Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Mar 28, 2023Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests.CVE-2023-28718 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govHigh 7.1
Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023Osprey Pump Controller version 1.01 contains an unauthenticated command injection vulnerability that could allow system access with www-data permissions.CVE-2023-28712 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govHigh 8.2
Osprey Pump Controller version 1.01 contains an unauthenticated command injection vulnerability that could allow system access with www-data permissions.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface CVE-2023-28654 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govCritical 9.8
Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and the password cannot be changed through any normal operation of the device.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user.CVE-2023-28648 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govHigh 7.5
Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to tCVE-2023-28398 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govCritical 9.8
Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat actor could exploit this vulnerability to create a user account without providing valid credentials. A threat actor who successfully exploits this vulnerability could gain access to the pump controller and cause disruption in operation, modify data, or shut down the controller.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure.CVE-2023-28375 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govHigh 7.5
Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure. Using a GET parameter, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability.CVE-2023-27886 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govCritical 9.8
Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP POST parameter called by index.php script.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability.CVE-2023-27394 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govCritical 9.8
Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP GET parameter called by DataLogView.php, EventsView.php and AlarmsView.php scripts.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorizaCVE-2023-28395 · Other software · ProPump and Controls, Inc. · reported by ics-cert@hq.dhs.govHigh 8.3
Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass. This may allow an attacker to hijack a session by predicting the session id and gain unauthorized access to the product.
- Product
- Osprey Pump Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2018The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions (CVE-2018-14327 · Other software · EE · reported by MITREHigh 7.8
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions (Everyone:Full Control) for the "Web Connecton\EE40" and "Web Connecton\EE40\BackgroundService" directories, which allows local users to gain privileges, as demonstrated by inserting a Trojan horse ServiceManager.exe file into the "Web Connecton\EE40\BackgroundService" directory.
- Product
- Ee40vb Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zerodaylab.compacketstormsecurity.com
May 12, 2009PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to execute arbitrary PHP code via a URL in the xml_dir paraCVE-2008-6807 · Other software · Ibiblio · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to execute arbitrary PHP code via a URL in the xml_dir parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the lib_dir vector is already covered by CVE-2006-6630.
- Product
- Osprey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Dec 18, 2006PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the lib_dir parameteCVE-2006-6630 · Other software · Ibiblio · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the lib_dir parameter.
- Product
- Osprey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Dec 18, 2006PHP remote file inclusion vulnerability in lib/xml/oai/GetRecord.php in osprey 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL iCVE-2006-6631 · Other software · Ibiblio · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in lib/xml/oai/GetRecord.php in osprey 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lib_dir parameter.
- Product
- Osprey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.