VARIoT IoT vulnerabilities database

A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a misconfiguration of certain sudoers files for the bashroot component on an affected device. An attacker could exploit this vulnerability by authenticating to the affected device with a crafted user ID, which may allow temporary administrative access to escalate privileges. A successful exploit could allow the attacker to escalate privileges on an affected device. This Vulnerability has been fixed in version 4.0(1h). The Cisco Nexus 9000 Series Switches are modular and fixed-port network switches designed for data centers. This issue is tracked by Cisco Bug ID CSCvn09838

A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to read arbitrary files on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms of user-supplied input sent to an affected device. A successful exploit could allow the attacker unauthorized access to read arbitrary files on an affected device. This vulnerability has been fixed in version 14.0(1h). Cisco Nexus 9000 Series Fabric Switch Contains an input validation vulnerability.Information may be obtained. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCvm52064

Emerson DCS CE3008 MQ Contronller is a controller from Emerson. Emerson DCS CE3008 MQ Contronller has a denial of service vulnerability that could be exploited by an attacker to cause the device to restart

A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter. ShoreTel Connect ONSITE Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ShoreTelConnectDirector is a simple system management that allows users to control phones, permissions, applications, trunks, and voice switches through a web interface. # Exploit Title: Shoretel Connect Multiple Vulnerability # Google Dork: inurl:/signin.php?ret= # Date: 14/06/2017 # Author: Ramikan # Vendor Homepage: https://www.shoretel.com/ # Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview # Version: Tested on 18.62.2000.0, 19.45.5101.0, 19.47.9000.0, 19.48.8400.0 can be affected on other versions. # Tested on: Mozila Firefox 53.0.3 (32 bit) Browser # CVE :CVE-2019-9591, CVE-2019-9592, CVE-2019-9593 # Category:Web Apps Vulnerability: Reflected XSS and Session Fixation Vendor Web site: http://support.shoretel.com Version tested:18.62.2000.0, Version 19.45.1602.0, 19.45.5101.0, 19.47.9000.0, 19.48.8400.0 Google dork: inurl:/signin.php?ret= Solution: Update to 19.49.1500.0 Vulnerability 1:Refelected XSS & Form Action Hijacking Affected URL: /signin.php?ret=http%3A%2F%2Fdomainname.com%2F%3Fpage%3DACCOUNT&&brand=4429769&brandUrl=https://domainname.com/site/l8o5g--><script>alert(1)</script>y0gpy&page=ACCOUNT Affected Parameter: brandUrl Vulnerability 2: Reflected XSS Affected URL: /index.php/" onmouseover%3dalert(document.cookie) style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b Affected Parameter: url Affected Version 19.45.1602.0 Vulnerability 3: Reflected XSS /site/?page=jtqv8"><script>alert(1)</script>bi14e Affected Parameter: page Affected Version:18.82.2000.0 GET /site/?page=jtqv8"><script>alert(1)</script>bi14e HTTP/1.1 Host: hostnamem User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://bdrsconference.bdrs.com/signin.php Cookie: PHPSESSID=2229e3450f16fcfb2531e2b9d01b9fec; chkcookie=1508247199505 Connection: close Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 Vulnerability 4: Session Hijacking By exploiting the above XSS vulnerability, the attacker can obtain the valid session cookies of a authenticated user and hijack the session. PHPSESSID, chkcookie both cookies are insecure

Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit these vulnerabilities either by injecting malicious code in a chat window or by sending a crafted link to a user of the interface. In both cases, the attacker must persuade the user to click the crafted link or open the chat window that contains the attacker's code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Version 11.6(1) is affected. Cisco Enterprise Chat and Email Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. These issues are being tracked by Cisco Bug IDs CSCvn77926, and CSCvn77927

A vulnerability in the web-based management interface of Cisco DNA Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco DNA Center versions prior to 1.2.5 are affected. Cisco DNA Center Access Contract is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCvk51466. The solution scales and protects devices, applications, and more within the network

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ASN.1 parser. When parsing ASN.1 strings, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7472. Samsung Galaxy S9 Contains a buffer error vulnerability. Zero Day Initiative Does not address this vulnerability ZDI-CAN-7472 Was numbered.Information is acquired, information is falsified, and denial of service (DoS) May be in a state

A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. An input validation issue in a .dll file of RSLinx Classic where the data in a Forward Open service request is passed to a fixed size buffer, allowing an attacker to exploit a stack-based buffer overflow condition. Rockwell Automation RSLinx Classic Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The program supports access to RockwellSoftware and Allen-Bradley applications via Allen-Bradley programmable controllers. A stack buffer overflow vulnerability exists in the .dll file in Rockwell Automation RSLinx Classic 4.10.00 and earlier, which can be exploited by remote attackers to execute code on target devices. RSLinx Classic is prone to a local stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Attackers can exploit this issue to execute arbitrary code with elevated privileges. Failed exploit attempts will likely cause denial-of-service conditions

Emily-L29C Huawei phones versions earlier than 9.0.0.159 (C185E2R1P12T8) have a Factory Reset Protection (FRP) bypass security vulnerability. Before the FRP account is verified and activated during the reset process, the attacker can perform some special operations to bypass the FRP function and obtain the right to use the mobile phone. Emily-L29C Huawei phone Contains vulnerabilities related to authorization, permissions, and access control.Information may be tampered with. Huawei Emily-L29C is a smartphone from China's Huawei. There is a security vulnerability in Huawei Emily-L29C version 9.0.0.159 (C185E2R1P12T8)

Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixed version of Service Processor firmware IMMEDIATELY. NetApp Service Processor Firmware contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NetAppServiceProcessor is a remote management device from NetApp Corporation of the United States. The product provides node remote management capabilities, including console redirection, logging and power control. An attacker could exploit this vulnerability to execute arbitrary commands. This issue affects the following products and versions: NetApp Service Processor versions 2.8, 3.7, 4.5, and 5.5 running on Clustered Data ONTAP 9.5, 9.4 and 9.3 NetApp Service Processor versions 2.5, 3.4, 3.4 patch1, 3.4 patch2, 4.2, 5.2, 4.2 patch1, 4.2 patch2, 5.2, and 5.2 patch1 running on Clustered Data ONTAP 9.2 NetApp Service Processor versions 2.4.1, 2.4.1 patch1, 3.3, 3.3 patch1, 3.3 patch2, 3.3 patch3, 3.3 patch4, 4.1,4.1 patch1, 4.1 patch2, 4.1 patch3, 4.1 patch4, 4.1 patch4, 4.1 patch5, 4.1 patch6, 5.1, 5.1 patch1, 5.1 patch2, and 5.1 patch3 running on Clustered Data ONTAP 9.1 NetApp Service Processor versions 2.4 and 3.2 running on Clustered Data ONTAP 9.0 NetApp Service Processor versions 2.3.2, 2.3.2 patch1, 2.3.2 patch2, 2.3.2 patch3, 3.1.2, 3.1.2 patch1, and 3.1.2 patch2 running on Clustered Data ONTAP 8.3 NetApp Service Processor versions 2.5, and 3.0.4 running on Clustered Data ONTAP 8.2

Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130. plural Snapdragon The product contains an information disclosure vulnerability.Information may be obtained. QualcommMDM9607 and others are a central processing unit (CPU) product of Qualcomm. There are information disclosure vulnerabilities in TrustZone in several Qualcomm products. An attacker could exploit the vulnerability to disclose information. The following products are affected: Qualcomm MDM9206; MDM9607; MDM9650; MDM9655; QCS605; SD 410/12; SD 615/16; SD 415; SD 636; SD 712; SD 710; SDA660; SDM630; SDM660; SXR1130

Undefined behavior in UE while processing unknown IEI in OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, Snapdragon_High_Med_2016, SXR1130. plural Snapdragon The product contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm MDM9206 is a central processing unit (CPU) product of Qualcomm (Qualcomm). The NAS in many Qualcomm products has an input validation error vulnerability, which originates from the fact that the network system or product does not properly validate the input data

Processing messages after error may result in user after free memory fault in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150. plural Snapdragon The product contains a vulnerability related to the use of released memory.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. MDM9607 is a central processing unit (CPU) product. MDM9650 is a central processing unit (CPU) product. Video Driver is one of the video drivers. A resource management error vulnerability exists in the Video Driver in several Qualcomm products. This vulnerability stems from improper management of system resources (such as memory, disk space, files, etc.) by network systems or products

kernel could return a received message length higher than expected, which leads to buffer overflow in a subsequent operation and stops normal operation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM439, SDX24, SM7150. plural Snapdragon The product contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm MDM9206 and others are products of Qualcomm (Qualcomm). MDM9206 is a central processing unit (CPU) product. SDX24 is a modem. SD 425 is a central processing unit (CPU) product. A buffer overflow vulnerability exists in the PMIC Modules of several Qualcomm products. The vulnerability is caused by the fact that the length of the received message returned by the kernel is longer than expected. An attacker could exploit this vulnerability to execute code or cause a denial of service

TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130. plural Snapdragon The product contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm MDM9206 is a central processing unit (CPU) product of Qualcomm (Qualcomm). Vulnerabilities of permissions and access control issues exist in many Qualcomm products, which originate from the lack of effective permissions and access control measures in network systems or products. The following products are affected: Qualcomm MDM9206; MDM9607; MDM9650; MDM9655; QCS605; SD 410/12; SD 636; SD 712; SD 710; SD 670; SD 845;

Insufficient protection of keys in keypad can lead HLOS to gain access to confidential keypad input data in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9607, MDM9650, MDM9655, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016. plural Snapdragon The product contains an access control vulnerability.Information may be obtained. QualcommMDM9607 and others are a central processing unit (CPU) product of Qualcomm. There are access control error vulnerabilities in ContentProtection in several Qualcomm products. An attacker could exploit this vulnerability to gain access to sensitive keypad input data. The following products are affected: Qualcomm MDM9206; MDM9607; MDM9650; MDM9655; Qualcomm 215; SD 210; SD 212; SD 205; SD 410/12; SD 425; SD 427; SD 615/16; SD 415; SD 625; SD 632; SD 636; SD 650/52; SDA660; SDM439; SDM630; SDM660; Snapdragon_High_Med_2016

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must connect to a wireless network. The specific flaw exists within the captive portal. By manipulating HTML, an attacker can force a page redirection. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7476. Samsung Galaxy S9 Contains an open redirect vulnerability. Zero Day Initiative Is vulnerable to this vulnerability ZDI-CAN-7476 Was numbered.Information may be obtained and information may be altered

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the GameServiceReceiver update mechanism. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7477. Zero Day Initiative Is vulnerable to this vulnerability ZDI-CAN-7477 Was numbered.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SamsungGalaxyS9 is a smartphone from South Korea's Samsung

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8. User interaction is required to exploit this vulnerability in that the target must answer a phone call.The specific flaw exists within the handling of Status Information Elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of the baseband processor.

IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081. Vendors have confirmed this vulnerability IBM X-Force ID: 152081 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. IBM Java SDK is prone to a local privilege-escalation vulnerability. An attackers may exploit this issue to inject and execute arbitrary-code with elevated privileges. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.35 and previous versions, 7.1.4.35 and previous versions, 8.0.5.27 and previous versions used by IBM® Db2®