VARIoT IoT exploits database

Multiple Polycom products are prone to a directory-traversal vulnerability and a command-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. Also, attackers can execute arbitrary commands with the privileges of the user running the application.

Parallels Plesk Panel is prone to an unspecified remote security vulnerability that allows attackers to gain unauthorized administrative access to the application. Attackers can exploit this issue to perform unauthorized actions on the affected application. Successfully exploiting this issue results in complete compromise of the application. Limited technical details are available at this time. We will update this BID as more information emerges. Parallels Plesk Panel versions 7.6.1 through 10.3.1 are vulnerable.

Cisco Wireless LAN Controller is prone to a remote denial-of-service vulnerability. An unauthenticated attacker can exploit this issue to cause an affected device to reload, denying service to legitimate users. This issue is tracked by Cisco Bug ID CSCtt07949. http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq24002

Cisco Wireless LAN Controller is prone to a remote denial-of-service vulnerability. An unauthenticated attacker can exploit this issue to cause an device configured for 'WebAuth' to reload, denying service to legitimate users. This issue is tracked by Cisco Bug ID CSCtt47435. http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq24002

Cisco Wireless LAN Controller is prone to a remote denial-of-service vulnerability. An unauthenticated attacker can exploit this issue to cause an affected device to reload, denying service to legitimate users. This issue is tracked by Cisco Bug ID CSCts81997. http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq24002

Cisco Cius is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause an affected device to stop responding and require reboot, denying service to legitimate users. Cisco Cius versions prior to 9.2(1) SR2 are vulnerable. This issue is being tracked by Cisco Bug ID CSCto71445.

Sagem F@ST 2604 suffers from a cross site request forgery vulnerability.

D-Link DCS - 'security.cgi' Cross-Site Request Forgery. CVE-2012-5319CVE-79770 . remote exploit for Hardware platform

The Xavi 7968 router suffers from cross site request forgery and persistent cross site scripting vulnerabilities.

The Xavi 7968 ADSL router suffers from a remote denial of service vulnerability.

Mercury MR804 Router - Multiple HTTP Header Fields Denial of Service Vulnerabilities. CVE-2012-4999CVE-79870 . dos exploit for Hardware platform

Xavi 7968 ADSL Router - '/webconfig/lan/lan_config.html/local_lan_config?host_name_txtbox' Cross-Site Scripting. CVE-79824CVE-2012-5322 . webapps exploit for Hardware platform

Xavi 7968 ADSL Router - '/webconfig/wan/confirm.html/confirm?pvcName' Cross-Site Scripting. CVE-79823CVE-2012-5322 . remote exploit for Hardware platform

Xavi 7968 ADSL Router - Multiple Cross-Site Request Forgery Vulnerabilities. CVE-79822CVE-2012-5323 . remote exploit for Hardware platform

D-Link DSL-2640B ADSL Router - Cross-Site Request Forgery. CVE-80803CVE-2012-1308 . webapps exploit for Hardware platform

The D-Link DSL-2640B ADSL router suffers from a cross site request forgery vulnerability.

Multiple Cisco Nexus devices are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause the device to crash, denying service to legitimate users. The following devices are affected: Cisco Nexus 1000V Cisco Nexus 5000 Cisco Nexus 7000 This issue is documented by Cisco Bug IDs CSCti23447, CSCti49507, and CSCtj01991.

D-Link DAP-1150 1.2.94 - Cross-Site Request Forgery.. remote exploit for Hardware platform

Advantech BroadWin WebAccess is prone to a remote code-execution vulnerability because it fails to sufficiently validate user-supplied data. Successful exploits will allow an attacker to run arbitrary code in the servers managed by the affected application. Failed attacks may cause denial-of-service conditions.

D-Link ShareCenter Products - Multiple Remote Code Execution Vulnerabilities.. remote exploit for Hardware platform