VARIoT IoT vulnerabilities database

SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue is being tracked by Cisco Bug ID CSCug90502. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies. A remote authorized attacker can exploit this vulnerability to execute arbitrary SQL commands

Cross-site scripting (XSS) vulnerability in the troubleshooting page in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCug77655. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCug77655. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies. The vulnerability is caused by the program's insufficient filtering of input parameters. A remote attacker can exploit this vulnerability to inject arbitrary Web scripts or HTML by enticing users to open malicious links

Integer overflow in the OZDocument::parseElement function in Apple Motion 5.0.7 allows remote attackers to cause a denial of service (application crash) via a (1) large or (2) small value in the subview attribute of a viewer element in a .motn file. Apple Motion is prone to a remote integer-overflow vulnerability because it fails to properly bounds-check user-supplied data. An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. Apple Motion 5.0.7 is vulnerable; other version may also be affected. The tool works with Final Cut Pro (video non-linear editing software) to create compelling titles, transitions, special effects, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-12-19-1 Motion 5.1 Motion 5.1 is now available and addresses the following: Motion Available for: OS X Mavericks v10.9 or later Impact: A maliciously crafted .motn file could lead to arbitrary code execution Description: An integer overflow existed in the handling of .motn files which led to an out of bounds memory access. This issue was addressed through improved bounds checking. CVE-ID CVE-2013-6114 : Jean Pascal Pereira Motion 5.1 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJSssLjAAoJEPefwLHPlZEwDwwQAJ5cXQe9I7In8kPrE27xB10/ ejogkZa8FAzS9mwcuvszAxITy35e0JKe+ou65+y1F+Rv+CT9VVzzIlEP7dGr5AUa r88ok05hzQbUsFRdCa/WIE2ERUVDl0aF1T696RQj4Ulxv0nMB7L54QjW1QixH3Sj ubU6X47SdqtVopYz0ca7MPh9O92UNZNwT44dQZco03FqzAdremWNyo/E5GYCqN4d H2BUIbKOrahhfSF8x+Xtl0xaGFbNTZBY9Y2258tisDyvuvVbFGdHKbLT/n1FSUNu CYzsxiCx+cXPEgxR+CeNNvPcva8Lr3uMZginGdOVkkJFD5MWahUv3DuiHgjrmVZv 4MB/cP2tQwfTznbZYf+k3SLUt0dM/WLbE5eV6FGuDeNe7w5z1UHGTcYfCVK5yKe3 /c0NaGtpgMOaaq/UmF41U9/R2wqLUXu0nsoscG9HG10yXGsL/8/Jzfm/CQ5Nr6t5 YpjwCZU3AO/ZhQWbD5PrBMsvcCllXO/aOSSq6z2OCTDHNnotbktQZ9a+7wikC+O3 8u0/Nvwp0K+nzCRa4AMUkZzC1GoQZ6UytU8S26ifWnyXyqs4lNGSX7rmd7hwJcVA QY8k/7Zjj66Uraafolb83nXO6TL/kf1clomHFILTXEwyQUI5hmKiwpKFijAPT0ju ZunhUVBiBiHHSjEFp+p2 =00oP -----END PGP SIGNATURE-----

The BGP implementation in Cisco NX-OS does not properly filter AS paths, which allows remote attackers to cause a denial of service (BGP service reset and resync) via a malformed UPDATE message, aka Bug ID CSCtn13055. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Successful exploitation of the vulnerability allows the downstream peer to reset the BGP link of the affected device. Cisco NX-OS is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input. This issue is being tracked by Cisco bug ID CSCtn13055. The vulnerability is caused by the program not correctly filtering the AS path attribute value

Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via shell metacharacters in unspecified command parameters, aka Bug IDs CSCtf19827 and CSCtf27788. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Cisco NX-OS is prone to a local arbitrary command-execution vulnerability. This issue is being tracked by Cisco bug IDs CSCtf19827 and CSCtf27788. An arbitrary code execution vulnerability exists in Cisco NX-OS Software due to the program's improper handling of parameters containing special characters

