Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Date Title Description Vulnerabilty Categorysort descending Platform
09.18.2008 Now SMS MMS Gateway Web Authorization Buffer Overflow Exploit update A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of software utilizing the web interface of Now SMS MMS Gateway. This version add support for Windows 2003 and all systems with DEP enabled. CVE-2008-0871 Exploits/Remote Windows
11.22.2011 Tomcat Deploy Manager Default Account Code Execution Exploit Update This update enhaces the functionality of this module. CVE-2009-3548 Exploits/Remote Windows
08.06.2014 Atlassian JIRA Issue Collector Plugin Path Traversal Vulnerability Exploit A path traversal vulnerability affects the Issue Collector plugin in Atlassian JIRA. This module exploits that vulnerability to achieve remote code execution. The installed agent will have SYSTEM privileges. CVE-2014-2314 Exploits/Remote Windows
12.18.2007 Apache - OpenSSL SSLv2 exploit update This update fixes an incompatibility issue between this exploit and latest Python versions. CVE-2002-0656 Exploits/Remote Linux
11.04.2008 MSRPC Server Service Remote Buffer Overflow Exploit (MS08-067) Update This module exploits a vulnerability in the Microsoft Server service sending a specially crafted RPC request. This module improves the reliability of the exploit on Windows 2000 and adds support for Windows XP SP3. CVE-2008-4250 Exploits/Remote Windows
01.05.2011 Mantis Manage_proj_page Remote Code Execution Exploit Update 5 This module exploits a Remote Code Execution vulnerability in Mantis version 1.1.3 when handling the sort parameter in manage_proj_page without the proper validation that leads to a remote code execution on Mantis' Web server. This update adds support for the OSX platform. CVE-2008-4687 Exploits/Remote Solaris, Linux, Windows, AIX, Mac OS X
11.04.2015 ManageEngine EventLog Analyzer Exploit ManageEngine EventLog Analyzer is vulnerable to abuse a SQL query functionality that allows attackers to insert and export a crafted JSP using 'guest' credentials allowing us to install an agent. CVE-2015-7387 Exploits/Remote Windows
09.30.2009 MS SMB 2.0 Negociate Protocol Request Remote BSOD Exploit Update This update improves the exploit reliability. This module exploits a vulnerability on srv2.sys via a SMB 2 malformed packet. This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-3103 Exploits/Remote Windows
12.13.2011 Zabbix Remote Code Execution Exploit Update This module adds support for Mac OS X and Solaris platforms. NOCVE-9999-37058 Exploits/Remote Solaris, Linux, Mac OS X
08.05.2010 Oracle Secure Backup Authentication Bypass-Command Injection Exploit This module exploits an authentication bypass in the login.php in vulnerable versions of Oracle Secure Backup in order to execute arbitrary code via command injection parameters. CVE-2010-0904 Exploits/Remote Windows, Solaris
09.17.2014 Apache Struts includeParams Remote Code Execution Exploit Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. This module leverages the vulnerability to install an agent in vulnerable installation. CVE-2013-1966 Exploits/Remote Windows, Linux
06.22.2010 Novell iManager Classname Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow in Novell iManager when creating a class with an overly long name. CVE-2010-1929 Exploits/Remote Windows
01.04.2006 miniserv perl format string exploit This is an exploit for Usermin's and Webmin's perl format string vulnerability (CAN-2005-3912). CVE-2005-3912 Exploits/Remote Linux, Windows
10.25.2012 EMC NetWorker nsrd RPC Service Format String Exploit A Format string vulnerability in the nsrd RPC service within EMC NetWorker? allows remote attackers to execute arbitrary code via format string specifiers in a crafted message. CVE-2012-2288 Exploits/Remote Linux, Windows
05.18.2015 Microsoft Windows HTTP.sys Range Integer Overflow Memory Disclosure Exploit (MS15-034) The code that handles the 'Range' HTTP header in the HTTP.sys driver in Microsoft Windows, which is used by Internet Information Services (IIS), is prone to an integer overflow vulnerability when processing a specially crafted HTTP request with a very long upper range. This integer overflow vulnerability can be leveraged to generate a memory disclosure condition, in which the HTTP.sys driver will return more data than it should from kernel memory, thus allowing remote unauthenticated attackers to obtain potentially sensitive information from the affected server. CVE-2015-1635 Exploits/Remote Windows
04.06.2010 Symantec Veritas VRTSweb Remote Exploit This module exploits a code execution vulnerability in the Veritas Web Server service by sending a specially crafted authentication request to the 14300/TCP port. CVE-2009-3027 Exploits/Remote Windows
