Core Certified Exploits

We provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact keeps you there.

Subscribe to receive regular updates by email:

 

Browse All Exploits

 

 

Title Description Date Added CVE Link Exploit Platform Exploit Type
Advantech WebAccess SCADA BwPAlarm Buffer Overflow Exploit Advantech WebAccess SCADA lack of proper validation of user supplied input may allow an attacker to cause the overflow of a buffer overflow and executes remote code. February 5, 2019 CVE-2018-18999 Windows Exploits / Remote
Horner Automation Cscape CSP File Buffer Overflow Exploit The specific flaw exists within the parsing of CSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. January 31, 2019 CVE-2018-19005 Windows Exploits / Client Side
AV Evasion Improvements_V9 Single stage agent wrappers were modified to be more stealth January 30, 2019 https://cve.mitre.org/cgi-bin/cvename.cgi?name= Exploits / Remote
TFM MMPlayer Buffer Overflow Exploit A Buffer Overflow exists when parsing .M3U files. The vulnerability is caused due to a boundary error when handling a crafted .M3U files. January 24, 2019 NOCVE-9999-117773 Windows Exploits / Client Side
Omron CX-One CXP File Buffer Overflow Exploit The specific flaw exists within the parsing of CXP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. January 18, 2019 CVE-2018-18993 Windows Exploits / Client Side
PCManFTPD Server APPE Command Buffer Overflow Exploit2 Server is prone to a stack-based buffer overflow vulnerability when processing long requests. This flaw can be exploited to execute arbitrary code by sending the server a special crafted request. January 16, 2019 CVE-2018-18861 Windows Exploits / Remote
VUPlayer Stack Buffer Overflow Exploit A Buffer Overflow exists when parsing .PLS files. The vulnerability is caused due to a boundary error when handling a crafted .PLS files. January 10, 2019 NOCVE-9999-116454 Windows Exploits / Client Side
Cisco Webex Meetings webexservice Update Service SMB Remote Code Execution Exploit A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated remote attacker, to execute arbitrary commands with SYSTEM user privileges. January 3, 2019 CVE-2018-15442 Windows Exploits / Remote
GIGABYTE Low Level Access Drivers Privilege Escalation Exploit This module exploits a vulnerability in various GIGABYTE and AORUS branded utilities. The low level access drivers at the core of these utilities expose dangerous functionality to low privilege processes, a local attacker can read/write arbitrary kernel memory, which can be leveraged to elevate privileges. December 18, 2018 CVE-2018-19320 Windows Exploits / Local
ASUS Low Level Access Drivers Privilege Escalation Exploit This module exploits a vulnerability in various ASUS and 3rd party branded utilities. The low level access drivers at the core of these utilities expose dangerous functionality to low privilege processes, a local attacker can read/write arbitrary kernel memory, which can be leveraged to elevate privileges. December 18, 2018 CVE-2018-18537 Windows Exploits / Local
Microsoft Windows Win32k xxxMNEndMenuState Local Privilege Escalation Exploit An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. December 17, 2018 CVE-2017-0263 Windows Exploits / Local
Advantech WebAccess webvrpcs Remote Command Execution Exploit The specific flaw exists within the implementation of the 0x2711 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. December 12, 2018 CVE-2018-14806 Windows Exploits / Remote
CyberLink LabelPrint File Project Processing Buffer Overflow Exploit Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INFORMATION tag), (2) name (inside the INFORMATION tag), (3) artist (inside the TRACK tag), or (4) default (inside the TEXT tag) parameter in an lpp project file. December 12, 2018 CVE-2017-14627 Windows Exploits / Client Side
Free WMA MP3 Converter Local Buffer Overflow Exploit A Local Buffer Overflow exists when parsing .wav files. The vulnerability is caused due to a boundary error when handling a crafted .wav files. December 11, 2018 NOCVE-9999-115102 Windows Exploits / Client Side
CMS Made Simple Module Import PHP Remote Command Injection Vulnerability Exploit CMS Made Simple allows remote authenticated administrators to execute arbitrary PHP code via command injection using the module import feature in admin/moduleinterface.php December 11, 2018 CVE-2018-10517 Windows, Linux Exploits / Remote File Inclusion / Known Vulnerabilities
Microsoft Windows SchRpcSetSecurity Local Privilege Escalation Exploit An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 November 27, 2018 CVE-2018-8440 Windows Exploits / Local
10-Strike LANState Local Buffer Overflow Exploit A Buffer Overflow exists when parsing .lsm files. The vulnerability is caused due to a boundary error when handling a crafted .lsm files. November 27, 2018 NOCVE-9999-113689 Windows Exploits / Client Side
Cisco Webex Meetings webexservice Update Service DLL Hijacking Local Privilege Escalation Exploit A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated local attacker, to execute arbitrary commands with SYSTEM user privileges. November 27, 2018 CVE-2018-15442 Windows Exploits / Local
VirIT eXplorer Anti-Virus Arbitrary Write Local Privilege Escalation Exploit In VirIT eXplorer Anti-Virus, the VIAGLT64.SYS driver file contains an Arbitrary Write vulnerability, and can be exploited to elevate privileges from a local account to SYSTEM. November 22, 2018 CVE-2017-16237 Windows Exploits / Local
Advantech WebAccess bwnodeip Buffer Overflow Exploit The specific flaw exists within bwnodeip.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process. November 20, 2018 CVE-2018-14816 Windows Exploits / Remote
Advantech WebAccess SCADA Webvrpcs ViewDll1 Buffer Overflow Exploit The specific flaw exists within the implementation of the 0x138bd IOCTL in the webvrpcs process. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this functionality to execute code under the context of Administrator. November 15, 2018 CVE-2018-14816 Windows Exploits / Remote
AVEVA InduSoft Web Studio Remote Command Execution Exploit The MTCheckFileFunctionsTimeout function in UniSoft.dll does not check the user-supplied executable file name that is used to create a process. If the file name is already a full path, it will be passed as the lpCommandLine parameter to a CreateProcessW call. November 15, 2018 CVE-2018-17914 Windows Exploits / Remote
Cisco Webex Meetings webexservice Update Service Local Privilege Escalation Exploit A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated local attacker, to execute arbitrary commands with SYSTEM user privileges. November 14, 2018 CVE-2018-15442 Windows Exploits / Local
Advantech WebAccess Node certUpdate Directory Traversal Remote Code Execution Vulnerability Exploit Advantech WebAccess Node is vulnerable to an unauthenticated remote file inclusion, allowing attackers to execute arbitrary code in the system. November 14, 2018 CVE-2018-5445 Windows Exploits / Remote File Inclusion / Known Vulnerabilities
Atlantis Word Processor JPEG Length Underflow Exploit An exploitable stack-based buffer overflow vulnerability exists in the JPEG parser of Atlantis Word Processor. November 13, 2018 CVE-2018-3999 Windows Exploits / Client Side