Core Impact Pro Exploits and Security Updates

Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Title Description Vulnerabilty Category Platform
BS Player BSL Buffer Overflow Exploit BS Player contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error when handling crafted .BSL files. CVE-2009-1068 Exploits/Client Side Windows
D-Link TFTP Transporting Mode Buffer Overflow Exploit D-Link TFTP Server 1.0 allows remote attackers to cause a buffer overflow via a long GET request, which triggers the vulnerability. CVE-2007-1435 Exploits/Remote Windows
EZip Wizard Buffer Overflow Exploit update A stack-based buffer overflow in eZip Wizard allows an attacker to execute arbitrary code via a crafted .ZIP file that contains a file with a long name. This update makes a correction to a parameter name. CVE-2009-1028 Exploits/Client Side Windows
UltraISO CCD and IMG Buffer Overflow Exploit A stack-based buffer overflow in UltraISO allows an attacker to execute arbitrary code via crafted .CCD and .IMG file. CVE-2009-1260 Exploits/Client Side Windows
AIX Setlocale Function Local Privilege Escalation Exploit The AIX Setlocale Function is prone to a local privilege-escalation vulnerability. A local attacker may be able to exploit this issue to gain elevated privileges on the affected computer. A successful exploit will lead to the complete compromise of the affected computer. CVE-2006-4254 Exploits/Local AIX
Steamcast GET Request Remote Buffer Overflow Exploit A boundary error can be exploited to cause a stack-based buffer overflow by sending a specially crafted GET HTTP request with an overly long path to the web server. CVE-2008-0550 Exploits/Remote Windows
Microsoft Office PowerPoint PPT 7 Memory Corruption Exploit (MS09-017) This module exploits a stack overflow on "pp7x32.dll" when it parses an inconsistent record length in sound data in a file that uses a PowerPoint 95 (PPT95) native file format. CVE-2009-1129 Exploits/Client Side Windows
Ston3d Player Command Injection Exploit This module exploits a remote command injection vulnerability in Ston3DWebPlayer and Ston3DStandalonePlayer via an specially crafted STK file. CVE-2009-1792 Exploits/Client Side Windows, Linux
Lotus Notes WPD File Processing Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in Lotus Notes 8.0 when parsing a malformed, specially crafted WPD (Word Perfect Document) file. CVE-2008-4564 Exploits/Client Side Windows
XBMC GET Request Remote Buffer Overflow Exploit This module exploits a vulnerability in XBMC by sending a specially crafted, overly long HTTP GET request to the application's web server which causes a stack-based buffer overflow, allowing arbitrary code execution. NOCVE-9999-37459 Exploits/Remote Windows
Mambo output Remote File Inclusion Exploit A remote file inclusion vulnerability is present in Mambo. /includes/Cache/Lite/Output.php doesn't sanitize the $mosConfig_absolute_path before using it in an include. CVE-2008-2905 Exploits/Remote File Inclusion/Known Vulnerabilities none
Microsoft Office Powerpoint PPT 4.0 Importer Buffer Overflow Exploit (MS09-017) This module exploits a stack-based based overflow in Microsoft Office Powerpoint when parsing a malformed .PPT 4.0 file with a specially crafted printer name. This is an early release module. This is not the final version of this module.It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-0220 Exploits/Client Side Windows
ElbyCDIO IO Driver Privilege Escalation Exploit This module exploits a vulnerability in ElbyCDIO.SYS driver when handling a specially crafted IOCTL request. The vulnerability allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters. CVE-2009-0824 Exploits/Local Windows
FreeBSD Telnetd Privilege Escalation Exploit Local attackers can exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will facilitate in the complete compromise of affected computers. CVE-2009-0641 Exploits/Local FreeBSD
IBM Director CIM Server Privilege Escalation Exploit IBM Director is prone to a privilege-escalation vulnerability that affects the CIM server. Attackers can leverage this issue to execute arbitrary code with elevated privileges in the context of the CIM server process. CVE-2009-0880 Exploits/Local Windows
