Exploits

Core Impact Threat Intelligence Exploits, Security and Penetration Testing Updates

When you buy Core Impact, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact keeps you there.

 

Use the controls below to navigate Core Impact exploits and other modules.

Title Description Vulnerabilty Category Platform
OpenBSD PF IP ICMPV6 Remote DoS

OpenBSD's PF is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to cause a kernel panic on affected computers, denying further service to legitimate users.

NOCVE-9999-37988 Denial of Service/Remote OpenBSD
OpenBSD PF IP ICMPV6 Remote DoS Update

OpenBSD's PF is prone to a remote denial-of-service vulnerability.
Exploiting this issue allows remote attackers to cause a kernel panic on affected computers, denying further service to legitimate users.

This update improves reliability in Impact 10.

CVE-2009-0687 Denial of Service/Remote OpenBSD
OpenBSD XMM Exceptions DoS

OpenBSD is prone to a local denial-of-service vulnerability.
XMM exceptions are not correctly handled, resulting in a kernel panic.

CVE-2009-3572 Denial of Service/Local OpenBSD
OpenEMR pc_category Cross Site Scripting Exploit

OpenEMR fails to sanitize the pc_category parameter in interface/main/calendar/index.php leading to a Cross-Site Scripting vulnerability.

NOCVE-9999-49218 Exploits/Cross Site Scripting (XSS)/Known Vulnerabilities
Openfiler Remote Code Execution Exploit

Insufficient sanitization in Openfile's /admin/system.html 'Hostname' field, leads to remote code execution.

NOCVE-9999-65590 Exploits/Remote Code Execution Linux
Openfiler Remote Code Execution Exploit Update

Insufficient sanitization in Openfile's /admin/system.html 'Hostname' field, leads to remote code execution.

This update fixes the exploit category.

NOCVE-9999-65590 Exploits/Remote Linux
Openfire Remote Command Injection Exploit

This module exploits a Reflected Cross-Site Scripting vulnerability in Openfire to install an agent.

CVE-2009-0496 Exploits/Client Side Windows, Mac OS X, Linux
Openftpd Server Buffer Overflow Exploit

The vulnerability is caused due to a boundary error within the authentication process. This can be exploited to cause a stack-based buffer overflow by sending an overly long, specially-crafted password to the affected server.

NOCVE-9999-42236 Exploits/Remote Windows
Openftpd Server Buffer Overflow Exploit Update

The vulnerability is caused due to a boundary error within the authentication process. This can be exploited to cause a stack-based buffer overflow by sending an overly long, specially-crafted password to the affected server. This update adds CVE Number.

CVE-2010-2620 Exploits/Remote Windows
OpenKM scripting Command Injection Exploit

OpenKM allows administrative users (those having the AdminRole) to run bean shell scripts. Due to this permission an attacker could lure an OpenKM administrator to a malicious web page that causes arbitrary OS commands to run in the administrators OpenKM session context.

NOCVE-9999-51465 Exploits/Client Side Linux
OpenLDAP modrdn Request Multiple Vulnerabilities

OpenLDAP allows remote attackers to cause a denial of service effect (service crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function within schema_init.c

CVE-2010-0212 Denial of Service/Remote Mac OS X
OpenNMS Platform Java Object Deserialization Remote Code Execution Exploit

OpenNMS Platform is prone to a remote vulnerability that allows attackers to take advantage of an insecure deployment of the JMX/RMI service used to manage and monitor the Java Virtual Machine.

NOCVE-9999-79964 Exploits/Remote Linux
OpenOffice OLE DocumentSummaryInformation Heap Overflow Exploit

A security vulnerability with the way OpenOffice.org processes OLE files may allow a remote unprivileged user who provides an OpenOffice.org document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running OpenOffice.org. This can be exploited to cause a heap-based buffer overflow when a specially crafted file is opened.

CVE-2008-0320 Exploits/Client Side Windows
OpenOffice RTF Prtdata tag Exploit

This module exploits a heap-based buffer overflow vulnerability in the OpenOffice software included in most linux distributions. The vulnerability is caused by the prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten. The exploit is triggered when an unsuspecting user opens a specially crafted file distributed via an email.

CVE-2007-0245 Exploits/Client Side Linux
OpenOffice Word sprmTDefTable Integer Overflow Exploit

Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTDefTable table property modifier in a Word document.

CVE-2009-3301 Exploits/Client Side Windows
OpenSite 2.1 Weak Authentication Exploit

This module exploits an authentication vulnerability in OpenSite 2.1. The function init in origin/libs/user.php checks for a matching origin_hash cookie. However, this cookie can be bruteforced in at most 2^32 tries for a known username. Actually, the number of attempts could be significantly reduced knowing that we do not have to check for time in the future, and long past. This works for OpenSite 2.1 and below.

