phoenix-security.de Cross Site Scripting vulnerability OBB-2692894

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

phoenix-neckartenzlingen.de Cross Site Scripting vulnerability OBB-2692890

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

phoenix-bs.de Cross Site Scripting vulnerability OBB-2692886

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CISA Releases Security Advisories Related to OT:ICEFALL (Insecure by Design) Report

CISA is aware that Forescout researchers have released OT:ICEFALL, a report on 56 vulnerabilities caused by insecure-by-design practices in operational technology across multiple vendors. The vulnerabilities are divided into four main categories: insecure engineering protocols, weak cryptography ...

CVE-2022-31800 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device...

CVE-2022-31800 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device...

Phoenix Contact Classic Line Controllers

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ILC, AXC, RFC, PC WORX, FC Vulnerability: Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

多款Phoenix Contact产品数据伪造问题漏洞

Phoenix Contact ProConOS/ProConOS eCLR is a series of embedded automation devices from Phoenix Contact, Germany. A data forgery issue vulnerability exists in several Phoenix Contact products, which could allow an unauthenticated, remote attacker to upload malicious logic to a ProConOS/ProConOS...

Phoenix Contact ProConOS and MULTIPROG

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ProConOS/ProConOS eCLR and MULTIPROG Vulnerability: Insufficient Verification of Data Authenticity CISA is aware of a public report, known as “OT:ICEFALL” that details...

Phoenix Contact Classic Line Industrial Controllers

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ILC 131 ETH, ILC 131 ETH/XC, ILC 151 ETH, ILC 151 ETH/XC, ILC 171 ETH 2TX, ILC 191 ETH 2TX, ILC 191 ME/AN, and AXC 1050 Vulnerability: Missing Authentication for Critical...

MAL-2022-2738 Malicious code in energy-phoenix-core-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc673c34e7bea5924e7599982f2bd50d123ea9adef3dff7d4a086d415638d275 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in energy-phoenix-core-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc673c34e7bea5924e7599982f2bd50d123ea9adef3dff7d4a086d415638d275 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twitch-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2ec64d7bc542941fe4b992c0ff30abdb9362e9afde3afb416b5fe5bd01e32e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6703 Malicious code in twitch-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2ec64d7bc542941fe4b992c0ff30abdb9362e9afde3afb416b5fe5bd01e32e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Phoenix-ws source code and data in extensions folder is publicly available

Impact All of the source code, files, and folders in phoenixfiles/extensions/ are available to end users through a simple HTTP GET request. Patches The issue has been patched. The users of version 1.0.6 and above are not effected...

GHSA-C8F7-X2G7-7FXJ Phoenix-ws source code and data in extensions folder is publicly available

Impact All of the source code, files, and folders in phoenixfiles/extensions/ are available to end users through a simple HTTP GET request. Patches The issue has been patched. The users of version 1.0.6 and above are not effected...

phoenixdrugrehabilitation.com Cross Site Scripting vulnerability OBB-2624931

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the configuration file loader for WebUI devices of PHOENIX CONTACT RAD-ISM-900-EN-* allows a attacker to execute arbitrary code with root privileges.

The vulnerability of the configuration file loader for WebUI devices of PHOENIX CONTACT RAD-ISM-900-EN- exists due to insufficient checks on the integrity of the firmware. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

The vulnerability of the Traceroute WebUI device from PHOENIX CONTACT RAD-ISM-900-EN-* allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the Traceroute WebUI tool for devices PHOENIX CONTACT RAD-ISM-900-EN- exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code with root privileges...

CVE-2022-29898

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware...