VARIoT IoT vulnerabilities database

A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML. Ruckus ICX7450-48 The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. The Ruckus ICX7450-48 is a switch device from Ruckus Wireless

MAC1100 PLC Programmable Logic Controller (PLC) is a product in the Dalian CECE Programmable Logic Controller (PLC) series. A remote code upload vulnerability exists in the DCCE MAC1100 PLC. Attackers can use this vulnerability to construct malicious control codes, remotely upload control codes in arbitrary PLCs, and overwrite the original control codes in PLCs, affecting the availability and integrity of the system and the normal operation of the PLC

MAC1100 PLC Programmable Logic Controller (PLC) is a product in the Dalian CECE Programmable Logic Controller (PLC) series. The DCCE MAC1100 PLC has an arbitrary memory tampering vulnerability. An attacker can use this vulnerability to arbitrarily write and tamper with the contents of a variable area, construct a malicious data packet to arbitrarily read and write the value of the output coil, and affect the normal operation of the PLC. PLC Normal operation

MAC1100 PLC Programmable Logic Controller (PLC) is a product in the Dalian CECE Programmable Logic Controller (PLC) series. DCCE MAC1100 PLC has an arbitrary file reading vulnerability. An attacker could use this vulnerability to read the contents of any variable area of the controller

mySCADA myPRO 7 allows remote attackers to discover all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 requests to TCP port 11010. mySCADA myPRO Contains an information disclosure vulnerability.Information may be obtained

DrayTek is a Taiwanese broadband CPE (client device) manufacturer that manufactures devices including routers, switches, firewalls and VPN devices. There is a 0day vulnerability in the DrayTek router. An attacker can exploit the vulnerability to modify the DNS configuration and then redirect the user to the phishing website through a man-in-the-middle attack to steal data.

Tplink ER5110G, Tplink ER5120G and Tplink WAR1300L are enterprise VPN routers and enterprise wireless VPN routers of Pulian Technology Co., Ltd. Command execution vulnerability exists in multiple TP-Link enterprise routers. An attacker could use the vulnerability to elevate from administrator privileges to root privileges.

A reflected Cross-Site-Scripting (XSS) vulnerability has been identified in Siemens PLM Software TEAMCENTER (V9.1.2.5). If a user visits the login portal through the URL crafted by the attacker, the attacker can insert html/javascript and thus alter/rewrite the login portal page. Siemens PLM Software TEAMCENTER V9.1.3 and newer are not affected. This product is mainly used to manage and share product designs, files, BOM And data etc. Attackers can use specially made URL Use this vulnerability to inject html or JavaScript Code, modify or rewrite the login page

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner. BeaconMedaes Scroll Medical Air Systems Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. BeaconMedaes Scroll Medical Air Systems is a medical surgical air system from BeaconMedaes, USA. The TotalAlert Web Application is one of the web-based hypervisors. An attacker could exploit this vulnerability to retrieve default or user-defined credentials that were not stored and delivered securely

A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in loss or corruption of data. ReadA Is SQL An injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. BD ReadA is a browser software used by BD (Bection, Dickinson and Commpany) in the United States. There are security vulnerabilities in BD ReadA 1.1.0.2 and earlier

A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corruption. DB Manager and PerformA In SQL An injection vulnerability exists.Information is falsified and denial of service (DoS) May be in a state. BD DB Manager and PerformA are products of BD (Bection, Dickinson and Commpany). BD DB Manager is a database manager. PerformA is a performance manager. Security vulnerabilities exist in BD DB Manager 3.0.1.0 and earlier and PerformA 3.0.0.0 and earlier. An attacker could exploit the vulnerability to issue SQL commands, causing data corruption

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability. An unauthenticated, remote attacker may send some specially crafted messages to the affected products. Due to improper authentication design, successful exploit may cause some information leak. plural Huawei Server products contain authentication vulnerabilities.Information may be obtained. Huawei1288HV5 and other Huawei server models are different types of servers. Huawei 1288H V5, etc. The following products and versions are affected: 1288H V5 V100R005C00 Version; 2288H V5 V100R005C00 Version; 2488 V5 V100R005C00 Version; CH121 V3 V100R001C00 Version; CH121L V3 V100R001C00 Version; CH121L V5 V100R001C00 Version; CH121 V5 V100R001C00 Version; CH140 V3 V100R001C00 Version; CH140L V3 V100R001C00 Version; CH220 V3 V100R001C00 Version; CH222 V3 V100R001C00 Version; CH242 V3 V100R001C00 Version; CH242 V5 V100R001C00 Version; RH1288 V3 V100R003C00 Version; RH2288 V3 V100R003C00 Version; RH2288H V3 V100R003C00 Version; XH310 V3 V100R003C00 Version; XH321 V3 V100R003C00 Version; XH321 V5 V100R005C00 Version: XH620 V3 V100R003C00 version

SimpliSafe Original has Unencrypted Sensor Transmissions, which allows physically proximate attackers to obtain potentially sensitive information about the specific times when alarm-system events occur. SimpliSafe Original Contains an information disclosure vulnerability.Information may be obtained. SimpliSafe Original is a home security management system. The system includes video surveillance and intrusion alarms, among other things. A security flaw exists in SimpliSafe Original, which stems from the program not encrypting the messages passed. An attacker in physical proximity could exploit this vulnerability to obtain sensitive information

In SimpliSafe Original, the Base Station fails to detect tamper attempts: it does not send a notification if a physically proximate attacker removes the battery and external power. SimpliSafe Original Contains vulnerabilities related to security features.Service operation interruption (DoS) There is a possibility of being put into a state. SimpliSafe Original is a home security management system. The system includes video surveillance and intrusion alarms, among other things. There is a security flaw in SimpliSafe Original

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system. Huawei 1288H V5 and 2288H V5 The software contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Huawei 1288HV5 and 2288HV5 are Huawei's rack server devices

Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have a numeric errors vulnerability. An unauthenticated, remote attacker may send specially crafted SCCP messages to the affected products. Due to the improper validation of the messages, it will cause numeric errors when handling the messages. Successful exploit will cause some services abnormal. plural Huawei The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Huawei DP300 and other products are all products of China Huawei. The DP300 is a video conferencing terminal. The RP200 is a video conferencing machine. A security vulnerability exists in several Huawei products due to insufficient verification messages from the program. The following products and versions are affected: Huawei DP300 V500R002C00 Version; RP200 V600R006C00 Version; TE30 V100R001C10 Version, V500R002C00 Version, V600R006C00 Version; TE40 V500R002C00 Version, V600R006C00 Version; TE50 V500R002C00 Version, V600R006C00 Version; TE60 V100R001C10 Version, V500R002C00 Version, V600R006C00 Version

In SimpliSafe Original, RF Interference (e.g., an extremely strong 433.92 MHz signal) by a physically proximate attacker does not cause a notification. SimpliSafe Original Contains vulnerabilities related to security features.Service operation interruption (DoS) There is a possibility of being put into a state. SimpliSafe Original is a home security management system. The system includes video surveillance and intrusion alarms, among other things. There is a security flaw in SimpliSafe Original. An attacker in physical proximity could exploit this vulnerability to bypass security protections

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system. Huawei 1288H V5 and 2288H V5 The software contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Huawei 1288HV5 and 2288HV5 are Huawei's rack server devices

Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system. Huawei 1288H V5 and 2288H V5 The software contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Huawei1288HV5 and 2288HV5 are rack routers, which can be widely used in cloud computing virtualization, database, big data and other workloads. The vulnerability stems from a program that fails to adequately verify input

SimpliSafe Original has Unencrypted Keypad Transmissions, which allows physically proximate attackers to discover the PIN. SimpliSafe Original Contains an information disclosure vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SimpliSafe Original is a home security management system. The system includes video surveillance and intrusion alarms, among other things. There is a security flaw in SimpliSafe Original, which stems from not encrypting the transmission. An attacker in close physical proximity could exploit this vulnerability to obtain a PIN