Core Impact Threat Intelligence Exploits, Security and Penetration Testing Updates

Core Impact Threat Intelligence Exploits, Security and Penetration Testing Updates

When you buy Core Impact, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Title Description Vulnerabilty Category Platform
Microsoft Internet Explorer Typed Array Detached ArrayBuffer Use-After-Free Exploit (MS16-063) Internet Explorer is prone to a use-after-free vulnerability when trying to access the ArrayBuffer that was backing a Typed Array after it has been detached by transferring it to a Web Worker by calling the postMessage() function. This vulnerability can be abused by an attacker to execute arbitrary code on systems running vulnerable versions of Internet Explorer. CVE-2016-0189 Exploits/Client Side Windows
Wireshark riched20 DLL Hijacking Exploit The vulnerability is caused due to the application loading a library (riched20.dll.dll) in an insecure manner. This can be exploited to load arbitrary libraries by tricking a user into e.g. opening a e.g. ".pcap" file located on a remote WebDAV or SMB share. CVE-2016-2521 Exploits/Client Side Windows
Ruby on Rails Action Pack Inline Exec Exploit Action Pack in Ruby on Rails allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. CVE-2016-2098 Exploits/OS Command Injection/Known Vulnerabilities Linux
Reprise License Manager akey Buffer Overflow Vulnerability The vulnerability is caused due to a boundary error when handling the "akey" POST parameter related to /goform/activate_doit, which can be exploited to cause a stack-based buffer overflow via a specially crafted HTTP request. NOCVE-9999-75007 Exploits/Remote Windows
JBoss EJBInvokerServlet Java Deserialization Vulnerability Remote Code Execution Exploit JBoss Application Server is prone to a remote vulnerability due to deserialization of untrusted inputs, allowing attackers to instantiate arbitrary java objects leading to remote code execution. This vulnerability affects the EJBInvokerServlet component of the server. NOCVE-9999-75005 Exploits/Remote Code Execution Windows, Linux
Symantec Endpoint Manager PowerPoint Misaligned Stream-Cache Privilege Escalation Exploit The vulnerability resides in parsing crafted Microsoft PowerPoint documents and produces a buffer overflow in the stack, leading to a privilege escalation to System. CVE-2016-2209 Exploits/Local Windows
Microsoft Windows WPAD BadTunnel Exploit (MS16-077) This module exploits a vulnerability in Windows Netbios cache by flooding crafted NBNS responses. CVE-2016-3236 Exploits/Client Side Windows
Drupal RESTWS Module PHP Remote Command Injection Exploit RESTWS alters the default page callbacks for entities to provide additional functionality. A vulnerability in this approach allows an unauthenticated attacker to send specially crafted requests resulting in arbitrary PHP execution. NOCVE-9999-75002 Exploits/OS Command Injection/Known Vulnerabilities Linux
Jenkins JRMP Java Library Deserialization Vulnerability Remote Code Execution Exploit The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener. CVE-2016-0788 Exploits/Remote Windows, Linux
FreeBSD atkbd SETFKEY Ioctl Privilege Escalation Exploit Update Incorrect signedness comparison in the ioctl handler of the atkbd keyboard driver in the FreeBSD kernel can be leveraged by a local unprivileged user to overwrite a portion of the kernel memory, thus allowing the attacker to gain root privileges on the affected system. This update improves the checking of preconditions before launching the attack. CVE-2016-1886 Exploits/Local FreeBSD
WECON LeviStudio PLC HmiSet Type Buffer Overflow Exploit This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of WECON LeviStudio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists in the handling of LeviStudio Project files. By providing an overly long HmiSet Type XML attribute, an attacker can overflow a stack-based buffer and execute arbitrary code in the context of the current process. NOCVE-9999-74997 Exploits/Client Side Windows
Microsoft Internet Explorer VBScript AccessArray Redefinition Exploit The AccessArray function in the VBScript engine of Internet Explorer is prone to a redefinition attack. By accessing a VBScript array using a specially crafted object as the index, it is possible to resize the array in the middle of the AccessArray function, leaving the array in an inconsistent state, which can be abused by an attacker to execute arbitrary code on systems running vulnerable versions of Internet Explorer. CVE-2016-0189 Exploits/Client Side Windows
Solarwinds Virtualization Manager Java JMX-RMI Remote Code Execution Exploit The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. CVE-2016-3642 Exploits/Remote Linux
Apache Struts 2 REST Plugin Remote Code Execution Exploit The REST plugin in the Apache Struts 2 framework is prone to a remote code execution vulnerability when evaluating OGNL expressions when Dynamic Method Invocation is enabled. This vulnerability allows remote attackers to execute arbitrary Java code on the affected server. This module exploits the vulnerability in any web application built on top of vulnerable versions of Apache Struts 2 making use of the REST plugin with the Dynamic Method Invocation feature enabled. CVE-2016-3087 Exploits/OS Command Injection/Known Vulnerabilities Windows, Linux
Microsoft Windows WPAD Elevation of Privilege Exploit (MS16-077) An elevation of privilege vulnerability exists in Microsoft Windows when the Web Proxy Auto Discovery (WPAD) protocol falls back to a vulnerable proxy discovery process. An attacker who successfully exploited this vulnerability could bypass security and gain elevated privileges on a targeted system. CVE-2016-3213 Exploits/Local Windows
Acunetix Web Vulnerability Scanner GUI Html Script Injection Exploit Acunetix Web Vulnerability Scanner 10.0 build 20160216 and previous versions, allows remote attackers to execute arbitrary JavaScript code in the context of the scanner GUI. The flaw exists in the way Acunetix WVS render some html elements inside it's GUI, using jscript.dll without any concern about unsafe ActiveX object such as WScript.shell. This module also abuses of a second vulnerability affecting the Acunetix Web Vulnerability Scanner Scheduler to gain SYSTEM privileges. NOCVE-9999-74978 Exploits/Client Side Windows
