 This update adds support for Solaris platforms. CVE-2008-4687 Exploits/Remote Solaris, Linux, Windows, AIX, Mac OS X
07.05.2011 HP Data Protector Client EXEC_SETUP Remote Code Execution Exploit This module exploits a design flaw in HP Data Protector by sending a specially crafted EXEC_SETUP request. The specific flaw exists within the implementation of the EXEC_SETUP command. This command instructs a Data Protector client to download and execute a setup file. A malicious attacker can instruct the client to access a file off of a share thus executing arbitrary code under the context of the current user. CVE-2011-0922 Exploits/Remote Windows
01.30.2007 ProFTPD sreplace buffer overflow exploit ProFTPD is prone to an remote buffer-overflow vulnerability. This issue is due to an off-by-one error, allowing attackers to corrupt memory. CVE-2006-5815 Exploits/Remote Linux
05.06.2010 Remote Exploits Service Package Update This package specify the service to be attacked, taking the info from CVE-2008-4038 Exploits/Remote Windows, Mac OS X
10.25.2012 EMC NetWorker nsrd RPC Service Format String Exploit A Format string vulnerability in the nsrd RPC service within EMC NetWorker? allows remote attackers to execute arbitrary code via format string specifiers in a crafted message. CVE-2012-2288 Exploits/Remote Linux, Windows
04.13.2011 DATAC RealWin ADDTAGMS Buffer Overflow Exploit DATAC RealWin is prone to a buffer overflow vulnerability when handling On_FC_CTAGLIST_FCS_ADDTAGMS packets with an overly long string. CVE-2011-1563 Exploits/Remote Windows
01.27.2010 AIX rpc.cmsd Buffer Overflow Exploit This module exploits a remote buffer overflow vulnerability on the Calendar Manager Service Daemon. CVE-2009-3699 Exploits/Remote AIX
07.21.2014 Adobe ColdFusion l10n.cfm Remote Code Execution Exploit The /CFIDE/adminapi/customtags/l10n.cfm page in Adobe ColdFusion does not properly validate its attributes.file parameter. This can be abused by a remote unauthenticated attacker to execute arbitrary code on vulnerable servers. CVE-2013-3336 Exploits/Remote Windows, Linux
12.06.2009 OpenSSH Channel Exploit Update Exploits an off-by-one bug in channel management code in OpenSSH. This update excludes the module from automated attacks launched by the "Network Attack and Penetration" feature, since the module requires credentials of a known account on the vulnerable system, and hence won't work with default parameters. CVE-2002-0083 Exploits/Remote OpenBSD, Linux
01.29.2012 Omni-NFS Enterprise FTP Server Buffer Overflow Exploit Update This vulnerability is caused by a buffer overflow in Omni-NFS Enterprise FTP Server, due to its lack of checking of user-supplied data within FTP requests. This update add CVE. CVE-2006-5792 Exploits/Remote Windows
07.28.2009 Wireshark PROFINET Dissector Format String Exploit Wireshark is prone to a format-string vulnerability. Attackers can leverage this issue to execute arbitrary code within the context of the vulnerable application. Failed attacks will likely cause denial-of-service conditions. CVE-2009-1210 Exploits/Remote Windows
08.09.2010 File Sharing Wizard HEAD Command Buffer Overflow Exploit File Sharing Wizard is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. CVE-2010-2331 Exploits/Remote Windows
05.02.2013 BigAnt IM Server DDNF Username Buffer Overflow Exploit BigAnt IM Server is vulnerable to a buffer-overflow within the AntDS.exe component when handling an overly long username. NOCVE-9999-57633 Exploits/Remote Windows
04.15.2007 MySQL create function exploit update MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls. This module exploits this vulnerability, and this update improve the exploit reliability. CVE-2005-0709 Exploits/Remote Linux, Windows
12.09.2008 AT TFTP Server Long Filename Buffer Overflow Exploit The vulnerability is caused due to a boundary error during the processing of TFTP Read/Write request packet types. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet with an overly long filename field. CVE-2006-6184 Exploits/Remote Windows
