VARIoT IoT vulnerabilities database

Cross-site scripting (XSS) vulnerability in im.php in IMessenger for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via a message. PHP-Nuke is prone to a cross-site scripting vulnerability

Cross-site scripting (XSS) vulnerability in the DMOZGateway module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the topic parameter. Dmozgateway is prone to a cross-site scripting vulnerability

IPRoute 0.973, 0.974 and 1.18 allows remote attackers to cause a denial of service via fragmented IP packets that split the TCP header. Iproute is prone to a denial-of-service vulnerability. Versions 0.973, 0.974 and 1.18 of IPRoute are vulnerable

CMG WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows remote attackers to spoof SSL certificates via a man-in-the-middle attack. Wap Gateway is prone to a remote security vulnerability

Openwave WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows remote attackers to spoof SSL certificates via a man-in-the-middle attack. Openwave Wap Gateway is prone to a remote security vulnerability

Cisco ubr900 series routers that conform to the Data-over-Cable Service Interface Specifications (DOCSIS) standard must ship without SNMP access restrictions, which can allow remote attackers to read and write information to the MIB using arbitrary community strings. The ubr900 series routers are a Cable Access solution manufactured and maintained by Cisco Systems. They are designed to route traffic over cable networks. The MIB supports default community strings xyzzy, agent_steal, freekevin, and fubar. This problem has been confirmed in models ubr920, ubr924, and ubr925

Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which allows local users to obtain authentication information via the ps command. An issue has been reported in Mac OS X which could disclose the authentication information for a PPP connection. If a user has established a PPP connection, executing a ps command will not only display the information about current processes running, but will disclose the PPP username and password for Internet Connect

D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point uses a default SNMP community string of 'public' which allows remote attackers to gain sensitive information. DLink DWL-1000AP is an 11Mbps wireless LAN access point product for home users. It supports WEP, MAC address control and user authentication.  The product has a security issue that could cause remote attackers to obtain sensitive information.  The device comes with a read-only SNMP communication word named 'public' by default. This communication word cannot be cancelled by setting, so a malicious attacker can use an SNMP client to browse to the sensitive information in the 'public' management system library. This community string is hard-coded into the product and cannot be changed with the configuration interface. This issue has been confirmed with the 3.2.28 #483 (Aug 23 2001) firmware. Other versions of the firmware may also be affected

D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point stores the administrative password in plaintext in the default Management Information Base (MIB), which allows remote attackers to gain administrative privileges. DLink DWL-1000AP is an 11Mbps wireless LAN access point product for home users. It supports WEP, MAC address control and user authentication.  The product has a security issue that could cause a remote attacker to hijack the access point.  This is because the administrator password is stored in plain text in the default 'public' management system library (OID 1.3.6.1.4.1.937.2.1.2.2.0). An attacker who has access to this management system library may pass the SNMP client Obtain the password, then access the wireless network, modify the configuration, or launch a denial of service attack. Any attacker within range, using a SNMP client, can reveal the administrative password by browsing the "public" MIB. This issue has been confirmed with the 3.2.28 #483 (Aug 23 2001) firmware. Other versions of the firmware may also be affected

Atmel Firmware 1.3 Wireless Access Point (WAP) allows remote attackers to cause a denial of service via a SNMP request with (1) a community string other than "public" or (2) an unknown OID, which causes the WAP to deny subsequent SNMP requests. Atmel is a chip designer and manufacturer that offers a variety of RF-based products. Atmel manufactures firmware for various wireless access systems. These firmware support SNMP for network management.  Some of these versions of the firmware have security issues that can cause a denial of service attack.  If an SNMP read request is sent using a non-public password or an unknown OID, the device will stop responding and only restart will resume normal operation. The device will not respond to further communication, and a restart is required to regain normal functionality

Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the request, which prevents IIS from timing out the connection. If an IIS 5.0 web server is sent a crafted HTTP GET request which contains a falsified and excessive "Content-Length" field, it behaves in an unusual manner. The server keeps the connection open and does not time out, but does not respond otherwise. It is possible that this may be used to cause a denial of service to the web server

DeltaThree Pc-To-Phone 3.0.3 stores sensitive data in a universally readable unit in the installation directory, which allows local users to read the information in temp.html, the log folder, and the PhoneBook folder.