Cross-site request forgery (CSRF) vulnerability in the web-management interface in the fabric interconnect (FI) component in Cisco Unified Computing System (UCS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCtg20755. Vendors have confirmed this vulnerability Bug ID CSCtg20755 It is released as.A third party may be able to hijack the authentication of any user. The Cisco Unified Computing System simplifies IT management and increases flexibility by consolidating unified computing, networking, storage access, and virtualization into one system. An attacker can construct a malicious URI, entice the logged in user to resolve, and perform arbitrary operations in the target user context. Other attacks are also possible. This issue is being tracked by Cisco bug ID CSCtg20755. The system integrates network, computing and virtualization resources into one platform by extensively adopting virtualization technology

qis/QIS_finish.htm on the ASUS RT-N10E router with firmware before 2.0.0.25 does not require authentication, which allows remote attackers to discover the administrator password via a direct request. ASUS Wireless-N150 Router RT-N10E No authentication bypass (CWE-592) Vulnerabilities exist. CWE-592: Authentication Bypass Issues http://cwe.mitre.org/data/definitions/592.htmlAdministrator authentication information may be obtained by a third party who can access the product. As a result, arbitrary operations may be executed with administrator privileges for the product. Successful exploits will allow unauthenticated attackers to obtain sensitive information of the device such as administrative password, which may aid in further attacks. ASUS RT-N10E firmware version 2.0.0.24 is vulnerable

Directory traversal vulnerability in the CLI parser in Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the "file name" parameter, aka Bug IDs CSCua71557 and CSCua71551. Cisco NX-OS of CLI The parser contains a directory traversal vulnerability. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Cisco NX-OS is prone to an arbitrary file-write vulnerability. This may aid in further attacks. This issue is being tracked by Cisco bug IDs CSCua71557 and CSCua71551

Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via shell metacharacters in a command that calls the system library function, aka Bug IDs CSCtf23559 and CSCtf27780. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. This issue is being tracked by Cisco bug IDs CSCtf23559 and CSCtf27780. The vulnerability is caused by the program not properly filtering parameters containing special characters

Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via the sed e option, aka Bug IDs CSCtf25457 and CSCtf27651. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. This issue is being tracked by Cisco bug IDs CSCtf25457 and CSCtf27651. An input validation vulnerability exists in Cisco NX-OS Software

The BGP implementation in Cisco NX-OS does not properly filter segment types in AS paths, which allows remote attackers to cause a denial of service (BGP service reset) via a malformed UPDATE message, aka Bug ID CSCtn13043. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Cisco NX-OS is prone to a denial-of-service vulnerability. This issue is being tracked by Cisco bug ID CSCtn13043. The vulnerability is caused by the program not properly filtering invalid AS path segment types

The BGP implementation in Cisco NX-OS does not properly filter AS paths, which allows remote attackers to cause a denial of service (BGP service reset and resync) via a malformed UPDATE message, aka Bug ID CSCtn13065. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Cisco NX-OS is prone to a denial-of-service vulnerability. This issue is being tracked by Cisco bug ID CSCtn13065. The vulnerability is caused by the program not properly filtering invalid AS path values

Cisco NX-OS allows local users to gain privileges, and read or modify arbitrary files, via the sed (1) r and (2) w commands, aka Bug IDs CSCts56559, CSCts56565, CSCts56570, and CSCts56574. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Cisco NX-OS is prone to a local arbitrary file-access vulnerability. This may lead to further attacks. This issue is being tracked by Cisco bug IDs CSCts56559, CSCts56565, CSCts56570, and CSCts56574

The management interface in Cisco NX-OS on Nexus 7000 devices allows remote authenticated users to obtain sensitive configuration-file information by leveraging the network-operator role, aka Bug ID CSCti09089. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Users who have the network-operator role can view the configuration file and get sensitive information because the configuration file is not properly filtered. This may result in further attacks. This issue is being tracked by Cisco Bug ID CSCti09089