01.24.2012 Goodtech Telnet Daemon Buffer Overflow Exploit There is a buffer overflow vulnerability in the administration web server for GoodTech Telnet Server which allows remote attackers to execute arbitrary code via a long string to port 2380. CVE-2005-0768 Exploits/Remote Windows
07.28.2009 Wireshark PROFINET Dissector Format String Exploit Wireshark is prone to a format-string vulnerability. Attackers can leverage this issue to execute arbitrary code within the context of the vulnerable application. Failed attacks will likely cause denial-of-service conditions. CVE-2009-1210 Exploits/Remote Windows
06.15.2010 IBM Lotus Domino If-Modified-Since Buffer Overflow Exploit This module exploits a stack-based buffer overflow in the nHTTP.exe application, a component of Lotus Domino Server, by sending an HTTP request with an invalid value for the If-Modified-Since parameter. CVE-2007-0067 Exploits/Remote Windows
12.04.2007 IBM Lotus Domino IMAP Server Buffer Overflow Exploit Update This module exploits a buffer overflow vulnerability in a Lotus Domino IMAP Server and installs an agent if successful. This vulnerability can be exploited remotely and it does not require user authentication. This update adds support for Lotus Domino for windows versions 6.5, 7.0.1, 7.0.1FP1, and 7.0.2. CVE-2007-1675 Exploits/Remote Windows, AIX
08.01.2011 HP Operations Manager Server Backdoor Account Exploit Update This module exploits a remote code execution vulnerability in HP Operations Manager by using an undocumented user account to upload an arbitrary file. This update fixes an issue in the agent injector. CVE-2009-3843 Exploits/Remote Windows
05.02.2013 BigAnt IM Server DDNF Username Buffer Overflow Exploit BigAnt IM Server is vulnerable to a buffer-overflow within the AntDS.exe component when handling an overly long username. NOCVE-9999-57633 Exploits/Remote Windows
05.16.2006 DCERPC Authentication and Encryption support This update will add DCERPC encryption to some MSRPC exploits. The result is that, when enabled, all the 'Stub data' for DCERPC requests will be encrypted, thus hiding the real content. CVE-2005-1985 Exploits/Remote Windows
05.04.2010 RealNetworks Helix Server AgentX Remote Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow vulnerability in AgentX++, as distributed with Helix Server, by sending multiple blocks of data to the port 705/TCP. CVE-2010-1318 Exploits/Remote Windows
08.06.2009 Motorola Timbuktu Pro PlughNTCommand Stack Based Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow in Motorola Timbuktu Pro by sending a long malformed string over the plughNTCommand named pipe. CVE-2009-1394 Exploits/Remote Windows
08.16.2011 MSRPC CA ARCserve Backup Command Injection Exploit Update CA BrightStor ARCserve Backup is prone to a command injection vulnerability on the RPC interface that could permit the execution of arbitrary remote code. A remote attacker can exploit this vulnerability to execute arbitrary code and completely compromise the computer. This update improves the reliability of the exploit. CVE-2008-4397 Exploits/Remote Windows
05.22.2011 Novell ZENworks Asset Management Remote Code Execution Exploit This module exploits a path traversal vulnerability in Novell ZENworks Asset Management. The specific flaw exists within a servlet provided within the Novell Zenworks distribution for uploading files. When processing the path name for the file, the servlet will allow a user to inject path traversal entities into the filename. Then, when the servlet downloads the provided file, the destination will store it to the user-provided location. CVE-2010-4229 Exploits/Remote Windows
05.10.2012 PHP-CGI Argument Injection Exploit This module exploits an argument injection vulnerability in PHP up to version 5.3.12 and 5.4.2 when running as a standalone CGI processor and takes advantage of the -d flag to achieve remote code execution. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2012-1823 Exploits/Remote Windows, OpenBSD, Linux, FreeBSD
08.26.2015 SolarWinds Firewall Security Manager userlogin Exploit Solarwinds FSM is vulnerable to an authentication bypass in userlogin.jsp that allows attacker to upload an agent via a weekness in the username atribute in settings-new.jsp allowing us to install an agent. CVE-2015-2284 Exploits/Remote Windows
02.06.2012 Sunway Force Control SCADA SMNP NetDBServer Buffer Overflow Exploit A stack based buffer overflow in the SNMP NetDBServer service of Sunway Forcecontrol is triggered when sending an overly long string to the listening service on port 2001. NOCVE-9999-51166 Exploits/Remote Windows

Pages