VARIoT IoT vulnerabilities database

ZLAN5102 and ZLAN5103 serial server are industrial grade RS232/485 and TCP/IP protocol converters produced by Shanghai ZLAN. ZLAN5102 and ZLAN5103 serial server have a denial of service vulnerability. Attackers can use this vulnerability to cause the device to restart.

Tvheadend is a streaming media server software installed under LINUX system. TVHeadend streaming media server has an unauthorized access vulnerability. Attackers can use this vulnerability to obtain sensitive information.

IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS is vulnerable to a buffer overflow vulnerability due to an error within the channel processing code. A remote attacker could overflow the buffer using an older client and cause a denial of service. IBM X-Force ID: 181562. Vendor exploits this vulnerability IBM X-Force ID: 181562 It is published as.Service operation interruption (DoS) It may be put into a state

IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub logic. IBM X-Force ID: 177402. Vendor exploits this vulnerability IBM X-Force ID: 177402 It is published as.Information may be obtained

IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could allow an attacker to cause a denial of service due to a memory leak caused by an error creating a dynamic queue. IBM X-Force ID: 179080. Vendor exploits this vulnerability IBM X-Force ID: 179080 It is published as.Service operation interruption (DoS) It may be put into a state

IBM MQ Appliance 9.1.4.CD could allow a local attacker to obtain highly sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 172616. IBM MQ Appliance There is an information leakage vulnerability in. Vendor exploits this vulnerability IBM X-Force ID: 172616 It is published as.Information may be obtained

An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in a third-party component. PI Vision Exists in a cross-site scripting vulnerability.Information may be obtained and tampered with

Tianyi Kandian is a security service that integrates camera, video, real-time monitoring, PTZ control, alarm, and storage. Tianyi Kandian camera has an unauthorized access vulnerability, which can be exploited by attackers to obtain sensitive information.

Shanghai ZLAN Information Technology Co., Ltd. is a high-tech enterprise providing industrial IoT solutions. The ZLAN serial server has an unauthorized access vulnerability. Attackers can use the vulnerability to log in to the WEB management interface without authorization.

Shenzhen Yichen Technology Co., Ltd. is a manufacturer and operator of network and communication equipment. The wireless router of Shenzhen Yichen Technology Co., Ltd. has an unauthorized access vulnerability. Attackers can use the vulnerability to perform unauthorized operations.

IBM MQ Appliance 9.1 LTS and 9.1 CD could allow a local privileged user to obtain highly sensitve information due to inclusion of data within trace files. IBM X-Force ID: 182118. IBM MQ Appliance There is an information leakage vulnerability in. Vendor exploits this vulnerability IBM X-Force ID: 182118 It is published as.Information may be obtained. IBM MQ Appliance is an all-in-one device from IBM in the United States for rapid deployment of enterprise-level messaging middleware. Local attackers can use this vulnerability to obtain highly sensitive information

Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm. (DoS) It may be put into a state

An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges. (DoS) It may be put into a state. Lenovo Drivers Management is a driver management application for Lenovo products from China Lenovo (Lenovo). This program is mainly used for driver installation and upgrade, etc

A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges. Lenovo Drivers Management Exists in an unreliable search path vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Lenovo Drivers Management is a driver management application for Lenovo products from China Lenovo (Lenovo). This program is mainly used for driver installation and upgrade, etc

KingView (KingView) is an industrial automation configuration software produced by Beijing Yakong Technology Development Co., Ltd. KingView has a denial of service vulnerability. Attackers can use this vulnerability to launch remote denial of service attacks.

httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root. WebCLI is one of the web-based command line interfaces. Attackers can use this vulnerability to bypass access restrictions by sending a specially crafted request

goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter. Tenda AC15 On the device OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Tenda AC15 AC1900 is a wireless router of China Tenda Company. Tenda AC15 AC1900 15.03.05.19 version of the goform/AdvSetLanip endpoint has security vulnerabilities

IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force ID: 179484. IBM Verify Gateway (IVG) is a set of cloud-based identity verification solutions from IBM Corporation in the United States. A security vulnerability exists in IBM IVG PAM versions 1.0.0 and 1.0.1. An attacker could exploit this vulnerability to obtain sensitive information

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel. GoAhead for, Capture-replay An authentication bypass vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. GoAhead is the world's most popular, tiny embedded web server. It is compact, secure and simple to use. GoAhead is deployed in hundreds of millions of devices and is ideal for the smallest of embedded devices.A security vulnerability affecting GoAhead versions 2 to 5 has been identified when using Digest authentication over HTTP. GoAhead versions 3 to 5 validated the nonce with a fixed duration of 5 minutes which permitted short-period replays. This duration is too long for most implementations.Tested on: GoAhead-httpGoAhead-Webs. There is a security vulnerability in Embedthis Software GoAhead versions before 5.1.2. An attacker could exploit this vulnerability to bypass authentication

A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on the engineering workstation to modify a Windows registry key which would divert all traffic updates to go through a server in the attacker's possession. A man-in-the-middle attack is then used to complete the exploit. An attacker could exploit this vulnerability to execute malicious code