Xnview is prone to a stack based buffer overflow which can be exploited through a specially crafted PSP file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

XMPlay contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in XMPlay when handling .ASX, .M3U and .PLS files. This exploit uses a crafted .M3U to cause a stack-based buffer overflow. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

The vulnerability is caused due to a boundary error in Xion when handling .M3U files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .M3U file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

Buffer overflow in Xenorate exists when opening a crafted XPL file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

The vulnerability is caused due to boundary errors in Word List Builder 1.0 within the processing of DIC files. This can be exploited to cause a stack-based buffer overflow when the victim opens a specially crafted file with an overly long supplied data.

The vulnerability is caused due to boundary errors in Wordtrainer 3.0 within the processing of ORD files. This can be exploited to cause a stack-based buffer overflow when the victim opens a specially crafted file with an overly long supplied data.

The vulnerability is caused due to boundary errors in wordperfect within the processing of WPD files. Wordperfect X3 fails to check the length of the printer selection (.PRS) filename stored inside Wordperfect documents, allowing an attacker to cause a stack overflow in order to execute arbitrary code.

WM Downloader contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in WM Downloader when handling .M3U files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .M3U file. This module runs a malicious web site on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site.

This module exploits a vulnerability in the WBEMSingleView.ocx control included in the WMI Tools ActiveX application. The exploit is triggered when the OpenURL() method processes a long string argument resulting in a stack-based buffer overflow. This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it. When the client connects, it will try to install an agent by exploiting a vulnerability in the way WMF metafile images are handled by Microsoft Window's graphic rendering engine. When Outlook Express is used as mail user agent, Internet Explorer can be exploited through sending the target an e-mail that contains a link to the specially designed HTML page that triggers the attack. Also, this module can drop a specially crafted WMF file in a local folder of the user's choice. This file can later be embedded into a Microsoft Office document or placed in a shared folder. Exploitation will occur in the first case when the user opens the document, and in the second case when the user double clicks on the image file, or simply browses the folder in Thumbnail View. Note that the file does not need to have the .wmf extension to work correctly, as Windows will detect the correct file type by examining it's contents.