06.10.2008 CitectSCADA Buffer Overflow Exploit Remote exploitation of a buffer overflow vulnerability in CitectSCADA allows for the remote execution of arbitrary code by attackers. CVE-2008-2639 Exploits/Remote Windows
03.10.2014 OracleDB TNS Listener Remote Poisoning Vulnerability Exploit Oracle Database Server is prone to a remote vulnerability that allows attackers to poison the data handled by the remote 'TNS Listener' component of the application. This module tries to verify if the vulnerability is present in the 'TNS Listener' component of the database server, without deploying an agent. If a database instance name is supplied, it will be used to check for the vulnerability against the TNS listener of the target, but this could affect future client connections, as long as the module is running. If no database instance name is supplied, the module will try to register a random name. CVE-2012-1675 Exploits/Remote Windows, Linux
02.14.2012 CA iTechnology iGateway Debug Mode Buffer Overflow Exploit The CA iGateway component, contains a buffer overflow vulnerability due to improper bounds checking on HTTP GET requests by the iGateway component when debug mode is enabled. CVE-2005-3190 Exploits/Remote Windows
08.06.2009 Motorola Timbuktu Pro PlughNTCommand Stack Based Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow in Motorola Timbuktu Pro by sending a long malformed string over the plughNTCommand named pipe. CVE-2009-1394 Exploits/Remote Windows
11.21.2007 HP OpenView Remote Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the Shared Trace Service (ovtrcsvc.exe) of the HP OpenView application. The exploit triggers a stack-based buffer overflow by sending a specially crafted packet to port 5053/TCP of the vulnerable system and installs an agent if successful. CVE-2007-3872 Exploits/Remote Windows, Solaris
09.28.2011 DCERPC Based Exploits Reliability Fix This update enhances the reliability of DCERPC based exploits. Exploits/Remote
05.22.2011 NetSupport Manager Agent Buffer Overflow Exploit This module exploits a stack based buffer overflow in Netsupport Agent via a long control hostname to TCP port 5405. CVE-2011-0404 Exploits/Remote Linux, Mac OS X
08.17.2006 MSRPC SRVSVC NetrpPathCanonicalize (MS06-040) exploit update This module exploits a remotely exploitable vulnerability in Windows' Server Service (MS06-040) over Microsoft DCERPC (ports 139 and 445). This update adds support for Windows XP SP0 and SP1. CVE-2006-3439 Exploits/Remote Windows
10.02.2014 PureFTPd Bash Variables Injection Exploit (CVE-2014-6271) This update includes a module exploiting a vulnerability found in Bash. When using PureFTPd in conjuntion with the vulnerable Bash version for user authentication, a Core Impact agent is installed. CVE-2014-6271 Exploits/Remote Solaris, Linux
05.10.2012 PHP-CGI Argument Injection Exploit This module exploits an argument injection vulnerability in PHP up to version 5.3.12 and 5.4.2 when running as a standalone CGI processor and takes advantage of the -d flag to achieve remote code execution. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2012-1823 Exploits/Remote Windows, OpenBSD, Linux, FreeBSD
03.26.2012 Sysax Multi Server SSH Username Buffer Overflow Exploit This module exploits a stack based buffer overflow on Sysax Multi Server when parsing an overly long username at the beginning of an SSH session. NOCVE-9999-51516 Exploits/Remote Windows
09.21.2010 Integard Home and Pro Remote Buffer Overflow Exploit The vulnerability is caused due to a boundary error within the handling of HTTP POST requests. This may allow execution of arbitrary code by sending an overly long, specially crafted HTTP POST request to the server. NOCVE-9999-45121 Exploits/Remote Windows
06.01.2009 D-Link TFTP Transporting Mode Buffer Overflow Exploit D-Link TFTP Server 1.0 allows remote attackers to cause a buffer overflow via a long GET request, which triggers the vulnerability. CVE-2007-1435 Exploits/Remote Windows
06.02.2011 Tomcat Deploy Manager Default Account Code Execution Exploit This module exploits a remote code execution vulnerability in Tomcat Web Server by using an default user account to upload an arbitrary file. CVE-2009-3548 Exploits/Remote Windows