VARIoT IoT exploits database

Devices running Cisco IOS with SIP enabled are prone to multiple denial-of-service vulnerabilities. These issues are tracked by the following Cisco bug IDs and CVEs: CSCse56800 (CVE-2008-3799) CSCsg91306 (CVE-2008-3800) CSCsl62609 (CVE-2008-3801) CSCsk42759 (CVE-2008-3802) An attacker can exploit these issues to deny service to legitimate users.

Cisco IOS is prone to multiple remote denial-of-service vulnerabilities because the software fails to properly handle malformed network datagrams. Successfully exploiting these issues allows remote attackers to cause targeted devices to reload. Multiple exploits can lead to a sustained denial-of-service. These issues are tracked by Cisco Bug IDs CSCsd95616 and CSCsl34355.

Multiple SAGEM F@st routers are prone to an HTML-injection vulnerability because they fail to sufficiently sanitize user-supplied input data. Attacker-supplied HTML and script code would run in the context of the web interface of the affected device, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. The issue affects SAGEM F@st routers 1200, 1240, 1400, 1400W, 1500, 1500-WG, and 2404.

Parallels H-Sphere 3.0/3.1 - 'login.php' Multiple Cross-Site Scripting Vulnerabilities.. webapps exploit for PHP platform

Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1). CVE-2008-4128 . remote exploit for Hardware platform

Cisco 871 Integrated Services Router - Cross-Site Request Forgery (1).. remote exploit for Hardware platform

Cisco 871 Integrated Services Router - Cross-Site Request Forgery (2).. remote exploit for Hardware platform

Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (2).. remote exploit for Hardware platform

Sagem F@st 2404 is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause the affected device to crash, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

Silentum LoginSys 1.0 - Multiple Cross-Site Scripting Vulnerabilities. CVE-2008-6764CVE-47940 . webapps exploit for PHP platform

vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities. CVE-2008-3101CVE-47865 . webapps exploit for PHP platform

Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure. CVE-2008-2370CVE-47463 . remote exploit for Multiple platform

Linux Kernel 2.6.x - 'net/ipv6/ip6_output.c' Null Pointer Dereference Denial of Service. CVE-2010-0437CVE-63146 . dos exploit for Linux platform

Linux Kernel 2.6.x - 'net/ipv6/ip6_output.c' Null Pointer Dereference Denial of Service. CVE-2010-0437CVE-63146 . dos exploit for Linux platform

CitectSCADA ODBC Server - Remote Stack Buffer Overflow (Metasploit). CVE-46105CVE-2008-2639 . remote exploit for Windows platform

CitectSCADA/CitectFacilities ODBC - Remote Buffer Overflow (Metasploit). CVE-2008-2639CVE-46105 . remote exploit for Windows platform

SNMPv3 - HMAC Validation error Remote Authentication Bypass. CVE-2008-0960CVE-98737CVE-55442CVE-55248CVE-46669CVE-46276CVE-46102CVE-46088CVE-46086CVE-46060CVE-46059 . remote exploit for Multiple platform

SAP Web Application Server 7.0 - '/sap/bc/gui/sap/its/webgui/' Cross-Site Scripting. CVE-2008-2421CVE-45649 . webapps exploit for Java platform

ZyWALL 100 HTTP Referer Header - Cross-Site Scripting. CVE-2008-2167CVE-45044 . remote exploit for Multiple platform