Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Dec 2, 2024A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices.CVE-2024-50381 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.8
A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device and can make a request to unclaim it from its original connection and make a request to claim it.
- Product
- OVRC cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested.CVE-2024-50380 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.7
Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumerated MAC addresses and receive sensitive information about the device.
- Product
- OVRC cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could alloCVE-2023-25183 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.3
In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection.CVE-2023-31245 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 7.1
Devices using Snap One OvrC cloud are sent to a web address when accessing a web management interface using a HTTP connection. Attackers could impersonate a device and supply malicious information about the device’s web server interface. By supplying malicious parameters, an attacker could redirect the user to arbitrary and dangerous locations on the web.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.CVE-2023-31241 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.6
Snap One OvrC cloud servers contain a route an attacker can use to bypass requirements and claim devices outright.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely.CVE-2023-31240 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.3
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers.CVE-2023-31193 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 7.5
Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it.CVE-2023-28649 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.6
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device.CVE-2023-28412 · Other software · Snap One · reported by ics-cert@hq.dhs.govMedium 5.3
When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enumerated in an attack and the OvrC cloud will disclose their information.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly.CVE-2023-28386 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.6
Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrary firmware updates, resulting in code execution.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.