Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Jul 6, 2023 PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials.CVE-2023-35765 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govMedium 6.5
PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 PiiGAB M-Bus is vulnerable to cross-site request forgery.CVE-2023-35120 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 8.8
PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the device and hope that the owner clicks on the link. If the owner of the device has a cookie stored that allows the owner to be logged in, then the device could execute the GET or POST link request.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the passwCVE-2023-34995 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 7.5
There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 PiiGAB M-Bus stores passwords using a weak hash algorithm.CVE-2023-34433 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 7.5
PiiGAB M-Bus stores passwords using a weak hash algorithm.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks.CVE-2023-32652 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 8
PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.CVE-2023-36859 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 8.8
PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 PiiGAB M-Bus contains hard-coded credentials which it uses for authentication.CVE-2023-35987 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govCritical 9.8
PiiGAB M-Bus contains hard-coded credentials which it uses for authentication.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 The number of login attempts is not limited.CVE-2023-33868 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govMedium 5.9
The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 PiiGAB M-Bus transmits credentials in plaintext format.CVE-2023-31277 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 7.5
PiiGAB M-Bus transmits credentials in plaintext format.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.