This module exploits a XSS vulnerability in the opera:historysearch page in Opera which leads to remote command injection. This module runs a web server waiting for vulnerable clients (Opera) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

Opera Web Browser is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.

OpenOffice is prone to a integer-based buffer-overflow vulnerability that occurs because it fails to perform adequate boundary checks on user-supplied dataa via a crafted sprmTDefTable table property modified in a Word document. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

A security vulnerability with the way OpenOffice.org processes OLE files may allow a remote unprivileged user who provides an OpenOffice.org document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running OpenOffice.org. This can be exploited to cause a heap-based buffer overflow when a specially crafted file is opened. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This module exploits a XSS vulnerability in Openfire, which leads to remote command injection impersonating the administrator and uploading a plugin. This module runs a web server waiting for vulnerable clients (any browser) to connect to it. When the client connects, it will use their cookie and try to install an agent by installing a plugin in openfire.

Use after free in Internet Explorer when an invalid reference to CFlatMarkupPointer is used. Successful control of the freed memory may leverage arbitrary code execution under the context of the user. This module runs a web server waiting for vulnerable clients (Internet Explorer 9) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

Numark Cue contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in Numark Cue when handling .M3U files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .M3U file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

Nuance PDF Reader is prone to a vulnerability that may allow the execution of any library file named dwmapi.dll, if this dll is located in the same folder than a .PDF file. The attacker must entice a victim into opening a specially crafted .PDF file. This file and the associated binary may be delivered to a user through remote WebDAV shares. An attacker may exploit this issue to execute arbitrary code.

This module exploits a vulnerability in the ntractivex118.dll module included in the NTRglobal NTR Activex Control application. The exploit is triggered when the StopModule() method processes a crafted argument resulting in a buffer overflow. This module runs a malicious web site on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site. This module runs a web server waiting for vulnerable clients (Internet Explorer 6, 7 and 8 in Windows XP to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

A buffer overflow vulnerability when handling a url can be exploited via a crafted "bstrParams" parameter passed to the "Check()" method. This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.