FreeBSD atkbd SETFKEY Ioctl Privilege Escalation Exploit Incorrect signedness comparison in the ioctl handler of the atkbd keyboard driver in the FreeBSD kernel can be leveraged by a local unprivileged user to overwrite a portion of the kernel memory, thus allowing the attacker to gain root privileges on the affected system. CVE-2016-1886 Exploits/Local FreeBSD
Trend Micro InterScan Web Security Virtual Appliance testConfiguration OS Command Injection Exploit Trend Micro InterScan Web Security Virtual Appliance is prone to an OS command injection vulnerability when handling HTTP requests for the /rest/testConfiguration resource. This vulnerability can be leveraged by a remote, unauthenticated attacker to execute arbitrary code on the vulnerable server. NOCVE-9999-74988 Exploits/Remote Linux
Joomla User Agent Object Injection Exploit Update This module exploits a remote code execution vulnerability in Joomla. The session handling code is susceptible to PHP Object Injection attacks due to lack of sanitization in some HTTP headers that are saved to the database session backend. This update fixes an issue which made the exploit abort before running. CVE-2015-8562 Exploits/OS Command Injection/Known Vulnerabilities Linux
Microsoft Windows Shell File Association Vulnerability Exploit (MS14-027) Update When the "HKEY_CURRENT_USER\Software\Classes\exefile" registry key is modified by this exploit and a Windows or third party service calls to the "ShellExecute" function, an invalid association file is produced, finalizing the attack with the execution of a crafted program instead of the original program. This update fixes a regression introduced in version 2016_R1. CVE-2014-1807 Exploits/Local Windows
Novell ServiceDesk Remote Code Execution Exploit This module exploits a directory traversal vulnerability in Novell ServiceDesk. The specific flaw is located in the import functionality provided to a user. Authenticated users can upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a LiveTime.woa URL. CVE-2016-1593 Exploits/Remote Linux
Ruby on Rails Action View Directory Traversal Exploit This vulnerability allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method. Combining this with log injection, remote code execution can be achieved. CVE-2016-0752 Exploits/OS Command Injection/Known Vulnerabilities Linux
Solarwinds DameWare Mini Remote Control Server Privilege Escalation Exploit A certain message parsing function inside the Dameware Mini Remote Control service does not properly validate the input size of an incoming string before passing it to wsprintfw(). CVE-2016-2345 Exploits/Local Windows
Magento eCommerce Web Sites Deserialization Remote Code Execution Exploit This module uses an unauthenticated deserialization vulnerability in Magento eCommerce Web Sites to perform an arbitrary write file to gain arbitrary PHP code execution on the affected system. CVE-2016-4010 Exploits/Authentication Weakness/Known Vulnerabilities none
Advantech WebAccess Dashboard Viewer Remote Code Execution Exploit This module exploits an arbitrary file upload vulnerability in Advantech WebAccess. The specific flaw exists within the WebAccess Dashboard Viewer. Insufficient validation within the FileUpload script allows unauthenticated callers to upload arbitrary code to directories in the server where the code can be automatically executed under the high-privilege context of the IIS AppPool. Authentication is not required to exploit this vulnerability. CVE-2016-0854 Exploits/Remote Windows
Apache Struts 2 DefaultActionMapper method Remote Code Execution Exploit The DefaultActionMapper class in Apache Struts 2 supports a Dynamic Method Invocation feature via the "method:" prefix. The information contained in this prefix is not properly sanitized before being evaluated as OGNL expressions on the server side, which allows remote attackers to execute arbitrary Java code on the server. This module exploits the vulnerability in any web application built on top of vulnerable versions of the Apache Struts 2 framework with the "struts.enable.DynamicMethodInvocation" configuration parameter in struts.xml set to True. CVE-2016-3081 Exploits/Remote Windows, Linux
Microsoft Windows Integer Overflow Exploit (MS16-039) This module exploits a "win32k.sys" integer overflow in Windows kernel by calling to "PathToRegion" function with crafted parameters. CVE-2016-0165 Exploits/Local Windows
Reprise License Manager edit_lf_process Write Arbitrary Files Exploit Update 4 The specific flaw exists within the edit_lf_process resource of the Reprise License Manager service. The issue lies in the ability to write arbitrary files with controlled data. An attacker could leverage this vulnerability to execute arbitrary code under the context of SYSTEM. This update specify information about vulnerable targets and add more targets. NOCVE-9999-74481 Exploits/Remote Windows
Microsoft Windows Media Center .MCL File Processing Remote Code Execution (MS16-059) Microsoft Windows Media Center (all versions prior to May 11th, 2016) contains a remote code execution upon processing specially crafted .MCL files. The vulnerability exists because Windows Media Center does not correctly processes paths in the "Run" parameter of the "Application" tag, bypassing the usual security warning displayed upon trying to run programs residing on remote (WebDAV/SMB) shares. CVE-2016-0185 Exploits/Client Side Windows
Hewlett Packard Enterprise Data Protector EXEC_BAR User Name Buffer Overflow Exploit The specific flaw exists within OmniInet.exe which listens by default on TCP port 5555. When parsing a malformed user name field in a request, the process blindly copies user supplied data into a fixed-length stack buffer. A remote attacker can abuse this to execute remote code under the context of SYSTEM. CVE-2016-2005 Exploits/Remote Windows