VARIoT IoT exploits database

Multiple Cisco products are prone to a buffer-overflow vulnerability. This issue is being tracked by Cisco Bug ID CSCtr21359. Attackers can exploit this issue to execute arbitrary command within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. The following products are affected: Cisco Firewall Services Module (FWSM) Cisco ASA 5500 Series Adaptive Security Appliances Cisco Catalyst 6500 Series ASA Services Module

Multiple Cisco products are prone to multiple remote denial-of-service vulnerabilities. These issues are being tracked by Cisco Bug IDs: CSCtr21346, CSCtr21376, CSCtr27521 and CSCtr27524. Successful exploit of these issues to cause the affected device to crash and reload, denying service to legitimate users. The following products are affected: Cisco Firewall Services Module (FWSM) Cisco ASA 5500 Series Adaptive Security Appliances Cisco Catalyst 6500 Series ASA Services Module

TP-LINK TD-W8151N 150Mbps wireless N ADSL+2 modem router suffers from a cross site request forgery vulnerability.

Cisco IOS and Unified Communications Manager are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause the affected device to reload, denying service to legitimate users. This issue is tracked by Cisco Bug IDs CSCtj33003, CSCtw84664, and CSCtw66721.

Cisco IOS is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause the affected device to reload, denying service to legitimate users. This issue is tracked by Cisco Bug ID CSCto57723.

The TP-LINK TL-WR340G SOHO router version 4.7.11 suffers from a malformed packet denial of service vulnerability.

Proficy Historian is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the process.

Tor is prone to multiple remote vulnerabilities, including: 1. Multiple denial-of-service vulnerabilities. 2. An information-disclosure vulnerability. 3. An out-of-bounds memory-access vulnerability. Attackers can exploit theses issues to crash the affected application, cause denial-of service conditions, or retrieve potentially sensitive information.

Some system directories on the Samsung Galaxy S2 for Sprint-US (Epic 4G Touch) are world-writable and allow for information disclosure, modification, and may lead to local root compromise of the device.

SAP Netweaver is prone to a remote code-execution vulnerability. An attacker may leverage this issue to execute arbitrary script code with administrator user rights in context of the affected application. This may allow an attacker to take complete control of the system. SAP NetWeaver 7.02 is vulnerable; other versions may also be affected.

Adobe Flash Player 11.3 - Font Parsing Code Execution (Metasploit). CVE-2012-1535CVE-84607 . remote exploit for Windows platform

Multiple Cisco Nexus devices are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause the device to crash, denying service to legitimate users. The following devices are affected: Cisco Nexus 2000 Cisco Nexus 5000 This issue is documented by CSCts46521.

Iconics GENESIS32 and BizViz are prone to a local authentication-bypass vulnerability. A local attacker can exploit this issue to bypass authentication methods and gain unauthorized administrative access in the Security Configurator. Successful exploits may lead to other attacks. Iconics GENESIS32 and BizViz versions 9.22 and prior are vulnerable.

WellinTech KingView is prone to an unauthorized-access vulnerability due to a backdoor in all versions of the application. Attackers can exploit this issue to gain unauthorized access to the affected application. This may aid in further attacks.

Vivotek IP Cameras - Multiple Vulnerabilities. CVE-2013-1598CVE-2013-1597CVE-2013-1596CVE-2013-1595CVE-2013-1594CVE-92877CVE-92876CVE-92875CVE-92874CVE-92873 . webapps exploit for Hardware platform

Siemens Simatic S7-300/400 - CPU START/STOP Module (Metasploit). CVE-72870 . remote exploit for Hardware platform

Siemens Simatic S7-300 - PLC Remote Memory Viewer (Metasploit). CVE-73645 . remote exploit for Hardware platform

Siemens Simatic S7-1200 - CPU START/STOP Module (Metasploit). CVE-72870 . remote exploit for Hardware platform

TP-Link Gateway 3.12.4 - Multiple Vulnerabilities. CVE-90262CVE-84906CVE-84905 . webapps exploit for Hardware platform

Cisco TelePresence Recording Server is prone to a remote command-injection vulnerability. Successful exploits will result in the execution of arbitrary attacker-supplied commands in the context of the root user. This may facilitate a complete compromise. This issue is being tracked by Cisco bug ID CSCti21830.