VARIoT IoT exploits database

Trend Micro Data Loss Prevention is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer. Trend Micro Data Loss Prevention 5.5 is vulnerable; other versions may also be affected.

Adobe Flash Player is prone to an unspecified cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The following versions are vulnerable: Adobe Flash Player 10.3.181.16 and prior versions for Windows, Macintosh, Linux and Solaris operating systems Adobe Flash Player 10.3.185.22 and prior versions for Android UPDATE (June 7, 2011): The vendor indicates there may be an impact related to the 'Authplay.dll' component of Adobe Reader and Acrobat X 10.0.3, Reader 9.x and 10.x, and Acrobat 9.x and 10.x. We will update this BID when additional details emerge.

MODACOM URoad-5000 version 1450 has a hard-coded backdoor account that allows for remote command execution.

MODACOM URoad-5000 1450 - Remote Command Execution / Backdoor Access. CVE-72958 . remote exploit for Hardware platform

MODACOM URoad-5000 is prone to a security-bypass vulnerability and a remote command-execution vulnerability. An attacker can exploit these issues to bypass certain security restrictions and execute arbitrary commands on the affected device. MODACOM URoad-5000 firmware version 1450 is vulnerable; other versions may also be affected.

Cisco AnyConnect VPN Client - ActiveX URL Property Download and Execute (Metasploit). CVE-2011-2039CVE-72714 . remote exploit for Windows platform

Netgear WNDAP350 Wireless Access Point - Multiple Information Disclosure Vulnerabilities.. remote exploit for Hardware platform

libxmlInvalid 2.7.x - XPath Multiple Memory Corruption Vulnerabilities. CVE-2011-1944CVE-73248 . remote exploit for Linux platform

Belkin F5D7234-4V5 Wireless G Router is prone to a password-disclosure vulnerability due to a design error. Attackers can exploit this issue to gain access to the administrator's password. Successfully exploiting this issue may lead to other attacks.

Vordel Gateway 6.0.3 - Directory Traversal.. remote exploit for Linux platform

7T Interactive Graphical SCADA System is prone to a remote memory-corruption vulnerability. An attacker can exploit this issue to execute arbitrary code with administrative privileges. Successfully exploiting this issue will completely compromise an affected computer. Failed exploit attempts will result in a denial-of-service condition. Versions prior to Interactive Graphical SCADA System 9.0.0.11143 are vulnerable.

Cisco Unified Operations Manager 8.5 - iptm/eventmon Multiple Cross-Site Scripting Vulnerabilities. CVE-2011-0959CVE-72418 . remote exploit for Hardware platform

Cisco Unified Operations Manager 8.5 - 'iptm/advancedfind.do?extn' Cross-Site Scripting. CVE-2011-0959CVE-72416 . remote exploit for Hardware platform

Cisco Unified Operations Manager 8.5 - '/iptm/logicalTopo.do' Multiple Cross-Site Scripting Vulnerabilities. CVE-2011-0959CVE-72420 . remote exploit for Hardware platform

Cisco Unified Operations Manager 8.5 - 'iptm/ddv.do?deviceInstanceName' Cross-Site Scripting. CVE-2011-0959CVE-72417 . remote exploit for Hardware platform

Cisco Unified Operations Manager 8.5 - Common Services Device Center Cross-Site Scripting. CVE-2011-0962CVE-72421 . remote exploit for Hardware platform

Cisco Unified Operations Manager 8.5 - '/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp' Multiple Cross-Site Scripting Vulnerabilities. CVE-2011-0959CVE-72419 . remote exploit for Hardware platform

DreamBox DM500 products are prone to a directory-traversal vulnerability because they fail to sufficiently sanitize user-supplied input. Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks. The following products are vulnerable: DreamBox DM500 DreamBox DM500+ DreamBox DM500HD DreamBox DM500S

Apache 1.4/2.2.x - APR 'apr_fnmatch()' Denial of Service. CVE-2011-0419CVE-73383 . dos exploit for Linux platform

7T Interactive Graphical SCADA System is prone to multiple denial-of-service vulnerabilities that affect the human-machine interface (HMI) component. An attacker can exploit these issues to cause denial-of-service conditions by sending specially crafted packets to the affected services.