VARIoT IoT exploits database

Airties RT210 suffers from a stored cross site scripting vulnerability.

Beckhoff IPC Diagnostics versions prior to 1.8 suffer from an authentication bypass vulnerability.

Airties - login-cgi Buffer Overflow (Metasploit). CVE-120335CVE-2015-2797 . remote exploit for Hardware platform

Multiple Cisco products are prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. This issue is being tracked by Cisco Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and CSCus68315.

D-Link DNR-326 is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and gain unauthorized access. This may aid in further attacks.

Sendio ESP - Information Disclosure. CVE-2014-0999CVE-122477CVE-2014-8391 . webapps exploit for JSP platform

Hikvision DS-7108HWI-SH suffers from XML injection and abuse control vulnerabilities.

Linux/MIPS Kernel 2.6.36 - 'NetUSB' Remote Code Execution. CVE-2015-3036 . remote exploit for Multiple platform

NetUSB - Kernel Stack Buffer Overflow. CVE-2015-3036CVE-122324 . dos exploit for Hardware platform

QEMU - Floppy Disk Controller (FDC) (PoC). CVE-2015-3456CVE-122072 . dos exploit for Multiple platform

Multiple SAP Products are prone to a buffer-overflow vulnerability and a denial-of-service vulnerability. Remote attackers can exploit these issues to execute arbitrary code in the context of the application or cause denial-of-service conditions.

ISC BIND 9 - TKEY (PoC). CVE-2015-5477 . dos exploit for Multiple platform

ISC BIND 9 - TKEY Remote Denial of Service (PoC). CVE-2015-5477CVE-125438 . dos exploit for Multiple platform

ZTE F660 - Remote Configuration Download. CVE-121896 . webapps exploit for Hardware platform

Dell SonicWALL Secure Remote Access (SRA) Appliance - Cross-Site Request Forgery. CVE-2015-2248CVE-121557 . webapps exploit for CGI platform

ASUS RT-G32 Router is prone to multiple cross-site scripting vulnerabilities and multiple cross-site request-forgery vulnerabilities. An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and perform unauthorized actions. Other attacks may also be possible. ASUS RT-G32 router running firmware 2.0.2.6 and 2.0.3.2 are vulnerable.

Inductive Automation Ignition is prone to an unspecified cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. Inductive Automation Ignition 7.7.2 is vulnerable; other versions may also be affected.