The RIP service engine in Cisco NX-OS allows remote attackers to cause a denial of service (engine restart) via a malformed (1) RIPv4 or (2) RIPv6 message, aka Bug ID CSCtj73415. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. Cisco NX-OS is prone to a remote denial-of-service vulnerability. Successfully exploiting this issue allows remote attackers to cause denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCtj73415. The vulnerability is caused by the program not filtering RIP packets correctly

The CLI parser in Cisco NX-OS allows local users to bypass intended access restrictions, and overwrite or create arbitrary files, via shell output redirection, aka Bug IDs CSCts56672 and CSCts56669. The Cisco Nexus Series switches are data center switches. Adopt the Cisco Nexus OS operating system. An attacker can exploit this issue to create or overwrite arbitrary files on the affected device. This may aid in further attacks. This issue is being tracked by Cisco bug IDs CSCts56672 and CSCts56669

Heap-based buffer overflow in Xper in Philips Xper Information Management Physiomonitoring 5 components, Xper Information Management Vascular Monitoring 5 components, and Xper Information Management servers and workstations for Flex Cardio products before XperConnect 1.5.4.053 SP2 allows remote attackers to execute arbitrary code via a crafted HTTP request to the Connect broker on TCP port 6000. Xper is a physiological testing system that is mostly deployed in the medical and public health sectors. Xper Connect is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input. Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. Versions prior to Xper Connect 1.5.4.053 SP2 is vulnerable. Philips Xper Information Management Physiomonitoring, etc. are all components in the healthcare information system (Xper Cardiovascular Workflow Solution) of Philips, the Netherlands. The solution provides workflow charting, registry management, real-time hemodynamic monitoring and reporting, and more. A heap-based buffer overflow vulnerability exists in the Philips Xper application

HP LaserJet M4555, M525, and M725; LaserJet flow MFP M525c; LaserJet Enterprise color flow MFP M575c; Color LaserJet CM4540, M575, and M775; and ScanJet Enterprise 8500fn1 FutureSmart devices do not properly encrypt PDF documents, which allows remote attackers to obtain sensitive information via unspecified vectors. HP FutureSmart LaserJet Printers are laser printer devices from Hewlett Packard. An attacker may exploit this issue to obtain sensitive information; this may lead to further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03888014 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03888014 Version: 1 HPSBPI02892 rev.1 - Certain HP FutureSmart MFP, Weak PDF Encryption, Local Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. The vulnerabilities might lead to weak encryption of PDF documents or local disclosure of scanned information. References: CVE-2013-4828 (SSRT101249) CVE-2013-4829 (SSRT101327) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Please refer to the RESOLUTION below for the list of impacted HP FutureSmart products. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2013-4828 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2013-4829 (AV:L/AC:M/Au:S/C:P/I:N/A:N) 1.5 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided updated printer firmware to resolve this issue, as referenced in the following table. Browse to www.hp.com/go/support and then: Select "Drivers & Software" Enter the HP product name listed in the table above into the search field Click on "Search" If the search returns a list of products click on the appropriate product Under "Select operating system select your operating system, click "Next" Under Select a Download Select "Firmware" Click "Download" to obtain the Firmware HISTORY Version:1 (rev.1) - 3 October 2013 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2013 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iEYEARECAAYFAlJNoO0ACgkQ4B86/C0qfVnWUwCg72K9DXFme7VlPjA6yROdlz+F cnAAoO0gEiP1K/DTFimE5+Qj55QJ2w3N =0mV7 -----END PGP SIGNATURE-----

Citrix NetScaler Application Delivery Controller (ADC) 10.0 before 10.0-76.7 allows remote attackers to cause a denial of service (nsconfigd crash and appliance reboot) via a crafted request. This solution is mainly used to optimize, protect and control the delivery of various enterprise services and cloud services. A denial of service vulnerability exists in versions prior to Citrix NetScaler 10.0-76.7, which is due to an error in the ADC. An attacker could use this vulnerability to cause a denial of service

The JP1/Automatic Job Management System 3 and JP1/Automatic Job Management System 2 contain a vulnerability where arbitrary commands may be executed when they receive request messages from unexpected hosts in the network.Malicious users can exploit this vulnerability to execute arbitrary commands by sending request messages from an unexpected host.