Oracle AutoVue ActiveX control can be exploited to create or overwrite arbitrary files in the context of the currently logged-on user.

A buffer overflow vulnerability found in the AutoVue.ocx ActiveX control due in strcpy function in the SetMarkupMode method, when handling a specially crafted sMarkup argument. This module runs a web server waiting for vulnerable clients (Internet Explorer 6 and 7 without JAVA, and Internet Explorer 8 with JAVA 6 in Windows XP, and Internet Explorer 8 and 9 in Windows VISTA/SEVEN with Java 6 installed) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

This module exploits a XSS vulnerability in the opera:historysearch page in Opera which leads to remote command injection. This module runs a web server waiting for vulnerable clients (Opera) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

Opera Web Browser is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.

OpenOffice is prone to a integer-based buffer-overflow vulnerability that occurs because it fails to perform adequate boundary checks on user-supplied dataa via a crafted sprmTDefTable table property modified in a Word document. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This module exploits a heap-based buffer overflow vulnerability in the OpenOffice software included in most linux distributions. The vulnerability is caused by the prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten. The exploit is triggered when an unsuspecting user opens a specially crafted file distributed via an email.

A security vulnerability with the way OpenOffice.org processes OLE files may allow a remote unprivileged user who provides an OpenOffice.org document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running OpenOffice.org. This can be exploited to cause a heap-based buffer overflow when a specially crafted file is opened. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This module exploits a XSS vulnerability in Openfire, which leads to remote command injection impersonating the administrator and uploading a plugin. This module runs a web server waiting for vulnerable clients (any browser) to connect to it. When the client connects, it will use their cookie and try to install an agent by installing a plugin in openfire.

Use after free in Internet Explorer when an invalid reference to CFlatMarkupPointer is used. Successful control of the freed memory may leverage arbitrary code execution under the context of the user. This module runs a web server waiting for vulnerable clients (Internet Explorer 9) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

Numark Cue contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in Numark Cue when handling .M3U files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .M3U file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.