NOCVE-9999-36572 Exploits/Authentication Weakness
OpenSSH Channel Exploit Update

Exploits an off-by-one bug in channel management code in OpenSSH.
This update excludes the module from automated attacks launched by the "Network Attack and Penetration" feature, since the module requires credentials of a known account on the vulnerable system, and hence won't work with default parameters.

CVE-2002-0083 Exploits/Remote OpenBSD, Linux
OpenSSH unexpected PAM authentication exploit Update

This module exploits an error in the PAM authentication code and installs an agent into the target host.
This update improves the reliability of the exploit.

CVE-2003-0786 Exploits/Remote Solaris, Linux
OpenSSH xauth Command Injection Vulnerability Exploit

An authenticated user may inject arbitrary xauth commands by sending an x11 channel request that includes a newline character in the x11 cookie.
The newline acts as a command separator to the xauth binary.
The injected xauth commands are performed with the effective permissions of the logged in user.
This attack requires the server to have 'X11Forwarding yes' enabled.
This module injects source xauth command to retrieve arbitrary files.

CVE-2016-3115 Exploits/Remote File Disclosure Linux
OpenSSL ChangeCipherSpec Message Vulnerability Checker

This module exploits a vulnerability in OpenSSL by sending a "Change Ciper Spec" message to the server.

This vulnerability allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake.

CVE-2014-0224 Exploits/Remote Linux
OpenSSL DTLS ChangeCipherSpec DoS

ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.

CVE-2009-1386 Denial of Service/Remote Linux, FreeBSD
OpenSSL DTLS Fragment Buffer Overflow DoS

OpenSSL is susceptible to a buffer overflow vulnerability. This issue allows remote attackers to crash a vulnerable server.

This module exploits a buffer overflow vulnerability in OpenSSL by sending a crafted packet to port 10161, causing a denial of service effect.

CVE-2014-0195 Denial of Service/Remote Linux
OpenSSL TLS Heartbeat Read Overrun Memory Disclosure Exploit

A missing boundary check in the TLS Heartbeat extension in OpenSSL can be abused by remote attackers to read up to 64 kb of memory from the server.

This memory disclosure vulnerability can be used by remote unauthenticated attackers to obtain sensitive information from the affected server, including private keys and session cookies.

WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation.

CVE-2014-0160 Exploits/Remote Linux
OpenSSL TLS Heartbeat Read Overrun Memory Disclosure Exploit Update

A missing boundary check in the TLS Heartbeat extension in OpenSSL can be abused by remote attackers to read up to 64 kb of memory from the server.

This memory disclosure vulnerability can be used by remote unauthenticated attackers to obtain sensitive information from the affected server, including private keys and session cookies.

This update adds features to the module, like the ability to read 64 kb of data from vulnerable services, reporting the results in the Module Output window, and saving the memory dumps to disk. It also improves the compatibility with OpenSSL services and adds support for FTPS.

CVE-2014-0160 Exploits/Remote Linux
OpenX Remote Code Execution Exploit

The vulnerability is caused due to the banner-edit.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to e.g. execute arbitrary PHP code by uploading a specially crafted PHP script that contains the GIF magic number.

CVE-2009-4098 Exploits/Remote Solaris, Linux, Mac OS X
OpenX Remote Code Execution Exploit Update

This update adds support for Solaris and Mac OS X platforms

CVE-2009-4098 Exploits/Remote Solaris, Linux, Mac OS X
Opera file URI Handling Buffer Overflow Exploit

Opera is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.

CVE-2008-5178 Exploits/Client Side Windows
Opera file URI Handling Buffer Overflow Exploit Update

Opera is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.
This update add Decouple feature.

CVE-2008-5178 Exploits/Client Side Windows
Opera Remote Command Injection Exploit

This module exploits a XSS vulnerability in the opera:historysearch page in Opera which leads to remote command injection.

CVE-2008-4696 Exploits/Client Side Linux
Oracle Application Testing Suite UploadFileAction Servlet Remote Code Execution Exploit

A vulnerability exists in the UploadFileAction servlet. By providing a fileType parameter of "*" to the UploadFileUpload page, an attacker can upload a file to an arbitrary location on the system.
This module abuses the auto deploy feature in the server in order to achieve remote code execution. Also, this module makes use of an authentication bypass vulnerability to perform the attack.

CVE-2016-0491 Exploits/Remote Windows