Core Certified Exploits

We provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact keeps you there.

Subscribe to receive regular updates by email:

 

Browse All Exploits

 

 

Title Description CVE Link Exploit Platform Exploit Type
ZipScan Archive Processing Buffer Overflow Exploit The vulnerability is caused due to a boundary error when processing archives containing entries with overly long paths. Windows Exploits/Client Side
RealNetworks Helix Server AgentX Remote Buffer Overflow Exploit This module exploits a remote stack-based buffer overflow vulnerability in AgentX++, as distributed with Helix Server, by sending multiple blocks of data to the port 705/TCP. Windows Exploits/Remote
SAP MaxDB Malformed Handshake Request Exploit Update This module exploits a stack buffer overflow vulnerability in SAP MaxDB by sending a specially crafted packet to 7210/TCP port. This update improves reliability. Windows Exploits/Remote
Microsoft WINS Name Validation Exploit Update Exploits a buffer overflow vulnerability in Microsoft WINS server. This update improves the reliability of the exploit when using Reuse Connection method. Windows Exploits/Remote
HP OpenView NNM OvWebHelp CGI Buffer Overflow Exploit This module exploits a vulnerability in HP OpenView NNM by sending a specially crafted request to OvWebHelp.exe. Windows Exploits/Remote
Microsoft MPEG Layer-3 Codecs Buffer Overflow Exploit (MS10-026) This module exploits a buffer overflow in the Microsoft Windows MPEG Layer-3 codecs when parsing a malformed .AVI file. Windows Exploits/Client Side
Microsoft Windows Media Services Remote Exploit (MS10-025) Update This module exploits a remote buffer overflow in the Microsoft Windows Media Services by sending a specially crafted packet to the 1755/TCP port. This module also works against targets with the original MS10-025 update installed. Windows Exploits/Remote
Microsoft Visio visiodwg.dll Buffer Overflow Exploit (MS10-028) Update Microsoft Visio is prone to a remote code-execution vulnerability. This issue arises when the application processes a crafted CAD DRAWING file (.DXF). This update adds support for Windows 7. Windows Exploits/Client Side
Microsoft Visio visiodwg.dll Buffer Overflow Exploit (MS10-028) Microsoft Visio is prone to a remote code-execution vulnerability. This issue arises when the application processes a crafted CAD DRAWING file (.DXF). WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. Windows Exploits/Client Side
Microsoft Windows SMTP Server MX Record Vulnerability DoS (MS10-024) This module exploits a vulnerability on Microsoft Windows SMTP Server 64 bits sending a malformed DNS response from a spoofed DNS Server. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. Windows Denial of Service/Remote
Microsoft Office Publisher TextBox Processing Buffer Overflow Exploit (MS10-023) Buffer overflow in file conversion TextBox processing of Microsoft Office Publisher allows remote attackers to execute arbitrary code via a crafted Publisher file. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. Windows Exploits/Client Side
MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Exploit MySQL compiled with yaSSL is prone to a remote stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Linux Exploits/Remote
vBulletin query Cross Site Scripting Exploit The application is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input to the 'query' parameter of the search pages. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. vBulletin 4.0.2 is vulnerable. This issue does not affect vBulletin 3.x versions. Exploits/Cross Site Scripting (XSS)/Known Vulnerabilities
Microsoft Windows Media Services Remote Exploit (MS10-025) This module exploits a remote buffer overflow in the Microsoft Windows Media Services by sending a specially crafted packet to the port 1755/TCP. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. Windows Exploits/Remote
Sun Java Web Start Arbitrary Command Line Injection Exploit This module exploits a command injection vulnerability within the launch() function in the Java Deployment Toolkit. Windows Exploits/Client Side
Wordpress NextGEN Gallery Plugin Cross Site Scripting Exploit This vulnerability results from a reflected unsanitized input that can be crafted into an attack by a malicious user by manipulating the 'mode' parameter of the xml/media-rss.php script. Version 1.5.1 is verified as vulnerable, older versions are probably vulnerable too but they were not tested at this time. Exploits/Cross Site Scripting (XSS)/Known Vulnerabilities
DameWare Mini Remote Control Pre Auth Exploit This module exploits a vulnerability in the DameWare Mini Remote Control Service sending a specially crafted packet to the 6129/TCP port. Windows Exploits/Remote
SAP MaxDB Malformed Handshake Request Exploit This module exploits a stack buffer overflow vulnerability in SAP MaxDB by sending a specially crafted packet to 7210/TCP port. This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. Windows Exploits/Remote
Symantec Veritas VRTSweb Remote Exploit This module exploits a code execution vulnerability in the Veritas Web Server service by sending a specially crafted authentication request to the 14300/TCP port. Windows Exploits/Remote
Creative Software AutoUpdate ActiveX Exploit Update This module exploits a vulnerability in the CTSUEng.ocx control included in the Creative Software AutoUpdate application. The exploit is triggered when the CacheFolder property processes a long string argument resulting in a stack-based buffer overflow. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site. This update add support till 2.0.12.0 version of CTSUEng.ocx. Windows Exploits/Client Side
MSRPC DCOM Exploit Update This update improves the reliability of the exploit when using Reuse Connection method. Windows Exploits/Remote
Oracle Java Soundbank Resource Name Buffer Overflow Exploit This module exploits a stack-based buffer overflow vulnerability in Oracle Java SE when jsound.dll parses a specially crafted Soundbank file. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. Windows Exploits/Client Side
Microsoft Internet Explorer Tabular Data Control ActiveX Exploit (MS10-018) This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. The specific flaw exists within the Tabular Data Control ActiveX module. Specifically, if provided a malicious DataURL parameter a stack corruption may occur in the function CTDCCtl::SecurityCHeckDataURL. This can be leveraged to execute arbitrary code under the context of the current user. WARNING: This is an early release module. This is not the final version of this module. Windows Exploits/Client Side
Microsoft Windows SMB Pathname Overflow DoS (MS10-012) This module exploits a vulnerability on srv.sys when it executes a rename command into shared folder using a long pathname. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. Windows Denial of Service/Remote
Linux Kernel Sock_Sendpage Local Privilege Escalation Exploit Update The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket. This update adds the 'one-shot' tag to the XML of the module. Linux Exploits/Local