Core Impact Pro Exploits and Security Updates

Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Title Description Vulnerabilty Category Platform
Acunetix Web Vulnerability Scanner GUI Html Script Injection Exploit Acunetix Web Vulnerability Scanner 10.0 build 20160216 and previous versions, allows remote attackers to execute arbitrary JavaScript code in the context of the scanner GUI. The flaw exists in the way Acunetix WVS render some html elements inside it's GUI, using jscript.dll without any concern about unsafe ActiveX object such as WScript.shell. This module also abuses of a second vulnerability affecting the Acunetix Web Vulnerability Scanner Scheduler to gain SYSTEM privileges. NOCVE-9999-74978 Exploits/Client Side Windows
FreeBSD atkbd SETFKEY Ioctl Privilege Escalation Exploit Incorrect signedness comparison in the ioctl handler of the atkbd keyboard driver in the FreeBSD kernel can be leveraged by a local unprivileged user to overwrite a portion of the kernel memory, thus allowing the attacker to gain root privileges on the affected system. CVE-2016-1886 Exploits/Local FreeBSD
Trend Micro InterScan Web Security Virtual Appliance testConfiguration OS Command Injection Exploit Trend Micro InterScan Web Security Virtual Appliance is prone to an OS command injection vulnerability when handling HTTP requests for the /rest/testConfiguration resource. This vulnerability can be leveraged by a remote, unauthenticated attacker to execute arbitrary code on the vulnerable server. NOCVE-9999-74988 Exploits/Remote Linux
Microsoft Windows Shell File Association Vulnerability Exploit (MS14-027) Update When the "HKEY_CURRENT_USER\Software\Classes\exefile" registry key is modified by this exploit and a Windows or third party service calls to the "ShellExecute" function, an invalid association file is produced, finalizing the attack with the execution of a crafted program instead of the original program. This update fixes a regression introduced in version 2016_R1. CVE-2014-1807 Exploits/Local Windows
Joomla User Agent Object Injection Exploit Update This module exploits a remote code execution vulnerability in Joomla. The session handling code is susceptible to PHP Object Injection attacks due to lack of sanitization in some HTTP headers that are saved to the database session backend. This update fixes an issue which made the exploit abort before running. CVE-2015-8562 Exploits/OS Command Injection/Known Vulnerabilities Linux
Novell ServiceDesk Remote Code Execution Exploit This module exploits a directory traversal vulnerability in Novell ServiceDesk. The specific flaw is located in the import functionality provided to a user. Authenticated users can upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a LiveTime.woa URL. CVE-2016-1593 Exploits/Remote Linux
Ruby on Rails Action View Directory Traversal Exploit This vulnerability allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method. Combining this with log injection, remote code execution can be achieved. CVE-2016-0752 Exploits/OS Command Injection/Known Vulnerabilities Linux
Solarwinds DameWare Mini Remote Control Server Privilege Escalation Exploit A certain message parsing function inside the Dameware Mini Remote Control service does not properly validate the input size of an incoming string before passing it to wsprintfw(). CVE-2016-2345 Exploits/Local Windows
Magento eCommerce Web Sites Deserialization Remote Code Execution Exploit This module uses an unauthenticated deserialization vulnerability in Magento eCommerce Web Sites to perform an arbitrary write file to gain arbitrary PHP code execution on the affected system. CVE-2016-4010 Exploits/Authentication Weakness/Known Vulnerabilities none
Advantech WebAccess Dashboard Viewer Remote Code Execution Exploit This module exploits an arbitrary file upload vulnerability in Advantech WebAccess. The specific flaw exists within the WebAccess Dashboard Viewer. Insufficient validation within the FileUpload script allows unauthenticated callers to upload arbitrary code to directories in the server where the code can be automatically executed under the high-privilege context of the IIS AppPool. Authentication is not required to exploit this vulnerability. CVE-2016-0854 Exploits/Remote Windows
Apache Struts 2 DefaultActionMapper method Remote Code Execution Exploit The DefaultActionMapper class in Apache Struts 2 supports a Dynamic Method Invocation feature via the "method:" prefix. The information contained in this prefix is not properly sanitized before being evaluated as OGNL expressions on the server side, which allows remote attackers to execute arbitrary Java code on the server. This module exploits the vulnerability in any web application built on top of vulnerable versions of the Apache Struts 2 framework with the "struts.enable.DynamicMethodInvocation" configuration parameter in struts.xml set to True. CVE-2016-3081 Exploits/Remote Windows, Linux
Microsoft Windows Integer Overflow Exploit (MS16-039) This module exploits a "win32k.sys" integer overflow in Windows kernel by calling to "PathToRegion" function with crafted parameters. CVE-2016-0165 Exploits/Local Windows
Reprise License Manager edit_lf_process Write Arbitrary Files Exploit Update 4 The specific flaw exists within the edit_lf_process resource of the Reprise License Manager service. The issue lies in the ability to write arbitrary files with controlled data. An attacker could leverage this vulnerability to execute arbitrary code under the context of SYSTEM. This update specify information about vulnerable targets and add more targets. NOCVE-9999-74481 Exploits/Remote Windows
Microsoft Windows Media Center .MCL File Processing Remote Code Execution (MS16-059) Microsoft Windows Media Center (all versions prior to May 11th, 2016) contains a remote code execution upon processing specially crafted .MCL files. The vulnerability exists because Windows Media Center does not correctly processes paths in the "Run" parameter of the "Application" tag, bypassing the usual security warning displayed upon trying to run programs residing on remote (WebDAV/SMB) shares. CVE-2016-0185 Exploits/Client Side Windows
Hewlett Packard Enterprise Data Protector EXEC_BAR User Name Buffer Overflow Exploit The specific flaw exists within OmniInet.exe which listens by default on TCP port 5555. When parsing a malformed user name field in a request, the process blindly copies user supplied data into a fixed-length stack buffer. A remote attacker can abuse this to execute remote code under the context of SYSTEM. CVE-2016-2005 Exploits/Remote Windows
ManageEngine OpManager Exploit ManageEngine OpManager is vulnerable to abuse a SQL query functionality that allows attackers to insert and export a crafted WAR using 'IntegrationUser' hidden account credentials allowing us to install an agent. CVE-2015-7765 Exploits/Remote Windows
Linux Kernel CONFIG_BPF_SYSCALL Local Privilege Escalation Exploit Update This module exploits a user-after-free vulnerability in the Linux Kernel. When bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in __bpf_map_get() and in replace_map_fd_with_map_ptr()). If the file descriptor table of the current task is shared, this causes f_count to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free). This can be exploited to gain root privileges by an unprivileged user. This update improves how the module removes unnecessary files after an exploitation attempt. NOCVE-9999-74975 Exploits/Local Linux
Linux Kernel CONFIG_BPF_SYSCALL Local Privilege Escalation Exploit This module exploits a user-after-free vulnerability in the Linux Kernel. When bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in __bpf_map_get() and in replace_map_fd_with_map_ptr()). If the file descriptor table of the current task is shared, this causes f_count to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free). This can be exploited to gain root privileges by an unprivileged user. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. NOCVE-9999-74975 Exploits/Local Linux
Microsoft MSHTML dll based Binary Planting Exploit (MS16-037) Microsoft Internet Explorer 11 ships with MSHTML.DLL referencing various DLLs which are not present on a Windows 7 SP1 installationd.In addition certain applications like Microsoft Word,Excel,Powerpoint,Project,powershell etc , as well as a certain number of third party software are prone to remote binary planting due to using MSHTML.DLL in some ways. CVE-2016-0160 Exploits/Client Side Windows
glibc getaddrinfo Buffer Overflow Verifier This module executes a program designed to check for a buffer overflow in glibc's getaddrinfo function. Multiple stack-based buffer overflows in the send_dg and send_vc functions in the libresolv library in the GNU C Library allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family. CVE-2015-7547 Exploits/Tools Linux
Image Magick Command Injection Exploit Insufficient input validation in ImageMagick can lead to code execution when processing with certain types of files. This update introduces a module that generates an MVG format file that, when manipulated by the vulnerable versions of ImageMagick tools, deploys an agent in the supported systems. CVE-2016-3714 Exploits/Tools Linux
OpenSSH xauth Command Injection Vulnerability Exploit An authenticated user may inject arbitrary xauth commands by sending an x11 channel request that includes a newline character in the x11 cookie. The newline acts as a command separator to the xauth binary. The injected xauth commands are performed with the effective permissions of the logged in user. This attack requires the server to have 'X11Forwarding yes' enabled. This module injects source xauth command to retrieve arbitrary files. CVE-2016-3115 Exploits/Remote File Disclosure Linux
Reprise License Manager edit_lf_process Write Arbitrary Files Exploit Update 3 The specific flaw exists within the edit_lf_process resource of the Reprise License Manager service. The issue lies in the ability to write arbitrary files with controlled data. An attacker could leverage this vulnerability to execute arbitrary code under the context of SYSTEM. This update introduces more accurate information about vulnerable targets. NOCVE-9999-74481 Exploits/Remote Windows
Reprise License Manager activate_doit Command actserver Parameter Buffer Overflow Exploit Update 2 The specific flaw exists within the activate_doit function of the service. The issue lies in the handling of the server parameter which can result in overflowing a stack-based buffer. This update introduces more accurate information about vulnerable targets. CVE-2015-6946 Exploits/Remote Windows
Atlassian Bamboo commons-collections Java Library Deserialization Vulnerability Remote Code Execution Exploit Atlassian Bamboo is prone to a remote vulnerability that allows attackers to take advantage of a deserialization vulnerability present in the commons-collections Java library. By exploiting known methods, it is possible to remotely load a InvokerTransformer Java class, which allows the execution of system commands. CVE-2015-6576 Exploits/Remote Windows
TrendMicro node.js HTTP Server Remote Code Execution Exploit The Password Manager component installed by various Trend Micro products runs a Node.js HTTP server by default. This web server opens multiple HTTP RPC ports for handling API requests. For example, the openUrlInDefaultBrowser API function, which internally maps to a ShellExecute function call, allows and attacker to execute arbitrary commands on localhost without the need of any type of credentials. NOCVE-9999-74958 Exploits/Client Side Windows
Jenkins XStream Java Library Deserialization Vulnerability Remote Code Execution Exploit Jenkins is prone to a remote vulnerability due to deserialization of untrusted inputs, allowing attackers to instantiate arbitrary Java objects leading to remote code execution. There are several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. CVE-2016-0792 Exploits/Remote Windows, Linux
Jenkins XStream Java Library Deserialization Vulnerability Remote Code Execution Exploit Update Jenkins is prone to a remote vulnerability due to deserialization of untrusted inputs, allowing attackers to instantiate arbitrary Java objects leading to remote code execution. There are several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. This update adds support for HTTPS and IPv6. It also allows to change the application root path. CVE-2016-0792 Exploits/Remote Windows, Linux
Apple Mac OS X XPC Entitlements Local Privilege Escalation Exploit The Admin framework in Apple OS X contains a hidden backdoor API to gain root privileges. A local user can exploit this flaw in the checking of XPC entitlements. CVE-2015-1130 Exploits/Local Mac OS X
Microsoft Windows Secondary Logon Vulnerability Exploit (MS16-032) This module exploits a vulnerability in "Windows Secondary Logon Service" when it fails to properly manage request handles in memory. CVE-2016-0099 Exploits/Local Windows