Exploits and Security Updates to Core Impact Threat Intelligence

Exploits and Security Updates to Core Impact Threat Intelligence

When you buy Core Impact, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Title Description Vulnerabilty Category Platform
Fortinet Single Sign On Windows AD Buffer Overflow Exploit This module exploits a buffer overflow in FSSO Collector Agent for Windows Active Directory from FORTINET and installs an agent into the target host CVE-2015-2281 Exploits/Remote Windows
Exim Ghost Buffer Overflow Exploit This update includes a module that remotely exploits CVE-2015-0235 (a.k.a. GHOST, a heap-based buffer overflow in the GNU C Library's gethostbyname functions) on x86 and x86_64 GNU/Linux systems that run the Exim mail server. CVE-2015-0235 Exploits/Remote Linux
Microsoft Windows LNK Shortcut Automatic DLL Loading Exploit (MS15-020) Microsoft Windows is prone to a vulnerability that may allow a DLL file to be automatically loaded because the software fails to handle LNK files properly. Specifically, the issue occurs when loading the icon of a shortcut file. A specially crafted LNK file can cause Windows to automatically execute code that is specified by the shortcut file. This vulnerability is the result of an incomplete fix for MS10-046 (CVE-2010-2568). WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-0096 Exploits/Tools Windows
Agilent Technologies Feature Extraction ActiveX Exploit The specific flaw exists within the AnnotateX dll ActiveX control included with the software. An attacker can use an unvalidated object parameter in the Insert() function to execute arbitrary code in the context of the browser. CVE-2015-2092 Exploits/Client Side Windows
SMB Relay Update This update add support to a new method to bypass SMB signing when doing a SMB relay attack. CVE-2008-4037 Exploits/Tools Windows
Kerberos Checksum Remote Privilege Escalation Exploit (MS14-068) Update A vulnerability in Microsoft's implementation of the Kerberos authentication protocol allows to modify a Kerberos ticket to remotely escalate privileges. This module exploits the vulnerability impersonating a user of the domain's Administrators group to install an agent in the domain controller with System privileges. This update solves issues related to name resolution of the target and to running the exploit with a source agent installed on a Linux host. CVE-2014-6324 Exploits/Remote Windows
Webgate WESP SDK WESPMonitor Module Buffer Overflow Exploit Webgate WESP SDK WESPMonitor Module is prone to a buffer overflow vulnerability when LoadImage method is invoked with a crafted argument. CVE-2015-2097 Exploits/Client Side Windows
Microsoft Windows Win32k Cursor Object Double Free Vulnerability DoS (MS15-010) This module exploits a double free vulnerability in win32k.sys, allowing an unprivileged local user to cause a BSOD. CVE-2015-0058 Denial of Service/Local Windows
Adobe Flash Player casi32 Integer Overflow Exploit This module exploits an integer overflow in Adobe Flash Player. The specific flaw exists within the implementation of casi32. The issue lies in the failure to properly sanitize a user-supplied length value with a specific array implementation. An attacker can leverage this vulnerability to execute code within the context of the current process. CVE-2014-0569 Exploits/Client Side Windows
Adobe Flash Player ByteArray UncompressViaZlibVariant Use-After-Free Exploit Adobe Flash Player is prone to a use-after-free vulnerability because the ByteArray::UncompressViaZlibVariant method frees an object while leaving a dangling pointer that can be later dereferenced. This vulnerability allows attackers to execute arbitrary code on vulnerable machines by enticing unsuspecting users to visit a website serving a specially crafted SWF Flash file. CVE-2015-0311 Exploits/Client Side Windows
SolarWinds Application Monitor TSUnicodeGraphEditorControl factory Buffer Overflow Exploit The specific flaw exists within the 'factory' object's loadExtensionFactory method. The issue lies in a failure to validate the size of an attacker-supplied input before copying it into a fixed-size buffer on the stack. An attacker can leverage this vulnerability to execute code under the context of the current process. CVE-2015-1500 Exploits/Client Side Windows
POODLE TLS1.x to SSLv3 Downgrading Vulnerability Exploit This module exploits a vulnerability in Internet Explorer 10/11 by downgrading the encryption from TLS 1.x to SSLv3. After that, part of the encrypted text plain will be decrypted. CVE-2014-3566 Exploits/Tools Windows
HP Data Protector Remote Command Execution Exploit This module exploits a remote code execution vulnerability in HP Data Protector by sending a specially crafted request CVE-2014-2623 Exploits/Remote Windows
Adobe Flash Player copyPixelsToByteArray Heap Buffer Overflow Exploit This module exploits a heap-based buffer overflow in Adobe Flash Player. The bug is triggered by calling BitmapData.copyPixelsToByteArray() with a reference to a ByteArray that has its position property set very large, close to 2^32. This results in an integer overflow in 32-bit arithmetic and allows an attacker to take control of the target machine. CVE-2014-0556 Exploits/Client Side Windows
Drupal core SQL injection Exploit Update This update is to add the exploit in order to attack Drupal core CMS 7.x versions prior to 7.32 using default configuration (CVE-2014-3704). CVE-2014-3704 Exploits/OS Command Injection/Known Vulnerabilities Windows, Linux
