Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Nov 5, 2024The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypassCVE-2023-29126 · Other software · Enel X · reported by cve@asrg.ioMedium 4.2
The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.CVE-2023-29125 · Other software · Enel X · reported by cve@asrg.ioCritical 9
A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Under certain conditions, access to service libraries is granted to account they should not have access to.CVE-2023-29122 · Other software · Enel X · reported by cve@asrg.ioMedium 6.7
Under certain conditions, access to service libraries is granted to account they should not have access to.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.CVE-2023-29121 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.CVE-2023-29120 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.CVE-2023-29119 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.CVE-2023-29118 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.CVE-2023-29117 · Other software · Enel X · reported by cve@asrg.ioHigh 8.8
Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuratioCVE-2023-29116 · Other software · Enel X · reported by cve@asrg.ioMedium 4.3
Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuration details could be obtained.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g.CVE-2023-29115 · Other software · Enel X · reported by cve@asrg.ioMedium 6.5
In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot).
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024System logs could be accessed through web management application due to a lack of access control.CVE-2023-29114 · Other software · Enel X · reported by cve@asrg.ioMedium 5.7
System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information: • Wi-Fi access point credentials to which the EV charger can connect. • APN web address and credentials. • IPSEC credentials. • Web interface access credentials for user and admin accounts. • JuiceBox system components (software installed, model, firmware version, etc.). • C2G configuration details. • Internal IP addresses. • OTA firmware update configurations (DNS servers). All the credentials are stored in logs in an unencrypted plaintext format.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.