SAP AG SAPgui EAI WebViewer3D Buffer Overflow Exploit This module exploits a stack overflow in Siemens Unigraphics Solutions Teamcenter Visualization EAI WebViewer3D ActiveX control that is bundled with SAPgui. When parsing an overly long string the SaveViewToSessionFile() method, arbitrary code may be executed. CVE-2007-4475 Exploits/Client Side Windows
AstonSoft DeepBurner DBR Compilation Buffer Overflow Exploit AstonSoft DeepBurner is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation. NOCVE-9999-37461 Exploits/Client Side Windows
VUPlayer CUE Buffer Overflow Exploit VUPlayer contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error when handling .CUE files. NOCVE-9999-37025 Exploits/Client Side Windows
Talkative IRC PRIVMSG Buffer Overflow Exploit Talkative IRC is prone to a stack-based buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. NOCVE-9999-37116 Exploits/Client Side Windows
Sun xVM VirtualBox Exploit This module exploits a local privilege escalation vulnerability in certain packages shipped with Sun xVM VirtualBox for the Linux platform. CVE-2009-0876 Exploits/Local Linux
Rosoft Media Player M3U Buffer Overflow Exploit Update Rosoft Media Player is prone to a stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input of M3U files. This update adds support till the last version of the program.(4.2.1 and 4.3.1) CVE-2007-6478 Exploits/Client Side Windows
GNOME Dia PySys_SetArgv Remote Command Execution Exploit A design error has been discovered in GNOME's Dia, which can be exploited by sending a malicious file to vulnerable victims. CVE-2008-5984 Exploits/Client Side Linux
Adobe PDF CustomDictionaryOpen Buffer Overflow Exploit This module exploits a vulnerability in Adobe Reader and Adobe Acrobat Professional .PDF files. The vulnerability is caused due to boundary errors in the customdictionaryopen() method in Javascript api. This can be exploited to cause a heap overflow when a specially crafted PDF file is opened. NOCVE-9999-38081 Exploits/Client Side Linux
RainbowPlayer RPL Buffer Overflow Exploit RainbowPlayer is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input. NOCVE-9999-37090 Exploits/Client Side Windows
MediaCoder M3U playlist Buffer Overflow Exploit MediaCoder contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in MediaCoder when handling .M3U files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .M3U file. NOCVE-9999-36982 Exploits/Client Side Windows
Belkin BullDog Plus UPS-Service Buffer Overflow Exploit The UPS management software contains a built-in web server which allows for remote management of the UPS. The management interface is protected by a username and password and the authentication is performed via Basic authentication. There is a small stack-based overflow in the base64 decoding routine which handles the Basic authentication data. NOCVE-9999-37026 Exploits/Remote Windows
Adobe Flash Player Linux Command Injection Exploit This module exploits a command injection in Adobe Flash Player triggered when processing a specially crafted SWF file. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site. This exploit needs the product Adobe Air (Any version) installed on the vulnerable system. CVE-2008-5499 Exploits/Client Side Linux
Microsoft Windows HTTP Services Integer Underflow DoS (MS09-013) This module exploits an integer underflow on "SSDP Discovery Service" Windows service through HTTP response. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-0086 Denial of Service/Remote Windows
Easy Chat Server Authentication Request Buffer Overflow Exploit A remote user of vulnerable installations of Easy Chat Server can send a specially crafted password parameter to chat.ghp to trigger a buffer overflow and execute arbitrary code on the target system. NOCVE-9999-36981 Exploits/Remote Windows
MSRPC Server Service Remote Buffer Overflow Exploit (MS08-067) Update 3 This module exploits a vulnerability in the Microsoft Windows Server service by sending a specially crafted RPC request. This update adds support for Windows 2003 Enterprise Edition sp2 with DEP enabled. This update also adds support for XP SP2 and 2003 SP1 as well as improves the reliability of the exploit against all supported platforms. CVE-2008-4250 Exploits/Remote Windows