Trihedral VTScada Integer Overflow DoS This module exploits a Integer Overflow vulnerability in the HTTP Server by sending a malformed packet to the 80/TCP port to crash the application. CVE-2014-9192 Denial of Service/Remote Windows
Schneider Electric Multiple Products DTM libraries Buffer Overflow Exploit The vulnerability exists within the isObjectModel ActiveX control's RemoveParameter property in Schneider Electric DTM libraries. CVE-2014-9200 Exploits/Client Side Windows
Schneider Electric ProClima MetaDraw ObjLinks Property Exploit The MetaDraw ActiveX control's ObjLinks property can be assigned an attacker-supplied memory address and the control will redirect execution flow to this given memory address. CVE-2014-8514 Exploits/Client Side Windows
Microsoft Windows TCP IP Arbitrary Write Local Privilege Escalation Exploit (MS14-070) The TCP/IP Driver (tcpip.sys) present in Microsoft Windows fails to sufficiently validate memory objects used during the processing of a user-provided IOCTL. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges by sending a specially crafted IOCTL (0x00120028) to the vulnerable driver. CVE-2014-4076 Exploits/Local Windows
CorelDRAW Graphics Suite X7 Wintab32 DLL Hijacking Exploit Untrusted search path vulnerability in CorelDRAW X7 17.1.0.572, Corel Photo-Paint X7 17.1.0.572, Corel PaintShop Pro X7 17.0.0.199, Corel Painter 2015 14.0.0.728, Corel PDF Fusion 1.12 Build 16/04/2013 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as an .cdr, .cpt, .pspimage, .rif or .pdf file. CVE-2014-8393 Exploits/Client Side Windows
GHOST glibc gethostbyname Buffer Overflow Verifier Update This update includes a module that executes a program designed to test a buffer overflow in glibc's __nss_hostname_digits_dots function. The function is used by the gethostbyname*() functions family used for name resolution. Under some circumstances, the use of those functions when the vulnerable underlying function is present, may lead to remote code execution, privilege escalation, or information disclosure. CVE-2015-0235 Exploits/Tools Linux
Oracle Forms and Reports Remote Code Execution Exploit This vulnerabilities allows remote attackers writing to the host filesystem on vulnerable installations of software utilizing Oracle Forms and Reporting. CVE-2012-3152 Exploits/Remote Windows
CorelCAD Multiple DLL Hijacking Exploit Untrusted search path vulnerability in CorelCAD 2014.5 Build 14.4.51 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse FxManagedCommands_3.08_9.tx or TD_Mgd_3.08_9.dll that is located in the same folder as an .dwt file. CVE-2014-8394 Exploits/Client Side Windows
Corel FastFlix Multiple DLL Hijacking Exploit Untrusted search path vulnerability in Corel FastFlix 17.0.0.249 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse igfxcmrt32.dll or ipl.dll or MSPStyleLib.dll or uFioUtil.dll or uhDSPlay.dll or uipl.dll or uvipl.dll or VC1DecDll.dll or VC1DecDll_SSE3.dll that is located in the same folder as an .vfp file. CVE-2014-8398 Exploits/Client Side Windows
GHOST glibc gethostbyname Buffer Overflow Verifier This update includes a module that executes a program designed to test a buffer overflow in glibc's __nss_hostname_digits_dots function. The function is used by the gethostbyname*() functions family used for name resolution. Under some circumstances, the use of those functions when the vulnerable underlying function is present, may lead to remote code execution, privilege escalation, or information disclosure. CVE-2015-0235 Exploits/Tools Linux
Git Insecure Path Component Exploit CVE-2014-9390: Git is prone to a vulnerability that may allow attackers to overwrite arbitrary local files. This module exploits the condition and installs an Agent when a vulnerable GIT client performs a CLONE to the fake repository created. CVE-2014-9390 Exploits/Client Side Mac OS X, Windows
Corel VideoStudio Pro X7 and FastFlix u32ZLib DLL Hijacking Exploit Untrusted search path vulnerability in Corel VideoStudio Pro X7 17.0.0.249 and Corel FastFlix 17.0.0.249 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse u32ZLib.dll that is located in the same folder as an .vsp or .vfp file. CVE-2014-8397 Exploits/Client Side Windows
Microsoft Windows Telnet Server ProcessDataReceivedOnSocket DoS (MS15-002) Update A stack-based buffer overflow in the ProcessDataReceivedOnSocket function in the Microsoft Telnet Server Helper (tlntsess.exe) can be used by remote unauthenticated attackers to render the Telnet server unresponsive. This update improves the way in which this module detects if the attack was successful. CVE-2015-0014 Denial of Service/Remote Windows
Microsoft Windows Telnet Server ProcessDataReceivedOnSocket DoS (MS15-002) A stack-based buffer overflow in the ProcessDataReceivedOnSocket function in the Microsoft Telnet Server Helper (tlntsess.exe) can be used by remote unauthenticated attackers to render the Telnet server unresponsive. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2015-0014 Denial of Service/Remote Windows
Corel Painter Wacommt DLL Hijacking Exploit Untrusted search path vulnerability in Corel Painter 2015 14.0.0.728 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wacommt.dll that is located in the same folder as an .rif file. CVE-2014-8395 Exploits/Client Side Windows