Tiny Personal Firewall 1.0 and 2.0 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters. Many of these applications only block packets created by the standard Windows protocol adapter. Exploitation will result in a violation of security policy. Tiny Personal Firewall, ZoneAlarm and ZoneAlarm Pro are confirmed vulnerable. It is believed that other applications similar in design may also be vulnerable

Axis network camera 2120, 2110, 2100, 200+ and 200 contains a default administration password "pass", which allows remote attackers to gain access to the camera. Axis Network Cameras are network ready cameras, including an internal web server to display images. They also include a web based administration tool. By default, the password to administer the cameras is 'pass'

SpeedXess HA-120 DSL router has a default administrative password of "speedxess", which allows remote attackers to gain access. The SpeedXess HA-120 router is a home-grade hardware solution used to route DSL connections. It is manufactured by Hyundai Networks. When installed, the router does not prompt the user to change the password. Added to this problem is the fact that the factory sets the password to a known default for every router. A remote attacker can use this vulnerability to gain root directory permissions

Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php. PHPNuke is a website creation/maintenance tool. PHPNuke is prone to cross-site scripting attacks. It is possible to create a link to the PHPNuke user information page, 'user.php', which contains malicious script code. When the link is clicked by an unsuspecting web user, the malicious script code will be executed on the user in the context of the site running PHPNuke. This attack may be used to steal a user's cookie-based authentication credentials for the vulnerable PHPNuke site. PostNuke is also affected by a number of these issues. This problem has also been reported with other scripts included in the PHPNuke package. More specifically, modules.php, upload.php, friend.php and submit.php are also vulnerable under some circumstances. Different parameters to the user.php script may also be sufficient for a cross-site scripting attack. An additional cross-site scripting vulnerability has been reported in modules.php for PostNuke. **It has been reported that the cross-site scripting issue affecting the 'ttitle' parameter of 'modules.php' script has been re-introduced in newer versions of the PHPNuke application. This issue is reported to affect versions 7.2 and prior

Cisco IOS Firewall Feature set, aka Context Based Access Control (CBAC) or Cisco Secure Integrated Software, for IOS 11.2P through 12.2T does not properly check the IP protocol type, which could allow remote attackers to bypass access control lists. IOS is a Cisco Internetwork Operating System. It is maintained and distributed by Cisco, and used on various types of Cisco hardware. A problem has been found in the checking of protocol by the system. The vulnerable version of IOS does not check the protocol type of the packets, thus making it possible for a system on either end of the connection to send data of a different type. One such instance would be a system on the protected network sending a UDP packet to a system outside of the protected network, and the external system returning a connection to the host via TCP using the pre-established IP address and port numbers. This could allow a remote user to gather intelligence about a host, and potentially lead to an organized attack against network resources. A remote attacker could exploit this vulnerability to bypass access control lists

Xircom REX 6000 allows local users to obtain the 10 digit PIN by starting a serial monitor, connecting to the personal digital assistant (PDA) via Rextools, and capturing the cleartext PIN. Xircom Rex 6000 PDA users can install Rextools on their desktop in order to manage the content on their MicroPDA device. A flaw exists in the transfer of the pin code information from the PDA to the Rextools application. The Rex 6000 sends the authentication information in plain text. The Xircom REX 6000 version is vulnerable

The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories. Apache is prone to a remote security vulnerability. An attacker can exploit this issue to perform unauthorized actions; other attacks are also possible

The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password (OTP) authentication is enabled, which allows remote attackers to sniff passwords. A vulnerability exists in the remote administration client for RhinoSoft Serv-U